[Syzkaller & bisect] There is KASAN: slab-use-after-free Read in arena_vm_close in v6.10-rc3 kernel
From: Pengfei Xu
Date: Thu Jun 13 2024 - 22:54:11 EST
Hi Alexei Starovoitov and bpf expert,
Greeting!
There is KASAN: slab-use-after-free Read in arena_vm_close in v6.10-rc3 kernel.
All detailed info:https://github.com/xupengfe/syzkaller_logs/tree/main/240613_011057_arena_vm_close
Syzkaller reproduced code: https://github.com/xupengfe/syzkaller_logs/blob/main/240613_011057_arena_vm_close/repro.c
Syzkaller syscall repro steps:https://github.com/xupengfe/syzkaller_logs/blob/main/240613_011057_arena_vm_close/repro.prog
Syzkaller report: https://github.com/xupengfe/syzkaller_logs/blob/main/240613_011057_arena_vm_close/repro.report
Kconfig(make olddefconfig): https://github.com/xupengfe/syzkaller_logs/blob/main/240613_011057_arena_vm_close/kconfig_origin
Bisect info: https://github.com/xupengfe/syzkaller_logs/blob/main/240613_011057_arena_vm_close/bisect_info.log
Issue dmesg: https://github.com/xupengfe/syzkaller_logs/blob/main/240613_011057_arena_vm_close/83a7eefedc9b56fe7bfeff13b6c7356688ffa670_dmesg.log
v6.10-rc3 bzImage: https://github.com/xupengfe/syzkaller_logs/raw/main/240613_011057_arena_vm_close/bzImage_83a7eefedc9b56fe7bfeff13b6c7356688ffa670.tar.gz
Bisected and found the first bad commit:
317460317a02 bpf: Introduce bpf_arena.
[ 25.142953] ==================================================================
[ 25.143738] BUG: KASAN: slab-use-after-free in arena_vm_close+0x1b1/0x1d0
[ 25.144474] Read of size 8 at addr ffff88800d3c93c8 by task repro/728
[ 25.145091]
[ 25.145266] CPU: 0 PID: 728 Comm: repro Not tainted 6.10.0-rc3-83a7eefedc9b #1
[ 25.145942] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
[ 25.147003] Call Trace:
[ 25.147256] <TASK>
[ 25.147482] dump_stack_lvl+0xea/0x150
[ 25.147883] print_report+0xce/0x610
[ 25.148267] ? arena_vm_close+0x1b1/0x1d0
[ 25.148668] ? kasan_complete_mode_report_info+0x80/0x200
[ 25.149168] ? arena_vm_close+0x1b1/0x1d0
[ 25.149555] kasan_report+0xcc/0x110
[ 25.149904] ? arena_vm_close+0x1b1/0x1d0
[ 25.150246] __asan_report_load8_noabort+0x18/0x20
[ 25.150616] arena_vm_close+0x1b1/0x1d0
[ 25.150922] ? __pfx_arena_vm_close+0x10/0x10
[ 25.151266] remove_vma+0x95/0x190
[ 25.151552] exit_mmap+0x4bf/0xb00
[ 25.151834] ? __pfx_exit_mmap+0x10/0x10
[ 25.152110] ? __kasan_check_write+0x18/0x20
[ 25.152405] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 25.152768] ? mutex_unlock+0x16/0x20
[ 25.153024] __mmput+0xde/0x3e0
[ 25.153262] mmput+0x74/0x90
[ 25.153471] do_exit+0x9fb/0x29f0
[ 25.153705] ? lock_release+0x418/0x840
[ 25.153983] ? __pfx_do_exit+0x10/0x10
[ 25.154239] ? __this_cpu_preempt_check+0x21/0x30
[ 25.154561] ? _raw_spin_unlock_irq+0x2c/0x60
[ 25.154858] ? lockdep_hardirqs_on+0x89/0x110
[ 25.155157] do_group_exit+0xe4/0x2c0
[ 25.155413] __x64_sys_exit_group+0x4d/0x60
[ 25.155697] x64_sys_call+0x1a1f/0x20d0
[ 25.155965] do_syscall_64+0x6d/0x140
[ 25.156220] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 25.156566] RIP: 0033:0x7f1343d18a4d
[ 25.156817] Code: Unable to access opcode bytes at 0x7f1343d18a23.
[ 25.157221] RSP: 002b:00007ffdc66dc268 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 25.157713] RAX: ffffffffffffffda RBX: 00007f1343df69e0 RCX: 00007f1343d18a4d
[ 25.158174] RDX: 00000000000000e7 RSI: ffffffffffffff80 RDI: 0000000000000000
[ 25.158634] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000020
[ 25.159092] R10: 00007ffdc66dc110 R11: 0000000000000246 R12: 00007f1343df69e0
[ 25.159557] R13: 00007f1343dfbf00 R14: 0000000000000001 R15: 00007f1343dfbee8
[ 25.160023] </TASK>
[ 25.160176]
[ 25.160287] Allocated by task 728:
[ 25.160519] kasan_save_stack+0x2c/0x60
[ 25.160782] kasan_save_track+0x18/0x40
[ 25.161043] kasan_save_alloc_info+0x3c/0x50
[ 25.161330] __kasan_kmalloc+0x88/0xa0
[ 25.161588] kmalloc_trace_noprof+0x1b9/0x3c0
[ 25.161891] arena_map_mmap+0x232/0x7a0
[ 25.162156] bpf_map_mmap+0x4b5/0x9a0
[ 25.162412] mmap_region+0x5f7/0x2740
[ 25.162666] do_mmap+0xd6a/0x11a0
[ 25.162898] vm_mmap_pgoff+0x1ea/0x390
[ 25.163155] ksys_mmap_pgoff+0x3e8/0x530
[ 25.163425] __x64_sys_mmap+0x139/0x1d0
[ 25.163691] x64_sys_call+0x1922/0x20d0
[ 25.163950] do_syscall_64+0x6d/0x140
[ 25.164200] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 25.164534]
[ 25.164647] Freed by task 728:
[ 25.164854] kasan_save_stack+0x2c/0x60
[ 25.165118] kasan_save_track+0x18/0x40
[ 25.165389] kasan_save_free_info+0x3f/0x60
[ 25.165668] __kasan_slab_free+0x115/0x1a0
[ 25.165946] kfree+0xfe/0x330
[ 25.166157] arena_vm_close+0x15e/0x1d0
[ 25.166420] remove_vma+0x95/0x190
[ 25.166654] do_vmi_align_munmap+0xc02/0x11f0
[ 25.166949] do_vmi_munmap+0x22c/0x420
[ 25.167206] __do_sys_mremap+0x7db/0x1830
[ 25.167481] __x64_sys_mremap+0xc7/0x150
[ 25.167755] x64_sys_call+0x1c50/0x20d0
[ 25.168014] do_syscall_64+0x6d/0x140
[ 25.168265] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 25.168601]
[ 25.168712] The buggy address belongs to the object at ffff88800d3c93c0
[ 25.168712] which belongs to the cache kmalloc-32 of size 32
[ 25.169492] The buggy address is located 8 bytes inside of
[ 25.169492] freed 32-byte region [ffff88800d3c93c0, ffff88800d3c93e0)
[ 25.170253]
[ 25.170366] The buggy address belongs to the physical page:
[ 25.170726] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xd3c9
[ 25.171234] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
[ 25.171656] page_type: 0xffffefff(slab)
[ 25.171923] raw: 000fffffc0000000 ffff88800a041780 ffffea000028cc40 dead000000000002
[ 25.172421] raw: 0000000000000000 0000000080400040 00000001ffffefff 0000000000000000
[ 25.172914] page dumped because: kasan: bad access detected
[ 25.173273]
[ 25.173383] Memory state around the buggy address:
[ 25.173697] ffff88800d3c9280: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[ 25.174162] ffff88800d3c9300: fa fb fb fb fc fc fc fc 00 00 01 fc fc fc fc fc
[ 25.174628] >ffff88800d3c9380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 25.175092] ^
[ 25.175456] ffff88800d3c9400: 00 00 00 fc fc fc fc fc 00 00 04 fc fc fc fc fc
[ 25.175921] ffff88800d3c9480: 00 00 01 fc fc fc fc fc 00 00 07 fc fc fc fc fc
[ 25.176393] ==================================================================
[ 25.177020] Disabling lock debugging due to kernel taint
[ 25.177414] Oops: general protection fault, probably for non-canonical address 0xe095fc1e8000005c: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 25.178167] KASAN: maybe wild-memory-access in range [0x04b000f4000002e0-0x04b000f4000002e7]
I hope it's helpful.
Thanks!
---
If you don't need the following environment to reproduce the problem or if you
already have one reproduced environment, please ignore the following information.
How to reproduce:
git clone https://gitlab.com/xupengfe/repro_vm_env.git
cd repro_vm_env
tar -xvf repro_vm_env.tar.gz
cd repro_vm_env; ./start3.sh // it needs qemu-system-x86_64 and I used v7.1.0
// start3.sh will load bzImage_2241ab53cbb5cdb08a6b2d4688feb13971058f65 v6.2-rc5 kernel
// You could change the bzImage_xxx as you want
// Maybe you need to remove line "-drive if=pflash,format=raw,readonly=on,file=./OVMF_CODE.fd \" for different qemu version
You could use below command to log in, there is no password for root.
ssh -p 10023 root@localhost
After login vm(virtual machine) successfully, you could transfer reproduced
binary to the vm by below way, and reproduce the problem in vm:
gcc -pthread -o repro repro.c
scp -P 10023 repro root@localhost:/root/
Get the bzImage for target kernel:
Please use target kconfig and copy it to kernel_src/.config
make olddefconfig
make -jx bzImage //x should equal or less than cpu num your pc has
Fill the bzImage file into above start3.sh to load the target kernel in vm.
Tips:
If you already have qemu-system-x86_64, please ignore below info.
If you want to install qemu v7.1.0 version:
git clone https://github.com/qemu/qemu.git
cd qemu
git checkout -f v7.1.0
mkdir build
cd build
yum install -y ninja-build.x86_64
yum -y install libslirp-devel.x86_64
../configure --target-list=x86_64-softmmu --enable-kvm --enable-vnc --enable-gtk --enable-sdl --enable-usb-redir --enable-slirp
make
make install
Best Regards,
Thanks!