KASAN: use-after-free Read in kernel_accept

Status: fixed on 2019/03/06 07:43
Subsystems: smc
[Documentation on labels]
Reported-by: syzbot+0bf2e01269f1274b4b03@syzkaller.appspotmail.com
Fix commit: 78abe3d0dfad net/smc: fix TCP fallback socket release 26d92e951fe0 smc: move unhash as early as possible in smc_release()
First crash: 2936d, last: 2786d
▶ ▼ Discussions (10)
Title Replies (including bot) Last reply
[PATCH 4.19 00/99] 4.19.17-stable review 109 (109) 2019/04/22 19:40
[PATCH 4.20 000/111] 4.20.4-stable review 120 (120) 2019/01/23 06:43
[PATCH 4.19 000/170] 4.19.14-stable review 194 (194) 2019/01/11 07:09
[PATCH 4.14 000/101] 4.14.92-stable review 130 (130) 2019/01/09 15:47
[Patch net] smc: move unhash as early as possible in smc_release() 5 (5) 2019/01/07 19:40
[PATCH v3] net/smc: fix TCP fallback socket release 1 (1) 2019/01/04 06:54
[PATCH v3] net/smc: fix TCP fallback socket release 2 (2) 2018/12/19 06:03
[PATCH v2] net/smc: fix TCP fallback socket release 4 (4) 2018/12/18 11:24
[PATCH] net/smc: fix TCP fallback socket release 2 (2) 2018/12/17 05:02
KASAN: use-after-free Read in kernel_accept 0 (1) 2018/07/16 14:59

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in kernel_accept+0x2a4/0x310 net/socket.c:3251
Read of size 8 at addr ffff8801a7ffb1a8 by task kworker/0:46/4718

CPU: 0 PID: 4718 Comm: kworker/0:46 Not tainted 4.18.0-rc3+ #15
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events smc_tcp_listen_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 kernel_accept+0x2a4/0x310 net/socket.c:3251
 smc_clcsock_accept net/smc/af_smc.c:701 [inline]
 smc_tcp_listen_work+0x222/0xef0 net/smc/af_smc.c:1114
 process_one_work+0xc73/0x1ba0 kernel/workqueue.c:2153
 worker_thread+0x189/0x13c0 kernel/workqueue.c:2296
 kthread+0x345/0x410 kernel/kthread.c:240
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412

Allocated by task 4719:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
 sock_alloc_inode+0x78/0x320 net/socket.c:243
 alloc_inode+0x63/0x190 fs/inode.c:210
 new_inode_pseudo+0x71/0x1a0 fs/inode.c:895
 sock_alloc+0x41/0x270 net/socket.c:567
 __sock_create+0x175/0x940 net/socket.c:1250
 sock_create_kern+0x3b/0x50 net/socket.c:1332
 smc_create+0x141/0x360 net/smc/af_smc.c:1713
 __sock_create+0x53c/0x940 net/socket.c:1286
 sock_create net/socket.c:1326 [inline]
 __sys_socket+0x106/0x260 net/socket.c:1356
 __do_sys_socket net/socket.c:1365 [inline]
 __se_sys_socket net/socket.c:1363 [inline]
 __x64_sys_socket+0x73/0xb0 net/socket.c:1363
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 4719:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kmem_cache_free+0x86/0x2d0 mm/slab.c:3756
 sock_destroy_inode+0x56/0x70 net/socket.c:273
 destroy_inode+0x159/0x200 fs/inode.c:267
 evict+0x5d5/0x990 fs/inode.c:575
 iput_final fs/inode.c:1506 [inline]
 iput+0x635/0xaa0 fs/inode.c:1532
 __sock_release+0x1f1/0x260 net/socket.c:610
 sock_release+0x17/0x20 net/socket.c:618
 smc_release+0x1a8/0x720 net/smc/af_smc.c:146
 __sock_release+0xd7/0x260 net/socket.c:599
 sock_close+0x19/0x20 net/socket.c:1150
 __fput+0x355/0x8b0 fs/file_table.c:209
 ____fput+0x15/0x20 fs/file_table.c:243
 task_work_run+0x1ec/0x2a0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:192 [inline]
 exit_to_usermode_loop+0x313/0x370 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8801a7ffb180
 which belongs to the cache sock_inode_cache of size 992
The buggy address is located 40 bytes inside of
 992-byte region [ffff8801a7ffb180, ffff8801a7ffb560)
The buggy address belongs to the page:
page:ffffea00069ffec0 count:1 mapcount:0 mapping:ffff8801d9476c00 index:0xffff8801a7ffbffd
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea00069ffe88 ffffea00069e06c8 ffff8801d9476c00
raw: ffff8801a7ffbffd ffff8801a7ffb180 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801a7ffb080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801a7ffb100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801a7ffb180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff8801a7ffb200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801a7ffb280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/19 15:02 net-old e56b8ce363a3 49f35839 .config console log report syz C ci-upstream-net-this-kasan-gce
2018/07/16 07:16 net-old 6bed5e260709 92a49505 .config console log report syz C ci-upstream-net-this-kasan-gce
2018/12/10 10:05 upstream 0844895a2e51 96cc4c50 .config console log report ci-upstream-kasan-gce-root
2018/09/21 20:45 upstream 10dc890d4228 37079712 .config console log report ci-upstream-kasan-gce-selinux-root
2018/07/30 18:18 upstream acb1872577b3 1a381291 .config console log report ci-upstream-kasan-gce-root
2018/08/24 20:59 upstream aa5b1054badb 9b0f5c75 .config console log report ci-upstream-kasan-gce-386
2018/12/13 13:01 net-old 9e69efd45321 f3d9d594 .config console log report ci-upstream-net-this-kasan-gce
2018/11/03 10:35 net-old 7b900ead6cc6 8bd6bd63 .config console log report ci-upstream-net-this-kasan-gce
2018/10/16 17:33 net-old bd8be2cf8b69 1ba7fd7e .config console log report ci-upstream-net-this-kasan-gce
2018/09/09 20:54 net-old 52ea992cfac3 6b5120a4 .config console log report ci-upstream-net-this-kasan-gce
2018/08/02 10:09 net-old e6aed040eafb 0a7cf4ec .config console log report ci-upstream-net-this-kasan-gce
2018/07/30 03:04 net-old 25432eba9cd8 1a381291 .config console log report ci-upstream-net-this-kasan-gce
2018/10/07 08:00 net-next-old 72438f8cef4e 8b311eaf .config console log report ci-upstream-net-kasan-gce
2018/09/30 05:12 net-next-old d4017665854b 41e4b329 .config console log report ci-upstream-net-kasan-gce
2018/08/21 18:43 net-next-old 2ad0d5269970 95b5c82b .config console log report ci-upstream-net-kasan-gce
2018/08/07 23:07 net-next-old c5d99d2b35da 1beb8136 .config console log report ci-upstream-net-kasan-gce
2018/10/22 21:58 linux-next 8c60c36d0b8c ecb386fe .config console log report ci-upstream-linux-next-kasan-gce-root
2018/09/11 04:00 linux-next f2b6e66e9885 8c88323f .config console log report ci-upstream-linux-next-kasan-gce-root
2018/08/30 20:13 linux-next 3d18c2437944 938220fd .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.