Kernel BUG: KASAN: use-after-free Read in poly1305_core_blocks

[Haichi Wang <wanghaichi@xxxxxxxxxx>]

Dear Linux maintainers and reviewers:
We are reporting a Linux kernel bug titled **KASAN: use-after-free Read in poly1305_core_blocks**, discovered using a modified version of Syzkaller.


### Affected Files
The affected files, as obtained from the VM log, are listed below. The corresponding maintainers were identified using `./scripts/get_maintainer.pl`:
donna64.c
arch/x86/entry/common.c
fs/bcachefs/btree_io.c
fs/bcachefs/fs.c
fs/namespace.c
fs/super.c
lib/dump_stack.c
crypto/poly1305_generic.c
fs/bcachefs/checksum.c
fs/bcachefs/recovery.c
fs/bcachefs/super.c
mm/kasan/report.c


### Kernel Versions
- **Kernel Version Tested:** v6.12-rc6:59b723cd2adbac2a34fc8e12c74ae26ae45bf230
- **Latest Kernel Version Reproduced On:** f44d154d6e3d633d4c49a5d6a8aed0e4684ae25e


### Environment Details
- **QEMU Version:** QEMU emulator version 4.2.1 (Debian 1:4.2-3ubuntu6.29)  
- **GCC Version:** gcc (Ubuntu 11.4.0-2ubuntu1~20.04) 11.4.0  
- **Syzkaller Version:** 2b3ef1577cde5da4fd1f7ece079731e140351177




### Attached Files
We have attached the following files to assist in reproducing and diagnosing the bug:
- **Bug Title:** `bugtitle`  
- **Bug Report:** `report`  
- **Machine Information:** `machineInfo`  
- **Kernel Config:** `config`  
- **Compiled Kernel Image:** `vmlinux`  


- **C Reproducing Program:** `repro.c`  
- **VM Log for C Reproducer:** `vm_c.log`  


- **Syzkaller Reproducing Program:** `repro.txt`  
- **VM Log for Syzkaller Reproducer:** `vm_syz.log`




### Reproduction Instructions
To reproduce the bug, please follow the instructions below. For additional details, refer to [Syzkaller Reproducing Crashes Documentation](https://github.com/google/syzkaller/blob/master/docs/reproducing_crashes.md).


Feel free to email us if any other information are needed. Hope the provided materials will help finding and fixing the
bug.


We also provide a brief documentation for how to execute the reproducing program:




#### Prepare the Linux Kernel Image
1. Clone the Linux kernel repository and checkout the latest kernel version:  
   ```bash
   cd /path/to/linux
   git checkout f44d154d6e3d633d4c49a5d6a8aed0e4684ae25e
   cp /path/to/config /path/to/linux/.config
   make olddefconfig
   make -j$(nproc)
   ```


#### Prepare the Root Filesystem
Follow the setup instructions at [Setting Up Ubuntu Host QEMU VM](https://github.com/google/syzkaller/blob/master/docs/linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md). Ensure the root filesystem is prepared at `/path/to/rootfs`.


#### Start the Virtual Machine
Use the following QEMU command to start the VM:
```bash
# start vm
# Here port is set to 10099, change it as needed
qemu-system-x86_64 \
    -m 20G -qmp unix:/tmp/qmp-sock,server,nowait \
    -smp 2 \
    -kernel /path/to/linux/arch/x86/boot/bzImage\
    -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
    -drive file=/path/to/rootfs/bullseye.img,format=raw \
    -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10099-:22 \
    -net nic,model=e1000 \
    -enable-kvm \
    -nographic \
    -pidfile vm.pid \
    2>&1 | tee vm.log
```




#### Reproduce the Bug


- **For C Reproducing Program:**  
   1. Compile the reproducing program:  
      ```bash
      gcc -o repro repro.c
      ```
   2. Transfer the program to the VM and execute it:  
      ```bash
      scp -i /path/to/rootfs/bullseye.id_rsa -P 10099 -o "StrictHostKeyChecking no" repro root@localhost:/root/
      ssh -i /path/to/rootfs/bullseye.id_rsa -p 10099 -o "StrictHostKeyChecking no" root@localhost
      cd /root && ./repro
      ```


  - **For Syzkaller Reproducing Program:**  
     1. Install Syzkaller ([Setup Guide](https://github.com/google/syzkaller/blob/master/docs/linux/setup.md#go-and-syzkaller)):  
        ```bash
        git clone https://github.com/google/syzkaller
        cd syzkaller
        make
        # if make command returns something like `cannot find package "github.com/google/syzkaller/` error, please run the following command, and try again
        # go env -w GO111MODULE=on
        ```
     2. Transfer the Syzkaller reproducing program and binary to the VM:  
        ```bash
        scp -i /path/to/rootfs/bullseye.id_rsa -P 10099 -o "StrictHostKeyChecking no" -r /path/to/repro.txt root@localhost:/root/
        scp -i /path/to/rootfs/bullseye.id_rsa -P 10099 -o "StrictHostKeyChecking no" -r /path/to/syzkaller/bin/linux_amd64/* root@localhost:/root/
        ssh -i /path/to/rootfs/bullseye.id_rsa -p 10099 -o "StrictHostKeyChecking no" root@localhost
        cd root && ./syz-execprog repro.txt
        ```


Feel free to reach out if additional information or clarifications are needed. We hope this report aids in identifying and fixing the bug.


Best regards,  


Haichi Wang


Tianjin University

从网易企业邮箱发来的云附件

d601c054034bd9f2c2971787e8c2648d1e95b642.7z
188.71M | 过期时间：2025年1月4日 13:29




下载