[Syzkaller] KASAN: use-after-free Write in xfs_extent_busy_clear_one

```
==================================================================
BUG: KASAN: use-after-free in __rb_erase_augmented include/linux/rbtree_augmented.h:225 [inline]
BUG: KASAN: use-after-free in rb_erase+0x160/0x5d4 lib/rbtree.c:443
Write of size 8 at addr ffff0000c7acb000 by task kworker/1:1H/117

CPU: 1 PID: 117 Comm: kworker/1:1H Not tainted 5.10.0-00742-ga91a89a00d3f-dirty #1
Hardware name: linux,dummy-virt (DT)
Workqueue: xfs-log/sda xlog_ioend_work
Call trace:
 dump_backtrace+0x0/0x420 arch/arm64/kernel/stacktrace.c:132
 show_stack+0x30/0x3c arch/arm64/kernel/stacktrace.c:196
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1cc/0x240 lib/dump_stack.c:118
 print_address_description.constprop.0+0x28/0x4bc mm/kasan/report.c:382
 __kasan_report mm/kasan/report.c:542 [inline]
 kasan_report+0x110/0x1b0 mm/kasan/report.c:559
 check_memory_region_inline mm/kasan/generic.c:187 [inline]
 __asan_store8+0x9c/0xc0 mm/kasan/generic.c:253
 __rb_erase_augmented include/linux/rbtree_augmented.h:225 [inline]
 rb_erase+0x160/0x5d4 lib/rbtree.c:443
 xfs_extent_busy_clear_one+0x64/0x1e4 fs/xfs/xfs_extent_busy.c:517
 xfs_extent_busy_clear+0x28c/0x360 fs/xfs/xfs_extent_busy.c:569
 xlog_cil_committed+0x164/0x5e0 fs/xfs/xfs_log_cil.c:659
 xlog_cil_process_committed+0xc8/0x110 fs/xfs/xfs_log_cil.c:683
 xlog_state_do_iclog_callbacks+0x380/0x810 fs/xfs/xfs_log.c:2777
 xlog_state_do_callback+0x190/0x30c fs/xfs/xfs_log.c:2802
 xlog_state_done_syncing+0x228/0x444 fs/xfs/xfs_log.c:2855
 xlog_ioend_work+0x60/0xd0 fs/xfs/xfs_log.c:1308
 process_one_work+0x478/0xb54 kernel/workqueue.c:2280
 worker_thread+0x120/0x95c kernel/workqueue.c:2426
 kthread+0x20c/0x25c kernel/kthread.c:313
 ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1034

Allocated by task 7803:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 set_alloc_info mm/kasan/common.c:498 [inline]
 __kasan_kmalloc mm/kasan/common.c:530 [inline]
 __kasan_kmalloc.constprop.0+0xd4/0x130 mm/kasan/common.c:501
 kasan_kmalloc+0xc/0x1c mm/kasan/common.c:544
 __kmalloc+0x244/0x9d0 mm/slub.c:4024
 kmalloc include/linux/slab.h:568 [inline]
 kmem_alloc+0x144/0x340 fs/xfs/kmem.c:21
 kmem_zalloc fs/xfs/kmem.h:69 [inline]
 xfs_extent_busy_insert+0xa8/0x53c fs/xfs/xfs_extent_busy.c:36
 __xfs_free_extent+0x1d8/0x2e0 fs/xfs/libxfs/xfs_alloc.c:3327
 xfs_free_extent fs/xfs/libxfs/xfs_alloc.h:183 [inline]
 xfs_ag_extend_space+0x238/0x2c4 fs/xfs/libxfs/xfs_ag.c:540
 xfs_growfs_data_private.isra.0+0x5b0/0x6d4 fs/xfs/xfs_fsops.c:112
 xfs_growfs_data+0x268/0x35c fs/xfs/xfs_fsops.c:239
 xfs_file_ioctl+0x11f4/0x22e0 fs/xfs/xfs_ioctl.c:2274
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __arm64_sys_ioctl+0x12c/0x184 fs/ioctl.c:739
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155
 do_el0_svc+0x50/0x12c arch/arm64/kernel/syscall.c:217
 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683

Freed by task 117:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:48
 kasan_set_track+0x24/0x34 mm/kasan/common.c:56
 kasan_set_free_info+0x24/0x44 mm/kasan/generic.c:361
 __kasan_slab_free.part.0+0x114/0x1a0 mm/kasan/common.c:482
 __kasan_slab_free mm/kasan/common.c:488 [inline]
 kasan_slab_free+0x2c/0x40 mm/kasan/common.c:489
 slab_free_hook mm/slub.c:1569 [inline]
 slab_free_freelist_hook mm/slub.c:1608 [inline]
 slab_free mm/slub.c:3179 [inline]
 kfree+0x12c/0xc40 mm/slub.c:4176
 kvfree+0x60/0x70 mm/util.c:647
 kmem_free fs/xfs/kmem.h:62 [inline]
 xfs_extent_busy_clear_one+0xe4/0x1e4 fs/xfs/xfs_extent_busy.c:521
 xfs_extent_busy_clear+0x28c/0x360 fs/xfs/xfs_extent_busy.c:569
 xlog_cil_committed+0x164/0x5e0 fs/xfs/xfs_log_cil.c:659
 xlog_cil_process_committed+0xc8/0x110 fs/xfs/xfs_log_cil.c:683
 xlog_state_do_iclog_callbacks+0x380/0x810 fs/xfs/xfs_log.c:2777
 xlog_state_do_callback+0x190/0x30c fs/xfs/xfs_log.c:2802
 xlog_state_done_syncing+0x228/0x444 fs/xfs/xfs_log.c:2855
 xlog_ioend_work+0x60/0xd0 fs/xfs/xfs_log.c:1308
 process_one_work+0x478/0xb54 kernel/workqueue.c:2280
 worker_thread+0x120/0x95c kernel/workqueue.c:2426
 kthread+0x20c/0x25c kernel/kthread.c:313
 ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1034

The buggy address belongs to the object at ffff0000c7acb000
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
 128-byte region [ffff0000c7acb000, ffff0000c7acb080)
The buggy address belongs to the page:
page:fffffe0002feb200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107ac8
head:fffffe0002feb200 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x17ffff800010200(slab|head|node=0|zone=2|lastcpupid=0xfffff)
raw: 017ffff800010200 fffffe0002e00708 fffffe000301c108 ffff0000c000c900
raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000c7acaf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000c7acaf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000c7acb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000c7acb080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000c7acb100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
```

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识