KASAN: slab-use-after-free Read in mini_qdisc_pair_swap

Status: closed as invalid on 2024/02/22 14:05
Subsystems: net
[Documentation on labels]
First crash: 1023d, last: 1023d
▶ ▼ Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-out-of-bounds Read in mini_qdisc_pair_swap net 19 2 954d 873d 0/29 auto-obsoleted due to no activity on 2024/07/04 00:16
upstream KASAN: slab-out-of-bounds Write in mini_qdisc_pair_swap prio:high net 21 21 248d 519d 0/29 auto-obsoleted due to no activity on 2026/06/10 07:18
upstream KASAN: slab-use-after-free Read in mini_qdisc_pair_swap (2) net 19 1 588d 588d 0/29 closed as invalid on 2025/05/01 15:05
upstream KASAN: slab-use-after-free Write in mini_qdisc_pair_swap net 22 syz, C error 76 1168d 1322d 23/29 fixed on 2023/09/29 02:49
upstream KASAN: use-after-free Write in mini_qdisc_pair_swap (2) net 22 24 1358d 1739d 22/29 fixed on 2023/02/24 13:50
upstream KASAN: use-after-free Write in mini_qdisc_pair_swap net 22 1 1829d 1829d 0/29 closed as invalid on 2022/01/11 13:43
linux-6.1 KASAN: use-after-free Write in mini_qdisc_pair_swap origin:upstream missing-backport 22 syz unreliable 2 21d 1265d 0/3 upstream: reported syz repro on 2023/05/19 13:51
upstream KASAN: slab-use-after-free Write in mini_qdisc_pair_swap (2) prio:high net 22 29 31d 88d 0/29 closed as invalid on 2026/10/06 02:03

Sample crash report:
==================================================================
BUG: KASAN: slab-use-after-free in mini_qdisc_pair_swap+0x19d/0x1f0 net/sched/sch_generic.c:1557
Read of size 8 at addr ffff888022f9e000 by task kworker/u16:27/32689

CPU: 2 PID: 32689 Comm: kworker/u16:27 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:488
 kasan_report+0xda/0x110 mm/kasan/report.c:601
 mini_qdisc_pair_swap+0x19d/0x1f0 net/sched/sch_generic.c:1557
 tcf_chain_head_change_item net/sched/cls_api.c:493 [inline]
 tcf_chain0_head_change_cb_del+0x1a5/0x3e0 net/sched/cls_api.c:940
 tcf_block_put_ext+0x74/0x170 net/sched/cls_api.c:1521
 clsact_destroy+0x2bb/0x9b0 net/sched/sch_ingress.c:301
 __qdisc_destroy+0x106/0x450 net/sched/sch_generic.c:1067
 qdisc_put+0xd1/0xf0 net/sched/sch_generic.c:1094
 shutdown_scheduler_queue+0xa5/0x160 net/sched/sch_generic.c:1147
 dev_shutdown+0x174/0x430 net/sched/sch_generic.c:1481
 unregister_netdevice_many_notify+0x615/0x1a10 net/core/dev.c:11073
 unregister_netdevice_many net/core/dev.c:11139 [inline]
 default_device_exit_batch+0x49b/0x610 net/core/dev.c:11610
 ops_exit_list+0x125/0x170 net/core/net_namespace.c:175
 cleanup_net+0x505/0xb20 net/core/net_namespace.c:618
 process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
 kthread+0x2c6/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>

Allocated by task 5541:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:314 [inline]
 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3813 [inline]
 slab_alloc_node mm/slub.c:3860 [inline]
 kmem_cache_alloc+0x136/0x320 mm/slub.c:3867
 getname_flags.part.0+0x50/0x4e0 fs/namei.c:140
 getname_flags+0x9c/0xf0 include/linux/audit.h:322
 vfs_fstatat+0x9a/0x140 fs/stat.c:303
 __do_sys_newfstatat+0x98/0x110 fs/stat.c:468
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Freed by task 5541:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:634
 poison_slab_object mm/kasan/common.c:241 [inline]
 __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2121 [inline]
 slab_free mm/slub.c:4299 [inline]
 kmem_cache_free+0x129/0x350 mm/slub.c:4363
 putname+0x12e/0x170 fs/namei.c:274
 vfs_fstatat+0xbd/0x140 fs/stat.c:305
 __do_sys_newfstatat+0x98/0x110 fs/stat.c:468
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

The buggy address belongs to the object at ffff888022f9d500
 which belongs to the cache names_cache of size 4096
The buggy address is located 2816 bytes inside of
 freed 4096-byte region [ffff888022f9d500, ffff888022f9e500)

The buggy address belongs to the physical page:
page:ffffea00008be600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22f98
head:ffffea00008be600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff8880146e3cc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5541, tgid 5541 (udevd), ts 1891047032362, free_ts 1890988096904
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2190 [inline]
 allocate_slab mm/slub.c:2354 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2407
 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540
 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3625
 __slab_alloc_node mm/slub.c:3678 [inline]
 slab_alloc_node mm/slub.c:3850 [inline]
 kmem_cache_alloc+0x2e9/0x320 mm/slub.c:3867
 getname_flags.part.0+0x50/0x4e0 fs/namei.c:140
 getname_flags+0x9c/0xf0 include/linux/audit.h:322
 vfs_fstatat+0x9a/0x140 fs/stat.c:303
 __do_sys_newfstatat+0x98/0x110 fs/stat.c:468
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
page last free pid 5579 tgid 5579 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x51f/0xb10 mm/page_alloc.c:2346
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
 qlink_free mm/kasan/quarantine.c:160 [inline]
 qlist_free_all+0x58/0x150 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:324
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3813 [inline]
 slab_alloc_node mm/slub.c:3860 [inline]
 kmem_cache_alloc+0x136/0x320 mm/slub.c:3867
 getname_flags.part.0+0x50/0x4e0 fs/namei.c:140
 getname_flags include/linux/audit.h:322 [inline]
 getname+0x90/0xe0 fs/namei.c:219
 do_sys_openat2+0x100/0x1e0 fs/open.c:1398
 do_sys_open fs/open.c:1419 [inline]
 __do_sys_openat fs/open.c:1435 [inline]
 __se_sys_openat fs/open.c:1430 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1430
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Memory state around the buggy address:
 ffff888022f9df00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888022f9df80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888022f9e000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888022f9e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888022f9e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/01/17 08:34 upstream 052d534373b7 2a7bcc7f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in mini_qdisc_pair_swap
* Struck through repros no longer work on HEAD.