* Re: posix timer: general protection fault in cleanup_timers
2017-06-13 5:11 ` posix timer: general protection fault in cleanup_timers Dmitry Vyukov
@ 2017-06-13 7:53 ` idaifish
0 siblings, 0 replies; 3+ messages in thread
From: idaifish @ 2017-06-13 7:53 UTC (permalink / raw)
To: Dmitry Vyukov; +Cc: syzkaller, Thomas Gleixner, LKML
[-- Attachment #1: Type: text/plain, Size: 11765 bytes --]
Hi,
My first report has already attached the C reproducer and .config.
I've tested on my Ubuntu16.04 (4.4.0-79-generic #100-Ubuntu SMP x86_64).
The reproducer can cause my computer to freeze.
2017-06-13 13:11 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>:
> On Tue, Jun 13, 2017 at 4:27 AM, <idaifish@gmail.com> wrote:
>> Update: got another reproducible KASAN report on commit
>> 32c1431eea4881a6b17bd7c639315010aeefa452(4.12-rc5) :
>
> Hi,
>
> If it's reproducible, please provide the reproducer.
>
>
>> ==================================================================
>> BUG: KASAN: use-after-free in cleanup_timers_list
>> kernel/time/posix-cpu-timers.c:401 [inline]
>> BUG: KASAN: use-after-free in cleanup_timers+0x35e/0x430
>> kernel/time/posix-cpu-timers.c:415
>> Read of size 8 at addr ffff88006c9229f0 by task syz-executor0/29927
>>
>> CPU: 2 PID: 29927 Comm: syz-executor0 Not tainted 4.12.0-rc5 #1
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
>> Ubuntu-1.8.2-1ubuntu1 04/01/2014
>> Call Trace:
>> __dump_stack lib/dump_stack.c:16 [inline]
>> dump_stack+0x83/0xbc lib/dump_stack.c:52
>> print_address_description+0x73/0x290 mm/kasan/report.c:252
>> kasan_report_error mm/kasan/report.c:351 [inline]
>> kasan_report+0x22b/0x340 mm/kasan/report.c:408
>> __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
>> cleanup_timers_list kernel/time/posix-cpu-timers.c:401 [inline]
>> cleanup_timers+0x35e/0x430 kernel/time/posix-cpu-timers.c:415
>> posix_cpu_timers_exit+0x19/0x20 kernel/time/posix-cpu-timers.c:425
>> __exit_signal kernel/exit.c:103 [inline]
>> release_task+0x1b7/0x12c0 kernel/exit.c:199
>> exit_notify kernel/exit.c:748 [inline]
>> do_exit+0x15ba/0x2c60 kernel/exit.c:900
>> do_group_exit+0xf6/0x340 kernel/exit.c:982
>> get_signal+0x5c2/0x11b0 kernel/signal.c:2318
>> do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:808
>> exit_to_usermode_loop+0xe5/0x130 arch/x86/entry/common.c:157
>> prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
>> syscall_return_slowpath+0xd6/0x100 arch/x86/entry/common.c:263
>> entry_SYSCALL_64_fastpath+0xa3/0xa5
>> RIP: 0033:0x450439
>> RSP: 002b:00007fd78ca08cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: fffffffffffffe00 RBX: 0000000000718020 RCX: 0000000000450439
>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718020
>> RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>> R13: 00007ffe2264c6cf R14: 00007fd78ca099c0 R15: 0000000000000000
>>
>> Allocated by task 29927:
>> save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
>> save_stack+0x46/0xd0 mm/kasan/kasan.c:513
>> set_track mm/kasan/kasan.c:525 [inline]
>> kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:617
>> kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:555
>> slab_post_alloc_hook mm/slab.h:456 [inline]
>> slab_alloc_node mm/slub.c:2718 [inline]
>> slab_alloc mm/slub.c:2726 [inline]
>> kmem_cache_alloc+0xb9/0x180 mm/slub.c:2731
>> kmem_cache_zalloc include/linux/slab.h:655 [inline]
>> alloc_posix_timer kernel/time/posix-timers.c:551 [inline]
>> SYSC_timer_create kernel/time/posix-timers.c:618 [inline]
>> SyS_timer_create+0x167/0x1020 kernel/time/posix-timers.c:603
>> entry_SYSCALL_64_fastpath+0x1a/0xa5
>>
>> Freed by task 26611:
>> save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
>> save_stack+0x46/0xd0 mm/kasan/kasan.c:513
>> set_track mm/kasan/kasan.c:525 [inline]
>> kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:590
>> slab_free_hook mm/slub.c:1357 [inline]
>> slab_free_freelist_hook mm/slub.c:1379 [inline]
>> slab_free mm/slub.c:2961 [inline]
>> kmem_cache_free+0x72/0x1a0 mm/slub.c:2983
>> k_itimer_rcu_free+0x1d/0x20 kernel/time/posix-timers.c:566
>> __rcu_reclaim kernel/rcu/rcu.h:195 [inline]
>> rcu_do_batch kernel/rcu/tree.c:2800 [inline]
>> invoke_rcu_callbacks kernel/rcu/tree.c:3057 [inline]
>> __rcu_process_callbacks kernel/rcu/tree.c:3024 [inline]
>> rcu_process_callbacks+0x3a4/0x1610 kernel/rcu/tree.c:3041
>> __do_softirq+0x1be/0x59c kernel/softirq.c:284
>>
>> The buggy address belongs to the object at ffff88006c922998
>> which belongs to the cache posix_timers_cache of size 216
>> The buggy address is located 88 bytes inside of
>> 216-byte region [ffff88006c922998, ffff88006c922a70)
>> The buggy address belongs to the page:
>> page:ffffea0001b24800 count:1 mapcount:0 mapping: (null)
>> index:0xffff88006c920af8 compound_mapcount: 0
>> flags: 0x500000000008100(slab|head)
>> raw: 0500000000008100 0000000000000000 ffff88006c920af8 00000001001d0002
>> raw: ffff88006c9f9850 ffff88006c9f9850 ffff88006d81aac0 0000000000000000
>> page dumped because: kasan: bad access detected
>>
>> Memory state around the buggy address:
>> ffff88006c922880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ffff88006c922900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>>>ffff88006c922980: fc fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb
>> ^
>> ffff88006c922a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
>> ffff88006c922a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ==================================================================
>> Disabling lock debugging due to kernel taint
>> Kernel panic - not syncing: panic_on_warn set ...
>>
>> CPU: 2 PID: 29927 Comm: syz-executor0 Tainted: G B 4.12.0-rc5
>> #1
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
>> Ubuntu-1.8.2-1ubuntu1 04/01/2014
>> Call Trace:
>> __dump_stack lib/dump_stack.c:16 [inline]
>> dump_stack+0x83/0xbc lib/dump_stack.c:52
>> panic+0x1af/0x388 kernel/panic.c:180
>> kasan_end_report+0x50/0x50 mm/kasan/report.c:176
>> kasan_report_error mm/kasan/report.c:356 [inline]
>> kasan_report+0x13b/0x340 mm/kasan/report.c:408
>> __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
>> cleanup_timers_list kernel/time/posix-cpu-timers.c:401 [inline]
>> cleanup_timers+0x35e/0x430 kernel/time/posix-cpu-timers.c:415
>> posix_cpu_timers_exit+0x19/0x20 kernel/time/posix-cpu-timers.c:425
>> __exit_signal kernel/exit.c:103 [inline]
>> release_task+0x1b7/0x12c0 kernel/exit.c:199
>> exit_notify kernel/exit.c:748 [inline]
>> do_exit+0x15ba/0x2c60 kernel/exit.c:900
>> do_group_exit+0xf6/0x340 kernel/exit.c:982
>> get_signal+0x5c2/0x11b0 kernel/signal.c:2318
>> do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:808
>> exit_to_usermode_loop+0xe5/0x130 arch/x86/entry/common.c:157
>> prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
>> syscall_return_slowpath+0xd6/0x100 arch/x86/entry/common.c:263
>> entry_SYSCALL_64_fastpath+0xa3/0xa5
>> RIP: 0033:0x450439
>> RSP: 002b:00007fd78ca08cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: fffffffffffffe00 RBX: 0000000000718020 RCX: 0000000000450439
>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718020
>> RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>> R13: 00007ffe2264c6cf R14: 00007fd78ca099c0 R15: 0000000000000000
>> Shutting down cpus with NMI
>> Dumping ftrace buffer:
>> (ftrace buffer empty)
>> Kernel Offset: disabled
>> Rebooting in 86400 seconds..
>>
>>
>> 在 2017年6月8日星期四 UTC+8下午5:30:27，idaifish写道：
>>>
>>> Hi:
>>>
>>> I've got the following error report while fuzzing the kernel with
>>> syzkaller on 4.12.0-rc3.
>>>
>>> PoC and config are attached.
>>>
>>>
>>> ------------------------------------------------------------------------------------------------------------------
>>>
>>> kasan: GPF could be caused by NULL-ptr deref or user memory access
>>> general protection fault: 0000 [#1] SMP KASAN
>>> Dumping ftrace buffer:
>>> (ftrace buffer empty)
>>> Modules linked in:
>>> CPU: 2 PID: 11989 Comm: syz-executor0 Not tainted 4.12.0-rc3 #1
>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
>>> Ubuntu-1.8.2-1ubuntu1 04/01/2014
>>> task: ffff88006d4f2980 task.stack: ffff88006acb0000
>>> RIP: 0010:__list_del include/linux/list.h:104 [inline]
>>> RIP: 0010:__list_del_entry include/linux/list.h:119 [inline]
>>> RIP: 0010:list_del_init include/linux/list.h:158 [inline]
>>> RIP: 0010:cleanup_timers_list kernel/time/posix-cpu-timers.c:402 [inline]
>>> RIP: 0010:cleanup_timers+0x299/0x430 kernel/time/posix-cpu-timers.c:415
>>> RSP: 0018:ffff88006acb7988 EFLAGS: 00010002
>>> RAX: ffff88006d4f2980 RBX: ffff88006bff3940 RCX: 0000000000000001
>>> RDX: ffffffff81266ad0 RSI: 0000000000000000 RDI: 0000000000000008
>>> RBP: ffff88006acb79c8 R08: 0000000000000000 R09: 0000000000000002
>>> R10: 00000000f17eaa6c R11: 000000006ec117ba R12: 0000000000000000
>>> R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88006bff3940
>>> FS: 0000000000000000(0000) GS:ffff88006e400000(0000)
>>> knlGS:0000000000000000
>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 00000000204f5000 CR3: 000000000380e000 CR4: 00000000000006e0
>>> DR0: 0000000000000042 DR1: 0000000000008000 DR2: 0000000000000000
>>> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
>>> Call Trace:
>>> posix_cpu_timers_exit+0x19/0x20 kernel/time/posix-cpu-timers.c:425
>>> __exit_signal kernel/exit.c:103 [inline]
>>> release_task+0x1b7/0x12c0 kernel/exit.c:199
>>> exit_notify kernel/exit.c:748 [inline]
>>> do_exit+0x15ba/0x2c60 kernel/exit.c:900
>>> do_group_exit+0xf6/0x340 kernel/exit.c:982
>>> get_signal+0x5c2/0x11b0 kernel/signal.c:2318
>>> do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:808
>>> exit_to_usermode_loop+0xe5/0x130 arch/x86/entry/common.c:157
>>> prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
>>> syscall_return_slowpath+0xd6/0x100 arch/x86/entry/common.c:263
>>> entry_SYSCALL_64_fastpath+0xa3/0xa5
>>> RIP: 0033:0x450439
>>> RSP: 002b:00007fce47004cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>>> RAX: fffffffffffffe00 RBX: 0000000000718020 RCX: 0000000000450439
>>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718020
>>> RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>>> R13: 00007fff1a12cddf R14: 00007fce470059c0 R15: 0000000000000000
>>> Code: 00 e8 9c a0 09 00 48 8d 7b 08 48 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f
>>> 85 c2 00 00 00 49 8d 7e 08 48 8b 53 08 48 89 f9 48 c1 e9 03 <42> 80 3c 29 00
>>> 0f 85 96 00 00 00 48 89 d1 49 89 56 08 48 c1 e9
>>> RIP: __list_del include/linux/list.h:104 [inline] RSP: ffff88006acb7988
>>> RIP: __list_del_entry include/linux/list.h:119 [inline] RSP:
>>> ffff88006acb7988
>>> RIP: list_del_init include/linux/list.h:158 [inline] RSP: ffff88006acb7988
>>> RIP: cleanup_timers_list kernel/time/posix-cpu-timers.c:402 [inline] RSP:
>>> ffff88006acb7988
>>> RIP: cleanup_timers+0x299/0x430 kernel/time/posix-cpu-timers.c:415 RSP:
>>> ffff88006acb7988
>>> ---[ end trace ac8e042e922b484f ]---
>>> Kernel panic - not syncing: Fatal exception
>>> Dumping ftrace buffer:
>>> (ftrace buffer empty)
>>> Kernel Offset: disabled
>>> Rebooting in 86400 seconds..
>>>
>>>
>>> -----------
>>> Regards,
>>> idaifish
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "syzkaller" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to syzkaller+unsubscribe@googlegroups.com.
>> For more options, visit https://groups.google.com/d/optout.
--
Regards,
idaifish
[-- Attachment #2: reproducer.c --]
[-- Type: text/x-csrc, Size: 9844 bytes --]
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#ifndef __NR_mmap
#define __NR_mmap 9
#endif
#ifndef __NR_rt_sigprocmask
#define __NR_rt_sigprocmask 14
#endif
#ifndef __NR_timer_create
#define __NR_timer_create 222
#endif
#ifndef __NR_getsockopt
#define __NR_getsockopt 55
#endif
#ifndef __NR_getpid
#define __NR_getpid 39
#endif
#ifndef __NR_gettid
#define __NR_gettid 186
#endif
#ifndef __NR_timer_settime
#define __NR_timer_settime 223
#endif
#ifndef __NR_rt_tgsigqueueinfo
#define __NR_rt_tgsigqueueinfo 297
#endif
#ifndef __NR_rt_sigtimedwait
#define __NR_rt_sigtimedwait 128
#endif
#define _GNU_SOURCE
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <linux/capability.h>
#include <linux/kvm.h>
#include <linux/sched.h>
#include <arpa/inet.h>
#include <linux/if.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <net/if_arp.h>
#include <assert.h>
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
const int kFailStatus = 67;
const int kErrorStatus = 68;
const int kRetryStatus = 69;
__attribute__((noreturn)) void doexit(int status)
{
volatile unsigned i;
syscall(__NR_exit_group, status);
for (i = 0;; i++) {
}
}
__attribute__((noreturn)) void fail(const char* msg, ...)
{
int e = errno;
fflush(stdout);
va_list args;
va_start(args, msg);
vfprintf(stderr, msg, args);
va_end(args);
fprintf(stderr, " (errno %d)\n", e);
doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}
__attribute__((noreturn)) void exitf(const char* msg, ...)
{
int e = errno;
fflush(stdout);
va_list args;
va_start(args, msg);
vfprintf(stderr, msg, args);
va_end(args);
fprintf(stderr, " (errno %d)\n", e);
doexit(kRetryStatus);
}
static int flag_debug;
void debug(const char* msg, ...)
{
if (!flag_debug)
return;
va_list args;
va_start(args, msg);
vfprintf(stdout, msg, args);
va_end(args);
fflush(stdout);
}
__thread int skip_segv;
__thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* uctx)
{
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
(addr < prog_start || addr > prog_end)) {
debug("SIGSEGV on %p, skipping\n", addr);
_longjmp(segv_env, 1);
}
debug("SIGSEGV on %p, exiting\n", addr);
doexit(sig);
for (;;) {
}
}
static void install_segv_handler()
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) \
{ \
__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
if (_setjmp(segv_env) == 0) { \
__VA_ARGS__; \
} \
__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
}
#define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1)
#define BITMASK_LEN_OFF(type, bf_off, bf_len) \
(type)(BITMASK_LEN(type, (bf_len)) << (bf_off))
#define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \
if ((bf_off) == 0 && (bf_len) == 0) { \
*(type*)(addr) = (type)(val); \
} else { \
type new_val = *(type*)(addr); \
new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \
new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \
*(type*)(addr) = new_val; \
}
struct csum_inet {
uint32_t acc;
};
void csum_inet_init(struct csum_inet* csum)
{
csum->acc = 0;
}
void csum_inet_update(struct csum_inet* csum, const uint8_t* data,
size_t length)
{
if (length == 0)
return;
size_t i;
for (i = 0; i < length - 1; i += 2)
csum->acc += *(uint16_t*)&data[i];
if (length & 1)
csum->acc += (uint16_t)data[length - 1];
while (csum->acc > 0xffff)
csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16);
}
uint16_t csum_inet_digest(struct csum_inet* csum)
{
return ~csum->acc;
}
static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1,
uintptr_t a2, uintptr_t a3,
uintptr_t a4, uintptr_t a5,
uintptr_t a6, uintptr_t a7,
uintptr_t a8)
{
switch (nr) {
default:
return syscall(nr, a0, a1, a2, a3, a4, a5);
}
}
static void setup_main_process()
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_handler = SIG_IGN;
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
install_segv_handler();
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
fail("failed to mkdtemp");
if (chmod(tmpdir, 0777))
fail("failed to chmod");
if (chdir(tmpdir))
fail("failed to chdir");
}
static void loop();
static void sandbox_common()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
setsid();
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
unshare(CLONE_NEWNS);
unshare(CLONE_NEWIPC);
unshare(CLONE_IO);
}
static int do_sandbox_setuid(int executor_pid, bool enable_tun)
{
int pid = fork();
if (pid)
return pid;
sandbox_common();
const int nobody = 65534;
if (setgroups(0, NULL))
fail("failed to setgroups");
if (syscall(SYS_setresgid, nobody, nobody, nobody))
fail("failed to setresgid");
if (syscall(SYS_setresuid, nobody, nobody, nobody))
fail("failed to setresuid");
prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
loop();
doexit(1);
}
long r[39];
void loop()
{
memset(r, -1, sizeof(r));
r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0x1c000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0);
NONFAILING(*(uint64_t*)0x20003000 = (uint64_t)0xfffffffffffff051);
r[2] = execute_syscall(__NR_rt_sigprocmask, 0x2ul, 0x20003000ul,
0x20011ff8ul, 0x8ul, 0, 0, 0, 0, 0);
r[3] = execute_syscall(__NR_getpid, 0, 0, 0, 0, 0, 0, 0, 0, 0);
r[4] = execute_syscall(__NR_gettid, 0, 0, 0, 0, 0, 0, 0, 0, 0);
NONFAILING(*(uint64_t*)0x2001afb0 = (uint64_t)0x0);
NONFAILING(*(uint32_t*)0x2001afb8 = (uint32_t)0x8);
NONFAILING(*(uint32_t*)0x2001afbc = (uint32_t)0x2);
NONFAILING(*(uint64_t*)0x2001afc0 = (uint64_t)0x7f);
NONFAILING(*(uint64_t*)0x2001afc8 = (uint64_t)0xbd);
NONFAILING(*(uint64_t*)0x2001afd0 = (uint64_t)0x86);
NONFAILING(*(uint64_t*)0x2001afd8 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x2001afe0 = (uint64_t)0x100);
NONFAILING(*(uint64_t*)0x2001afe8 = (uint64_t)0x4);
NONFAILING(*(uint64_t*)0x2001aff0 = (uint64_t)0xffff);
NONFAILING(*(uint64_t*)0x2001aff8 = (uint64_t)0x7);
r[16] = execute_syscall(__NR_timer_create, 0x3ul, 0x2001afb0ul,
0x2000b000ul, 0, 0, 0, 0, 0, 0);
if (r[16] != -1)
NONFAILING(r[17] = *(uint32_t*)0x2000b000);
NONFAILING(*(uint32_t*)0x2000b000 = (uint32_t)0x0);
NONFAILING(*(uint16_t*)0x2000b004 = (uint16_t)0x3f7d);
NONFAILING(*(uint16_t*)0x2000b006 = (uint16_t)0x21);
NONFAILING(*(uint64_t*)0x2000b008 = (uint64_t)0x1);
NONFAILING(*(uint64_t*)0x2000b010 = (uint64_t)0x2);
NONFAILING(*(uint32_t*)0x2001b000 = (uint32_t)0x18);
r[24] =
execute_syscall(__NR_getsockopt, 0xfffffffffffffffful, 0x84ul,
0x73ul, 0x2000b000ul, 0x2001b000ul, 0, 0, 0, 0);
NONFAILING(*(uint64_t*)0x20011fe0 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20011fe8 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20011ff0 = (uint64_t)0x77359400);
NONFAILING(*(uint64_t*)0x20011ff8 = (uint64_t)0x0);
r[29] = execute_syscall(__NR_timer_settime, r[17], 0x1ul,
0x20011fe0ul, 0x2001afe0ul, 0, 0, 0, 0, 0);
NONFAILING(*(uint32_t*)0x2000aff0 = (uint32_t)0x0);
NONFAILING(*(uint32_t*)0x2000aff4 = (uint32_t)0x3);
NONFAILING(*(uint32_t*)0x2000aff8 = (uint32_t)0x10001);
NONFAILING(*(uint32_t*)0x2000affc = (uint32_t)0x3d9d);
r[34] = execute_syscall(__NR_rt_tgsigqueueinfo, r[3], r[4], 0x32ul,
0x2000aff0ul, 0, 0, 0, 0, 0);
NONFAILING(*(uint64_t*)0x20012000 = (uint64_t)0xfffffffffffffffc);
NONFAILING(*(uint64_t*)0x20014ff0 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20014ff8 = (uint64_t)0x98967c);
r[38] =
execute_syscall(__NR_rt_sigtimedwait, 0x20012000ul, 0x20015ff0ul,
0x20014ff0ul, 0x8ul, 0, 0, 0, 0, 0);
}
int main()
{
setup_main_process();
int pid = do_sandbox_setuid(0, false);
int status = 0;
while (waitpid(pid, &status, __WALL) != pid) {
}
return 0;
}
[-- Attachment #3: repro.report --]
[-- Type: application/octet-stream, Size: 6399 bytes --]
==================================================================
BUG: KASAN: use-after-free in cleanup_timers_list kernel/time/posix-cpu-timers.c:401 [inline]
BUG: KASAN: use-after-free in cleanup_timers+0x35e/0x430 kernel/time/posix-cpu-timers.c:415
Read of size 8 at addr ffff88006c9229f0 by task syz-executor0/29927
CPU: 2 PID: 29927 Comm: syz-executor0 Not tainted 4.12.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x83/0xbc lib/dump_stack.c:52
print_address_description+0x73/0x290 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report+0x22b/0x340 mm/kasan/report.c:408
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
cleanup_timers_list kernel/time/posix-cpu-timers.c:401 [inline]
cleanup_timers+0x35e/0x430 kernel/time/posix-cpu-timers.c:415
posix_cpu_timers_exit+0x19/0x20 kernel/time/posix-cpu-timers.c:425
__exit_signal kernel/exit.c:103 [inline]
release_task+0x1b7/0x12c0 kernel/exit.c:199
exit_notify kernel/exit.c:748 [inline]
do_exit+0x15ba/0x2c60 kernel/exit.c:900
do_group_exit+0xf6/0x340 kernel/exit.c:982
get_signal+0x5c2/0x11b0 kernel/signal.c:2318
do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:808
exit_to_usermode_loop+0xe5/0x130 arch/x86/entry/common.c:157
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath+0xd6/0x100 arch/x86/entry/common.c:263
entry_SYSCALL_64_fastpath+0xa3/0xa5
RIP: 0033:0x450439
RSP: 002b:00007fd78ca08cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 0000000000718020 RCX: 0000000000450439
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718020
RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe2264c6cf R14: 00007fd78ca099c0 R15: 0000000000000000
Allocated by task 29927:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x46/0xd0 mm/kasan/kasan.c:513
set_track mm/kasan/kasan.c:525 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:617
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:555
slab_post_alloc_hook mm/slab.h:456 [inline]
slab_alloc_node mm/slub.c:2718 [inline]
slab_alloc mm/slub.c:2726 [inline]
kmem_cache_alloc+0xb9/0x180 mm/slub.c:2731
kmem_cache_zalloc include/linux/slab.h:655 [inline]
alloc_posix_timer kernel/time/posix-timers.c:551 [inline]
SYSC_timer_create kernel/time/posix-timers.c:618 [inline]
SyS_timer_create+0x167/0x1020 kernel/time/posix-timers.c:603
entry_SYSCALL_64_fastpath+0x1a/0xa5
Freed by task 26611:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x46/0xd0 mm/kasan/kasan.c:513
set_track mm/kasan/kasan.c:525 [inline]
kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:590
slab_free_hook mm/slub.c:1357 [inline]
slab_free_freelist_hook mm/slub.c:1379 [inline]
slab_free mm/slub.c:2961 [inline]
kmem_cache_free+0x72/0x1a0 mm/slub.c:2983
k_itimer_rcu_free+0x1d/0x20 kernel/time/posix-timers.c:566
__rcu_reclaim kernel/rcu/rcu.h:195 [inline]
rcu_do_batch kernel/rcu/tree.c:2800 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:3057 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:3024 [inline]
rcu_process_callbacks+0x3a4/0x1610 kernel/rcu/tree.c:3041
__do_softirq+0x1be/0x59c kernel/softirq.c:284
The buggy address belongs to the object at ffff88006c922998
which belongs to the cache posix_timers_cache of size 216
The buggy address is located 88 bytes inside of
216-byte region [ffff88006c922998, ffff88006c922a70)
The buggy address belongs to the page:
page:ffffea0001b24800 count:1 mapcount:0 mapping: (null) index:0xffff88006c920af8 compound_mapcount: 0
flags: 0x500000000008100(slab|head)
raw: 0500000000008100 0000000000000000 ffff88006c920af8 00000001001d0002
raw: ffff88006c9f9850 ffff88006c9f9850 ffff88006d81aac0 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88006c922880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88006c922900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88006c922980: fc fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88006c922a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff88006c922a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Disabling lock debugging due to kernel taint
Kernel panic - not syncing: panic_on_warn set ...
CPU: 2 PID: 29927 Comm: syz-executor0 Tainted: G B 4.12.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x83/0xbc lib/dump_stack.c:52
panic+0x1af/0x388 kernel/panic.c:180
kasan_end_report+0x50/0x50 mm/kasan/report.c:176
kasan_report_error mm/kasan/report.c:356 [inline]
kasan_report+0x13b/0x340 mm/kasan/report.c:408
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
cleanup_timers_list kernel/time/posix-cpu-timers.c:401 [inline]
cleanup_timers+0x35e/0x430 kernel/time/posix-cpu-timers.c:415
posix_cpu_timers_exit+0x19/0x20 kernel/time/posix-cpu-timers.c:425
__exit_signal kernel/exit.c:103 [inline]
release_task+0x1b7/0x12c0 kernel/exit.c:199
exit_notify kernel/exit.c:748 [inline]
do_exit+0x15ba/0x2c60 kernel/exit.c:900
do_group_exit+0xf6/0x340 kernel/exit.c:982
get_signal+0x5c2/0x11b0 kernel/signal.c:2318
do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:808
exit_to_usermode_loop+0xe5/0x130 arch/x86/entry/common.c:157
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath+0xd6/0x100 arch/x86/entry/common.c:263
entry_SYSCALL_64_fastpath+0xa3/0xa5
RIP: 0033:0x450439
RSP: 002b:00007fd78ca08cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 0000000000718020 RCX: 0000000000450439
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718020
RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe2264c6cf R14: 00007fd78ca099c0 R15: 0000000000000000
Shutting down cpus with NMI
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
^ permalink raw reply [flat|nested] 3+ messages in thread