[v5.15] KASAN: slab-out-of-bounds Read in __xfrm_decode_session
6 views
Skip to first unread message
syzbot
May 5, 2023, 6:26:08 PM5/5/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=159e6e18280000
kernel config: https://syzkaller.appspot.com/x/.config?x=ba8d5c9d6c5289f
dashboard link: https://syzkaller.appspot.com/bug?extid=98547f1ef754f8a551a0
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fc04f54c047f/disk-8a7f2a5c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6b4ba4cb1191/vmlinux-8a7f2a5c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d927dc3f9670/bzImage-8a7f2a5c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98547f...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in decode_session6 net/xfrm/xfrm_policy.c:3376 [inline]
BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x19de/0x23e0 net/xfrm/xfrm_policy.c:3483
Read of size 1 at addr ffff88806dbf6fae by task kworker/u4:14/4453
CPU: 1 PID: 4453 Comm: kworker/u4:14 Not tainted 5.15.110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: netns cleanup_net
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description+0x63/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
decode_session6 net/xfrm/xfrm_policy.c:3376 [inline]
__xfrm_decode_session+0x19de/0x23e0 net/xfrm/xfrm_policy.c:3483
vti6_tnl_xmit+0x439/0x1ae0
__netdev_start_xmit include/linux/netdevice.h:5019 [inline]
netdev_start_xmit include/linux/netdevice.h:5033 [inline]
xmit_one net/core/dev.c:3592 [inline]
dev_hard_start_xmit+0x298/0x7a0 net/core/dev.c:3608
sch_direct_xmit+0x2b2/0x5e0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0xae2/0x1e90 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3877 [inline]
__dev_queue_xmit+0xf0a/0x3230 net/core/dev.c:4188
neigh_output include/net/neighbour.h:516 [inline]
ip6_finish_output2+0xee4/0x14f0 net/ipv6/ip6_output.c:126
dst_output include/net/dst.h:449 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
ndisc_send_skb+0xae0/0x13c0 net/ipv6/ndisc.c:508
addrconf_rs_timer+0x357/0x610 net/ipv6/addrconf.c:3932
call_timer_fn+0x16d/0x560 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1737
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1750
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:636
irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1097
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:is_idle_task include/linux/sched.h:1872 [inline]
RIP: 0010:___might_sleep+0x1e4/0x6a0 kernel/sched/core.c:9594
Code: 89 e7 48 89 d3 e8 dc 64 70 00 48 89 da f6 84 24 a1 00 00 00 02 45 89 ec 74 46 4c 8d 62 2c 4c 89 e0 48 c1 e8 03 42 0f b6 04 30 <84> c0 0f 85 ec 03 00 00 41 f6 04 24 02 45 89 ec 75 24 48 8d 9a b0
RSP: 0018:ffffc900036df940 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: 1ffff920006dbf3c RCX: ffff8880300c8000
RDX: ffff8880300c8000 RSI: ffffffff8a8b0e00 RDI: ffffffff8ad858c0
RBP: ffffc900036dfa50 R08: dffffc0000000000 R09: fffffbfff1bc744e
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880300c802c
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff920006dbf30
inet_twsk_purge+0x10f/0xa20 net/ipv4/inet_timewait_sock.c:267
ops_exit_list net/core/net_namespace.c:174 [inline]
cleanup_net+0x763/0xb60 net/core/net_namespace.c:596
process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2306
worker_thread+0xaca/0x1280 kernel/workqueue.c:2453
kthread+0x3f6/0x4f0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
Allocated by task 5853:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513
kasan_kmalloc include/linux/kasan.h:264 [inline]
__kmalloc_node_track_caller+0x195/0x390 mm/slub.c:4963
kmalloc_reserve net/core/skbuff.c:356 [inline]
__alloc_skb+0x12c/0x590 net/core/skbuff.c:427
alloc_skb include/linux/skbuff.h:1167 [inline]
ndisc_alloc_skb+0xee/0x2c0 net/ipv6/ndisc.c:420
ndisc_send_rs+0x269/0x6a0 net/ipv6/ndisc.c:686
addrconf_rs_timer+0x357/0x610 net/ipv6/addrconf.c:3932
