KASAN: use-after-free Read in ip6_tnl_start_xmit
6 views
Skip to first unread message
syzbot
Apr 12, 2019, 8:00:41 PM4/12/19
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 1c57ba4f FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_IN..
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=149239c6400000
kernel config: https://syzkaller.appspot.com/x/.config?x=ce644b18d115ba72
dashboard link: https://syzkaller.appspot.com/bug?extid=a66eef71da2de8fdfe19
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17aec0e9400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1611eb11400000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a66eef...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in ipv6_get_dsfield include/net/dsfield.h:23
[inline]
BUG: KASAN: use-after-free in ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1362
[inline]
BUG: KASAN: use-after-free in ip6_tnl_start_xmit+0x14db/0x1680
net/ipv6/ip6_tunnel.c:1389
Read of size 2 at addr ffff8801c9a51298 by task syz-executor017/2489
CPU: 1 PID: 2489 Comm: syz-executor017 Not tainted 4.9.128+ #45
ffff8801c9ab7048 ffffffff81af2469 ffffea0007269400 ffff8801c9a51298
0000000000000000 ffff8801c9a51298 ffff8801c9a51298 ffff8801c9ab7080
ffffffff814e13cb ffff8801c9a51298 0000000000000002 0000000000000000
Call Trace:
[<ffffffff81af2469>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81af2469>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff814e13cb>] print_address_description+0x6c/0x234
mm/kasan/report.c:256
[<ffffffff814e17d5>] kasan_report_error mm/kasan/report.c:355 [inline]
[<ffffffff814e17d5>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
[<ffffffff814d3bd4>] __asan_report_load2_noabort+0x14/0x20
mm/kasan/report.c:431
[<ffffffff82729c4b>] ipv6_get_dsfield include/net/dsfield.h:23 [inline]
[<ffffffff82729c4b>] ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1362 [inline]
[<ffffffff82729c4b>] ip6_tnl_start_xmit+0x14db/0x1680
net/ipv6/ip6_tunnel.c:1389
[<ffffffff82296f67>] __netdev_start_xmit include/linux/netdevice.h:4062
[inline]
[<ffffffff82296f67>] netdev_start_xmit include/linux/netdevice.h:4071
[inline]
[<ffffffff82296f67>] xmit_one net/core/dev.c:2955 [inline]
[<ffffffff82296f67>] dev_hard_start_xmit+0x197/0x8b0 net/core/dev.c:2971
[<ffffffff82298abf>] __dev_queue_xmit+0x117f/0x1b90 net/core/dev.c:3451
[<ffffffff822994e7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3484
[<ffffffff822b1275>] neigh_direct_output+0x15/0x20
net/core/neighbour.c:1362
[<ffffffff82609ece>] dst_neigh_output include/net/dst.h:470 [inline]
[<ffffffff82609ece>] ip6_finish_output2+0xb0e/0x1d10
net/ipv6/ip6_output.c:119
[<ffffffff8261aa84>] ip6_finish_output+0x334/0x980
net/ipv6/ip6_output.c:145
[<ffffffff8261b2ba>] NF_HOOK_COND include/linux/netfilter.h:246 [inline]
[<ffffffff8261b2ba>] ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
[<ffffffff8273507b>] dst_output include/net/dst.h:507 [inline]
[<ffffffff8273507b>] ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
[<ffffffff8261d4a1>] ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1753
[<ffffffff8267ea33>] udp_v6_send_skb+0x843/0xe70 net/ipv6/udp.c:974
[<ffffffff8267f28d>] udp_v6_push_pending_frames+0x22d/0x340
net/ipv6/udp.c:1007
[<ffffffff82681241>] udpv6_sendmsg+0x1dc1/0x2430 net/ipv6/udp.c:1273
[<ffffffff82512b43>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
[<ffffffff8222530b>] sock_sendmsg_nosec net/socket.c:648 [inline]
[<ffffffff8222530b>] sock_sendmsg+0xbb/0x110 net/socket.c:658
[<ffffffff82225583>] sock_write_iter+0x223/0x3b0 net/socket.c:856
[<ffffffff814e8d57>] new_sync_write fs/read_write.c:496 [inline]
[<ffffffff814e8d57>] __vfs_write+0x3d7/0x580 fs/read_write.c:509
[<ffffffff814eb5a7>] vfs_write+0x187/0x520 fs/read_write.c:557
[<ffffffff814ef3d9>] SYSC_write fs/read_write.c:604 [inline]
[<ffffffff814ef3d9>] SyS_write+0xd9/0x1c0 fs/read_write.c:596
[<ffffffff81005fd1>] do_syscall_32_irqs_on arch/x86/entry/common.c:325
[inline]
[<ffffffff81005fd1>] do_fast_syscall_32+0x2f1/0x860
arch/x86/entry/common.c:387
[<ffffffff8278f460>] entry_SYSENTER_compat+0x90/0xa2
arch/x86/entry/entry_64_compat.S:137
Allocated by task 2489:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack mm/kasan/kasan.c:505 [inline]
