Hi Kernel Maintainers, Our tool found a kernel bug KASAN: slab-use-after-free in hfsplus_bnode_read. Please see the details below. Kernel commit: v6.9 (Commits on May 12, 2024) Kernel config: attachment C/Syz reproducer: attachment Please let me know for anything I can help. Best, Shuangpeng [ 64.430573][ T8067] ================================================================== [ 64.437558][ T8067] BUG: KASAN: slab-use-after-free in hfsplus_bnode_read (fs/hfsplus/bnode.c:32) [ 64.440771][ T8067] Read of size 8 at addr ffff88814a21e208 by task a.out/8067 [ 64.441604][ T8067] [ 64.441876][ T8067] CPU: 1 PID: 8067 Comm: a.out Not tainted 6.9.0 #7 [ 64.443191][ T8067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 64.445530][ T8067] Call Trace: [ 64.446372][ T8067] <TASK> [ 64.447125][ T8067] dump_stack_lvl (lib/dump_stack.c:117) [ 64.448268][ T8067] print_report (mm/kasan/report.c:378 mm/kasan/report.c:488) [ 64.449345][ T8067] ? __phys_addr (arch/x86/mm/physaddr.c:32 (discriminator 4)) [ 64.450449][ T8067] ? hfsplus_bnode_read (fs/hfsplus/bnode.c:32) [ 64.451713][ T8067] kasan_report (mm/kasan/report.c:603) [ 64.454026][ T8067] ? hfsplus_bnode_read (fs/hfsplus/bnode.c:32) [ 64.455161][ T8067] hfsplus_bnode_read (fs/hfsplus/bnode.c:32) [ 64.456458][ T8067] hfsplus_bnode_dump (fs/hfsplus/bnode.c:322) [ 64.457542][ T8067] ? __pfx_hfsplus_bnode_dump (fs/hfsplus/bnode.c:292) [ 64.458768][ T8067] ? hfsplus_bnode_write_u16 (fs/hfsplus/bnode.c:95) [ 64.459964][ T8067] ? hfsplus_bnode_move (fs/hfsplus/bnode.c:182) [ 64.461109][ T8067] ? __pfx___hfsplus_brec_find (fs/hfsplus/bfind.c:116) [ 64.462370][ T8067] ? __mark_inode_dirty (fs/fs-writeback.c:2499) [ 64.463512][ T8067] hfsplus_brec_remove (fs/hfsplus/brec.c:230) [ 64.464631][ T8067] __hfsplus_delete_attr (fs/hfsplus/attributes.c:300) [ 64.465941][ T8067] ? __pfx_hfs_find_1st_rec_by_cnid (fs/hfsplus/bfind.c:59) [ 64.467596][ T8067] ? __pfx___hfsplus_delete_attr (fs/hfsplus/attributes.c:268) [ 64.469176][ T8067] ? __sanitizer_cov_trace_switch (kernel/kcov.c:340 (discriminator 3)) [ 64.470515][ T8067] hfsplus_delete_all_attrs (fs/hfsplus/attributes.c:379) [ 64.471810][ T8067] ? __pfx_hfsplus_delete_all_attrs (fs/hfsplus/attributes.c:355) [ 64.473199][ T8067] ? __mark_inode_dirty (fs/fs-writeback.c:2499) [ 64.474417][ T8067] hfsplus_delete_cat (fs/hfsplus/catalog.c:425) [ 64.475594][ T8067] ? __pfx_hfsplus_delete_cat (fs/hfsplus/catalog.c:331) [ 64.477195][ T8067] ? avc_lookup (security/selinux/avc.c:567) [ 64.478203][ T8067] ? __pfx_mutex_lock (kernel/locking/mutex.c:282) [ 64.479313][ T8067] ? __pfx_selinux_inode_permission (security/selinux/hooks.c:3096) [ 64.480721][ T8067] hfsplus_unlink (fs/hfsplus/dir.c:386) [ 64.481697][ T8067] ? __pfx_hfsplus_unlink (fs/hfsplus/dir.c:359) [ 64.482655][ T8067] ? __pfx_selinux_inode_rename (security/selinux/hooks.c:3052) [ 64.483719][ T8067] ? down_write (./arch/x86/include/asm/preempt.h:103 kernel/locking/rwsem.c:1309 kernel/locking/rwsem.c:1315 kernel/locking/rwsem.c:1580) [ 64.484549][ T8067] ? __pfx_down_write (kernel/locking/rwsem.c:1577) [ 64.485462][ T8067] hfsplus_rename (fs/hfsplus/dir.c:547) [ 64.486340][ T8067] ? __pfx_hfsplus_rename (fs/hfsplus/dir.c:536) [ 64.487306][ T8067] vfs_rename (fs/namei.c:4882) [ 64.488171][ T8067] ? __pfx_vfs_rename (fs/namei.c:4760) [ 64.489092][ T8067] ? _raw_spin_unlock (./arch/x86/include/asm/preempt.h:103 ./include/linux/spinlock_api_smp.h:143 kernel/locking/spinlock.c:186) [ 64.489989][ T8067] ? security_path_rename (security/security.c:1920) [ 64.490991][ T8067] do_renameat2 (fs/namei.c:5037) [ 64.491839][ T8067] ? __pfx_do_renameat2 (fs/namei.c:4921) [ 64.492745][ T8067] ? security_file_free (security/security.c:2747) [ 64.493662][ T8067] ? preempt_count_add (./include/linux/ftrace.h:974 kernel/sched/core.c:5852 kernel/sched/core.c:5849 kernel/sched/core.c:5877) [ 64.494514][ T8067] ? __phys_addr_symbol (arch/x86/mm/physaddr.c:42 (discriminator 2)) [ 64.495369][ T8067] ? strncpy_from_user (lib/strncpy_from_user.c:145) [ 64.496307][ T8067] __x64_sys_rename (fs/namei.c:5082) [ 64.497234][ T8067] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 64.498156][ T8067] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 64.499321][ T8067] RIP: 0033:0x7f9b7d26e73d [ 64.500284][ T8067] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 78 All code ======== 0: 00 c3 add %al,%bl 2: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 9: 00 00 00 c: 90 nop d: f3 0f 1e fa endbr64 11: 48 89 f8 mov %rdi,%rax 14: 48 89 f7 mov %rsi,%rdi 17: 48 89 d6 mov %rdx,%rsi 1a: 48 89 ca mov %rcx,%rdx 1d: 4d 89 c2 mov %r8,%r10 20: 4d 89 c8 mov %r9,%r8 23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9 28: 0f 05 syscall 2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 78 .byte 0x78 Code starting with the faulting instruction =========================================== 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax 6: 78 .byte 0x78 [ 64.504419][ T8067] RSP: 002b:00007ffc6ae0d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 64.506221][ T8067] RAX: ffffffffffffffda RBX: 000056463a55c410 RCX: 00007f9b7d26e73d [ 64.507926][ T8067] RDX: 0031656c69662f2e RSI: 00000000200001c0 RDI: 0000000020000180 [ 64.509611][ T8067] RBP: 00007ffc6ae0d940 R08: 0000000000000000 R09: 00007ffc6ae0d970 [ 64.511078][ T8067] R10: 00007ffc6ae0d810 R11: 0000000000000246 R12: 000056463a55a480 [ 64.512509][ T8067] R13: 00007ffc6ae0da70 R14: 0000000000000000 R15: 0000000000000000 [ 64.513878][ T8067] </TASK> [ 64.514442][ T8067] [ 64.514875][ T8067] Allocated by task 6003: [ 64.515673][ T8067] kasan_save_stack (mm/kasan/common.c:48) [ 64.516553][ T8067] kasan_save_track (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) [ 64.517421][ T8067] __kasan_kmalloc (mm/kasan/common.c:370 mm/kasan/common.c:387) [ 64.518285][ T8067] kernfs_fop_open (fs/kernfs/file.c:526 fs/kernfs/file.c:700) [ 64.519166][ T8067] do_dentry_open (fs/open.c:956) [ 64.520075][ T8067] path_openat (fs/namei.c:3643 fs/namei.c:3799) [ 64.520933][ T8067] do_filp_open (fs/namei.c:3827) [ 64.521761][ T8067] do_sys_openat2 (fs/open.c:1407) [ 64.522631][ T8067] __x64_sys_openat (fs/open.c:1432) [ 64.523518][ T8067] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 64.524462][ T8067] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 64.525814][ T8067] [ 64.526347][ T8067] Freed by task 773: [ 64.527195][ T8067] kasan_save_stack (mm/kasan/common.c:48) [ 64.528155][ T8067] kasan_save_track (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) [ 64.529066][ T8067] kasan_save_free_info (mm/kasan/generic.c:582) [ 64.530143][ T8067] poison_slab_object (mm/kasan/common.c:240 