Re: [syzbot] [f2fs?] KASAN: slab-use-after-free Read in f2fs_filemap_fault

[Jaegeuk Kim]

On 03/12, Ed Tsai (蔡宗軒) wrote:
> On Mon, 2024-01-15 at 20:05 +0800, Hillf Danton wrote:
> > 
> > ...
> > 
> > --- x/fs/f2fs/file.c
> > +++ y/fs/f2fs/file.c
> > @@ -39,6 +39,7 @@
> >  static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
> >  {
> >         struct inode *inode = file_inode(vmf->vma->vm_file);
> > +       vm_flags_t flags = vmf->vma->vm_flags;
> >         vm_fault_t ret;
> >  
> >         ret = filemap_fault(vmf);
> > @@ -46,7 +47,7 @@ static vm_fault_t f2fs_filemap_fault(str
> >                 f2fs_update_iostat(F2FS_I_SB(inode), inode,
> >                                         APP_MAPPED_READ_IO,
> > F2FS_BLKSIZE);
> >  
> > -       trace_f2fs_filemap_fault(inode, vmf->pgoff, vmf->vma-
> > >vm_flags, ret);
> > +       trace_f2fs_filemap_fault(inode, vmf->pgoff, flags, ret);
> >  
> >         return ret;
> >  }
> > --
> 
> Hi Jaegeuk,
> 
> We recently encountered this slabe-use-after-free issue in KASAN as
> well. Could you please review the patch above and merge it into f2fs?

Where is the patch?

> 
> Best,
> Ed
> 
> ==================================================================
> [29195.369964][T31720] BUG: KASAN: slab-use-after-free in
> f2fs_filemap_fault+0x50/0xe0
> [29195.370971][T31720] Read at addr f7ffff80454ebde0 by task AsyncTask
> #11/31720
> [29195.371881][T31720] Pointer tag: [f7], memory tag: [f1]
> [29195.372549][T31720] 
> [29195.372838][T31720] CPU: 2 PID: 31720 Comm: AsyncTask #11 Tainted:
> G        W  OE      6.6.17-android15-0-gcb5ba718a525 #1
> [29195.374862][T31720] Call trace:
> [29195.375268][T31720]  dump_backtrace+0xec/0x138
> [29195.375848][T31720]  show_stack+0x18/0x24
> [29195.376365][T31720]  dump_stack_lvl+0x50/0x6c
> [29195.376943][T31720]  print_report+0x1b0/0x714
> [29195.377520][T31720]  kasan_report+0xc4/0x124
> [29195.378076][T31720]  __do_kernel_fault+0xb8/0x26c
> [29195.378694][T31720]  do_bad_area+0x30/0xdc
> [29195.379226][T31720]  do_tag_check_fault+0x20/0x34
> [29195.379834][T31720]  do_mem_abort+0x58/0x104
> [29195.380388][T31720]  el1_abort+0x3c/0x5c
> [29195.380899][T31720]  el1h_64_sync_handler+0x54/0x90
> [29195.381529][T31720]  el1h_64_sync+0x68/0x6c
> [29195.382069][T31720]  f2fs_filemap_fault+0x50/0xe0
> [29195.382678][T31720]  __do_fault+0xc8/0xfc
> [29195.383209][T31720]  handle_mm_fault+0xb44/0x10c4
> [29195.383816][T31720]  do_page_fault+0x294/0x48c
> [29195.384395][T31720]  do_translation_fault+0x38/0x54
> [29195.385023][T31720]  do_mem_abort+0x58/0x104
> [29195.385577][T31720]  el0_da+0x44/0x78
> [29195.386057][T31720]  el0t_64_sync_handler+0x98/0xbc
> [29195.386688][T31720]  el0t_64_sync+0x1a8/0x1ac
> [29195.387249][T31720] 
> [29195.387534][T31720] Allocated by task 14784:
> [29195.388085][T31720]  kasan_save_stack+0x40/0x70
> [29195.388672][T31720]  save_stack_info+0x34/0x128
> [29195.389259][T31720]  kasan_save_alloc_info+0x14/0x20
> [29195.389901][T31720]  __kasan_slab_alloc+0x168/0x174
> [29195.390530][T31720]  slab_post_alloc_hook+0x88/0x3a4
> [29195.391168][T31720]  kmem_cache_alloc+0x18c/0x2c8
> [29195.391771][T31720]  vm_area_alloc+0x2c/0xe8
> [29195.392327][T31720]  mmap_region+0x440/0xa94
> [29195.392888][T31720]  do_mmap+0x3d0/0x524
> [29195.393399][T31720]  vm_mmap_pgoff+0x1a0/0x1f8
> [29195.393980][T31720]  ksys_mmap_pgoff+0x78/0xf4
> [29195.394557][T31720]  __arm64_sys_mmap+0x34/0x44
> [29195.395138][T31720]  invoke_syscall+0x58/0x114
> [29195.395727][T31720]  el0_svc_common+0x80/0xe0
> [29195.396292][T31720]  do_el0_svc+0x1c/0x28
> [29195.396812][T31720]  el0_svc+0x38/0x68
> [29195.397302][T31720]  el0t_64_sync_handler+0x68/0xbc
> [29195.397932][T31720]  el0t_64_sync+0x1a8/0x1ac
> [29195.398492][T31720] 
> [29195.398778][T31720] Freed by task 0:
> [29195.399240][T31720]  kasan_save_stack+0x40/0x70
> [29195.399825][T31720]  save_stack_info+0x34/0x128
> [29195.400412][T31720]  kasan_save_free_info+0x18/0x28
> [29195.401043][T31720]  ____kasan_slab_free+0x254/0x25c
> [29195.401682][T31720]  __kasan_slab_free+0x10/0x20
> [29195.402278][T31720]  slab_free_freelist_hook+0x174/0x1e0
> [29195.402961][T31720]  kmem_cache_free+0xc4/0x348
> [29195.403544][T31720]  __vm_area_free+0x84/0xa4
> [29195.404103][T31720]  vm_area_free_rcu_cb+0x10/0x20
> [29195.404719][T31720]  rcu_do_batch+0x214/0x720
> [29195.405284][T31720]  rcu_core+0x1b0/0x408
> [29195.405800][T31720]  rcu_core_si+0x10/0x20
> [29195.406348][T31720]  __do_softirq+0x120/0x3f4
> [29195.406907][T31720] 
> [29195.407191][T31720] The buggy address belongs to the object at
> ffffff80454ebdc0
> [29195.407191][T31720]  which belongs to the cache vm_area_struct of
> size 176
> [29195.408978][T31720] The buggy address is located 32 bytes inside of
> [29195.408978][T31720]  176-byte region [ffffff80454ebdc0,
> ffffff80454ebe70)
> [29195.410625][T31720] 
> [29195.410911][T31720] The buggy address belongs to the physical page:
> [29195.411709][T31720] page:0000000058f0f2f1 refcount:1 mapcount:0
> mapping:0000000000000000 index:0x0 pfn:0xc54eb
> [29195.412980][T31720] anon flags:
> 0x4000000000000800(slab|zone=1|kasantag=0x0)
> [29195.413880][T31720] page_type: 0xffffffff()
> [29195.414418][T31720] raw: 4000000000000800 f6ffff8002904500
> fffffffe076fc8c0 dead000000000007
> [29195.415488][T31720] raw: 0000000000000000 0000000000170017
> 00000001ffffffff 0000000000000000