KASAN: use-after-free Read in skb_dequeue
16 views
Skip to first unread message
syzbot
Aug 16, 2021, 12:14:24 PM8/16/21
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: a8f2bcabf9c5 UPSTREAM: compat: provide compat_ptr() on all..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1167c519300000
kernel config: https://syzkaller.appspot.com/x/.config?x=12fdca0186751701
dashboard link: https://syzkaller.appspot.com/bug?extid=2f3a0be2a3fef0e262a9
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ad4fa1300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2f3a0b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __skb_unlink include/linux/skbuff.h:2051 [inline]
BUG: KASAN: use-after-free in __skb_dequeue include/linux/skbuff.h:2070 [inline]
BUG: KASAN: use-after-free in skb_dequeue+0xad/0x180 net/core/skbuff.c:3057
Read of size 8 at addr ffff8881e08bfc80 by task kworker/u5:6/408
CPU: 0 PID: 408 Comm: kworker/u5:6 Not tainted 5.4.125-syzkaller-00008-ga8f2bcabf9c5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci4 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d8/0x24e lib/dump_stack.c:118
print_address_description+0x9b/0x650 mm/kasan/report.c:384
__kasan_report+0x182/0x260 mm/kasan/report.c:516
kasan_report+0x30/0x60 mm/kasan/common.c:653
__skb_unlink include/linux/skbuff.h:2051 [inline]
__skb_dequeue include/linux/skbuff.h:2070 [inline]
skb_dequeue+0xad/0x180 net/core/skbuff.c:3057
hci_rx_work+0x620/0x780 net/bluetooth/hci_core.c:4463
process_one_work+0x679/0x1030 kernel/workqueue.c:2277
worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
kthread+0x30f/0x330 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 466:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
__kasan_kmalloc+0x137/0x1e0 mm/kasan/common.c:529
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2821 [inline]
slab_alloc mm/slub.c:2829 [inline]
kmem_cache_alloc+0x115/0x290 mm/slub.c:2834
kmem_cache_alloc_node include/linux/slab.h:427 [inline]
__alloc_skb+0x75/0x4d0 net/core/skbuff.c:198
alloc_skb include/linux/skbuff.h:1060 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
h4_recv_buf+0x274/0xd00 drivers/bluetooth/hci_h4.c:182
h4_recv+0xf4/0x1b0 drivers/bluetooth/hci_h4.c:116
hci_uart_tty_receive+0x275/0x460 drivers/bluetooth/hci_ldisc.c:613
tiocsti drivers/tty/tty_io.c:2197 [inline]
tty_ioctl+0xd48/0x1710 drivers/tty/tty_io.c:2573
do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 408:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
kasan_set_free_info mm/kasan/common.c:345 [inline]
__kasan_slab_free+0x18a/0x240 mm/kasan/common.c:487
slab_free_hook mm/slub.c:1454 [inline]
slab_free_freelist_hook+0x7b/0x150 mm/slub.c:1492
slab_free mm/slub.c:3072 [inline]
kmem_cache_free+0xb8/0x5f0 mm/slub.c:3088
hci_event_packet+0xa284/0x22220 net/bluetooth/hci_event.c:6067
hci_rx_work+0x287/0x780 net/bluetooth/hci_core.c:4498
process_one_work+0x679/0x1030 kernel/workqueue.c:2277
worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
kthread+0x30f/0x330 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881e08bfc80
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 0 bytes inside of
240-byte region [ffff8881e08bfc80, ffff8881e08bfd70)
The buggy address belongs to the page:
page:ffffea0007822fc0 refcount:1 mapcount:0 mapping:ffff8881f1dde280 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881f1dde280
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2165 [inline]
prep_new_page+0x19a/0x380 mm/page_alloc.c:2171