set_track mm/kasan/kasan.c:517 [inline]
kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609
kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
slab_post_alloc_hook mm/slab.h:417 [inline]
slab_alloc_node mm/slub.c:2715 [inline]
slab_alloc mm/slub.c:2723 [inline]
__kmalloc_track_caller+0xf0/0x2d0 mm/slub.c:4232
__kmalloc_reserve.isra.5+0x33/0xc0 net/core/skbuff.c:138
__alloc_skb+0x11a/0x5b0 net/core/skbuff.c:231
alloc_skb include/linux/skbuff.h:919 [inline]
alloc_skb_with_frags+0xaf/0x4e0 net/core/skbuff.c:4685
sock_alloc_send_pskb+0x59e/0x740 net/core/sock.c:1893
sock_alloc_send_skb+0x32/0x40 net/core/sock.c:1910
__ip6_append_data.isra.3+0x1fd2/0x3460 net/ipv6/ip6_output.c:1487
ip6_append_data+0x1c1/0x2f0 net/ipv6/ip6_output.c:1647
udpv6_sendmsg+0x88b/0x2430 net/ipv6/udp.c:1267
inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
sock_sendmsg_nosec net/socket.c:648 [inline]
sock_sendmsg+0xbb/0x110 net/socket.c:658
SYSC_sendto net/socket.c:1683 [inline]
SyS_sendto+0x220/0x370 net/socket.c:1651
do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
do_fast_syscall_32+0x2f1/0x860 arch/x86/entry/common.c:387
entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137
Freed by task 2489:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack mm/kasan/kasan.c:505 [inline]
set_track mm/kasan/kasan.c:517 [inline]
kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582
slab_free_hook mm/slub.c:1355 [inline]
slab_free_freelist_hook mm/slub.c:1377 [inline]
slab_free mm/slub.c:2958 [inline]
kfree+0xfb/0x310 mm/slub.c:3878
skb_free_head+0x8b/0xb0 net/core/skbuff.c:580
pskb_expand_head+0x457/0x8a0 net/core/skbuff.c:1246
skb_header_unclone include/linux/skbuff.h:1359 [inline]
iptunnel_handle_offloads+0x3f0/0x520 net/ipv4/ip_tunnel_core.c:169
ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1359 [inline]
ip6_tnl_start_xmit+0x4ca/0x1680 net/ipv6/ip6_tunnel.c:1389
__netdev_start_xmit include/linux/netdevice.h:4062 [inline]
netdev_start_xmit include/linux/netdevice.h:4071 [inline]
xmit_one net/core/dev.c:2955 [inline]
dev_hard_start_xmit+0x197/0x8b0 net/core/dev.c:2971
__dev_queue_xmit+0x117f/0x1b90 net/core/dev.c:3451
dev_queue_xmit+0x17/0x20 net/core/dev.c:3484
neigh_direct_output+0x15/0x20 net/core/neighbour.c:1362
dst_neigh_output include/net/dst.h:470 [inline]
ip6_finish_output2+0xb0e/0x1d10 net/ipv6/ip6_output.c:119
ip6_finish_output+0x334/0x980 net/ipv6/ip6_output.c:145
NF_HOOK_COND include/linux/netfilter.h:246 [inline]
ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
dst_output include/net/dst.h:507 [inline]
ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1753
udp_v6_send_skb+0x843/0xe70 net/ipv6/udp.c:974
udp_v6_push_pending_frames+0x22d/0x340 net/ipv6/udp.c:1007
udpv6_sendmsg+0x1dc1/0x2430 net/ipv6/udp.c:1273
inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
sock_sendmsg_nosec net/socket.c:648 [inline]
sock_sendmsg+0xbb/0x110 net/socket.c:658
sock_write_iter+0x223/0x3b0 net/socket.c:856
new_sync_write fs/read_write.c:496 [inline]
__vfs_write+0x3d7/0x580 fs/read_write.c:509
vfs_write+0x187/0x520 fs/read_write.c:557
SYSC_write fs/read_write.c:604 [inline]
SyS_write+0xd9/0x1c0 fs/read_write.c:596
do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
do_fast_syscall_32+0x2f1/0x860 arch/x86/entry/common.c:387
entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137
The buggy address belongs to the object at ffff8801c9a51200
which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 152 bytes inside of
1024-byte region [ffff8801c9a51200, ffff8801c9a51600)
The buggy address belongs to the page:
page:ffffea0007269400 count:1 mapcount:0 mapping: (null) index:0x0
compound_mapcount: 0
flags: 0x4000000000004080(slab|head)
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801c9a51180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801c9a51200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801c9a51280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801c9a51300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801c9a51380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following crash on:
HEAD commit: 1c57ba4f FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_IN..
