Re: [syzbot] [jffs2?] KASAN: slab-use-after-free Read in jffs2_erase_pending_blocks

From: lee bruce
Date: Tue Apr 09 2024 - 08:41:21 EST

Next message: Eric Biggers: "[PATCH 0/2] crypto: x86/sha256-ni - cleanup and optimization"
Previous message: Louis Chauvet: "Re: [PATCH 0/3] drm: Multiple documentation update"
In reply to: syzbot: "[syzbot] [jffs2?] KASAN: slab-use-after-free Read in jffs2_erase_pending_blocks"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello, I reproduced this bug and comfired in the latest upstream.

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei lee <xrivendell7@xxxxxxxxx>
Reported-by: yue sun <samsun1006219@xxxxxxxxx>

I use the same kernel as syzbot instance:
https://syzkaller.appspot.com/bug?extid=5a281fe8aadf8f11230d
Kernel Commit: upstream fe46a7dd189e25604716c03576d05ac8a5209743
Kernel Config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4d90a36f0cab495a
with KASAN enabled

root@syzkaller:~# ./84e
[ 770.516785][ T8231] jffs2: notice: (8231)
jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of
xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
root@syzkaller:~# [ 770.575686][ T8255]
==================================================================
[ 770.576754][ T8255] BUG: KASAN: slab-use-after-free in
__mutex_lock+0xfe/0xd70
[ 770.577681][ T8255] Read of size 8 at addr ffff888019ad9130 by task
jffs2_gcd_mtd0/8255
[ 770.578672][ T8255]
[ 770.578989][ T8255] CPU: 0 PID: 8255 Comm: jffs2_gcd_mtd0 Not
tainted 6.8.0-08951-gfe46a7dd189e-dirty #6
[ 770.580190][ T8255] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 770.581476][ T8255] Call Trace:
[ 770.581915][ T8255] <TASK>
[ 770.582301][ T8255] dump_stack_lvl+0x250/0x380
[ 770.582920][ T8255] ? __pfx_dump_stack_lvl+0x10/0x10
[ 770.583599][ T8255] ? __pfx__printk+0x10/0x10
[ 770.584222][ T8255] ? _printk+0xda/0x120
[ 770.584784][ T8255] ? __virt_addr_valid+0x19b/0x580
[ 770.585429][ T8255] ? __virt_addr_valid+0x19b/0x580
[ 770.586071][ T8255] print_report+0x169/0x550
[ 770.586643][ T8255] ? __virt_addr_valid+0x19b/0x580
[ 770.587298][ T8255] ? __virt_addr_valid+0x19b/0x580
[ 770.587949][ T8255] ? __virt_addr_valid+0x4a8/0x580
[ 770.588559][ T8255] ? __phys_addr+0xc3/0x180
[ 770.589036][ T8255] ? __mutex_lock+0xfe/0xd70
[ 770.589613][ T8255] kasan_report+0x143/0x180
[ 770.590214][ T8255] ? __mutex_lock+0xfe/0xd70
[ 770.590809][ T8255] __mutex_lock+0xfe/0xd70
[ 770.591384][ T8255] ? jffs2_garbage_collect_pass+0xb3/0x2130
[ 770.592122][ T8255] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 770.592812][ T8255] ? __pfx___mutex_lock+0x10/0x10
[ 770.593467][ T8255] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 770.594273][ T8255] ? _raw_spin_lock_irq+0xdf/0x120
[ 770.594917][ T8255] jffs2_garbage_collect_pass+0xb3/0x2130
[ 770.595639][ T8255] ? lockdep_hardirqs_on+0x99/0x150
[ 770.596293][ T8255] ? _raw_spin_unlock_irq+0x2e/0x50