get_page_from_freelist+0x550/0x8b0 mm/page_alloc.c:3794
__alloc_pages_nodemask+0x3a2/0x880 mm/page_alloc.c:4855
alloc_slab_page+0x39/0x3e0 mm/slub.c:342
allocate_slab mm/slub.c:1675 [inline]
new_slab+0x97/0x460 mm/slub.c:1741
new_slab_objects mm/slub.c:2498 [inline]
___slab_alloc+0x330/0x4c0 mm/slub.c:2659
__slab_alloc mm/slub.c:2699 [inline]
slab_alloc_node mm/slub.c:2784 [inline]
slab_alloc mm/slub.c:2829 [inline]
kmem_cache_alloc+0x18b/0x290 mm/slub.c:2834
kmem_cache_alloc_node include/linux/slab.h:427 [inline]
__alloc_skb+0x75/0x4d0 net/core/skbuff.c:198
alloc_skb include/linux/skbuff.h:1060 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
hci_prepare_cmd net/bluetooth/hci_request.c:296 [inline]
hci_req_add_ev+0xa4/0x3c0 net/bluetooth/hci_request.c:330
bredr_init net/bluetooth/hci_core.c:200 [inline]
hci_init1_req+0x134/0x270 net/bluetooth/hci_core.c:256
__hci_req_sync+0x174/0x8a0 net/bluetooth/hci_request.c:205
__hci_init net/bluetooth/hci_core.c:868 [inline]
hci_dev_do_open+0xafe/0x1670 net/bluetooth/hci_core.c:1528
hci_power_on+0x155/0x580 net/bluetooth/hci_core.c:2200
process_one_work+0x679/0x1030 kernel/workqueue.c:2277
worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
kthread+0x30f/0x330 kernel/kthread.c:268
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1176 [inline]
free_pcp_prepare+0x1a9/0x270 mm/page_alloc.c:1233
free_unref_page_prepare mm/page_alloc.c:3085 [inline]
free_unref_page mm/page_alloc.c:3134 [inline]
free_the_page mm/page_alloc.c:4915 [inline]
__free_pages+0x9c/0x250 mm/page_alloc.c:4923
selinux_genfs_get_sid security/selinux/hooks.c:1367 [inline]
inode_doinit_with_dentry+0xb34/0x11d0 security/selinux/hooks.c:1562
security_d_instantiate+0xa5/0x100 security/security.c:1882
d_instantiate+0x51/0x90 fs/dcache.c:1954
debugfs_create_dir+0x1bc/0x3f0 fs/debugfs/inode.c:571
hci_register_dev+0x297/0x710 net/bluetooth/hci_core.c:3333
hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:682 [inline]
hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:706 [inline]
hci_uart_tty_ioctl+0x89e/0xa10 drivers/bluetooth/hci_ldisc.c:760
tty_ioctl+0xf68/0x1710 drivers/tty/tty_io.c:2666
do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Memory state around the buggy address:
ffff8881e08bfb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e08bfc00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
>ffff8881e08bfc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881e08bfd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff8881e08bfd80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 408 Comm: kworker/u5:6 Tainted: G B 5.4.125-syzkaller-00008-ga8f2bcabf9c5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci4 hci_rx_work
RIP: 0010:__write_once_size include/linux/compiler.h:293 [inline]
RIP: 0010:__skb_unlink include/linux/skbuff.h:2054 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2070 [inline]
RIP: 0010:skb_dequeue+0xe8/0x180 net/core/skbuff.c:3057
Code: 80 3c 38 00 74 05 e8 87 8f 1e fe 49 8b 5c 24 08 4d 8d 6e 08 ba 10 00 00 00 4c 89 e7 31 f6 e8 3f 62 1e fe 4c 89 e8 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 ef e8 d9 8f 1e fe 49 89 5e 08 48 89 d8
RSP: 0018:ffff8881e1adfc50 EFLAGS: 00010002
RAX: 0000000000000001 RBX: ffff8881e08bfc80 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff8881e08bfc90
RBP: 1ffff1103bed0172 R08: dffffc0000000000 R09: ffff8881e08bfc80
R10: ffffed103c117f92 R11: 00000000000000fb R12: ffff8881e08bfc80
