[Android 6.1] KASAN: use-after-free Read in consume_skb
5 views
Skip to first unread message
syzbot
Sep 9, 2023, 5:41:11 PM9/9/23
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: cd94fe67fd33 ANDROID: ABI: Update symbols to qcom whitelist
git tree: android14-6.1
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15ec20a0680000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5b8b7a65c87c651
dashboard link: https://syzkaller.appspot.com/bug?extid=667c0f2f1a7b3f2cd327
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13979c30680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15feb694680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/86c2595ccb29/disk-cd94fe67.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c938d89f9cfc/vmlinux-cd94fe67.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ebbd4ce5af82/bzImage-cd94fe67.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+667c0f...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:72 [inline]
BUG: KASAN: use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:147 [inline]
BUG: KASAN: use-after-free in skb_unref include/linux/skbuff.h:1207 [inline]
BUG: KASAN: use-after-free in consume_skb+0x3c/0x250 net/core/skbuff.c:1029
Read of size 4 at addr ffff8881099d4374 by task kworker/1:1/37
CPU: 1 PID: 37 Comm: kworker/1:1 Not tainted 6.1.25-syzkaller-00088-gcd94fe67fd33 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Workqueue: events sk_psock_destroy
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0x158/0x4e0 mm/kasan/report.c:427
kasan_report+0x13c/0x170 mm/kasan/report.c:531
kasan_check_range+0x294/0x2a0 mm/kasan/generic.c:189
__kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31
instrument_atomic_read include/linux/instrumented.h:72 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
refcount_read include/linux/refcount.h:147 [inline]
skb_unref include/linux/skbuff.h:1207 [inline]
consume_skb+0x3c/0x250 net/core/skbuff.c:1029
__sk_msg_free+0x2dd/0x370 net/core/skmsg.c:205
sk_msg_free net/core/skmsg.c:218 [inline]
__sk_psock_purge_ingress_msg net/core/skmsg.c:769 [inline]
__sk_psock_zap_ingress net/core/skmsg.c:782 [inline]
sk_psock_destroy+0x351/0x810 net/core/skmsg.c:814
process_one_work+0x73d/0xcb0 kernel/workqueue.c:2296
worker_thread+0xa60/0x1260 kernel/workqueue.c:2443
kthread+0x26d/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
Allocated by task 317:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:333
kasan_slab_alloc include/linux/kasan.h:202 [inline]
slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:768
slab_alloc_node mm/slub.c:3418 [inline]
kmem_cache_alloc_node+0x18a/0x2d0 mm/slub.c:3463
__alloc_skb+0xcc/0x2c0 net/core/skbuff.c:497
alloc_skb include/linux/skbuff.h:1275 [inline]
alloc_skb_with_frags+0xa6/0x680 net/core/skbuff.c:6128
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2727
unix_dgram_sendmsg+0x5b1/0x2050 net/unix/af_unix.c:1943
sock_sendmsg_nosec net/socket.c:716 [inline]
sock_sendmsg net/socket.c:736 [inline]
____sys_sendmsg+0x5dc/0x9d0 net/socket.c:2482
___sys_sendmsg net/socket.c:2536 [inline]
__sys_sendmmsg+0x3b9/0x6f0 net/socket.c:2622
__do_sys_sendmmsg net/socket.c:2651 [inline]
__se_sys_sendmmsg net/socket.c:2648 [inline]
__x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2648
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 37:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:249
kasan_slab_free include/linux/kasan.h:178 [inline]
slab_free_hook mm/slub.c:1744 [inline]
slab_free_freelist_hook mm/slub.c:1770 [inline]
slab_free mm/slub.c:3681 [inline]
kmem_cache_free+0x291/0x510 mm/slub.c:3703
kfree_skbmem+0x104/0x170
__kfree_skb net/core/skbuff.c:869 [inline]
kfree_skb_reason+0xdb/0x250 net/core/skbuff.c:891
kfree_skb include/linux/skbuff.h:1224 [inline]
sock_drop include/linux/skmsg.h:306 [inline]
__sk_psock_zap_ingress net/core/skmsg.c:780 [inline]
sk_psock_destroy+0x143/0x810 net/core/skmsg.c:814