[ 770.596938][ T8255] ? __set_current_blocked+0x31f/0x390
[ 770.597610][ T8255] ? __pfx___set_current_blocked+0x10/0x10
[ 770.598257][ T8255] ? schedule+0x90/0x320
[ 770.598705][ T8255] ? schedule+0x155/0x320
[ 770.599239][ T8255] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[ 770.600014][ T8255] ? schedule_timeout+0x227/0x320
[ 770.600663][ T8255] ? sigprocmask+0x231/0x290
[ 770.601178][ T8255] ? __pfx_sigprocmask+0x10/0x10
[ 770.601814][ T8255] ? do_raw_spin_unlock+0x13c/0x8b0
[ 770.602473][ T8255] jffs2_garbage_collect_thread+0x691/0x730
[ 770.603218][ T8255] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 770.604008][ T8255] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 770.604758][ T8255] ? __kthread_parkme+0x172/0x1d0
[ 770.605407][ T8255] kthread+0x310/0x3b0
[ 770.605935][ T8255] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 770.606720][ T8255] ? __pfx_kthread+0x10/0x10
[ 770.607223][ T8255] ret_from_fork+0x52/0x80
[ 770.607722][ T8255] ? __pfx_kthread+0x10/0x10
[ 770.608230][ T8255] ret_from_fork_asm+0x1a/0x30
[ 770.608766][ T8255] </TASK>
[ 770.609073][ T8255]
[ 770.609323][ T8255] Allocated by task 8231:
[ 770.609831][ T8255] kasan_save_track+0x3f/0x80
[ 770.610374][ T8255] __kasan_kmalloc+0x98/0xb0
[ 770.610915][ T8255] kmalloc_trace+0x1db/0x360
[ 770.611495][ T8255] jffs2_init_fs_context+0x54/0xd0
[ 770.612155][ T8255] alloc_fs_context+0x6a5/0x830
[ 770.612788][ T8255] do_new_mount+0x175/0xb90
[ 770.613338][ T8255] __se_sys_mount+0x362/0x3d0
[ 770.613925][ T8255] do_syscall_64+0xfb/0x240
[ 770.614522][ T8255] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 770.615270][ T8255]
[ 770.615567][ T8255] Freed by task 8231:
[ 770.616053][ T8255] kasan_save_track+0x3f/0x80
[ 770.616676][ T8255] kasan_save_free_info+0x40/0x50
[ 770.617335][ T8255] poison_slab_object+0xa6/0xe0
[ 770.617968][ T8255] __kasan_slab_free+0x37/0x60
[ 770.618518][ T8255] kfree+0x14a/0x380
[ 770.619008][ T8255] deactivate_locked_super+0xcb/0x140
[ 770.619596][ T8255] put_fs_context+0x9b/0x7b0
[ 770.620158][ T8255] fscontext_release+0x6c/0x90
[ 770.620746][ T8255] __fput+0x442/0x8d0
[ 770.621247][ T8255] task_work_run+0x25c/0x320
[ 770.621835][ T8255] do_exit+0xa46/0x28a0
[ 770.622362][ T8255] do_group_exit+0x20b/0x2c0
[ 770.622951][ T8255] __x64_sys_exit_group+0x3f/0x40
[ 770.623596][ T8255] do_syscall_64+0xfb/0x240
[ 770.624167][ T8255] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 770.624912][ T8255]
[ 770.625213][ T8255] The buggy address belongs to the object at
ffff888019ad9000
[ 770.625213][ T8255] which belongs to the cache kmalloc-4k of size 4096
[ 770.626916][ T8255] The buggy address is located 304 bytes inside of
[ 770.626916][ T8255] freed 4096-byte region [ffff888019ad9000,
ffff888019ada000)

=* repro.c =*
#define _GNU_SOURCE

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#include <linux/capability.h>

#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fspick
#define __NR_fspick 433
#endif

static bool write_file(const char* file, const char* what, ...) {
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}

static void setup_common() {
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
}
}

static void setup_binderfs() {
if (mkdir("/dev/binderfs", 0777)) {
}
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
}
if (symlink("/dev/binderfs", "./binderfs")) {
}
}

static void loop();

static void sandbox_common() {
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setsid();
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = (200 << 20);
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 32 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 136 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
if (unshare(CLONE_NEWNS)) {
}
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
}
if (unshare(CLONE_NEWIPC)) {
}
if (unshare(0x02000000)) {
}
if (unshare(CLONE_NEWUTS)) {
}
if (unshare(CLONE_SYSVSEM)) {
}
typedef struct {
const char* name;
const char* value;
} sysctl_t;
static const sysctl_t sysctls[] = {
{"/proc/sys/kernel/shmmax", "16777216"},
{"/proc/sys/kernel/shmall", "536870912"},
{"/proc/sys/kernel/shmmni", "1024"},
{"/proc/sys/kernel/msgmax", "8192"},
{"/proc/sys/kernel/msgmni", "1024"},
{"/proc/sys/kernel/msgmnb", "1024"},
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
};
unsigned i;
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
write_file(sysctls[i].name, sysctls[i].value);
}

static int wait_for_loop(int pid) {
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, __WALL) != pid) {
}
return WEXITSTATUS(status);
}

static void drop_caps(void) {
struct __user_cap_header_struct cap_hdr = {};
struct __user_cap_data_struct cap_data[2] = {};
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
cap_hdr.pid = getpid();
if (syscall(SYS_capget, &cap_hdr, &cap_data))
exit(1);
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
cap_data[0].effective &= ~drop;
cap_data[0].permitted &= ~drop;
cap_data[0].inheritable &= ~drop;
if (syscall(SYS_capset, &cap_hdr, &cap_data))
exit(1);
}

static int do_sandbox_none(void) {
if (unshare(CLONE_NEWPID)) {
}
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
setup_common();
sandbox_common();
drop_caps();
if (unshare(CLONE_NEWNET)) {
}
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
setup_binderfs();
loop();
exit(1);
}

static void setup_binfmt_misc() {
if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) {
}
write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:");
write_file("/proc/sys/fs/binfmt_misc/register",
":syz1:M:1:\x02::./file0:POC");
}

uint64_t r[1] = {0xffffffffffffffff};

void loop(void) {
intptr_t res = 0;
memcpy((void*)0x200000c0, "./file0\000", 8);
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000c0ul, /*mode=*/0ul);
memcpy((void*)0x20000040, "mtd", 3);
sprintf((char*)0x20000043, "0x%016llx", (long long)0);
memcpy((void*)0x200000c0, "./file0\000", 8);
memcpy((void*)0x20001200, "jffs2\000", 6);
syscall(__NR_mount, /*src=*/0x20000040ul, /*dst=*/0x200000c0ul,
/*type=*/0x20001200ul, /*flags=*/3ul, /*data=*/0ul);
memcpy((void*)0x20000380, "./file0/../file0\000", 17);
res = syscall(__NR_fspick, /*dfd=*/0xffffff9c, /*path=*/0x20000380ul,
/*flags=*/0ul);
if (res != -1)
r[0] = res;
syscall(__NR_fsconfig, /*fd=*/r[0], /*cmd=*/7ul, /*key=*/0ul, /*value=*/0ul,
/*aux=*/0ul);
}
int main(void) {
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
setup_binfmt_misc();
do_sandbox_none();
return 0;
}

=* repro.txt =*
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000040)=ANY=[@ANYBLOB='mtd', @ANYRESHEX=0x0],
&(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='jffs2\x00', 0x3,
0x0)
r0 = fspick(0xffffffffffffff9c, &(0x7f0000000380)='./file0/../file0\x00', 0x0)
fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0)

and see also in
https://gist.github.com/xrivendell7/2832a318a4c3bbad0bdeae8d268c4883

I hope it helps.
Best regards

Next message: Eric Biggers: "[PATCH 0/2] crypto: x86/sha256-ni - cleanup and optimization"
Previous message: Louis Chauvet: "Re: [PATCH 0/3] drm: Multiple documentation update"
In reply to: syzbot: "[syzbot] [jffs2?] KASAN: slab-use-after-free Read in jffs2_erase_pending_blocks"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]