R13: 0000000000000008 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005198f0 CR3: 00000001e6370000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hci_rx_work+0x620/0x780 net/bluetooth/hci_core.c:4463
process_one_work+0x679/0x1030 kernel/workqueue.c:2277
worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
kthread+0x30f/0x330 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 29535e1e0975b2a5 ]---
RIP: 0010:__write_once_size include/linux/compiler.h:293 [inline]
RIP: 0010:__skb_unlink include/linux/skbuff.h:2054 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2070 [inline]
RIP: 0010:skb_dequeue+0xe8/0x180 net/core/skbuff.c:3057
Code: 80 3c 38 00 74 05 e8 87 8f 1e fe 49 8b 5c 24 08 4d 8d 6e 08 ba 10 00 00 00 4c 89 e7 31 f6 e8 3f 62 1e fe 4c 89 e8 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 ef e8 d9 8f 1e fe 49 89 5e 08 48 89 d8
RSP: 0018:ffff8881e1adfc50 EFLAGS: 00010002
RAX: 0000000000000001 RBX: ffff8881e08bfc80 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff8881e08bfc90
RBP: 1ffff1103bed0172 R08: dffffc0000000000 R09: ffff8881e08bfc80
R10: ffffed103c117f92 R11: 00000000000000fb R12: ffff8881e08bfc80
R13: 0000000000000008 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005198f0 CR3: 00000001e6370000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 80 3c 38 00 cmpb $0x0,(%rax,%rdi,1)
4: 74 05 je 0xb
6: e8 87 8f 1e fe callq 0xfe1e8f92
b: 49 8b 5c 24 08 mov 0x8(%r12),%rbx
10: 4d 8d 6e 08 lea 0x8(%r14),%r13
14: ba 10 00 00 00 mov $0x10,%edx
19: 4c 89 e7 mov %r12,%rdi
1c: 31 f6 xor %esi,%esi
1e: e8 3f 62 1e fe callq 0xfe1e6262
23: 4c 89 e8 mov %r13,%rax
26: 48 c1 e8 03 shr $0x3,%rax
2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 ef mov %r13,%rdi
34: e8 d9 8f 1e fe callq 0xfe1e9012
39: 49 89 5e 08 mov %rbx,0x8(%r14)
3d: 48 89 d8 mov %rbx,%rax
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: a8f2bcabf9c5 UPSTREAM: compat: provide compat_ptr() on all..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1167c519300000
kernel config: https://syzkaller.appspot.com/x/.config?x=12fdca0186751701
dashboard link: https://syzkaller.appspot.com/bug?extid=2f3a0be2a3fef0e262a9
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ad4fa1300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2f3a0b...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __skb_unlink include/linux/skbuff.h:2051 [inline]
BUG: KASAN: use-after-free in __skb_dequeue include/linux/skbuff.h:2070 [inline]
BUG: KASAN: use-after-free in skb_dequeue+0xad/0x180 net/core/skbuff.c:3057
Read of size 8 at addr ffff8881e08bfc80 by task kworker/u5:6/408
CPU: 0 PID: 408 Comm: kworker/u5:6 Not tainted 5.4.125-syzkaller-00008-ga8f2bcabf9c5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci4 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d8/0x24e lib/dump_stack.c:118
print_address_description+0x9b/0x650 mm/kasan/report.c:384
__kasan_report+0x182/0x260 mm/kasan/report.c:516
kasan_report+0x30/0x60 mm/kasan/common.c:653
__skb_unlink include/linux/skbuff.h:2051 [inline]
__skb_dequeue include/linux/skbuff.h:2070 [inline]
skb_dequeue+0xad/0x180 net/core/skbuff.c:3057
hci_rx_work+0x620/0x780 net/bluetooth/hci_core.c:4463
process_one_work+0x679/0x1030 kernel/workqueue.c:2277
worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
kthread+0x30f/0x330 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 466:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
__kasan_kmalloc+0x137/0x1e0 mm/kasan/common.c:529
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2821 [inline]
slab_alloc mm/slub.c:2829 [inline]