process_one_work+0x73d/0xcb0 kernel/workqueue.c:2296
worker_thread+0xa60/0x1260 kernel/workqueue.c:2443
kthread+0x26d/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff8881099d4280
which belongs to the cache skbuff_head_cache of size 256
The buggy address is located 244 bytes inside of
256-byte region [ffff8881099d4280, ffff8881099d4380)
The buggy address belongs to the physical page:
page:ffffea0004267500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1099d4
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100b90180
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 292, tgid 292 (sshd), ts 25562268276, free_ts 25556056951
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x213/0x220 mm/page_alloc.c:2582
prep_new_page+0x1b/0x110 mm/page_alloc.c:2589
get_page_from_freelist+0x2762/0x27f0 mm/page_alloc.c:4387
__alloc_pages+0x3a1/0x780 mm/page_alloc.c:5664
allocate_slab mm/slub.c:1959 [inline]
new_slab+0xce/0x4c0 mm/slub.c:2012
___slab_alloc+0x6f9/0xb80 mm/slub.c:3200
__slab_alloc+0x5d/0xa0 mm/slub.c:3299
slab_alloc_node mm/slub.c:3384 [inline]
slab_alloc mm/slub.c:3426 [inline]
__kmem_cache_alloc_lru mm/slub.c:3433 [inline]
kmem_cache_alloc+0x1b9/0x2c0 mm/slub.c:3442
skb_clone+0x1f8/0x380 net/core/skbuff.c:1650
dev_queue_xmit_nit+0x248/0xa90 net/core/dev.c:2272
xmit_one net/core/dev.c:3596 [inline]
dev_hard_start_xmit+0x140/0x630 net/core/dev.c:3616
sch_direct_xmit+0x298/0x9b0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3827 [inline]
__dev_queue_xmit+0x17df/0x3660 net/core/dev.c:4232
dev_queue_xmit include/linux/netdevice.h:3072 [inline]
neigh_hh_output include/net/neighbour.h:538 [inline]
neigh_output include/net/neighbour.h:552 [inline]
ip_finish_output2+0xb60/0xf90 net/ipv4/ip_output.c:228
__ip_finish_output+0x162/0x370
ip_finish_output+0x31/0x2a0 net/ipv4/ip_output.c:316
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1494 [inline]
free_pcp_prepare mm/page_alloc.c:1568 [inline]
free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3486
free_unref_page_list+0xf6/0x6c0 mm/page_alloc.c:3628
release_pages+0xf7f/0xfe0 mm/swap.c:1055
free_pages_and_swap_cache+0x8a/0xa0 mm/swap_state.c:314
tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
tlb_flush_mmu mm/mmu_gather.c:261 [inline]
tlb_finish_mmu+0x1e0/0x3f0 mm/mmu_gather.c:361
exit_mmap+0x3e5/0x8a0 mm/mmap.c:3329
__mmput+0x95/0x310 kernel/fork.c:1272
mmput+0x56/0x170 kernel/fork.c:1295
exit_mm kernel/exit.c:566 [inline]
do_exit+0xb29/0x2b80 kernel/exit.c:862
do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
get_signal+0x169d/0x1820 kernel/signal.c:2866
arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:869
exit_to_user_mode_loop+0x6b/0xa0 kernel/entry/common.c:168
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x26/0x130 kernel/entry/common.c:297
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
Memory state around the buggy address:
ffff8881099d4200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8881099d4280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881099d4300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881099d4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881099d4400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: cd94fe67fd33 ANDROID: ABI: Update symbols to qcom whitelist
git tree: android14-6.1
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15ec20a0680000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5b8b7a65c87c651
dashboard link: https://syzkaller.appspot.com/bug?extid=667c0f2f1a7b3f2cd327
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13979c30680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15feb694680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/86c2595ccb29/disk-cd94fe67.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c938d89f9cfc/vmlinux-cd94fe67.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ebbd4ce5af82/bzImage-cd94fe67.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+667c0f...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:72 [inline]
BUG: KASAN: use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:147 [inline]
BUG: KASAN: use-after-free in skb_unref include/linux/skbuff.h:1207 [inline]
BUG: KASAN: use-after-free in consume_skb+0x3c/0x250 net/core/skbuff.c:1029
Read of size 4 at addr ffff8881099d4374 by task kworker/1:1/37
CPU: 1 PID: 37 Comm: kworker/1:1 Not tainted 6.1.25-syzkaller-00088-gcd94fe67fd33 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Workqueue: events sk_psock_destroy
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0x158/0x4e0 mm/kasan/report.c:427
kasan_report+0x13c/0x170 mm/kasan/report.c:531
kasan_check_range+0x294/0x2a0 mm/kasan/generic.c:189
__kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31
instrument_atomic_read include/linux/instrumented.h:72 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
refcount_read include/linux/refcount.h:147 [inline]
skb_unref include/linux/skbuff.h:1207 [inline]
consume_skb+0x3c/0x250 net/core/skbuff.c:1029
__sk_msg_free+0x2dd/0x370 net/core/skmsg.c:205
sk_msg_free net/core/skmsg.c:218 [inline]
__sk_psock_purge_ingress_msg net/core/skmsg.c:769 [inline]
__sk_psock_zap_ingress net/core/skmsg.c:782 [inline]
sk_psock_destroy+0x351/0x810 net/core/skmsg.c:814
process_one_work+0x73d/0xcb0 kernel/workqueue.c:2296
worker_thread+0xa60/0x1260 kernel/workqueue.c:2443
kthread+0x26d/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
Allocated by task 317:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:333
kasan_slab_alloc include/linux/kasan.h:202 [inline]
slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:768
slab_alloc_node mm/slub.c:3418 [inline]
kmem_cache_alloc_node+0x18a/0x2d0 mm/slub.c:3463
__alloc_skb+0xcc/0x2c0 net/core/skbuff.c:497
alloc_skb include/linux/skbuff.h:1275 [inline]
alloc_skb_with_frags+0xa6/0x680 net/core/skbuff.c:6128
sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2727
unix_dgram_sendmsg+0x5b1/0x2050 net/unix/af_unix.c:1943
sock_sendmsg_nosec net/socket.c:716 [inline]
sock_sendmsg net/socket.c:736 [inline]
____sys_sendmsg+0x5dc/0x9d0 net/socket.c:2482
___sys_sendmsg net/socket.c:2536 [inline]
__sys_sendmmsg+0x3b9/0x6f0 net/socket.c:2622
__do_sys_sendmmsg net/socket.c:2651 [inline]
__se_sys_sendmmsg net/socket.c:2648 [inline]
__x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2648
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 37:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:249
kasan_slab_free include/linux/kasan.h:178 [inline]
slab_free_hook mm/slub.c:1744 [inline]
slab_free_freelist_hook mm/slub.c:1770 [inline]
slab_free mm/slub.c:3681 [inline]
kmem_cache_free+0x291/0x510 mm/slub.c:3703
kfree_skbmem+0x104/0x170
__kfree_skb net/core/skbuff.c:869 [inline]
kfree_skb_reason+0xdb/0x250 net/core/skbuff.c:891
kfree_skb include/linux/skbuff.h:1224 [inline]
sock_drop include/linux/skmsg.h:306 [inline]
__sk_psock_zap_ingress net/core/skmsg.c:780 [inline]
sk_psock_destroy+0x143/0x810 net/core/skmsg.c:814
process_one_work+0x73d/0xcb0 kernel/workqueue.c:2296
worker_thread+0xa60/0x1260 kernel/workqueue.c:2443
kthread+0x26d/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff8881099d4280
which belongs to the cache skbuff_head_cache of size 256
The buggy address is located 244 bytes inside of
256-byte region [ffff8881099d4280, ffff8881099d4380)
The buggy address belongs to the physical page:
page:ffffea0004267500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1099d4
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100b90180
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 292, tgid 292 (sshd), ts 25562268276, free_ts 25556056951
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x213/0x220 mm/page_alloc.c:2582
prep_new_page+0x1b/0x110 mm/page_alloc.c:2589
get_page_from_freelist+0x2762/0x27f0 mm/page_alloc.c:4387
__alloc_pages+0x3a1/0x780 mm/page_alloc.c:5664
allocate_slab mm/slub.c:1959 [inline]