mm/kasan/common.c:211) [ 64.531271][ T8067] __kasan_slab_free (mm/kasan/common.c:256) [ 64.532332][ T8067] kmem_cache_free_bulk (mm/slub.c:2140 mm/slub.c:4299 mm/slub.c:4513 mm/slub.c:4501) [ 64.533668][ T8067] kvfree_rcu_bulk (./include/linux/slab.h:546 kernel/rcu/tree.c:3033) [ 64.534708][ T8067] kfree_rcu_work (kernel/rcu/tree.c:3111) [ 64.535665][ T8067] process_one_work (kernel/workqueue.c:3272) [ 64.536600][ T8067] worker_thread (kernel/workqueue.c:3342 kernel/workqueue.c:3429) [ 64.537446][ T8067] kthread (kernel/kthread.c:388) [ 64.538188][ T8067] ret_from_fork (arch/x86/kernel/process.c:153) [ 64.538982][ T8067] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) [ 64.539877][ T8067] [ 64.540300][ T8067] Last potentially related work creation: [ 64.541329][ T8067] kasan_save_stack (mm/kasan/common.c:48) [ 64.542070][ T8067] __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 64.542847][ T8067] kvfree_call_rcu (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:67 ./arch/x86/include/asm/irqflags.h:103 kernel/rcu/tree.c:2958 kernel/rcu/tree.c:3359 kernel/rcu/tree.c:3444) [ 64.543517][ T8067] kernfs_unlink_open_file (fs/kernfs/file.c:586 (discriminator 4)) [ 64.544311][ T8067] kernfs_fop_release (fs/kernfs/file.c:766) [ 64.545016][ T8067] __fput (fs/file_table.c:423) [ 64.545595][ T8067] __fput_sync (fs/file_table.c:508) [ 64.546205][ T8067] __x64_sys_close (fs/open.c:1559 fs/open.c:1541 fs/open.c:1541) [ 64.546880][ T8067] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 64.547547][ T8067] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 64.548439][ T8067] [ 64.548771][ T8067] The buggy address belongs to the object at ffff88814a21e200 [ 64.548771][ T8067] which belongs to the cache kmalloc-96 of size 96 [ 64.550693][ T8067] The buggy address is located 8 bytes inside of [ 64.550693][ T8067] freed 96-byte region [ffff88814a21e200, ffff88814a21e260) [ 64.552572][ T8067] [ 64.552894][ T8067] The buggy address belongs to the physical page: [ 64.553785][ T8067] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a21e [ 64.554992][ T8067] anon flags: 0x57ff00000000800(slab|node=1|zone=2|lastcpupid=0x7ff) [ 64.556305][ T8067] page_type: 0xffffffff() [ 64.557209][ T8067] raw: 057ff00000000800 ffff888011c41780 ffffea00052f6340 dead000000000005 [ 64.559204][ T8067] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 64.560953][ T8067] page dumped because: kasan: bad access detected [ 64.562281][ T8067] page_owner tracks the page as allocated [ 64.563443][ T8067] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 20193864540 [ 64.566911][ T8067] post_alloc_hook (./include/linux/page_owner.h:32 mm/page_alloc.c:1534) [ 64.567974][ T8067] get_page_from_freelist (mm/page_alloc.c:1543 mm/page_alloc.c:3317) [ 64.569143][ T8067] __alloc_pages (mm/page_alloc.c:4576) [ 64.570134][ T8067] allocate_slab (mm/slub.c:2181 mm/slub.c:2343) [ 64.571066][ T8067] ___slab_alloc (mm/slub.c:3531) [ 64.572051][ T8067] __slab_alloc.constprop.0 (mm/slub.c:3615) [ 64.573174][ T8067] kmalloc_trace (mm/slub.c:3668 mm/slub.c:3841 mm/slub.c:3998) [ 64.574120][ T8067] get_device_parent (drivers/base/core.c:3255 drivers/base/core.c:3314) [ 64.575207][ T8067] device_add (drivers/base/core.c:3645) [ 64.576185][ T8067] device_create_groups_vargs (drivers/base/core.c:4413) [ 64.577391][ T8067] device_create (drivers/base/core.c:4454) [ 64.578345][ T8067] mon_bin_add (drivers/usb/mon/mon_bin.c:1374 (discriminator 4)) [ 64.579280][ T8067] mon_bus_init (drivers/usb/mon/mon_main.c:291) [ 64.580257][ T8067] mon_notify (drivers/usb/mon/mon_main.c:189 drivers/usb/mon/mon_main.c:219) [ 64.581198][ T8067] notifier_call_chain (kernel/notifier.c:95) [ 64.582285][ T8067] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 64.583480][ T8067] page_owner free stack trace missing [ 64.584652][ T8067] [ 64.585149][ T8067] Memory state around the buggy address: [ 64.586318][ T8067] ffff88814a21e100: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 64.587984][ T8067] ffff88814a21e180: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 64.589761][ T8067] >ffff88814a21e200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 64.591498][ T8067] ^ [ 64.592455][ T8067] ffff88814a21e280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 64.594123][ T8067] ffff88814a21e300: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 64.595879][ T8067] ================================================================== [ 64.611805][ T8067] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 64.613464][ T8067] CPU: 1 PID: 8067 Comm: a.out Not tainted 6.9.0 #7 [ 64.614916][ T8067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 64.616894][ T8067] Call Trace: [ 64.617606][ T8067] <TASK> [ 64.618238][ T8067] dump_stack_lvl (lib/dump_stack.c:118 (discriminator 4)) [ 64.619263][ T8067] panic (kernel/panic.c:348) [ 64.620170][ T8067] ? __pfx_panic (kernel/panic.c:282) [ 64.621147][ T8067] ? preempt_schedule_thunk (arch/x86/entry/thunk_64.S:12) [ 64.622329][ T8067] ? preempt_schedule_common (./arch/x86/include/asm/preempt.h:84 kernel/sched/core.c:6927) [ 64.623551][ T8067] ? check_panic_on_warn (kernel/panic.c:240) [ 64.624663][ T8067] ? hfsplus_bnode_read (fs/hfsplus/bnode.c:32) [ 64.625777][ T8067] check_panic_on_warn (kernel/panic.c:241) [ 64.626850][ T8067] end_report (mm/kasan/report.c:226) [ 64.627815][ T8067] kasan_report (./arch/x86/include/asm/smap.h:56 mm/kasan/report.c:606) [ 64.628749][ T8067] ? hfsplus_bnode_read (fs/hfsplus/bnode.c:32) [ 64.629838][ T8067] hfsplus_bnode_read (fs/hfsplus/bnode.c:32) [ 64.630907][ T8067] hfsplus_bnode_dump (fs/hfsplus/bnode.c:322) [ 64.632056][ T8067] ? __pfx_hfsplus_bnode_dump (fs/hfsplus/bnode.c:292) [ 64.633228][ T8067] ? hfsplus_bnode_write_u16 (fs/hfsplus/bnode.c:95) [ 64.634372][ T8067] ? hfsplus_bnode_move (fs/hfsplus/bnode.c:182) [ 64.635470][ T8067] ? __pfx___hfsplus_brec_find (fs/hfsplus/bfind.c:116) [ 64.636722][ T8067] ? __mark_inode_dirty (fs/fs-writeback.c:2499) [ 64.637863][ T8067] hfsplus_brec_remove (fs/hfsplus/brec.c:230) [ 64.638970][ T8067] __hfsplus_delete_attr (fs/hfsplus/attributes.c:300) [ 64.640185][ T8067] ? __pfx_hfs_find_1st_rec_by_cnid (fs/hfsplus/bfind.c:59) [ 64.641540][ T8067] ? __pfx___hfsplus_delete_attr (fs/hfsplus/attributes.c:268) [ 64.642821][ T8067] ? __sanitizer_cov_trace_switch (kernel/kcov.c:340 (discriminator 3)) [ 64.644083][ T8067] hfsplus_delete_all_attrs (fs/hfsplus/attributes.c:379) [ 64.645289][ T8067] ? __pfx_hfsplus_delete_all_attrs (fs/hfsplus/attributes.c:355) [ 64.646670][ T8067] ? __mark_inode_dirty (fs/fs-writeback.c:2499) [ 64.647805][ T8067] hfsplus_delete_cat (fs/hfsplus/catalog.c:425) [ 64.648842][ T8067] ? __pfx_hfsplus_delete_cat (fs/hfsplus/catalog.c:331) [ 64.650020][ T8067] ? avc_lookup (security/selinux/avc.c:567) [ 64.650980][ T8067] ? __pfx_mutex_lock (kernel/locking/mutex.c:282) [ 64.652044][ T8067] ? __pfx_selinux_inode_permission (security/selinux/hooks.c:3096) [ 64.653331][ T8067] hfsplus_unlink (fs/hfsplus/dir.c:386) [ 64.654323][ T8067] ? __pfx_hfsplus_unlink (fs/hfsplus/dir.c:359) [ 64.655423][ T8067] ? __pfx_selinux_inode_rename (security/selinux/hooks.c:3052) [ 64.656647][ T8067] ? down_write (./arch/x86/include/asm/preempt.h:103 kernel/locking/rwsem.c:1309 kernel/locking/rwsem.c:1315 kernel/locking/rwsem.c:1580) [ 64.657573][ T8067] ? __pfx_down_write (kernel/locking/rwsem.c:1577) [ 64.658605][ T8067] hfsplus_rename (fs/hfsplus/dir.c:547) [ 64.659602][ T8067] ? __pfx_hfsplus_rename (fs/hfsplus/dir.c:536) [ 64.660787][ T8067] vfs_rename (fs/namei.c:4882) [ 64.661798][ T8067] ? __pfx_vfs_rename (fs/namei.c:4760) [ 64.662812][ T8067] ? _raw_spin_unlock (./arch/x86/include/asm/preempt.h:103 ./include/linux/spinlock_api_smp.h:143 kernel/locking/spinlock.c:186) [ 64.663875][ T8067] ? security_path_rename (security/security.c:1920) [ 64.664966][ T8067] do_renameat2 (fs/namei.c:5037) [ 64.665897][ T8067] ? __pfx_do_renameat2 (fs/namei.c:4921) [ 64.666924][ T8067] ? security_file_free (security/security.c:2747) [ 64.667996][ T8067] ? preempt_count_add (./include/linux/ftrace.h:974 kernel/sched/core.c:5852 kernel/sched/core.c:5849 kernel/sched/core.c:5877) [ 64.669040][ T8067] ? __phys_addr_symbol (arch/x86/mm/physaddr.c:42 (discriminator 2)) [ 64.670105][ T8067] ? strncpy_from_user (lib/strncpy_from_user.c:145) [ 64.671224][ T8067] __x64_sys_rename (fs/namei.c:5082) [ 64.672191][ T8067] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 64.673124][ T8067] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 64.674368][ T8067] RIP: 0033:0x7f9b7d26e73d [ 64.675354][ T8067] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 78 All code ======== 0: 00 c3 add %al,%bl 2: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 9: 00 00 00 c: 90 nop d: f3 0f 1e fa endbr64 11: 48 89 f8 mov %rdi,%rax 14: 48 89 f7 mov %rsi,%rdi 17: 48 89 d6 mov %rdx,%rsi 1a: 48 89 ca mov %rcx,%rdx 1d: 4d 89 c2 mov %r8,%r10 20: 4d 89 c8 mov %r9,%r8 23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9 28: 0f 05 syscall 2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 78 .byte 0x78 Code starting with the faulting instruction =========================================== 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax 6: 78 .byte 0x78 [ 64.679398][ T8067] RSP: 002b:00007ffc6ae0d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 64.681121][ T8067] RAX: ffffffffffffffda RBX: 000056463a55c410 RCX: 00007f9b7d26e73d [ 64.682737][ T8067] RDX: 0031656c69662f2e RSI: 00000000200001c0 RDI: 0000000020000180 [ 64.684367][ T8067] RBP: 00007ffc6ae0d940 R08: 0000000000000000 R09: 00007ffc6ae0d970 [ 64.685970][ T8067] R10: 00007ffc6ae0d810 R11: 0000000000000246 R12: 000056463a55a480 [ 64.687638][ T8067] R13: 00007ffc6ae0da70 R14: 0000000000000000 R15: 0000000000000000 [ 64.689293][ T8067] </TASK> [ 64.690111][ T8067] Kernel Offset: disabled [ 64.691070][ T8067] Rebooting in 86400 seconds..
Attachment:
repro.c
Description: Binary data
Attachment:
.config
Description: Binary data