call_timer_fn+0x16d/0x560 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1737
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1750
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
Freed by task 5853:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0xf1/0x270 mm/slub.c:4559
skb_free_head net/core/skbuff.c:655 [inline]
skb_release_data+0x73a/0x8a0 net/core/skbuff.c:677
skb_release_all net/core/skbuff.c:742 [inline]
__kfree_skb net/core/skbuff.c:756 [inline]
kfree_skb_reason+0xb3/0x170 net/core/skbuff.c:776
kfree_skb include/linux/skbuff.h:1123 [inline]
xfrmi_xmit+0xac4/0x1590 net/xfrm/xfrm_interface.c:447
__netdev_start_xmit include/linux/netdevice.h:5019 [inline]
netdev_start_xmit include/linux/netdevice.h:5033 [inline]
xmit_one net/core/dev.c:3592 [inline]
dev_hard_start_xmit+0x298/0x7a0 net/core/dev.c:3608
__dev_queue_xmit+0x1cee/0x3230 net/core/dev.c:4223
neigh_output include/net/neighbour.h:516 [inline]
ip6_finish_output2+0xee4/0x14f0 net/ipv6/ip6_output.c:126
dst_output include/net/dst.h:449 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
ndisc_send_skb+0xae0/0x13c0 net/ipv6/ndisc.c:508
addrconf_rs_timer+0x357/0x610 net/ipv6/addrconf.c:3932
call_timer_fn+0x16d/0x560 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1737
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1750
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
The buggy address belongs to the object at ffff88806dbf6c00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 430 bytes to the right of
512-byte region [ffff88806dbf6c00, ffff88806dbf6e00)
The buggy address belongs to the page:
page:ffffea0001b6fd00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6dbf4
head:ffffea0001b6fd00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888011c41c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 14, ts 60823936311, free_ts 13308416334
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x322a/0x33c0 mm/page_alloc.c:4159
__alloc_pages+0x272/0x700 mm/page_alloc.c:5421
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xbb/0x4b0 mm/slub.c:1975
___slab_alloc+0x6f6/0xe10 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
__kmalloc_node_track_caller+0x1f6/0x390 mm/slub.c:4958
kmalloc_reserve net/core/skbuff.c:356 [inline]
__alloc_skb+0x12c/0x590 net/core/skbuff.c:427
__napi_alloc_skb+0x15c/0x2d0 net/core/skbuff.c:568
napi_alloc_skb include/linux/skbuff.h:3046 [inline]
page_to_skb+0x294/0xd20 drivers/net/virtio_net.c:454
receive_mergeable drivers/net/virtio_net.c:1070 [inline]
receive_buf+0x1218/0x6490 drivers/net/virtio_net.c:1180
virtnet_receive drivers/net/virtio_net.c:1472 [inline]
virtnet_poll+0x629/0x1270 drivers/net/virtio_net.c:1585
__napi_poll+0xc7/0x440 net/core/dev.c:7008
napi_poll net/core/dev.c:7075 [inline]
net_rx_action+0x617/0xda0 net/core/dev.c:7162
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
run_ksoftirqd+0xc1/0x120 kernel/softirq.c:920
smpboot_thread_fn+0x51b/0x9d0 kernel/smpboot.c:164
kthread+0x3f6/0x4f0 kernel/kthread.c:319
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317
free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
free_contig_range+0x95/0xf0 mm/page_alloc.c:9340
destroy_args+0xfe/0x97f mm/debug_vm_pgtable.c:1018
debug_vm_pgtable+0x40d/0x462 mm/debug_vm_pgtable.c:1331
do_one_initcall+0x22b/0x7a0 init/main.c:1306
do_initcall_level+0x157/0x207 init/main.c:1379
do_initcalls+0x49/0x86 init/main.c:1395
kernel_init_freeable+0x43c/0x5c5 init/main.c:1619
kernel_init+0x19/0x290 init/main.c:1510
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Memory state around the buggy address:
ffff88806dbf6e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806dbf6f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88806dbf6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88806dbf7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88806dbf7080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 89 e7 mov %esp,%edi
2: 48 89 d3 mov %rdx,%rbx
5: e8 dc 64 70 00 callq 0x7064e6
a: 48 89 da mov %rbx,%rdx
d: f6 84 24 a1 00 00 00 testb $0x2,0xa1(%rsp)
14: 02
15: 45 89 ec mov %r13d,%r12d
18: 74 46 je 0x60
1a: 4c 8d 62 2c lea 0x2c(%rdx),%r12
1e: 4c 89 e0 mov %r12,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax
* 2a: 84 c0 test %al,%al <-- trapping instruction
2c: 0f 85 ec 03 00 00 jne 0x41e
32: 41 f6 04 24 02 testb $0x2,(%r12)
37: 45 89 ec mov %r13d,%r12d
3a: 75 24 jne 0x60
3c: 48 rex.W
3d: 8d .byte 0x8d
3e: 9a (bad)
3f: b0 .byte 0xb0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=159e6e18280000
kernel config: https://syzkaller.appspot.com/x/.config?x=ba8d5c9d6c5289f
dashboard link: https://syzkaller.appspot.com/bug?extid=98547f1ef754f8a551a0
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fc04f54c047f/disk-8a7f2a5c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6b4ba4cb1191/vmlinux-8a7f2a5c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d927dc3f9670/bzImage-8a7f2a5c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98547f...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in decode_session6 net/xfrm/xfrm_policy.c:3376 [inline]
BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x19de/0x23e0 net/xfrm/xfrm_policy.c:3483
Read of size 1 at addr ffff88806dbf6fae by task kworker/u4:14/4453
CPU: 1 PID: 4453 Comm: kworker/u4:14 Not tainted 5.15.110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: netns cleanup_net
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description+0x63/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
decode_session6 net/xfrm/xfrm_policy.c:3376 [inline]
__xfrm_decode_session+0x19de/0x23e0 net/xfrm/xfrm_policy.c:3483
vti6_tnl_xmit+0x439/0x1ae0
__netdev_start_xmit include/linux/netdevice.h:5019 [inline]
netdev_start_xmit include/linux/netdevice.h:5033 [inline]
xmit_one net/core/dev.c:3592 [inline]
dev_hard_start_xmit+0x298/0x7a0 net/core/dev.c:3608
sch_direct_xmit+0x2b2/0x5e0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0xae2/0x1e90 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3877 [inline]
__dev_queue_xmit+0xf0a/0x3230 net/core/dev.c:4188
neigh_output include/net/neighbour.h:516 [inline]
ip6_finish_output2+0xee4/0x14f0 net/ipv6/ip6_output.c:126
dst_output include/net/dst.h:449 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
ndisc_send_skb+0xae0/0x13c0 net/ipv6/ndisc.c:508
addrconf_rs_timer+0x357/0x610 net/ipv6/addrconf.c:3932
call_timer_fn+0x16d/0x560 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1737
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1750
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:636
irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1097
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:is_idle_task include/linux/sched.h:1872 [inline]
RIP: 0010:___might_sleep+0x1e4/0x6a0 kernel/sched/core.c:9594
Code: 89 e7 48 89 d3 e8 dc 64 70 00 48 89 da f6 84 24 a1 00 00 00 02 45 89 ec 74 46 4c 8d 62 2c 4c 89 e0 48 c1 e8 03 42 0f b6 04 30 <84> c0 0f 85 ec 03 00 00 41 f6 04 24 02 45 89 ec 75 24 48 8d 9a b0
RSP: 0018:ffffc900036df940 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: 1ffff920006dbf3c RCX: ffff8880300c8000
RDX: ffff8880300c8000 RSI: ffffffff8a8b0e00 RDI: ffffffff8ad858c0
RBP: ffffc900036dfa50 R08: dffffc0000000000 R09: fffffbfff1bc744e
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880300c802c
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff920006dbf30
inet_twsk_purge+0x10f/0xa20 net/ipv4/inet_timewait_sock.c:267
ops_exit_list net/core/net_namespace.c:174 [inline]
cleanup_net+0x763/0xb60 net/core/net_namespace.c:596
process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2306
worker_thread+0xaca/0x1280 kernel/workqueue.c:2453
kthread+0x3f6/0x4f0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
Allocated by task 5853:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513
kasan_kmalloc include/linux/kasan.h:264 [inline]
__kmalloc_node_track_caller+0x195/0x390 mm/slub.c:4963
kmalloc_reserve net/core/skbuff.c:356 [inline]
__alloc_skb+0x12c/0x590 net/core/skbuff.c:427
alloc_skb include/linux/skbuff.h:1167 [inline]
ndisc_alloc_skb+0xee/0x2c0 net/ipv6/ndisc.c:420
ndisc_send_rs+0x269/0x6a0 net/ipv6/ndisc.c:686
addrconf_rs_timer+0x357/0x610 net/ipv6/addrconf.c:3932
call_timer_fn+0x16d/0x560 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1737
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1750
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
Freed by task 5853:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x80 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0xf1/0x270 mm/slub.c:4559
skb_free_head net/core/skbuff.c:655 [inline]
skb_release_data+0x73a/0x8a0 net/core/skbuff.c:677
skb_release_all net/core/skbuff.c:742 [inline]
__kfree_skb net/core/skbuff.c:756 [inline]
kfree_skb_reason+0xb3/0x170 net/core/skbuff.c:776
kfree_skb include/linux/skbuff.h:1123 [inline]
xfrmi_xmit+0xac4/0x1590 net/xfrm/xfrm_interface.c:447
__netdev_start_xmit include/linux/netdevice.h:5019 [inline]
netdev_start_xmit include/linux/netdevice.h:5033 [inline]
xmit_one net/core/dev.c:3592 [inline]
dev_hard_start_xmit+0x298/0x7a0 net/core/dev.c:3608
__dev_queue_xmit+0x1cee/0x3230 net/core/dev.c:4223
neigh_output include/net/neighbour.h:516 [inline]
ip6_finish_output2+0xee4/0x14f0 net/ipv6/ip6_output.c:126
dst_output include/net/dst.h:449 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
ndisc_send_skb+0xae0/0x13c0 net/ipv6/ndisc.c:508
addrconf_rs_timer+0x357/0x610 net/ipv6/addrconf.c:3932
call_timer_fn+0x16d/0x560 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1737
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1750
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
The buggy address belongs to the object at ffff88806dbf6c00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 430 bytes to the right of
512-byte region [ffff88806dbf6c00, ffff88806dbf6e00)
The buggy address belongs to the page:
page:ffffea0001b6fd00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6dbf4
head:ffffea0001b6fd00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888011c41c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 14, ts 60823936311, free_ts 13308416334
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x322a/0x33c0 mm/page_alloc.c:4159
__alloc_pages+0x272/0x700 mm/page_alloc.c:5421
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab mm/slub.c:1912 [inline]
new_slab+0xbb/0x4b0 mm/slub.c:1975
___slab_alloc+0x6f6/0xe10 mm/slub.c:3008
__slab_alloc mm/slub.c:3095 [inline]
slab_alloc_node mm/slub.c:3186 [inline]
__kmalloc_node_track_caller+0x1f6/0x390 mm/slub.c:4958
kmalloc_reserve net/core/skbuff.c:356 [inline]
__alloc_skb+0x12c/0x590 net/core/skbuff.c:427
__napi_alloc_skb+0x15c/0x2d0 net/core/skbuff.c:568
napi_alloc_skb include/linux/skbuff.h:3046 [inline]
page_to_skb+0x294/0xd20 drivers/net/virtio_net.c:454
receive_mergeable drivers/net/virtio_net.c:1070 [inline]
receive_buf+0x1218/0x6490 drivers/net/virtio_net.c:1180
virtnet_receive drivers/net/virtio_net.c:1472 [inline]
virtnet_poll+0x629/0x1270 drivers/net/virtio_net.c:1585
__napi_poll+0xc7/0x440 net/core/dev.c:7008
napi_poll net/core/dev.c:7075 [inline]
net_rx_action+0x617/0xda0 net/core/dev.c:7162
__do_softirq+0x3b3/0x93a kernel/softirq.c:558
run_ksoftirqd+0xc1/0x120 kernel/softirq.c:920
smpboot_thread_fn+0x51b/0x9d0 kernel/smpboot.c:164
kthread+0x3f6/0x4f0 kernel/kthread.c:319
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317
free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
free_contig_range+0x95/0xf0 mm/page_alloc.c:9340
destroy_args+0xfe/0x97f mm/debug_vm_pgtable.c:1018