new_slab+0xce/0x4c0 mm/slub.c:2012
___slab_alloc+0x6f9/0xb80 mm/slub.c:3200
__slab_alloc+0x5d/0xa0 mm/slub.c:3299
slab_alloc_node mm/slub.c:3384 [inline]
slab_alloc mm/slub.c:3426 [inline]
__kmem_cache_alloc_lru mm/slub.c:3433 [inline]
kmem_cache_alloc+0x1b9/0x2c0 mm/slub.c:3442
skb_clone+0x1f8/0x380 net/core/skbuff.c:1650
dev_queue_xmit_nit+0x248/0xa90 net/core/dev.c:2272
xmit_one net/core/dev.c:3596 [inline]
dev_hard_start_xmit+0x140/0x630 net/core/dev.c:3616
sch_direct_xmit+0x298/0x9b0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3827 [inline]
__dev_queue_xmit+0x17df/0x3660 net/core/dev.c:4232
dev_queue_xmit include/linux/netdevice.h:3072 [inline]
neigh_hh_output include/net/neighbour.h:538 [inline]
neigh_output include/net/neighbour.h:552 [inline]
ip_finish_output2+0xb60/0xf90 net/ipv4/ip_output.c:228
__ip_finish_output+0x162/0x370
ip_finish_output+0x31/0x2a0 net/ipv4/ip_output.c:316
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1494 [inline]
free_pcp_prepare mm/page_alloc.c:1568 [inline]
free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3486
free_unref_page_list+0xf6/0x6c0 mm/page_alloc.c:3628
release_pages+0xf7f/0xfe0 mm/swap.c:1055
free_pages_and_swap_cache+0x8a/0xa0 mm/swap_state.c:314
tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
tlb_flush_mmu mm/mmu_gather.c:261 [inline]
tlb_finish_mmu+0x1e0/0x3f0 mm/mmu_gather.c:361
exit_mmap+0x3e5/0x8a0 mm/mmap.c:3329
__mmput+0x95/0x310 kernel/fork.c:1272
mmput+0x56/0x170 kernel/fork.c:1295
exit_mm kernel/exit.c:566 [inline]
do_exit+0xb29/0x2b80 kernel/exit.c:862
do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
get_signal+0x169d/0x1820 kernel/signal.c:2866
arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:869
exit_to_user_mode_loop+0x6b/0xa0 kernel/entry/common.c:168
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x26/0x130 kernel/entry/common.c:297
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
Memory state around the buggy address:
ffff8881099d4200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8881099d4280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881099d4300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881099d4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881099d4400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Dec 8, 2023, 12:26:05 AM12/8/23
to syzkaller-a...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 923877254f002ae87d441382bb1096d9e773d56d
Author: John Fastabend <john.fa...@gmail.com>
Date: Fri Sep 1 20:21:37 2023 +0000
bpf, sockmap: Fix skb refcnt race after locking changes
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1353badae80000
start commit: d3212c2dbaba UPSTREAM: sched/rt: Fix bad task migration fo..
git tree: android14-6.1
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d6d638680000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: bpf, sockmap: Fix skb refcnt race after locking changes
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 923877254f002ae87d441382bb1096d9e773d56d
Author: John Fastabend <john.fa...@gmail.com>
Date: Fri Sep 1 20:21:37 2023 +0000
bpf, sockmap: Fix skb refcnt race after locking changes
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1353badae80000
start commit: d3212c2dbaba UPSTREAM: sched/rt: Fix bad task migration fo..
git tree: android14-6.1
kernel config: https://syzkaller.appspot.com/x/.config?x=c5b8b7a65c87c651
dashboard link: https://syzkaller.appspot.com/bug?extid=667c0f2f1a7b3f2cd327
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=162e4938680000
dashboard link: https://syzkaller.appspot.com/bug?extid=667c0f2f1a7b3f2cd327
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d6d638680000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: bpf, sockmap: Fix skb refcnt race after locking changes
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Feb 15, 2024, 10:09:20 AMFeb 15
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages