[BUG] KASAN: slab-use-after-free Write in msp_remove

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   47.456977][ T9485] BUG: KASAN: slab-use-after-free in
kthread_stop+0xb0/0x5b0
[   47.457064][ T9485] Write of size 4 at addr ffff88802a218028 by
task repro/9485
[   47.457092][ T9485]
[   47.457131][ T9485] CPU: 0 UID: 0 PID: 9485 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   47.457170][ T9485] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   47.457203][ T9485] Call Trace:
[   47.457223][ T9485]  <TASK>
[   47.457244][ T9485]  dump_stack_lvl+0xe8/0x150
[   47.457283][ T9485]  print_address_description+0x55/0x1e0
[   47.457319][ T9485]  ? kthread_stop+0xb0/0x5b0
[   47.457351][ T9485]  print_report+0x58/0x70
[   47.457380][ T9485]  kasan_report+0x117/0x150
[   47.457427][ T9485]  ? kthread_stop+0xb0/0x5b0
[   47.457465][ T9485]  kasan_check_range+0x264/0x2c0
[   47.457511][ T9485]  kthread_stop+0xb0/0x5b0
[   47.457546][ T9485]  msp_remove+0x95/0xd0
[   47.457590][ T9485]  i2c_device_remove+0x88/0x220
[   47.457618][ T9485]  ? __pfx_i2c_device_remove+0x10/0x10
[   47.457648][ T9485]  device_release_driver_internal+0x46f/0x870
[   47.457702][ T9485]  bus_remove_device+0x455/0x570
[   47.457749][ T9485]  ? __pfx_bus_remove_device+0x10/0x10
[   47.457795][ T9485]  ? kernfs_remove_by_name_ns+0x101/0x140
[   47.457842][ T9485]  device_del+0x527/0x8f0
[   47.457879][ T9485]  ? __pfx_device_del+0x10/0x10
[   47.457909][ T9485]  ? __dev_fwnode+0x50/0x80
[   47.457957][ T9485]  ? device_remove_software_node+0x42/0x160
[   47.457992][ T9485]  device_unregister+0x21/0xf0
[   47.458025][ T9485]  delete_device_store+0x43e/0x500
[   47.458066][ T9485]  ? __pfx_delete_device_store+0x10/0x10
[   47.458103][ T9485]  ? sysfs_file_kobj+0x1e4/0x230
[   47.458134][ T9485]  ? sysfs_kf_write+0x166/0x260
[   47.458168][ T9485]  ? __pfx_sysfs_kf_write+0x10/0x10
[   47.458200][ T9485]  kernfs_fop_write_iter+0x3af/0x540
[   47.458249][ T9485]  vfs_write+0x61d/0xb90
[   47.458289][ T9485]  ? __pfx_vfs_write+0x10/0x10
[   47.458329][ T9485]  ? __fget_files+0x2a/0x420
[   47.458365][ T9485]  ksys_write+0x150/0x270
[   47.458400][ T9485]  ? __pfx_ksys_write+0x10/0x10
[   47.458441][ T9485]  do_syscall_64+0x155/0x510
[   47.458487][ T9485]  ? trace_irq_disable+0x3b/0x140
[   47.458527][ T9485]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.458560][ T9485]  ? clear_bhb_loop+0x30/0x80
[   47.458595][ T9485]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.458626][ T9485] RIP: 0033:0x43ca82
[   47.458669][ T9485] Code: 08 0f 85 41 df ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[   47.458703][ T9485] RSP: 002b:00007ffca70bb398 EFLAGS: 00000246
ORIG_RAX: 0000000000000001
[   47.458748][ T9485] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 000000000043ca82
[   47.458772][ T9485] RDX: 0000000000000004 RSI: 00000000004a110a
RDI: 0000000000000004
[   47.458791][ T9485] RBP: 00007ffca70bb3c0 R08: 0000000000000000
R09: 0000000000000000
[   47.458811][ T9485] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffca70bb978
[   47.458832][ T9485] R13: 00007ffca70bb988 R14: 0000000000000002
R15: 00000000004caa00
[   47.458865][ T9485]  </TASK>
[   47.458876][ T9485]
[   47.458895][ T9485] Allocated by task 2:
[   47.458910][ T9485]  kasan_save_track+0x3e/0x80
[   47.458973][ T9485]  __kasan_slab_alloc+0x6c/0x80
[   47.459011][ T9485]  kmem_cache_alloc_node_noprof+0x358/0x610
[   47.459045][ T9485]  dup_task_struct+0x52/0xa00
[   47.459071][ T9485]  copy_process+0x777/0x4330
[   47.459095][ T9485]  kernel_clone+0x2d7/0x940
[   47.459122][ T9485]  kernel_thread+0x13f/0x1b0
[   47.459149][ T9485]  kthreadd+0x4ec/0x6e0
[   47.459177][ T9485]  ret_from_fork+0x514/0xb70
[   47.459209][ T9485]  ret_from_fork_asm+0x1a/0x30
[   47.459243][ T9485]
[   47.459250][ T9485] Freed by task 0:
[   47.459264][ T9485]  kasan_save_track+0x3e/0x80
[   47.459298][ T9485]  kasan_save_free_info+0x46/0x50
[   47.459334][ T9485]  __kasan_slab_free+0x5c/0x80
[   47.459370][ T9485]  kmem_cache_free+0x182/0x650
[   47.459404][ T9485]  rcu_core+0x985/0x1250
[   47.459442][ T9485]  handle_softirqs+0x22c/0x860
[   47.459467][ T9485]  __irq_exit_rcu+0xcb/0x220
[   47.459492][ T9485]  irq_exit_rcu+0x9/0x30
[   47.459517][ T9485]  sysvec_apic_timer_interrupt+0xa6/0xc0
[   47.459557][ T9485]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   47.459587][ T9485]
[   47.459594][ T9485] Last potentially related work creation:
[   47.459606][ T9485]  kasan_save_stack+0x3e/0x60
[   47.459640][ T9485]  kasan_record_aux_stack+0xbd/0xd0
[   47.459669][ T9485]  call_rcu+0xee/0x890
[   47.459709][ T9485]  rcu_core+0x985/0x1250
[   47.459745][ T9485]  handle_softirqs+0x22c/0x860
[   47.459770][ T9485]  __irq_exit_rcu+0xcb/0x220
[   47.459795][ T9485]  irq_exit_rcu+0x9/0x30
[   47.459819][ T9485]  sysvec_apic_timer_interrupt+0xa6/0xc0
[   47.459859][ T9485]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   47.459889][ T9485]
[   47.459896][ T9485] Second to last potentially related work creation:
[   47.459908][ T9485]  kasan_save_stack+0x3e/0x60
[   47.459958][ T9485]  kasan_record_aux_stack+0xbd/0xd0
[   47.459986][ T9485]  call_rcu+0xee/0x890
[   47.460026][ T9485]  __schedule+0x187a/0x5930
[   47.460062][ T9485]  schedule_idle+0x51/0x90
[   47.460098][ T9485]  do_idle+0x4ad/0x540
[   47.460128][ T9485]  cpu_startup_entry+0x43/0x60
[   47.460161][ T9485]  start_secondary+0x101/0x110
[   47.460193][ T9485]  common_startup_64+0x13e/0x157
[   47.460235][ T9485]
[   47.460242][ T9485] The buggy address belongs to the object at
ffff88802a218000
[   47.460242][ T9485]  which belongs to the cache task_struct of size 9480
[   47.460278][ T9485] The buggy address is located 40 bytes inside of
[   47.460278][ T9485]  freed 9480-byte region [ffff88802a218000,
ffff88802a21a508)
[   47.460310][ T9485]
[   47.460319][ T9485] The buggy address belongs to the physical page:
[   47.460350][ T9485] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x2a218
[   47.460381][ T9485] head: order:3 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[   47.460405][ T9485] memcg:ffff88802a21f2c1
[   47.460420][ T9485] flags:
0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   47.460463][ T9485] page_type: f5(slab)
[   47.460501][ T9485] raw: 00fff00000000040 ffff888100018000
dead000000000100 dead000000000122
[   47.460528][ T9485] raw: 0000000000000000 0000000200030003
00000000f5000000 ffff88802a21f2c1
[   47.460556][ T9485] head: 00fff00000000040 ffff888100018000
dead000000000100 dead000000000122
[   47.460583][ T9485] head: 0000000000000000 0000000200030003
00000000f5000000 ffff88802a21f2c1
[   47.460610][ T9485] head: 00fff00000000003 fffffffffffffe01
00000000ffffffff 00000000ffffffff
[   47.460636][ T9485] head: ffffffffffffffff 0000000000000000
00000000ffffffff 0000000000000008
[   47.460652][ T9485] page dumped because: kasan: bad access detected
[   47.460674][ T9485] page_owner tracks the page as allocated
[   47.460686][ T9485] page last allocated via order 3, migratetype
Unmovable, gfp_mask
0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 5428, tgid 5428 ((udev-worker)), ts 34366220313
[   47.460738][ T9485]  post_alloc_hook+0x1f9/0x250
[   47.460769][ T9485]  get_page_from_freelist+0x235a/0x23e0
[   47.460807][ T9485]  __alloc_frozen_pages_noprof+0x217/0x5a0
[   47.460844][ T9485]  allocate_slab+0x7d/0x610
[   47.460868][ T9485]  refill_objects+0x2d6/0x350
[   47.460893][ T9485]  __pcs_replace_empty_main+0x2c9/0x6c0
[   47.460935][ T9485]  kmem_cache_alloc_node_noprof+0x441/0x610
[   47.460986][ T9485]  dup_task_struct+0x52/0xa00
[   47.461011][ T9485]  copy_process+0x777/0x4330
[   47.461034][ T9485]  kernel_clone+0x2d7/0x940
[   47.461061][ T9485]  __x64_sys_clone+0x1b6/0x230
[   47.461090][ T9485]  do_syscall_64+0x155/0x510
[   47.461130][ T9485]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.461159][ T9485] page last free pid 5057 tgid 5057 ts
33546286148 stack trace:
[   47.461181][ T9485]  __free_frozen_pages+0xc9f/0xd90
[   47.461212][ T9485]  __slab_free+0x274/0x2c0
[   47.461244][ T9485]  qlist_free_all+0x99/0x100
[   47.461278][ T9485]  kasan_quarantine_reduce+0x148/0x160
[   47.461313][ T9485]  __kasan_slab_alloc+0x22/0x80
[   47.461350][ T9485]  kmem_cache_alloc_node_noprof+0x358/0x610
[   47.461383][ T9485]  __alloc_skb+0x1d4/0x7d0
[   47.461417][ T9485]  netlink_sendmsg+0x5d4/0xb40
[   47.461444][ T9485]  sock_sendmsg_nosec+0x13a/0x180
[   47.461473][ T9485]  ____sys_sendmsg+0x589/0x8c0
[   47.461511][ T9485]  ___sys_sendmsg+0x2a5/0x360
[   47.461548][ T9485]  __x64_sys_sendmsg+0x1b1/0x290
[   47.461587][ T9485]  do_syscall_64+0x155/0x510
[   47.461628][ T9485]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.461657][ T9485]
[   47.461664][ T9485] Memory state around the buggy address:
[   47.461681][ T9485]  ffff88802a217f00: ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff
[   47.461701][ T9485]  ffff88802a217f80: ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff
[   47.461721][ T9485] >ffff88802a218000: fa fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   47.461737][ T9485]                                   ^
[   47.461753][ T9485]  ffff88802a218080: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   47.461773][ T9485]  ffff88802a218100: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[   47.461788][ T9485]
==================================================================
[   47.463486][ T9485] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   47.555510][ T9485] CPU: 0 UID: 0 PID: 9485 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   47.556461][ T9485] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   47.557450][ T9485] Call Trace:
[   47.557759][ T9485]  <TASK>
[   47.558037][ T9485]  vpanic+0x56d/0xa60
[   47.558412][ T9485]  ? __pfx_vpanic+0x10/0x10
[   47.558834][ T9485]  panic+0xc5/0xd0
[   47.559187][ T9485]  ? __pfx_panic+0x10/0x10
[   47.559598][ T9485]  ? preempt_schedule_thunk+0x16/0x40
[   47.560096][ T9485]  ? preempt_schedule_thunk+0x16/0x40
[   47.560589][ T9485]  ? kthread_stop+0xb0/0x5b0
[   47.561018][ T9485]  check_panic_on_warn+0x89/0xb0
[   47.561476][ T9485]  ? kthread_stop+0xb0/0x5b0
[   47.561917][ T9485]  end_report+0x73/0x170
[   47.562314][ T9485]  ? kthread_stop+0xb0/0x5b0
[   47.562739][ T9485]  kasan_report+0x128/0x150
[   47.563163][ T9485]  ? kthread_stop+0xb0/0x5b0
[   47.563590][ T9485]  kasan_check_range+0x264/0x2c0
[   47.564052][ T9485]  kthread_stop+0xb0/0x5b0
[   47.564463][ T9485]  msp_remove+0x95/0xd0
[   47.564914][ T9485]  i2c_device_remove+0x88/0x220
[   47.565364][ T9485]  ? __pfx_i2c_device_remove+0x10/0x10
[   47.565862][ T9485]  device_release_driver_internal+0x46f/0x870
[   47.566419][ T9485]  bus_remove_device+0x455/0x570
[   47.566877][ T9485]  ? __pfx_bus_remove_device+0x10/0x10
[   47.567381][ T9485]  ? kernfs_remove_by_name_ns+0x101/0x140
[   47.567904][ T9485]  device_del+0x527/0x8f0
[   47.568308][ T9485]  ? __pfx_device_del+0x10/0x10
[   47.568757][ T9485]  ? __dev_fwnode+0x50/0x80
[   47.569180][ T9485]  ? device_remove_software_node+0x42/0x160
[   47.569718][ T9485]  device_unregister+0x21/0xf0
[   47.570160][ T9485]  delete_device_store+0x43e/0x500
[   47.570630][ T9485]  ? __pfx_delete_device_store+0x10/0x10
[   47.571146][ T9485]  ? sysfs_file_kobj+0x1e4/0x230
[   47.571617][ T9485]  ? sysfs_kf_write+0x166/0x260
[   47.572066][ T9485]  ? __pfx_sysfs_kf_write+0x10/0x10
[   47.572541][ T9485]  kernfs_fop_write_iter+0x3af/0x540
[   47.573030][ T9485]  vfs_write+0x61d/0xb90
[   47.573423][ T9485]  ? __pfx_vfs_write+0x10/0x10
[   47.573865][ T9485]  ? __fget_files+0x2a/0x420
[   47.574298][ T9485]  ksys_write+0x150/0x270
[   47.574765][ T9485]  ? __pfx_ksys_write+0x10/0x10
[   47.575218][ T9485]  do_syscall_64+0x155/0x510
[   47.575647][ T9485]  ? trace_irq_disable+0x3b/0x140
[   47.576116][ T9485]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.576670][ T9485]  ? clear_bhb_loop+0x30/0x80
[   47.577105][ T9485]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.577689][ T9485] RIP: 0033:0x43ca82
[   47.578084][ T9485] Code: 08 0f 85 41 df ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[   47.579884][ T9485] RSP: 002b:00007ffca70bb398 EFLAGS: 00000246
ORIG_RAX: 0000000000000001
[   47.580695][ T9485] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 000000000043ca82
[   47.581467][ T9485] RDX: 0000000000000004 RSI: 00000000004a110a
RDI: 0000000000000004
[   47.582224][ T9485] RBP: 00007ffca70bb3c0 R08: 0000000000000000
R09: 0000000000000000
[   47.582980][ T9485] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffca70bb978
[   47.583729][ T9485] R13: 00007ffca70bb988 R14: 0000000000000002
R15: 00000000004caa00
[   47.584484][ T9485]  </TASK>
[   47.585205][ T9485] Kernel Offset: disabled
[   47.585796][ T9485] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data