kmem_cache_alloc+0x115/0x290 mm/slub.c:2834
kmem_cache_alloc_node include/linux/slab.h:427 [inline]
__alloc_skb+0x75/0x4d0 net/core/skbuff.c:198
alloc_skb include/linux/skbuff.h:1060 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
h4_recv_buf+0x274/0xd00 drivers/bluetooth/hci_h4.c:182
h4_recv+0xf4/0x1b0 drivers/bluetooth/hci_h4.c:116
hci_uart_tty_receive+0x275/0x460 drivers/bluetooth/hci_ldisc.c:613
tiocsti drivers/tty/tty_io.c:2197 [inline]
tty_ioctl+0xd48/0x1710 drivers/tty/tty_io.c:2573
do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 408:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
kasan_set_free_info mm/kasan/common.c:345 [inline]
__kasan_slab_free+0x18a/0x240 mm/kasan/common.c:487
slab_free_hook mm/slub.c:1454 [inline]
slab_free_freelist_hook+0x7b/0x150 mm/slub.c:1492
slab_free mm/slub.c:3072 [inline]
kmem_cache_free+0xb8/0x5f0 mm/slub.c:3088
hci_event_packet+0xa284/0x22220 net/bluetooth/hci_event.c:6067
hci_rx_work+0x287/0x780 net/bluetooth/hci_core.c:4498
process_one_work+0x679/0x1030 kernel/workqueue.c:2277
worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
kthread+0x30f/0x330 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881e08bfc80
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 0 bytes inside of
240-byte region [ffff8881e08bfc80, ffff8881e08bfd70)
The buggy address belongs to the page:
page:ffffea0007822fc0 refcount:1 mapcount:0 mapping:ffff8881f1dde280 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881f1dde280
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2165 [inline]
prep_new_page+0x19a/0x380 mm/page_alloc.c:2171
get_page_from_freelist+0x550/0x8b0 mm/page_alloc.c:3794
__alloc_pages_nodemask+0x3a2/0x880 mm/page_alloc.c:4855
alloc_slab_page+0x39/0x3e0 mm/slub.c:342
allocate_slab mm/slub.c:1675 [inline]
new_slab+0x97/0x460 mm/slub.c:1741
new_slab_objects mm/slub.c:2498 [inline]
___slab_alloc+0x330/0x4c0 mm/slub.c:2659
__slab_alloc mm/slub.c:2699 [inline]
slab_alloc_node mm/slub.c:2784 [inline]
slab_alloc mm/slub.c:2829 [inline]
kmem_cache_alloc+0x18b/0x290 mm/slub.c:2834
kmem_cache_alloc_node include/linux/slab.h:427 [inline]
__alloc_skb+0x75/0x4d0 net/core/skbuff.c:198
alloc_skb include/linux/skbuff.h:1060 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
hci_prepare_cmd net/bluetooth/hci_request.c:296 [inline]
hci_req_add_ev+0xa4/0x3c0 net/bluetooth/hci_request.c:330
bredr_init net/bluetooth/hci_core.c:200 [inline]
hci_init1_req+0x134/0x270 net/bluetooth/hci_core.c:256
__hci_req_sync+0x174/0x8a0 net/bluetooth/hci_request.c:205
__hci_init net/bluetooth/hci_core.c:868 [inline]
hci_dev_do_open+0xafe/0x1670 net/bluetooth/hci_core.c:1528
hci_power_on+0x155/0x580 net/bluetooth/hci_core.c:2200
process_one_work+0x679/0x1030 kernel/workqueue.c:2277
worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
kthread+0x30f/0x330 kernel/kthread.c:268
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1176 [inline]
free_pcp_prepare+0x1a9/0x270 mm/page_alloc.c:1233
free_unref_page_prepare mm/page_alloc.c:3085 [inline]
free_unref_page mm/page_alloc.c:3134 [inline]
free_the_page mm/page_alloc.c:4915 [inline]
__free_pages+0x9c/0x250 mm/page_alloc.c:4923
selinux_genfs_get_sid security/selinux/hooks.c:1367 [inline]
inode_doinit_with_dentry+0xb34/0x11d0 security/selinux/hooks.c:1562
security_d_instantiate+0xa5/0x100 security/security.c:1882
d_instantiate+0x51/0x90 fs/dcache.c:1954
debugfs_create_dir+0x1bc/0x3f0 fs/debugfs/inode.c:571
hci_register_dev+0x297/0x710 net/bluetooth/hci_core.c:3333
hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:682 [inline]
hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:706 [inline]
hci_uart_tty_ioctl+0x89e/0xa10 drivers/bluetooth/hci_ldisc.c:760
tty_ioctl+0xf68/0x1710 drivers/tty/tty_io.c:2666
do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Memory state around the buggy address:
ffff8881e08bfb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e08bfc00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
>ffff8881e08bfc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881e08bfd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff8881e08bfd80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 408 Comm: kworker/u5:6 Tainted: G B 5.4.125-syzkaller-00008-ga8f2bcabf9c5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci4 hci_rx_work
RIP: 0010:__write_once_size include/linux/compiler.h:293 [inline]
RIP: 0010:__skb_unlink include/linux/skbuff.h:2054 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2070 [inline]
RIP: 0010:skb_dequeue+0xe8/0x180 net/core/skbuff.c:3057
Code: 80 3c 38 00 74 05 e8 87 8f 1e fe 49 8b 5c 24 08 4d 8d 6e 08 ba 10 00 00 00 4c 89 e7 31 f6 e8 3f 62 1e fe 4c 89 e8 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 ef e8 d9 8f 1e fe 49 89 5e 08 48 89 d8
RSP: 0018:ffff8881e1adfc50 EFLAGS: 00010002
RAX: 0000000000000001 RBX: ffff8881e08bfc80 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff8881e08bfc90
RBP: 1ffff1103bed0172 R08: dffffc0000000000 R09: ffff8881e08bfc80
R10: ffffed103c117f92 R11: 00000000000000fb R12: ffff8881e08bfc80
R13: 0000000000000008 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005198f0 CR3: 00000001e6370000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hci_rx_work+0x620/0x780 net/bluetooth/hci_core.c:4463
process_one_work+0x679/0x1030 kernel/workqueue.c:2277
worker_thread+0xa6f/0x1400 kernel/workqueue.c:2423
kthread+0x30f/0x330 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 29535e1e0975b2a5 ]---
RIP: 0010:__write_once_size include/linux/compiler.h:293 [inline]
RIP: 0010:__skb_unlink include/linux/skbuff.h:2054 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2070 [inline]
RIP: 0010:skb_dequeue+0xe8/0x180 net/core/skbuff.c:3057
Code: 80 3c 38 00 74 05 e8 87 8f 1e fe 49 8b 5c 24 08 4d 8d 6e 08 ba 10 00 00 00 4c 89 e7 31 f6 e8 3f 62 1e fe 4c 89 e8 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 ef e8 d9 8f 1e fe 49 89 5e 08 48 89 d8
RSP: 0018:ffff8881e1adfc50 EFLAGS: 00010002
RAX: 0000000000000001 RBX: ffff8881e08bfc80 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff8881e08bfc90
RBP: 1ffff1103bed0172 R08: dffffc0000000000 R09: ffff8881e08bfc80
R10: ffffed103c117f92 R11: 00000000000000fb R12: ffff8881e08bfc80
R13: 0000000000000008 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005198f0 CR3: 00000001e6370000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 80 3c 38 00 cmpb $0x0,(%rax,%rdi,1)
4: 74 05 je 0xb
6: e8 87 8f 1e fe callq 0xfe1e8f92
b: 49 8b 5c 24 08 mov 0x8(%r12),%rbx
10: 4d 8d 6e 08 lea 0x8(%r14),%r13
14: ba 10 00 00 00 mov $0x10,%edx
19: 4c 89 e7 mov %r12,%rdi
1c: 31 f6 xor %esi,%esi
1e: e8 3f 62 1e fe callq 0xfe1e6262
23: 4c 89 e8 mov %r13,%rax
26: 48 c1 e8 03 shr $0x3,%rax
2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 ef mov %r13,%rdi
34: e8 d9 8f 1e fe callq 0xfe1e9012
39: 49 89 5e 08 mov %rbx,0x8(%r14)
3d: 48 89 d8 mov %rbx,%rax
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Apr 22, 2023, 10:47:30 PM4/22/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages