KASAN: use-after-free Read in dev_queue_xmit_nit
10 views
Skip to first unread message
syzbot
Oct 22, 2019, 3:23:11 PM10/22/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: c3038e71 Linux 4.19.80
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=145fe2df600000
kernel config: https://syzkaller.appspot.com/x/.config?x=44c623b7e5432cee
dashboard link: https://syzkaller.appspot.com/bug?extid=98d3d17521288c367d41
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+98d3d1...@syzkaller.appspotmail.com
protocol 88fb is buggy, dev hsr_slave_0
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:193
[inline]
BUG: KASAN: use-after-free in dev_queue_xmit_nit+0x896/0xa10
net/core/dev.c:2007
Read of size 8 at addr ffff888057bdbe30 by task syz-executor.1/26972
CPU: 1 PID: 26972 Comm: syz-executor.1 Not tainted 4.19.80 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
__read_once_size include/linux/compiler.h:193 [inline]
dev_queue_xmit_nit+0x896/0xa10 net/core/dev.c:2007
xmit_one net/core/dev.c:3253 [inline]
dev_hard_start_xmit+0xa7/0x980 net/core/dev.c:3273
__dev_queue_xmit+0x2704/0x2fe0 net/core/dev.c:3843
dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
hsr_xmit net/hsr/hsr_forward.c:237 [inline]
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0xd2e/0x1c10 net/hsr/hsr_forward.c:373
send_hsr_supervision_frame+0x8c8/0xf30 net/hsr/hsr_device.c:319
hsr_announce+0x12f/0x3b0 net/hsr/hsr_device.c:348
call_timer_fn+0x18d/0x720 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers kernel/time/timer.c:1684 [inline]
__run_timers kernel/time/timer.c:1652 [inline]
run_timer_softirq+0x64f/0x16a0 kernel/time/timer.c:1697
__do_softirq+0x25c/0x921 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789
[inline]
RIP: 0010:rcu_read_unlock_special+0x7a3/0xea0 kernel/rcu/tree_plugin.h:601
Code: 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 6d 06 00 00 48
83 3d 91 81 19 07 00 0f 84 21 02 00 00 48 8b 7d d0 57 9d <0f> 1f 44 00 00
48 83 c4 48 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 a4
RSP: 0018:ffff88805a407880 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e48c9 RBX: ffff8880ae92cfc0 RCX: 1ffff11013172551
RDX: dffffc0000000000 RSI: ffff888098b92a68 RDI: 0000000000000282
RBP: ffff88805a4078f0 R08: ffff888098b921c0 R09: ffff888098b92a88
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888098b921c0
R13: ffff888098b92534 R14: 0000000000000000 R15: ffff888098b92536
__rcu_read_unlock+0x161/0x170 kernel/rcu/tree_plugin.h:428
rcu_read_unlock include/linux/rcupdate.h:680 [inline]
dput+0x2c5/0x670 fs/dcache.c:839
path_put fs/namei.c:484 [inline]
put_link fs/namei.c:885 [inline]
step_into fs/namei.c:1772 [inline]
walk_component+0x9a8/0x2000 fs/namei.c:1829
link_path_walk.part.0+0x594/0x1330 fs/namei.c:2138
link_path_walk fs/namei.c:2072 [inline]
path_parentat.isra.0+0x51/0x160 fs/namei.c:2366
filename_parentat.isra.0+0x19c/0x410 fs/namei.c:2388
filename_create+0xb3/0x4f0 fs/namei.c:3618
user_path_create fs/namei.c:3693 [inline]
do_mkdirat+0xb5/0x2a0 fs/namei.c:3831
__do_sys_mkdirat fs/namei.c:3850 [inline]
__se_sys_mkdirat fs/namei.c:3848 [inline]
__x64_sys_mkdirat+0x76/0xb0 fs/namei.c:3848
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459cd9
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fb6cec66c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459cd9
RDX: 00000000000001ff RSI: 00000000200000c0 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb6cec676d4
R13: 00000000004c63b3 R14: 00000000004db558 R15: 00000000ffffffff
Allocated by task 26983:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15d/0x750 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x19c/0x2e0 net/core/sock.c:1466
sk_alloc+0x39/0xf70 net/core/sock.c:1520
packet_create+0x11e/0x860 net/packet/af_packet.c:3228
__sock_create+0x3d8/0x730 net/socket.c:1276
sock_create net/socket.c:1316 [inline]
__sys_socket+0x103/0x220 net/socket.c:1346
__do_sys_socket net/socket.c:1355 [inline]
__se_sys_socket net/socket.c:1353 [inline]
__x64_sys_socket+0x73/0xb0 net/socket.c:1353
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 26982:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
sk_prot_free net/core/sock.c:1503 [inline]
__sk_destruct+0x4a2/0x680 net/core/sock.c:1583
sk_destruct+0xc8/0x100 net/core/sock.c:1598
__sk_free+0xce/0x300 net/core/sock.c:1609
sk_free+0x42/0x50 net/core/sock.c:1620
sock_put include/net/sock.h:1702 [inline]
packet_release+0x927/0xc60 net/packet/af_packet.c:3057
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff888057bdb640
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 2032 bytes inside of
2048-byte region [ffff888057bdb640, ffff888057bdbe40)
The buggy address belongs to the page:
page:ffffea00015ef680 count:1 mapcount:0 mapping:ffff88812c3f0c40
index:0xffff888057bdadc0 compound_mapcount: 0
flags: 0x1fffc0000008100(slab|head)
raw: 01fffc0000008100 ffffea000286fd08 ffffea0001682a08 ffff88812c3f0c40
raw: ffff888057bdadc0 ffff888057bda540 0000000100000002 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888057bdbd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888057bdbd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888057bdbe00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888057bdbe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888057bdbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: c3038e71 Linux 4.19.80
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=145fe2df600000
kernel config: https://syzkaller.appspot.com/x/.config?x=44c623b7e5432cee
dashboard link: https://syzkaller.appspot.com/bug?extid=98d3d17521288c367d41
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+98d3d1...@syzkaller.appspotmail.com
protocol 88fb is buggy, dev hsr_slave_0
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:193
[inline]
BUG: KASAN: use-after-free in dev_queue_xmit_nit+0x896/0xa10
net/core/dev.c:2007
Read of size 8 at addr ffff888057bdbe30 by task syz-executor.1/26972
CPU: 1 PID: 26972 Comm: syz-executor.1 Not tainted 4.19.80 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
__read_once_size include/linux/compiler.h:193 [inline]
dev_queue_xmit_nit+0x896/0xa10 net/core/dev.c:2007
xmit_one net/core/dev.c:3253 [inline]
dev_hard_start_xmit+0xa7/0x980 net/core/dev.c:3273
__dev_queue_xmit+0x2704/0x2fe0 net/core/dev.c:3843
dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
hsr_xmit net/hsr/hsr_forward.c:237 [inline]
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0xd2e/0x1c10 net/hsr/hsr_forward.c:373
send_hsr_supervision_frame+0x8c8/0xf30 net/hsr/hsr_device.c:319
hsr_announce+0x12f/0x3b0 net/hsr/hsr_device.c:348
call_timer_fn+0x18d/0x720 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers kernel/time/timer.c:1684 [inline]
__run_timers kernel/time/timer.c:1652 [inline]
run_timer_softirq+0x64f/0x16a0 kernel/time/timer.c:1697
__do_softirq+0x25c/0x921 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789
[inline]
RIP: 0010:rcu_read_unlock_special+0x7a3/0xea0 kernel/rcu/tree_plugin.h:601
Code: 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 6d 06 00 00 48
83 3d 91 81 19 07 00 0f 84 21 02 00 00 48 8b 7d d0 57 9d <0f> 1f 44 00 00
48 83 c4 48 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 a4
RSP: 0018:ffff88805a407880 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e48c9 RBX: ffff8880ae92cfc0 RCX: 1ffff11013172551
RDX: dffffc0000000000 RSI: ffff888098b92a68 RDI: 0000000000000282
RBP: ffff88805a4078f0 R08: ffff888098b921c0 R09: ffff888098b92a88
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888098b921c0
R13: ffff888098b92534 R14: 0000000000000000 R15: ffff888098b92536
__rcu_read_unlock+0x161/0x170 kernel/rcu/tree_plugin.h:428
rcu_read_unlock include/linux/rcupdate.h:680 [inline]
dput+0x2c5/0x670 fs/dcache.c:839
path_put fs/namei.c:484 [inline]
put_link fs/namei.c:885 [inline]
step_into fs/namei.c:1772 [inline]
walk_component+0x9a8/0x2000 fs/namei.c:1829
link_path_walk.part.0+0x594/0x1330 fs/namei.c:2138
link_path_walk fs/namei.c:2072 [inline]
path_parentat.isra.0+0x51/0x160 fs/namei.c:2366
filename_parentat.isra.0+0x19c/0x410 fs/namei.c:2388
filename_create+0xb3/0x4f0 fs/namei.c:3618
user_path_create fs/namei.c:3693 [inline]
do_mkdirat+0xb5/0x2a0 fs/namei.c:3831
__do_sys_mkdirat fs/namei.c:3850 [inline]
__se_sys_mkdirat fs/namei.c:3848 [inline]
__x64_sys_mkdirat+0x76/0xb0 fs/namei.c:3848
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459cd9
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fb6cec66c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459cd9
RDX: 00000000000001ff RSI: 00000000200000c0 RDI: ffffffffffffff9c
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb6cec676d4
R13: 00000000004c63b3 R14: 00000000004db558 R15: 00000000ffffffff
Allocated by task 26983:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15d/0x750 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x19c/0x2e0 net/core/sock.c:1466
sk_alloc+0x39/0xf70 net/core/sock.c:1520
packet_create+0x11e/0x860 net/packet/af_packet.c:3228
__sock_create+0x3d8/0x730 net/socket.c:1276
sock_create net/socket.c:1316 [inline]
__sys_socket+0x103/0x220 net/socket.c:1346
__do_sys_socket net/socket.c:1355 [inline]
__se_sys_socket net/socket.c:1353 [inline]
__x64_sys_socket+0x73/0xb0 net/socket.c:1353
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 26982:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
sk_prot_free net/core/sock.c:1503 [inline]
__sk_destruct+0x4a2/0x680 net/core/sock.c:1583
sk_destruct+0xc8/0x100 net/core/sock.c:1598
__sk_free+0xce/0x300 net/core/sock.c:1609
sk_free+0x42/0x50 net/core/sock.c:1620
sock_put include/net/sock.h:1702 [inline]
packet_release+0x927/0xc60 net/packet/af_packet.c:3057
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff888057bdb640
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 2032 bytes inside of
2048-byte region [ffff888057bdb640, ffff888057bdbe40)
The buggy address belongs to the page:
page:ffffea00015ef680 count:1 mapcount:0 mapping:ffff88812c3f0c40
index:0xffff888057bdadc0 compound_mapcount: 0
flags: 0x1fffc0000008100(slab|head)
raw: 01fffc0000008100 ffffea000286fd08 ffffea0001682a08 ffff88812c3f0c40
raw: ffff888057bdadc0 ffff888057bda540 0000000100000002 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888057bdbd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888057bdbd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888057bdbe00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888057bdbe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888057bdbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Aug 19, 2020, 6:03:22 PM8/19/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: a834132b Linux 4.19.140
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1264b3a1900000
kernel config: https://syzkaller.appspot.com/x/.config?x=cf0941721f5dace0
dashboard link: https://syzkaller.appspot.com/bug?extid=98d3d17521288c367d41
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150dccb1900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98d3d1...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:193 [inline]
BUG: KASAN: use-after-free in dev_queue_xmit_nit+0x87e/0xa20 net/core/dev.c:2004
Read of size 8 at addr ffff8880a46b7170 by task syz-executor.4/10372
CPU: 0 PID: 10372 Comm: syz-executor.4 Not tainted 4.19.140-syzkaller #0
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
__read_once_size include/linux/compiler.h:193 [inline]
dev_queue_xmit_nit+0x87e/0xa20 net/core/dev.c:2004
xmit_one net/core/dev.c:3252 [inline]
dev_hard_start_xmit+0xaa/0x920 net/core/dev.c:3272
__dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
send_hsr_supervision_frame+0x917/0xf70 net/hsr/hsr_device.c:321
hsr_announce+0x125/0x3a0 net/hsr/hsr_device.c:350
call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1716
__do_softirq+0x26c/0x9a0 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x215/0x260 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184
Code: 48 c7 c0 48 5b d2 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d fc ea 94 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 9a ee c2 f9 eb c0 0f 0b 0f 0b 48 c7 c7 48
RSP: 0018:ffff88808afffa88 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff11a4b69 RBX: 0000000000000286 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffff888088adccc8 RDI: 0000000000000286
RBP: ffffffff88d95b00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888088adc440
R13: ffffffff88d95bc0 R14: ffff888088adc7b8 R15: ffffffff88d95b00
rcu_read_unlock_special+0x7ce/0xfc0 kernel/rcu/tree_plugin.h:587
__rcu_read_unlock+0x158/0x160 kernel/rcu/tree_plugin.h:428
rcu_read_unlock include/linux/rcupdate.h:680 [inline]
mntput_no_expire+0xfc/0xa30 fs/namespace.c:1133
mntput+0x67/0x90 fs/namespace.c:1187
__fput+0x41d/0x890 fs/file_table.c:292
task_work_run+0x148/0x1c0 kernel/task_work.c:113
get_signal+0x1b64/0x1f70 kernel/signal.c:2399
do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d4d9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f7b02429c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: 0000000020ffc000 RBX: 000000000001ff40 RCX: 000000000045d4d9
RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffc000
RBP: 000000000118d0d8 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000246 R12: 000000000118d08c
R13: 00007fffdef7c3ef R14: 00007f7b0242a9c0 R15: 000000000118d08c
Allocated by task 10371:
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15a/0x3c0 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x1e2/0x2d0 net/core/sock.c:1466
sk_alloc+0x36/0xec0 net/core/sock.c:1520
packet_create+0x117/0x850 net/packet/af_packet.c:3252
__sock_create+0x3d8/0x740 net/socket.c:1276
sock_create net/socket.c:1316 [inline]
__sys_socket+0xef/0x200 net/socket.c:1346
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 10370:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
sk_prot_free net/core/sock.c:1503 [inline]
__sk_destruct+0x5ff/0x810 net/core/sock.c:1584
sk_destruct net/core/sock.c:1599 [inline]
__sk_free+0x165/0x3b0 net/core/sock.c:1610
sk_free+0x3b/0x50 net/core/sock.c:1621
sock_put include/net/sock.h:1707 [inline]
packet_release+0x890/0xb70 net/packet/af_packet.c:3081
__sock_release+0xcd/0x2a0 net/socket.c:579
sock_close+0x15/0x20 net/socket.c:1140
__fput+0x2ce/0x890 fs/file_table.c:278
task_work_run+0x148/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880a46b6980
flags: 0xfffe0000008100(slab|head)
raw: 00fffe0000008100 ffffea000294d908 ffffea0002929188 ffff88812c39cc40
raw: 0000000000000000 ffff8880a46b6100 0000000100000003 0000000000000000
ffff8880a46b7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880a46b7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a46b7180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880a46b7200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
HEAD commit: a834132b Linux 4.19.140
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1264b3a1900000
kernel config: https://syzkaller.appspot.com/x/.config?x=cf0941721f5dace0
dashboard link: https://syzkaller.appspot.com/bug?extid=98d3d17521288c367d41
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150dccb1900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98d3d1...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:193 [inline]
Read of size 8 at addr ffff8880a46b7170 by task syz-executor.4/10372
CPU: 0 PID: 10372 Comm: syz-executor.4 Not tainted 4.19.140-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
__read_once_size include/linux/compiler.h:193 [inline]
dev_queue_xmit_nit+0x87e/0xa20 net/core/dev.c:2004
xmit_one net/core/dev.c:3252 [inline]
dev_hard_start_xmit+0xaa/0x920 net/core/dev.c:3272
__dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
hsr_xmit net/hsr/hsr_forward.c:237 [inline]
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0xd2d/0x1c30 net/hsr/hsr_forward.c:373
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
send_hsr_supervision_frame+0x917/0xf70 net/hsr/hsr_device.c:321
hsr_announce+0x125/0x3a0 net/hsr/hsr_device.c:350
call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1716
__do_softirq+0x26c/0x9a0 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x215/0x260 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184
Code: 48 c7 c0 48 5b d2 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d fc ea 94 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 9a ee c2 f9 eb c0 0f 0b 0f 0b 48 c7 c7 48
RSP: 0018:ffff88808afffa88 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff11a4b69 RBX: 0000000000000286 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffff888088adccc8 RDI: 0000000000000286
RBP: ffffffff88d95b00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888088adc440
R13: ffffffff88d95bc0 R14: ffff888088adc7b8 R15: ffffffff88d95b00
rcu_read_unlock_special+0x7ce/0xfc0 kernel/rcu/tree_plugin.h:587
__rcu_read_unlock+0x158/0x160 kernel/rcu/tree_plugin.h:428
rcu_read_unlock include/linux/rcupdate.h:680 [inline]
mntput_no_expire+0xfc/0xa30 fs/namespace.c:1133
mntput+0x67/0x90 fs/namespace.c:1187
__fput+0x41d/0x890 fs/file_table.c:292
task_work_run+0x148/0x1c0 kernel/task_work.c:113
get_signal+0x1b64/0x1f70 kernel/signal.c:2399
do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d4d9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f7b02429c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: 0000000020ffc000 RBX: 000000000001ff40 RCX: 000000000045d4d9
RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffc000
RBP: 000000000118d0d8 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000246 R12: 000000000118d08c
R13: 00007fffdef7c3ef R14: 00007f7b0242a9c0 R15: 000000000118d08c
Allocated by task 10371:
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15a/0x3c0 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x1e2/0x2d0 net/core/sock.c:1466
sk_alloc+0x36/0xec0 net/core/sock.c:1520
packet_create+0x117/0x850 net/packet/af_packet.c:3252
__sock_create+0x3d8/0x740 net/socket.c:1276
sock_create net/socket.c:1316 [inline]
__sys_socket+0xef/0x200 net/socket.c:1346
__do_sys_socket net/socket.c:1355 [inline]
__se_sys_socket net/socket.c:1353 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1353
__se_sys_socket net/socket.c:1353 [inline]
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 10370:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
sk_prot_free net/core/sock.c:1503 [inline]
__sk_destruct+0x5ff/0x810 net/core/sock.c:1584
sk_destruct net/core/sock.c:1599 [inline]
__sk_free+0x165/0x3b0 net/core/sock.c:1610
sk_free+0x3b/0x50 net/core/sock.c:1621
sock_put include/net/sock.h:1707 [inline]
packet_release+0x890/0xb70 net/packet/af_packet.c:3081
__sock_release+0xcd/0x2a0 net/socket.c:579
sock_close+0x15/0x20 net/socket.c:1140
__fput+0x2ce/0x890 fs/file_table.c:278
task_work_run+0x148/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880a46b6980
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 2032 bytes inside of
2048-byte region [ffff8880a46b6980, ffff8880a46b7180)
The buggy address is located 2032 bytes inside of
The buggy address belongs to the page:
page:ffffea000291ad80 count:1 mapcount:0 mapping:ffff88812c39cc40 index:0x0 compound_mapcount: 0
flags: 0xfffe0000008100(slab|head)
raw: 00fffe0000008100 ffffea000294d908 ffffea0002929188 ffff88812c39cc40
raw: 0000000000000000 ffff8880a46b6100 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a46b7000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Memory state around the buggy address:
ffff8880a46b7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880a46b7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a46b7180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880a46b7200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
syzbot
Feb 26, 2022, 9:45:28 PM2/26/22
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=175289fe700000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=98d3d17521288c367d41
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11b79b32700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=160215b6700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98d3d1...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:263 [inline]
BUG: KASAN: use-after-free in dev_queue_xmit_nit+0x87e/0xa20 net/core/dev.c:2004
Read of size 8 at addr ffff888092a4f470 by task syz-executor117/25955
CPU: 1 PID: 25955 Comm: syz-executor117 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
__read_once_size include/linux/compiler.h:263 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
dev_queue_xmit_nit+0x87e/0xa20 net/core/dev.c:2004
xmit_one net/core/dev.c:3252 [inline]
dev_hard_start_xmit+0xaa/0x920 net/core/dev.c:3272
__dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
neigh_hh_output include/net/neighbour.h:491 [inline]
xmit_one net/core/dev.c:3252 [inline]
dev_hard_start_xmit+0xaa/0x920 net/core/dev.c:3272
__dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
neigh_output include/net/neighbour.h:499 [inline]
ip6_finish_output2+0xde7/0x2290 net/ipv6/ip6_output.c:120
ip6_finish_output+0x89b/0x10f0 net/ipv6/ip6_output.c:192
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip6_output+0x205/0x770 net/ipv6/ip6_output.c:209
dst_output include/net/dst.h:455 [inline]
NF_HOOK include/linux/netfilter.h:289 [inline]
ndisc_send_skb+0xa24/0x1720 net/ipv6/ndisc.c:491
ndisc_send_rs+0x131/0x690 net/ipv6/ndisc.c:685
addrconf_rs_timer+0x384/0x6a0 net/ipv6/addrconf.c:3835
call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1696 [inline]
expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
__do_softirq+0x265/0x980 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x215/0x260 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184
Code: 48 c7 c0 88 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d 7c 31 d8 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 fb eb e6 f8 eb c0 0f 0b 0f 0b 48 c7 c7 88
RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184
RSP: 0018:ffff888092137680 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3051 RBX: 0000000000000286 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffff8880a6534b08 RDI: 0000000000000286
RBP: ffffffff8d3e1408 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dead000000000200
R13: ffff88809abc0000 R14: 0000000000000000 R15: dffffc0000000000
__debug_check_no_obj_freed lib/debugobjects.c:798 [inline]
debug_check_no_obj_freed+0x201/0x490 lib/debugobjects.c:817
free_pages_prepare mm/page_alloc.c:1056 [inline]
__free_pages_ok+0x22d/0xd30 mm/page_alloc.c:1279
free_thread_stack kernel/fork.c:270 [inline]
release_task_stack kernel/fork.c:385 [inline]
put_task_stack+0xd2/0x1f0 kernel/fork.c:396
finish_task_switch+0x523/0x760 kernel/sched/core.c:2710
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x88f/0x2040 kernel/sched/core.c:3517
preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:3641
___preempt_schedule+0x16/0x18
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
_raw_spin_unlock_irqrestore+0xaf/0xe0 kernel/locking/spinlock.c:184
__rcu_read_unlock+0x158/0x160 kernel/rcu/tree_plugin.h:428
rcu_read_unlock include/linux/rcupdate.h:680 [inline]
is_bpf_text_address+0xdf/0x1b0 kernel/bpf/core.c:548
kernel_text_address kernel/extable.c:152 [inline]
kernel_text_address+0xbd/0xf0 kernel/extable.c:122
__kernel_text_address+0x9/0x30 kernel/extable.c:107
unwind_get_return_address arch/x86/kernel/unwind_orc.c:297 [inline]
unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_orc.c:292
__save_stack_trace+0xaf/0x190 arch/x86/kernel/stacktrace.c:45
save_stack mm/kasan/kasan.c:448 [inline]
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553
kmem_cache_alloc+0x122/0x370 mm/slab.c:3559
__d_alloc+0x2b/0xa10 fs/dcache.c:1612
d_alloc_pseudo+0x19/0x70 fs/dcache.c:1743
alloc_file_pseudo+0xc6/0x250 fs/file_table.c:224
sock_alloc_file+0x48/0x180 net/socket.c:406
sock_map_fd net/socket.c:429 [inline]
__sys_socket+0x13d/0x200 net/socket.c:1462
__do_sys_socket net/socket.c:1467 [inline]
__se_sys_socket net/socket.c:1465 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1465
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb022342e89
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb021ae01f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 0000000000000014 RCX: 00007fb022342e89
RDX: 0000000000000300 RSI: 0000000000000002 RDI: 0000000000000011
RBP: 00007fb0223cb280 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb0223cb28c
R13: 00007fff4176abaf R14: 00007fb021ae0300 R15: 0000000000022000
Allocated by task 25951:
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15a/0x3c0 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x1e2/0x2d0 net/core/sock.c:1483
sk_alloc+0x36/0xec0 net/core/sock.c:1537
packet_create+0x117/0x850 net/packet/af_packet.c:3259
__sock_create+0x3d8/0x740 net/socket.c:1365
sock_create net/socket.c:1416 [inline]
__sys_socket+0xef/0x200 net/socket.c:1458
__do_sys_socket net/socket.c:1467 [inline]
__se_sys_socket net/socket.c:1465 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1465
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 25959:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
sk_prot_free net/core/sock.c:1520 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
__sk_destruct+0x684/0x8a0 net/core/sock.c:1602
sk_destruct net/core/sock.c:1617 [inline]
__sk_free+0x165/0x3b0 net/core/sock.c:1628
sk_free+0x3b/0x50 net/core/sock.c:1639
sock_put include/net/sock.h:1713 [inline]
packet_release+0x890/0xb70 net/packet/af_packet.c:3088
__sock_release+0xcd/0x2a0 net/socket.c:599
sock_close+0x15/0x20 net/socket.c:1214
__fput+0x2ce/0x890 fs/file_table.c:278
task_work_run+0x148/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
task_work_run+0x148/0x1c0 kernel/task_work.c:113
do_exit+0xbf3/0x2be0 kernel/exit.c:870
do_group_exit+0x125/0x310 kernel/exit.c:967
get_signal+0x3f2/0x1f70 kernel/signal.c:2589
do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799
exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff888092a4ec40
which belongs to the cache kmalloc-4096 of size 4096
The buggy address is located 2096 bytes inside of
4096-byte region [ffff888092a4ec40, ffff888092a4fc40)
The buggy address belongs to the page:
page:ffffea00024a9380 count:1 mapcount:0 mapping:ffff88813bff0dc0 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffffea0002953d88 ffffea0002408e88 ffff88813bff0dc0
raw: 0000000000000000 ffff888092a4ec40 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888092a4f300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Memory state around the buggy address:
ffff888092a4f380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888092a4f400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888092a4f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888092a4f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 48 c7 c0 88 82 f1 89 mov $0xffffffff89f18288,%rax
7: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
e: fc ff df
11: 48 c1 e8 03 shr $0x3,%rax
15: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1)
19: 75 2f jne 0x4a
1b: 48 83 3d 7c 31 d8 01 cmpq $0x0,0x1d8317c(%rip) # 0x1d8319f
22: 00
23: 74 15 je 0x3a
25: 48 89 df mov %rbx,%rdi
28: 57 push %rdi
29: 9d popfq
* 2a: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) <-- trapping instruction
2f: eb b2 jmp 0xffffffe3
31: e8 fb eb e6 f8 callq 0xf8e6ec31
36: eb c0 jmp 0xfffffff8
38: 0f 0b ud2
3a: 0f 0b ud2
3c: 48 rex.W
3d: c7 .byte 0xc7
3e: c7 (bad)
3f: 88 .byte 0x88
Reply all
Reply to author
Forward
0 new messages