|
Hi there, I used Syzkaller and found that there is KASAN: null-ptr-deref (general protection fault in sock_map_link_update_prog) in net/core/sock_map.c in v6.12.0-rc2, which
also causes a KASAN: slab-use-after-free at the same time. It looks like a concurrency bug in the BPF related subsystems. The reproducer is available, and I have reproduced this bug with it manually. Currently I can only reproduce this bug with root
privilege. The detailed reports, config file, and reproducer program are attached in this e-mail. If you need further details, please let me know. Bug report message:
``` Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 UID: 0 PID: 640 Comm: syz-executor229 Not tainted 6.12.0-rc2-00667-g53bac8330865 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sock_map_progs net/core/sock_map.c:1449 [inline] RIP: 0010:sock_map_prog_link_lookup net/core/sock_map.c:1464 [inline] RIP: 0010:sock_map_link_update_prog+0x17a/0x450 net/core/sock_map.c:1756 Code: 8b 6c 24 68 49 8d 5c 24 70 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 a3 02 00 00 8b 2b 49 8d 5d 18 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 a6 02 00
00 8b 1b 48 89 df 48 c7 c6 10 RSP: 0018:ffff888003837cc8 EFLAGS: 00010206 RAX: 0000000000000003 RBX: 0000000000000018 RCX: 0000000000000000 RDX: ffff888006b95400 RSI: 000000000000000d RDI: ffff888005f91a68 RBP: 0000000000000005 R08: ffffffff99e031af R09: 1ffffffff33c0635 R10: dffffc0000000000 R11: fffffbfff33c0636 R12: ffff888005f91a00 R13: 0000000000000000 R14: ffffc90000e55000 R15: dffffc0000000000 FS: 00007f4f04921640(0000) GS:ffff88806cc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4f049bf7a0 CR3: 0000000006446000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> link_update+0x726/0x8a0 kernel/bpf/syscall.c:5328 __sys_bpf+0x5d5/0x7f0 kernel/bpf/syscall.c:5707 __do_sys_bpf kernel/bpf/syscall.c:5741 [inline] __se_sys_bpf kernel/bpf/syscall.c:5739 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5739 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xe4/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4f0497d73d Code: c3 e8 37 20 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7
c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4f049211a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f4f04a18228 RCX: 00007f4f0497d73d RDX: 0000000000000010 RSI: 00000000200004c0 RDI: 000000000000001d RBP: 00007f4f04a18220 R08: 00007f4f04921640 R09: 00007f4f04921640 R10: 00007f4f04921640 R11: 0000000000000246 R12: 00007f4f04a1822c R13: 00007f4f049e3074 R14: 656c6c616b7a7973 R15: 00007f4f04901000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:sock_map_progs net/core/sock_map.c:1449 [inline] RIP: 0010:sock_map_prog_link_lookup net/core/sock_map.c:1464 [inline] RIP: 0010:sock_map_link_update_prog+0x17a/0x450 net/core/sock_map.c:1756 Code: 8b 6c 24 68 49 8d 5c 24 70 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 a3 02 00 00 8b 2b 49 8d 5d 18 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 a6 02 00
00 8b 1b 48 89 df 48 c7 c6 10 RSP: 0018:ffff888003837cc8 EFLAGS: 00010206 RAX: 0000000000000003 RBX: 0000000000000018 RCX: 0000000000000000 RDX: ffff888006b95400 RSI: 000000000000000d RDI: ffff888005f91a68 RBP: 0000000000000005 R08: ffffffff99e031af R09: 1ffffffff33c0635 R10: dffffc0000000000 R11: fffffbfff33c0636 R12: ffff888005f91a00 R13: 0000000000000000 R14: ffffc90000e55000 R15: dffffc0000000000 FS: 00007f4f04921640(0000) GS:ffff88806cc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4f049bf7a0 CR3: 0000000006446000 CR4: 0000000000750ef0 PKRU: 55555554 ================================================================== BUG: KASAN: slab-use-after-free in owner_on_cpu include/linux/sched.h:2171 [inline] BUG: KASAN: slab-use-after-free in mutex_can_spin_on_owner kernel/locking/mutex.c:409 [inline] BUG: KASAN: slab-use-after-free in mutex_optimistic_spin kernel/locking/mutex.c:452 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:612 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0xc63/0xcd0 kernel/locking/mutex.c:752 Read of size 4 at addr ffff888006b95434 by task syz-executor229/644 CPU: 0 UID: 0 PID: 644 Comm: syz-executor229 Tainted: G D 6.12.0-rc2-00667-g53bac8330865 #6 Tainted: [D]=DIE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x14b/0x1c0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x171/0x750 mm/kasan/report.c:488 kasan_report+0xd2/0x110 mm/kasan/report.c:601 owner_on_cpu include/linux/sched.h:2171 [inline] mutex_can_spin_on_owner kernel/locking/mutex.c:409 [inline] mutex_optimistic_spin kernel/locking/mutex.c:452 [inline] __mutex_lock_common kernel/locking/mutex.c:612 [inline] __mutex_lock+0xc63/0xcd0 kernel/locking/mutex.c:752 sock_map_link_create+0x2b6/0x5b0 net/core/sock_map.c:1861 link_create+0x513/0x890 kernel/bpf/syscall.c:5215 __sys_bpf+0x49c/0x7f0 kernel/bpf/syscall.c:5704 __do_sys_bpf kernel/bpf/syscall.c:5741 [inline] __se_sys_bpf kernel/bpf/syscall.c:5739 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5739 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xe4/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4f0497d73d Code: c3 e8 37 20 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7
c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4f049211a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f4f04a18228 RCX: 00007f4f0497d73d RDX: 0000000000000010 RSI: 0000000020000200 RDI: 000000000000001c RBP: 00007f4f04a18220 R08: 00007f4f04921640 R09: 00007f4f04921640 R10: 00007f4f04921640 R11: 0000000000000246 R12: 00007f4f04a1822c R13: 00007f4f049e3074 R14: 656c6c616b7a7973 R15: 00007f4f04901000 </TASK> Allocated by task 639: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x2f/0x70 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x4b/0x60 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x139/0x2e0 mm/slub.c:4186 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0xb2/0x7d0 kernel/fork.c:1107 copy_process+0x5fa/0x3c30 kernel/fork.c:2203 kernel_clone+0x20c/0x800 kernel/fork.c:2784 __do_sys_clone3 kernel/fork.c:3088 [inline] __se_sys_clone3 kernel/fork.c:3067 [inline] __x64_sys_clone3+0x2e2/0x360 kernel/fork.c:3067 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xe4/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 0: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x2f/0x70 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x37/0x50 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kmem_cache_free+0x179/0x3e0 mm/slub.c:4681 put_task_struct include/linux/sched/task.h:144 [inline] delayed_put_task_struct+0x114/0x2c0 kernel/exit.c:228 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xcb1/0x19d0 kernel/rcu/tree.c:2823 handle_softirqs+0x24e/0x840 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xc2/0x160 kernel/softirq.c:637 irq_exit_rcu+0x9/0x20 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline] sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1037 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Last potentially related work creation: kasan_save_stack+0x2f/0x50 mm/kasan/common.c:47 __kasan_record_aux_stack mm/kasan/generic.c:541 [inline] kasan_record_aux_stack_noalloc+0x99/0xb0 mm/kasan/generic.c:551 __call_rcu_common kernel/rcu/tree.c:3086 [inline] call_rcu+0xd9/0xab0 kernel/rcu/tree.c:3190 context_switch kernel/sched/core.c:5325 [inline] __schedule+0x189e/0x25c0 kernel/sched/core.c:6682 schedule_idle+0x52/0x90 kernel/sched/core.c:6800 do_idle+0x533/0x590 kernel/sched/idle.c:354 cpu_startup_entry+0x44/0x60 kernel/sched/idle.c:424 rest_init+0x2e1/0x300 init/main.c:747 start_kernel+0x47b/0x510 init/main.c:1105 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0x79/0x80 arch/x86/kernel/head64.c:488 common_startup_64+0x12c/0x137 The buggy address belongs to the object at ffff888006b95400 which belongs to the cache task_struct of size 6856 The buggy address is located 52 bytes inside of freed 6856-byte region [ffff888006b95400, ffff888006b96ec8) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6b90 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88800a08f201 flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff8880011a03c0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000040004 00000001f5000000 ffff88800a08f201 head: 0100000000000040 ffff8880011a03c0 dead000000000122 0000000000000000 head: 0000000000000000 0000000000040004 00000001f5000000 ffff88800a08f201 head: 0100000000000003 ffffea00001ae401 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888006b95300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888006b95380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888006b95400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888006b95480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888006b95500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ---------------- Code disassembly (best guess): 0: 8b 6c 24 68 mov 0x68(%rsp),%ebp 4: 49 8d 5c 24 70 lea 0x70(%r12),%rbx 9: 48 89 d8 mov %rbx,%rax c: 48 c1 e8 03 shr $0x3,%rax 10: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax 15: 84 c0 test %al,%al 17: 0f 85 a3 02 00 00 jne 0x2c0 1d: 8b 2b mov (%rbx),%ebp 1f: 49 8d 5d 18 lea 0x18(%r13),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 a6 02 00 00 jne 0x2dd 37: 8b 1b mov (%rbx),%ebx 39: 48 89 df mov %rbx,%rdi 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: c6 (bad) 3f: 10 .byte 0x10 ``` Thanks and best regards, Bonan |
Attachment:
repro.cprog
Description: repro.cprog
Attachment:
repro_config
Description: repro_config
Attachment:
repro.prog
Description: repro.prog
Attachment:
repro.report
Description: repro.report
Attachment:
other_details.zip
Description: other_details.zip