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=149239c6400000
kernel config: https://syzkaller.appspot.com/x/.config?x=ce644b18d115ba72
dashboard link: https://syzkaller.appspot.com/bug?extid=a66eef71da2de8fdfe19
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17aec0e9400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1611eb11400000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a66eef...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in ipv6_get_dsfield include/net/dsfield.h:23
[inline]
BUG: KASAN: use-after-free in ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1362
[inline]
BUG: KASAN: use-after-free in ip6_tnl_start_xmit+0x14db/0x1680
net/ipv6/ip6_tunnel.c:1389
Read of size 2 at addr ffff8801c9a51298 by task syz-executor017/2489
CPU: 1 PID: 2489 Comm: syz-executor017 Not tainted 4.9.128+ #45
ffff8801c9ab7048 ffffffff81af2469 ffffea0007269400 ffff8801c9a51298
0000000000000000 ffff8801c9a51298 ffff8801c9a51298 ffff8801c9ab7080
ffffffff814e13cb ffff8801c9a51298 0000000000000002 0000000000000000
Call Trace:
[<ffffffff81af2469>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81af2469>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff814e13cb>] print_address_description+0x6c/0x234
mm/kasan/report.c:256
[<ffffffff814e17d5>] kasan_report_error mm/kasan/report.c:355 [inline]
[<ffffffff814e17d5>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
[<ffffffff814d3bd4>] __asan_report_load2_noabort+0x14/0x20
mm/kasan/report.c:431
[<ffffffff82729c4b>] ipv6_get_dsfield include/net/dsfield.h:23 [inline]
[<ffffffff82729c4b>] ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1362 [inline]
[<ffffffff82729c4b>] ip6_tnl_start_xmit+0x14db/0x1680
net/ipv6/ip6_tunnel.c:1389
[<ffffffff82296f67>] __netdev_start_xmit include/linux/netdevice.h:4062
[inline]
[<ffffffff82296f67>] netdev_start_xmit include/linux/netdevice.h:4071
[inline]
[<ffffffff82296f67>] xmit_one net/core/dev.c:2955 [inline]
[<ffffffff82296f67>] dev_hard_start_xmit+0x197/0x8b0 net/core/dev.c:2971
[<ffffffff82298abf>] __dev_queue_xmit+0x117f/0x1b90 net/core/dev.c:3451
[<ffffffff822994e7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3484
[<ffffffff822b1275>] neigh_direct_output+0x15/0x20
net/core/neighbour.c:1362
[<ffffffff82609ece>] dst_neigh_output include/net/dst.h:470 [inline]
[<ffffffff82609ece>] ip6_finish_output2+0xb0e/0x1d10
net/ipv6/ip6_output.c:119
[<ffffffff8261aa84>] ip6_finish_output+0x334/0x980
net/ipv6/ip6_output.c:145
[<ffffffff8261b2ba>] NF_HOOK_COND include/linux/netfilter.h:246 [inline]
[<ffffffff8261b2ba>] ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
[<ffffffff8273507b>] dst_output include/net/dst.h:507 [inline]
[<ffffffff8273507b>] ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
[<ffffffff8261d4a1>] ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1753
[<ffffffff8267ea33>] udp_v6_send_skb+0x843/0xe70 net/ipv6/udp.c:974
[<ffffffff8267f28d>] udp_v6_push_pending_frames+0x22d/0x340
net/ipv6/udp.c:1007
[<ffffffff82681241>] udpv6_sendmsg+0x1dc1/0x2430 net/ipv6/udp.c:1273
[<ffffffff82512b43>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
[<ffffffff8222530b>] sock_sendmsg_nosec net/socket.c:648 [inline]
[<ffffffff8222530b>] sock_sendmsg+0xbb/0x110 net/socket.c:658
[<ffffffff82225583>] sock_write_iter+0x223/0x3b0 net/socket.c:856
[<ffffffff814e8d57>] new_sync_write fs/read_write.c:496 [inline]
[<ffffffff814e8d57>] __vfs_write+0x3d7/0x580 fs/read_write.c:509
[<ffffffff814eb5a7>] vfs_write+0x187/0x520 fs/read_write.c:557
[<ffffffff814ef3d9>] SYSC_write fs/read_write.c:604 [inline]
[<ffffffff814ef3d9>] SyS_write+0xd9/0x1c0 fs/read_write.c:596
[<ffffffff81005fd1>] do_syscall_32_irqs_on arch/x86/entry/common.c:325
[inline]
[<ffffffff81005fd1>] do_fast_syscall_32+0x2f1/0x860
arch/x86/entry/common.c:387
[<ffffffff8278f460>] entry_SYSENTER_compat+0x90/0xa2
arch/x86/entry/entry_64_compat.S:137
Allocated by task 2489:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack mm/kasan/kasan.c:505 [inline]
set_track mm/kasan/kasan.c:517 [inline]
kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609
kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
slab_post_alloc_hook mm/slab.h:417 [inline]
slab_alloc_node mm/slub.c:2715 [inline]
slab_alloc mm/slub.c:2723 [inline]
__kmalloc_track_caller+0xf0/0x2d0 mm/slub.c:4232
__kmalloc_reserve.isra.5+0x33/0xc0 net/core/skbuff.c:138
__alloc_skb+0x11a/0x5b0 net/core/skbuff.c:231
alloc_skb include/linux/skbuff.h:919 [inline]
alloc_skb_with_frags+0xaf/0x4e0 net/core/skbuff.c:4685
sock_alloc_send_pskb+0x59e/0x740 net/core/sock.c:1893
sock_alloc_send_skb+0x32/0x40 net/core/sock.c:1910
__ip6_append_data.isra.3+0x1fd2/0x3460 net/ipv6/ip6_output.c:1487
ip6_append_data+0x1c1/0x2f0 net/ipv6/ip6_output.c:1647
udpv6_sendmsg+0x88b/0x2430 net/ipv6/udp.c:1267
inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
sock_sendmsg_nosec net/socket.c:648 [inline]
sock_sendmsg+0xbb/0x110 net/socket.c:658
SYSC_sendto net/socket.c:1683 [inline]
SyS_sendto+0x220/0x370 net/socket.c:1651
do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
do_fast_syscall_32+0x2f1/0x860 arch/x86/entry/common.c:387
entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137
Freed by task 2489:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack mm/kasan/kasan.c:505 [inline]
set_track mm/kasan/kasan.c:517 [inline]
kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582
slab_free_hook mm/slub.c:1355 [inline]
slab_free_freelist_hook mm/slub.c:1377 [inline]
slab_free mm/slub.c:2958 [inline]
kfree+0xfb/0x310 mm/slub.c:3878
skb_free_head+0x8b/0xb0 net/core/skbuff.c:580
pskb_expand_head+0x457/0x8a0 net/core/skbuff.c:1246
skb_header_unclone include/linux/skbuff.h:1359 [inline]
iptunnel_handle_offloads+0x3f0/0x520 net/ipv4/ip_tunnel_core.c:169
ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1359 [inline]
ip6_tnl_start_xmit+0x4ca/0x1680 net/ipv6/ip6_tunnel.c:1389
__netdev_start_xmit include/linux/netdevice.h:4062 [inline]
netdev_start_xmit include/linux/netdevice.h:4071 [inline]
xmit_one net/core/dev.c:2955 [inline]
dev_hard_start_xmit+0x197/0x8b0 net/core/dev.c:2971
__dev_queue_xmit+0x117f/0x1b90 net/core/dev.c:3451
dev_queue_xmit+0x17/0x20 net/core/dev.c:3484
neigh_direct_output+0x15/0x20 net/core/neighbour.c:1362
dst_neigh_output include/net/dst.h:470 [inline]
ip6_finish_output2+0xb0e/0x1d10 net/ipv6/ip6_output.c:119
ip6_finish_output+0x334/0x980 net/ipv6/ip6_output.c:145
NF_HOOK_COND include/linux/netfilter.h:246 [inline]
ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
dst_output include/net/dst.h:507 [inline]
ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1753
udp_v6_send_skb+0x843/0xe70 net/ipv6/udp.c:974
udp_v6_push_pending_frames+0x22d/0x340 net/ipv6/udp.c:1007
udpv6_sendmsg+0x1dc1/0x2430 net/ipv6/udp.c:1273
inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
sock_sendmsg_nosec net/socket.c:648 [inline]
sock_sendmsg+0xbb/0x110 net/socket.c:658
sock_write_iter+0x223/0x3b0 net/socket.c:856
new_sync_write fs/read_write.c:496 [inline]
__vfs_write+0x3d7/0x580 fs/read_write.c:509
vfs_write+0x187/0x520 fs/read_write.c:557
SYSC_write fs/read_write.c:604 [inline]
SyS_write+0xd9/0x1c0 fs/read_write.c:596
do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
do_fast_syscall_32+0x2f1/0x860 arch/x86/entry/common.c:387
entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137
The buggy address belongs to the object at ffff8801c9a51200
which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 152 bytes inside of
1024-byte region [ffff8801c9a51200, ffff8801c9a51600)
The buggy address belongs to the page:
page:ffffea0007269400 count:1 mapcount:0 mapping: (null) index:0x0
compound_mapcount: 0
flags: 0x4000000000004080(slab|head)
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801c9a51180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801c9a51200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801c9a51280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801c9a51300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801c9a51380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
Reply all
Reply to author
Forward
0 new messages