debug_vm_pgtable+0x40d/0x462 mm/debug_vm_pgtable.c:1331
do_one_initcall+0x22b/0x7a0 init/main.c:1306
do_initcall_level+0x157/0x207 init/main.c:1379
do_initcalls+0x49/0x86 init/main.c:1395
kernel_init_freeable+0x43c/0x5c5 init/main.c:1619
kernel_init+0x19/0x290 init/main.c:1510
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Memory state around the buggy address:
ffff88806dbf6e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806dbf6f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88806dbf6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88806dbf7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88806dbf7080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 89 e7 mov %esp,%edi
2: 48 89 d3 mov %rdx,%rbx
5: e8 dc 64 70 00 callq 0x7064e6
a: 48 89 da mov %rbx,%rdx
d: f6 84 24 a1 00 00 00 testb $0x2,0xa1(%rsp)
14: 02
15: 45 89 ec mov %r13d,%r12d
18: 74 46 je 0x60
1a: 4c 8d 62 2c lea 0x2c(%rdx),%r12
1e: 4c 89 e0 mov %r12,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax
* 2a: 84 c0 test %al,%al <-- trapping instruction
2c: 0f 85 ec 03 00 00 jne 0x41e
32: 41 f6 04 24 02 testb $0x2,(%r12)
37: 45 89 ec mov %r13d,%r12d
3a: 75 24 jne 0x60
3c: 48 rex.W
3d: 8d .byte 0x8d
3e: 9a (bad)
3f: b0 .byte 0xb0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jun 20, 2023, 1:20:14 PM6/20/23
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 471e639e59d1 Linux 5.15.117
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16cce7a7280000
kernel config: https://syzkaller.appspot.com/x/.config?x=eeb4064efec7aa39
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145a3247280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14ff8633280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2e7359ecba67/disk-471e639e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ef6d17e44bc3/vmlinux-471e639e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/99b68dbd7e00/Image-471e639e.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98547f...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in decode_session6 net/xfrm/xfrm_policy.c:3377 [inline]
BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x1520/0x1d20 net/xfrm/xfrm_policy.c:3484
Read of size 1 at addr ffff0000d9b4158d by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.117-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load1_noabort+0x44/0x50 mm/kasan/report_generic.c:306
decode_session6 net/xfrm/xfrm_policy.c:3377 [inline]
__xfrm_decode_session+0x1520/0x1d20 net/xfrm/xfrm_policy.c:3484
xfrm_decode_session include/net/xfrm.h:1155 [inline]
xfrmi_xmit+0x1a0/0x12f8 net/xfrm/xfrm_interface.c:356
__netdev_start_xmit include/linux/netdevice.h:5022 [inline]
netdev_start_xmit include/linux/netdevice.h:5036 [inline]
xmit_one net/core/dev.c:3594 [inline]
dev_hard_start_xmit+0x2bc/0x92c net/core/dev.c:3610
sch_direct_xmit+0x2e0/0x484 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x878/0x1fc0 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3879 [inline]
__dev_queue_xmit+0x1068/0x2a6c net/core/dev.c:4190
dev_queue_xmit+0x24/0x34 net/core/dev.c:4258
neigh_connected_output+0x334/0x378 net/core/neighbour.c:1553
neigh_output include/net/neighbour.h:516 [inline]
ip6_finish_output2+0x1344/0x1c48 net/ipv6/ip6_output.c:126
__ip6_finish_output+0x518/0x67c net/ipv6/ip6_output.c:191
ip6_finish_output+0x40/0x218 net/ipv6/ip6_output.c:201
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip6_output+0x270/0x594 net/ipv6/ip6_output.c:224
ndisc_send_rs+0x494/0x5fc net/ipv6/ndisc.c:702
addrconf_rs_timer+0x308/0x5a8 net/ipv6/addrconf.c:3932
call_timer_fn+0x19c/0x8f0 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x554/0x718 kernel/time/timer.c:1737
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1750
__do_softirq+0x344/0xe20 kernel/softirq.c:558
do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
invoke_softirq kernel/softirq.c:439 [inline]
__irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
irq_exit+0x14/0x88 kernel/softirq.c:660
handle_domain_irq+0xf4/0x178 kernel/irq/irqdesc.c:710
gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899
do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0xcc/0x4a8 kernel/sched/idle.c:112
cpuidle_idle_call kernel/sched/idle.c:194 [inline]
do_idle+0x1d4/0x4dc kernel/sched/idle.c:306
cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:403
secondary_start_kernel+0x240/0x298 arch/arm64/kernel/smp.c:265
__secondary_switched+0x94/0x98 arch/arm64/kernel/head.S:661
Allocated by task 5581:
__kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
__kmalloc+0x29c/0x4c8 mm/slub.c:4407
kmalloc include/linux/slab.h:596 [inline]
tomoyo_realpath_from_path+0xd0/0x508 security/tomoyo/realpath.c:254
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x1dc/0x3f4 security/tomoyo/file.c:771
tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311
security_file_open+0x6c/0xb0 security/security.c:1650
do_dentry_open+0x29c/0xed8 fs/open.c:813
vfs_open+0x7c/0x90 fs/open.c:956
do_open fs/namei.c:3538 [inline]
path_openat+0x1f28/0x26f0 fs/namei.c:3672
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 5581:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
slab_free mm/slub.c:3499 [inline]
kfree+0x178/0x410 mm/slub.c:4559
tomoyo_realpath_from_path+0x4c0/0x508 security/tomoyo/realpath.c:291
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x1dc/0x3f4 security/tomoyo/file.c:771
tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311
security_file_open+0x6c/0xb0 security/security.c:1650
do_dentry_open+0x29c/0xed8 fs/open.c:813
vfs_open+0x7c/0x90 fs/open.c:956
do_open fs/namei.c:3538 [inline]
path_openat+0x1f28/0x26f0 fs/namei.c:3672
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000d9b40000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1421 bytes to the right of
4096-byte region [ffff0000d9b40000, ffff0000d9b41000)
head:00000000ff538ed2 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002a80
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
ffff0000d9b41500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000d9b41580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff0000d9b41600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d9b41680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 471e639e59d1 Linux 5.15.117
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16cce7a7280000
kernel config: https://syzkaller.appspot.com/x/.config?x=eeb4064efec7aa39
dashboard link: https://syzkaller.appspot.com/bug?extid=98547f1ef754f8a551a0
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145a3247280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14ff8633280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2e7359ecba67/disk-471e639e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ef6d17e44bc3/vmlinux-471e639e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/99b68dbd7e00/Image-471e639e.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+98547f...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x1520/0x1d20 net/xfrm/xfrm_policy.c:3484
Read of size 1 at addr ffff0000d9b4158d by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.117-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load1_noabort+0x44/0x50 mm/kasan/report_generic.c:306
decode_session6 net/xfrm/xfrm_policy.c:3377 [inline]
__xfrm_decode_session+0x1520/0x1d20 net/xfrm/xfrm_policy.c:3484
xfrm_decode_session include/net/xfrm.h:1155 [inline]
xfrmi_xmit+0x1a0/0x12f8 net/xfrm/xfrm_interface.c:356
__netdev_start_xmit include/linux/netdevice.h:5022 [inline]
netdev_start_xmit include/linux/netdevice.h:5036 [inline]
xmit_one net/core/dev.c:3594 [inline]
dev_hard_start_xmit+0x2bc/0x92c net/core/dev.c:3610
sch_direct_xmit+0x2e0/0x484 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x878/0x1fc0 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3879 [inline]
__dev_queue_xmit+0x1068/0x2a6c net/core/dev.c:4190
dev_queue_xmit+0x24/0x34 net/core/dev.c:4258
neigh_connected_output+0x334/0x378 net/core/neighbour.c:1553
neigh_output include/net/neighbour.h:516 [inline]
ip6_finish_output2+0x1344/0x1c48 net/ipv6/ip6_output.c:126
__ip6_finish_output+0x518/0x67c net/ipv6/ip6_output.c:191
ip6_finish_output+0x40/0x218 net/ipv6/ip6_output.c:201
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip6_output+0x270/0x594 net/ipv6/ip6_output.c:224
dst_output include/net/dst.h:449 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
ndisc_send_skb+0xbf8/0x1788 net/ipv6/ndisc.c:508
NF_HOOK include/linux/netfilter.h:307 [inline]
ndisc_send_rs+0x494/0x5fc net/ipv6/ndisc.c:702
addrconf_rs_timer+0x308/0x5a8 net/ipv6/addrconf.c:3932
call_timer_fn+0x19c/0x8f0 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers+0x554/0x718 kernel/time/timer.c:1737
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1750
__do_softirq+0x344/0xe20 kernel/softirq.c:558
do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
invoke_softirq kernel/softirq.c:439 [inline]
__irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
irq_exit+0x14/0x88 kernel/softirq.c:660
handle_domain_irq+0xf4/0x178 kernel/irq/irqdesc.c:710
gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899
do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0xcc/0x4a8 kernel/sched/idle.c:112
cpuidle_idle_call kernel/sched/idle.c:194 [inline]
do_idle+0x1d4/0x4dc kernel/sched/idle.c:306
cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:403
secondary_start_kernel+0x240/0x298 arch/arm64/kernel/smp.c:265
__secondary_switched+0x94/0x98 arch/arm64/kernel/head.S:661
Allocated by task 5581:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xbc/0xfc mm/kasan/common.c:513
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
__kmalloc+0x29c/0x4c8 mm/slub.c:4407
kmalloc include/linux/slab.h:596 [inline]
tomoyo_realpath_from_path+0xd0/0x508 security/tomoyo/realpath.c:254
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x1dc/0x3f4 security/tomoyo/file.c:771
tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311
security_file_open+0x6c/0xb0 security/security.c:1650
do_dentry_open+0x29c/0xed8 fs/open.c:813
vfs_open+0x7c/0x90 fs/open.c:956
do_open fs/namei.c:3538 [inline]
path_openat+0x1f28/0x26f0 fs/namei.c:3672
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 5581:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free_hook mm/slub.c:1705 [inline]
slab_free mm/slub.c:3499 [inline]
kfree+0x178/0x410 mm/slub.c:4559
tomoyo_realpath_from_path+0x4c0/0x508 security/tomoyo/realpath.c:291
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x1dc/0x3f4 security/tomoyo/file.c:771
tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311
security_file_open+0x6c/0xb0 security/security.c:1650
do_dentry_open+0x29c/0xed8 fs/open.c:813
vfs_open+0x7c/0x90 fs/open.c:956
do_open fs/namei.c:3538 [inline]
path_openat+0x1f28/0x26f0 fs/namei.c:3672
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000d9b40000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1421 bytes to the right of
4096-byte region [ffff0000d9b40000, ffff0000d9b41000)
The buggy address belongs to the page:
page:00000000ff538ed2 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119b40
head:00000000ff538ed2 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002a80
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d9b41480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d9b41500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000d9b41580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff0000d9b41600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d9b41680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Feb 16, 2024, 6:16:20 PMFeb 16
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages