KASAN: invalid-free in ieee80211_ibss_leave
5 views
Skip to first unread message
syzbot
Oct 6, 2020, 3:05:25 PM10/6/20
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: ab402fc4 ANDROID: workqueue: add vendor hook for wq lockup..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=146b0227900000
kernel config: https://syzkaller.appspot.com/x/.config?x=889e2c88a7f30f62
dashboard link: https://syzkaller.appspot.com/bug?extid=6280fadb224f17f04990
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150c39c0500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15ada24f900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6280fa...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3051 [inline]
BUG: KASAN: double-free or invalid-free in kfree+0x12b/0x5d0 mm/slub.c:4017
CPU: 1 PID: 353 Comm: syz-executor478 Not tainted 5.4.69-syzkaller-00001-gab402fc4c187 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b0/0x21e lib/dump_stack.c:118
print_address_description+0x96/0x5d0 mm/kasan/report.c:374
kasan_report_invalid_free+0x54/0xc0 mm/kasan/report.c:468
__kasan_slab_free+0x102/0x220 mm/kasan/common.c:459
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kfree+0x12b/0x5d0 mm/slub.c:4017
ieee80211_ibss_leave+0x7d/0xe0 net/mac80211/ibss.c:1870
rdev_leave_ibss+0x194/0x2f0 net/wireless/rdev-ops.h:532
__cfg80211_leave_ibss+0x6f/0x100 net/wireless/ibss.c:212
cfg80211_leave net/wireless/core.c:1216 [inline]
cfg80211_netdev_notifier_call+0x46b/0xee0 net/wireless/core.c:1325
notifier_call_chain kernel/notifier.c:98 [inline]
__raw_notifier_call_chain kernel/notifier.c:399 [inline]
raw_notifier_call_chain+0x9e/0x100 kernel/notifier.c:406
call_netdevice_notifiers_info net/core/dev.c:1670 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1682 [inline]
call_netdevice_notifiers net/core/dev.c:1696 [inline]
__dev_close_many+0x154/0x320 net/core/dev.c:1384
__dev_close net/core/dev.c:1422 [inline]
__dev_change_flags+0x2db/0x6f0 net/core/dev.c:7884
dev_change_flags+0x85/0x190 net/core/dev.c:7957
dev_ifsioc+0x103/0xa60 net/core/dev_ioctl.c:237
dev_ioctl+0x460/0xb90 net/core/dev_ioctl.c:489
sock_do_ioctl+0x227/0x300 net/socket.c:1062
sock_ioctl+0x4cf/0x700 net/socket.c:1190
do_vfs_ioctl+0x746/0x16f0 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:714 [inline]
__do_sys_ioctl fs/ioctl.c:721 [inline]
__se_sys_ioctl fs/ioctl.c:719 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:719
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4479b9
Code: e8 ec e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 04 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd30e880da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006dcc68 RCX: 00000000004479b9
RDX: 00000000200008c0 RSI: 0000000000008914 RDI: 0000000000000005
RBP: 00000000006dcc60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc6c
R13: 0000000000000000 R14: 000000306e616c77 R15: 0000000000000000
Allocated by task 354:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x117/0x1b0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
__kmalloc_track_caller+0x201/0x2b0 mm/slub.c:4395
kmemdup+0x21/0x50 mm/util.c:127
ieee80211_ibss_join+0x6ff/0xcf0 net/mac80211/ibss.c:1818
rdev_join_ibss+0x1af/0x310 net/wireless/rdev-ops.h:522
__cfg80211_join_ibss+0x4a0/0x730 net/wireless/ibss.c:144
nl80211_join_ibss+0x1420/0x19d0 net/wireless/nl80211.c:9599
genl_family_rcv_msg net/netlink/genetlink.c:629 [inline]
genl_rcv_msg+0xe76/0x1330 net/netlink/genetlink.c:654
netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2478
genl_rcv+0x24/0x40 net/netlink/genetlink.c:665
netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
netlink_unicast+0x87c/0xa20 net/netlink/af_netlink.c:1329
netlink_sendmsg+0x9a7/0xd40 net/netlink/af_netlink.c:1918
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
____sys_sendmsg+0x56f/0x860 net/socket.c:2298
___sys_sendmsg net/socket.c:2352 [inline]
__sys_sendmsg+0x26a/0x350 net/socket.c:2398
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 361:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x168/0x220 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kfree+0x12b/0x5d0 mm/slub.c:4017
ieee80211_ibss_leave+0x7d/0xe0 net/mac80211/ibss.c:1870
rdev_leave_ibss+0x194/0x2f0 net/wireless/rdev-ops.h:532
__cfg80211_leave_ibss+0x6f/0x100 net/wireless/ibss.c:212
cfg80211_leave net/wireless/core.c:1216 [inline]
cfg80211_netdev_notifier_call+0x46b/0xee0 net/wireless/core.c:1325
notifier_call_chain kernel/notifier.c:98 [inline]
__raw_notifier_call_chain kernel/notifier.c:399 [inline]
raw_notifier_call_chain+0x9e/0x100 kernel/notifier.c:406
call_netdevice_notifiers_info net/core/dev.c:1670 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1682 [inline]
call_netdevice_notifiers net/core/dev.c:1696 [inline]
__dev_close_many+0x154/0x320 net/core/dev.c:1384
__dev_close net/core/dev.c:1422 [inline]
__dev_change_flags+0x2db/0x6f0 net/core/dev.c:7884
dev_change_flags+0x85/0x190 net/core/dev.c:7957
dev_ifsioc+0x103/0xa60 net/core/dev_ioctl.c:237
dev_ioctl+0x460/0xb90 net/core/dev_ioctl.c:489
sock_do_ioctl+0x227/0x300 net/socket.c:1062
sock_ioctl+0x4cf/0x700 net/socket.c:1190
do_vfs_ioctl+0x746/0x16f0 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:714 [inline]
__do_sys_ioctl fs/ioctl.c:721 [inline]
__se_sys_ioctl fs/ioctl.c:719 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:719
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881ceaa9200
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
192-byte region [ffff8881ceaa9200, ffff8881ceaa92c0)
The buggy address belongs to the page:
page:ffffea00073aaa40 refcount:1 mapcount:0 mapping:ffff8881da802a00 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 0000000000000000 0000000100000001 ffff8881da802a00
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881ceaa9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ceaa9180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881ceaa9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881ceaa9280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8881ceaa9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: ab402fc4 ANDROID: workqueue: add vendor hook for wq lockup..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=146b0227900000
kernel config: https://syzkaller.appspot.com/x/.config?x=889e2c88a7f30f62
dashboard link: https://syzkaller.appspot.com/bug?extid=6280fadb224f17f04990
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150c39c0500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15ada24f900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6280fa...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3051 [inline]
BUG: KASAN: double-free or invalid-free in kfree+0x12b/0x5d0 mm/slub.c:4017
CPU: 1 PID: 353 Comm: syz-executor478 Not tainted 5.4.69-syzkaller-00001-gab402fc4c187 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b0/0x21e lib/dump_stack.c:118
print_address_description+0x96/0x5d0 mm/kasan/report.c:374
kasan_report_invalid_free+0x54/0xc0 mm/kasan/report.c:468
__kasan_slab_free+0x102/0x220 mm/kasan/common.c:459
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kfree+0x12b/0x5d0 mm/slub.c:4017
ieee80211_ibss_leave+0x7d/0xe0 net/mac80211/ibss.c:1870
rdev_leave_ibss+0x194/0x2f0 net/wireless/rdev-ops.h:532
__cfg80211_leave_ibss+0x6f/0x100 net/wireless/ibss.c:212
cfg80211_leave net/wireless/core.c:1216 [inline]
cfg80211_netdev_notifier_call+0x46b/0xee0 net/wireless/core.c:1325
notifier_call_chain kernel/notifier.c:98 [inline]
__raw_notifier_call_chain kernel/notifier.c:399 [inline]
raw_notifier_call_chain+0x9e/0x100 kernel/notifier.c:406
call_netdevice_notifiers_info net/core/dev.c:1670 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1682 [inline]
call_netdevice_notifiers net/core/dev.c:1696 [inline]
__dev_close_many+0x154/0x320 net/core/dev.c:1384
__dev_close net/core/dev.c:1422 [inline]
__dev_change_flags+0x2db/0x6f0 net/core/dev.c:7884
dev_change_flags+0x85/0x190 net/core/dev.c:7957
dev_ifsioc+0x103/0xa60 net/core/dev_ioctl.c:237
dev_ioctl+0x460/0xb90 net/core/dev_ioctl.c:489
sock_do_ioctl+0x227/0x300 net/socket.c:1062
sock_ioctl+0x4cf/0x700 net/socket.c:1190
do_vfs_ioctl+0x746/0x16f0 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:714 [inline]
__do_sys_ioctl fs/ioctl.c:721 [inline]
__se_sys_ioctl fs/ioctl.c:719 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:719
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4479b9
Code: e8 ec e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 04 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd30e880da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006dcc68 RCX: 00000000004479b9
RDX: 00000000200008c0 RSI: 0000000000008914 RDI: 0000000000000005
RBP: 00000000006dcc60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc6c
R13: 0000000000000000 R14: 000000306e616c77 R15: 0000000000000000
Allocated by task 354:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x117/0x1b0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
__kmalloc_track_caller+0x201/0x2b0 mm/slub.c:4395
kmemdup+0x21/0x50 mm/util.c:127
ieee80211_ibss_join+0x6ff/0xcf0 net/mac80211/ibss.c:1818
rdev_join_ibss+0x1af/0x310 net/wireless/rdev-ops.h:522
__cfg80211_join_ibss+0x4a0/0x730 net/wireless/ibss.c:144
nl80211_join_ibss+0x1420/0x19d0 net/wireless/nl80211.c:9599
genl_family_rcv_msg net/netlink/genetlink.c:629 [inline]
genl_rcv_msg+0xe76/0x1330 net/netlink/genetlink.c:654
netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2478
genl_rcv+0x24/0x40 net/netlink/genetlink.c:665
netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
netlink_unicast+0x87c/0xa20 net/netlink/af_netlink.c:1329
netlink_sendmsg+0x9a7/0xd40 net/netlink/af_netlink.c:1918
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
____sys_sendmsg+0x56f/0x860 net/socket.c:2298
___sys_sendmsg net/socket.c:2352 [inline]
__sys_sendmsg+0x26a/0x350 net/socket.c:2398
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 361:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x168/0x220 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kfree+0x12b/0x5d0 mm/slub.c:4017
ieee80211_ibss_leave+0x7d/0xe0 net/mac80211/ibss.c:1870
rdev_leave_ibss+0x194/0x2f0 net/wireless/rdev-ops.h:532
__cfg80211_leave_ibss+0x6f/0x100 net/wireless/ibss.c:212
cfg80211_leave net/wireless/core.c:1216 [inline]
cfg80211_netdev_notifier_call+0x46b/0xee0 net/wireless/core.c:1325
notifier_call_chain kernel/notifier.c:98 [inline]
__raw_notifier_call_chain kernel/notifier.c:399 [inline]
raw_notifier_call_chain+0x9e/0x100 kernel/notifier.c:406
call_netdevice_notifiers_info net/core/dev.c:1670 [inline]
call_netdevice_notifiers_extack net/core/dev.c:1682 [inline]
call_netdevice_notifiers net/core/dev.c:1696 [inline]
__dev_close_many+0x154/0x320 net/core/dev.c:1384
__dev_close net/core/dev.c:1422 [inline]
__dev_change_flags+0x2db/0x6f0 net/core/dev.c:7884
dev_change_flags+0x85/0x190 net/core/dev.c:7957
dev_ifsioc+0x103/0xa60 net/core/dev_ioctl.c:237
dev_ioctl+0x460/0xb90 net/core/dev_ioctl.c:489
sock_do_ioctl+0x227/0x300 net/socket.c:1062
sock_ioctl+0x4cf/0x700 net/socket.c:1190
do_vfs_ioctl+0x746/0x16f0 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:714 [inline]
__do_sys_ioctl fs/ioctl.c:721 [inline]
__se_sys_ioctl fs/ioctl.c:719 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:719
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881ceaa9200
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
192-byte region [ffff8881ceaa9200, ffff8881ceaa92c0)
The buggy address belongs to the page:
page:ffffea00073aaa40 refcount:1 mapcount:0 mapping:ffff8881da802a00 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 0000000000000000 0000000100000001 ffff8881da802a00
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881ceaa9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ceaa9180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881ceaa9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881ceaa9280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8881ceaa9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Apr 16, 2023, 2:56:43 PM4/16/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages