KASAN: use-after-free Read in htab_map_alloc

Status: fixed on 2021/03/10 01:48
Subsystems: bpf
[Documentation on labels]
Fix commit: 8aaeed81fcb9 bpf: Fix error path in htab_map_alloc()
First crash: 2095d, last: 2092d
Cause bisection: introduced by (bisect log) :
commit c50eb518e262fa06bd334e6eec172eaf5d7a5bd9
Author: Song Liu <songliubraving@fb.com>
Date: Thu Oct 29 07:19:24 2020 +0000

  bpf: Use separate lockdep class for each hashtab

Crash: WARNING in htab_map_alloc (log)
Repro: C syz .config
  
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-use-after-free Read in htab_map_alloc (2) bpf 19 224 807d 813d 27/29 fixed on 2024/09/12 12:56

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in lockdep_register_key+0x356/0x3e0 kernel/locking/lockdep.c:1182
Read of size 8 at addr ffff88801b78f2d8 by task syz-executor828/23636

CPU: 1 PID: 23636 Comm: syz-executor828 Not tainted 5.9.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x4c8 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
 lockdep_register_key+0x356/0x3e0 kernel/locking/lockdep.c:1182
 htab_init_buckets kernel/bpf/hashtab.c:144 [inline]
 htab_map_alloc+0x6c5/0x14a0 kernel/bpf/hashtab.c:521
 find_and_alloc_map kernel/bpf/syscall.c:122 [inline]
 map_create kernel/bpf/syscall.c:825 [inline]
 __do_sys_bpf+0xa80/0x5180 kernel/bpf/syscall.c:4381
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4469e9
Code: e8 8c e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd7498c2db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000006dbc28 RCX: 00000000004469e9
RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000000
RBP: 00000000006dbc20 R08: 00007fd7498c3700 R09: 0000000000000000
R10: 00007fd7498c3700 R11: 0000000000000246 R12: 00000000006dbc2c
R13: 00007ffe949789ff R14: 00007fd7498c39c0 R15: 0000000000000000

Allocated by task 19600:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461
 kmalloc include/linux/slab.h:554 [inline]
 kzalloc include/linux/slab.h:666 [inline]
 htab_map_alloc+0xdf/0x14a0 kernel/bpf/hashtab.c:454
 find_and_alloc_map kernel/bpf/syscall.c:122 [inline]
 map_create kernel/bpf/syscall.c:825 [inline]
 __do_sys_bpf+0xa80/0x5180 kernel/bpf/syscall.c:4381
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 19600:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0x102/0x140 mm/kasan/common.c:422
 slab_free_hook mm/slub.c:1544 [inline]
 slab_free_freelist_hook+0x5d/0x150 mm/slub.c:1577
 slab_free mm/slub.c:3142 [inline]
 kfree+0xdb/0x360 mm/slub.c:4124
 htab_map_alloc+0x3f9/0x14a0 kernel/bpf/hashtab.c:549
 find_and_alloc_map kernel/bpf/syscall.c:122 [inline]
 map_create kernel/bpf/syscall.c:825 [inline]
 __do_sys_bpf+0xa80/0x5180 kernel/bpf/syscall.c:4381
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff88801b78f000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 728 bytes inside of
 1024-byte region [ffff88801b78f000, ffff88801b78f400)
The buggy address belongs to the page:
page:000000007495086b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b788
head:000000007495086b order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head)
raw: 00fff00000010200 ffffea0000800000 0000000300000003 ffff888010041140
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88801b78f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801b78f200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801b78f280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff88801b78f300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801b78f380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (38):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/11/01 09:27 bpf-next cb5dc5b062a9 8bc4594f .config console log report syz C ci-upstream-bpf-next-kasan-gce
2020/11/01 05:15 bpf-next cb5dc5b062a9 8bc4594f .config console log report syz C ci-upstream-bpf-next-kasan-gce
2020/10/31 20:35 bpf-next cb5dc5b062a9 8bc4594f .config console log report syz C ci-upstream-bpf-next-kasan-gce
2020/10/31 17:03 bpf-next cb5dc5b062a9 8bc4594f .config console log report syz C ci-upstream-bpf-next-kasan-gce
2020/10/31 03:29 bpf-next cb5dc5b062a9 18e33098 .config console log report syz C ci-upstream-bpf-next-kasan-gce
2020/10/30 23:35 bpf-next cb5dc5b062a9 a6e3ac3b .config console log report syz C ci-upstream-bpf-next-kasan-gce
2020/11/02 08:31 bpf-next cb5dc5b062a9 8bc4594f .config console log report syz ci-upstream-bpf-next-kasan-gce
2020/11/01 23:52 bpf-next cb5dc5b062a9 8bc4594f .config console log report syz ci-upstream-bpf-next-kasan-gce
2020/10/31 06:20 bpf-next cb5dc5b062a9 18e33098 .config console log report syz ci-upstream-bpf-next-kasan-gce
2020/10/31 01:52 bpf-next cb5dc5b062a9 18e33098 .config console log report syz ci-upstream-bpf-next-kasan-gce
2020/11/02 22:00 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/02 21:42 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/02 21:19 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/02 17:42 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/02 14:07 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/02 11:52 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/02 09:16 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/02 08:54 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/02 08:46 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 21:08 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 15:55 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 15:16 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 15:00 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 11:14 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 08:37 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 05:26 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 03:59 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/11/01 00:03 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 21:27 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 18:48 bpf-next cb5dc5b062a9 8bc4594f .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 11:09 bpf-next cb5dc5b062a9 18e33098 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 09:39 bpf-next cb5dc5b062a9 18e33098 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 08:06 bpf-next cb5dc5b062a9 18e33098 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 03:25 bpf-next cb5dc5b062a9 18e33098 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 02:52 bpf-next cb5dc5b062a9 18e33098 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 00:35 bpf-next cb5dc5b062a9 18e33098 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/31 00:21 bpf-next cb5dc5b062a9 18e33098 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/10/30 23:18 bpf-next cb5dc5b062a9 a6e3ac3b .config console log report info ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.