KASAN: use-after-free Read in nr_release
25 views
Skip to first unread message
syzbot
Aug 9, 2019, 9:07:05 PM8/9/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 893af1c7 Linux 4.19.66
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=131c298c600000
kernel config: https://syzkaller.appspot.com/x/.config?x=d5fac5a8617b8643
dashboard link: https://syzkaller.appspot.com/bug?extid=33090272a4173513d932
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+330902...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic_read
include/asm-generic/atomic-instrumented.h:21 [inline]
BUG: KASAN: use-after-free in refcount_inc_not_zero_checked+0x7b/0x200
lib/refcount.c:120
Read of size 4 at addr ffff8880a851ce40 by task syz-executor.2/27328
CPU: 1 PID: 27328 Comm: syz-executor.2 Not tainted 4.19.66 #40
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
refcount_inc_not_zero_checked+0x7b/0x200 lib/refcount.c:120
refcount_inc_checked+0x17/0x70 lib/refcount.c:153
sock_hold include/net/sock.h:647 [inline]
nr_release+0x62/0x3b0 net/netrom/af_netrom.c:523
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x413511
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffdcc0a09c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000413511
RDX: 0000000000000000 RSI: ffffffff86f0d7ba RDI: 0000000000000005
RBP: 0000000000000001 R08: ffffffff8130f15a R09: 000000004942f2fa
R10: 00007ffdcc0a0aa0 R11: 0000000000000293 R12: 000000000075c9a0
R13: 000000000075c9a0 R14: 00000000007616f0 R15: ffffffffffffffff
Allocated by task 27334:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15d/0x750 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x19c/0x2e0 net/core/sock.c:1466
sk_alloc+0x39/0xf70 net/core/sock.c:1520
nr_create+0xb9/0x5e0 net/netrom/af_netrom.c:436
__sock_create+0x3d8/0x730 net/socket.c:1276
sock_create net/socket.c:1316 [inline]
__sys_socket+0x103/0x220 net/socket.c:1346
__do_sys_socket net/socket.c:1355 [inline]
__se_sys_socket net/socket.c:1353 [inline]
__x64_sys_socket+0x73/0xb0 net/socket.c:1353
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 27328:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
sk_prot_free net/core/sock.c:1503 [inline]
__sk_destruct+0x4ef/0x6d0 net/core/sock.c:1585
sk_destruct+0x7b/0x90 net/core/sock.c:1593
__sk_free+0xce/0x300 net/core/sock.c:1604
sk_free+0x42/0x50 net/core/sock.c:1615
sock_put include/net/sock.h:1702 [inline]
nr_release+0x332/0x3b0 net/netrom/af_netrom.c:557
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880a851cdc0
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 128 bytes inside of
2048-byte region [ffff8880a851cdc0, ffff8880a851d5c0)
The buggy address belongs to the page:
page:ffffea0002a14700 count:1 mapcount:0 mapping:ffff88812c3f0c40 index:0x0
compound_mapcount: 0
flags: 0x1fffc0000008100(slab|head)
raw: 01fffc0000008100 ffffea00018d5588 ffffea0002384e08 ffff88812c3f0c40
raw: 0000000000000000 ffff8880a851c540 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a851cd00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880a851cd80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff8880a851ce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a851ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a851cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 893af1c7 Linux 4.19.66
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=131c298c600000
kernel config: https://syzkaller.appspot.com/x/.config?x=d5fac5a8617b8643
dashboard link: https://syzkaller.appspot.com/bug?extid=33090272a4173513d932
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+330902...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in atomic_read
include/asm-generic/atomic-instrumented.h:21 [inline]
BUG: KASAN: use-after-free in refcount_inc_not_zero_checked+0x7b/0x200
lib/refcount.c:120
Read of size 4 at addr ffff8880a851ce40 by task syz-executor.2/27328
CPU: 1 PID: 27328 Comm: syz-executor.2 Not tainted 4.19.66 #40
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
refcount_inc_not_zero_checked+0x7b/0x200 lib/refcount.c:120
refcount_inc_checked+0x17/0x70 lib/refcount.c:153
sock_hold include/net/sock.h:647 [inline]
nr_release+0x62/0x3b0 net/netrom/af_netrom.c:523
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x413511
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffdcc0a09c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000413511
RDX: 0000000000000000 RSI: ffffffff86f0d7ba RDI: 0000000000000005
RBP: 0000000000000001 R08: ffffffff8130f15a R09: 000000004942f2fa
R10: 00007ffdcc0a0aa0 R11: 0000000000000293 R12: 000000000075c9a0
R13: 000000000075c9a0 R14: 00000000007616f0 R15: ffffffffffffffff
Allocated by task 27334:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15d/0x750 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x19c/0x2e0 net/core/sock.c:1466
sk_alloc+0x39/0xf70 net/core/sock.c:1520
nr_create+0xb9/0x5e0 net/netrom/af_netrom.c:436
__sock_create+0x3d8/0x730 net/socket.c:1276
sock_create net/socket.c:1316 [inline]
__sys_socket+0x103/0x220 net/socket.c:1346
__do_sys_socket net/socket.c:1355 [inline]
__se_sys_socket net/socket.c:1353 [inline]
__x64_sys_socket+0x73/0xb0 net/socket.c:1353
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 27328:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
sk_prot_free net/core/sock.c:1503 [inline]
__sk_destruct+0x4ef/0x6d0 net/core/sock.c:1585
sk_destruct+0x7b/0x90 net/core/sock.c:1593
__sk_free+0xce/0x300 net/core/sock.c:1604
sk_free+0x42/0x50 net/core/sock.c:1615
sock_put include/net/sock.h:1702 [inline]
nr_release+0x332/0x3b0 net/netrom/af_netrom.c:557
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880a851cdc0
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 128 bytes inside of
2048-byte region [ffff8880a851cdc0, ffff8880a851d5c0)
The buggy address belongs to the page:
page:ffffea0002a14700 count:1 mapcount:0 mapping:ffff88812c3f0c40 index:0x0
compound_mapcount: 0
flags: 0x1fffc0000008100(slab|head)
raw: 01fffc0000008100 ffffea00018d5588 ffffea0002384e08 ffff88812c3f0c40
raw: 0000000000000000 ffff8880a851c540 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a851cd00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880a851cd80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff8880a851ce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a851ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a851cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Aug 13, 2019, 8:20:06 AM8/13/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 3ffe1e79 Linux 4.14.138
syzbot found the following crash on:
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=115d0572600000
kernel config: https://syzkaller.appspot.com/x/.config?x=978e269523a888e8
dashboard link: https://syzkaller.appspot.com/bug?extid=7e79fbe1b2d89a255fc2
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7e79fb...@syzkaller.appspotmail.com
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183
[inline]
BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:27
[inline]
BUG: KASAN: use-after-free in refcount_inc_not_zero+0xd3/0xe0
lib/refcount.c:120
Read of size 4 at addr ffff88805bcaaa40 by task syz-executor.4/14169
CPU: 0 PID: 14169 Comm: syz-executor.4 Not tainted 4.14.138 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
Google 01/01/2011
Call Trace:
dump_stack+0x138/0x19c lib/dump_stack.c:53
print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
__read_once_size include/linux/compiler.h:183 [inline]
atomic_read arch/x86/include/asm/atomic.h:27 [inline]
refcount_inc_not_zero+0xd3/0xe0 lib/refcount.c:120
refcount_inc+0x16/0x40 lib/refcount.c:153
sock_hold include/net/sock.h:619 [inline]
nr_release+0x5e/0x390 net/netrom/af_netrom.c:523
__sock_release+0xce/0x2b0 net/socket.c:602
sock_close+0x1b/0x30 net/socket.c:1139
__fput+0x275/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x114/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x413511
RSP: 002b:00007ffce6032ea0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000413511
RDX: 0000000000000000 RSI: 00000000000010d6 RDI: 0000000000000004
RBP: 0000000000000001 R08: 00000000e3d750d6 R09: 00000000e3d750da
R10: 00007ffce6032f80 R11: 0000000000000293 R12: 000000000075c9a0
R13: 000000000075c9a0 R14: 00000000007619b8 R15: ffffffffffffffff
Allocated by task 14172:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
__do_kmalloc mm/slab.c:3720 [inline]
__kmalloc+0x15d/0x7a0 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
sk_prot_alloc+0x171/0x2a0 net/core/sock.c:1467
sk_alloc+0x39/0xd70 net/core/sock.c:1521
nr_create+0xa1/0x5d0 net/netrom/af_netrom.c:436
__sock_create+0x2f6/0x620 net/socket.c:1275
sock_create net/socket.c:1315 [inline]
SYSC_socket net/socket.c:1345 [inline]
SyS_socket+0xd3/0x170 net/socket.c:1325
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
Freed by task 14169:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xcc/0x270 mm/slab.c:3815
sk_prot_free net/core/sock.c:1504 [inline]
__sk_destruct+0x493/0x5d0 net/core/sock.c:1583
sk_destruct+0x67/0x80 net/core/sock.c:1591
__sk_free+0x54/0x230 net/core/sock.c:1599
sk_free+0x35/0x40 net/core/sock.c:1610
sock_put include/net/sock.h:1653 [inline]
nr_release+0x309/0x390 net/netrom/af_netrom.c:557
__sock_release+0xce/0x2b0 net/socket.c:602
sock_close+0x1b/0x30 net/socket.c:1139
__fput+0x275/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x114/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x42/0xb7
The buggy address belongs to the object at ffff88805bcaa9c0
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 128 bytes inside of
2048-byte region [ffff88805bcaa9c0, ffff88805bcab1c0)
The buggy address is located 128 bytes inside of
The buggy address belongs to the page:
page:ffffea00016f2a80 count:1 mapcount:0 mapping:ffff88805bcaa140 index:0x0
compound_mapcount: 0
flags: 0x1fffc0000008100(slab|head)
raw: 01fffc0000008100 ffff88805bcaa140 0000000000000000 0000000100000003
flags: 0x1fffc0000008100(slab|head)
raw: ffffea00016f2da0 ffffea00016f32a0 ffff8880aa800c40 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88805bcaa900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
Memory state around the buggy address:
ffff88805bcaa980: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff88805bcaaa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88805bcaaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88805bcaab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
syzbot
Aug 20, 2019, 1:53:06 PM8/20/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: a5aa8058 Linux 4.19.67
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=176ed74a600000
kernel config: https://syzkaller.appspot.com/x/.config?x=8e5f93d2c874cdab
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1309e2ac600000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+330902...@syzkaller.appspotmail.com
8021q: adding VLAN 0 to HW filter on device batadv0
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
CPU: 1 PID: 7350 Comm: syz-executor303 Not tainted 4.19.67 #41
do_exit+0x994/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
get_signal+0x3ec/0x1fc0 kernel/signal.c:2574
do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
Code: Bad RIP value.
RSP: 002b:00007fff611671a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120
RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 0000000000446359
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000003 R08: 0000000301bbbbbb R09: 0000000301bbbbbb
R10: 0000000000000800 R11: 0000000000000246 R12: 0000000001a09850
R13: 000000000000000e R14: 0000000000000000 R15: 0000000000000000
Allocated by task 7350:
do_exit+0x994/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
get_signal+0x3ec/0x1fc0 kernel/signal.c:2574
do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
raw: 0000000000000000 ffff88809efb4540 0000000100000003 0000000000000000
ffff88809efb4d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff88809efb4e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809efb4e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809efb4f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
HEAD commit: a5aa8058 Linux 4.19.67
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=176ed74a600000
kernel config: https://syzkaller.appspot.com/x/.config?x=8e5f93d2c874cdab
dashboard link: https://syzkaller.appspot.com/bug?extid=33090272a4173513d932
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=168539a6600000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1309e2ac600000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+330902...@syzkaller.appspotmail.com
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KASAN: use-after-free in atomic_read
include/asm-generic/atomic-instrumented.h:21 [inline]
BUG: KASAN: use-after-free in refcount_inc_not_zero_checked+0x7b/0x200
lib/refcount.c:120
Read of size 4 at addr ffff88809efb4e40 by task syz-executor303/7350
BUG: KASAN: use-after-free in atomic_read
include/asm-generic/atomic-instrumented.h:21 [inline]
BUG: KASAN: use-after-free in refcount_inc_not_zero_checked+0x7b/0x200
lib/refcount.c:120
CPU: 1 PID: 7350 Comm: syz-executor303 Not tainted 4.19.67 #41
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
refcount_inc_not_zero_checked+0x7b/0x200 lib/refcount.c:120
refcount_inc_checked+0x17/0x70 lib/refcount.c:153
sock_hold include/net/sock.h:647 [inline]
nr_release+0x62/0x3b0 net/netrom/af_netrom.c:523
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x123/0x190 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
refcount_inc_not_zero_checked+0x7b/0x200 lib/refcount.c:120
refcount_inc_checked+0x17/0x70 lib/refcount.c:153
sock_hold include/net/sock.h:647 [inline]
nr_release+0x62/0x3b0 net/netrom/af_netrom.c:523
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
do_exit+0x994/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
get_signal+0x3ec/0x1fc0 kernel/signal.c:2574
do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446359
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: Bad RIP value.
RSP: 002b:00007fff611671a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120
RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 0000000000446359
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000003 R08: 0000000301bbbbbb R09: 0000000301bbbbbb
R10: 0000000000000800 R11: 0000000000000246 R12: 0000000001a09850
R13: 000000000000000e R14: 0000000000000000 R15: 0000000000000000
Allocated by task 7350:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15d/0x750 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x19c/0x2e0 net/core/sock.c:1466
sk_alloc+0x39/0xf70 net/core/sock.c:1520
nr_create+0xb9/0x5e0 net/netrom/af_netrom.c:436
__sock_create+0x3d8/0x730 net/socket.c:1276
sock_create net/socket.c:1316 [inline]
__sys_socket+0x103/0x220 net/socket.c:1346
__do_sys_socket net/socket.c:1355 [inline]
__se_sys_socket net/socket.c:1353 [inline]
__x64_sys_socket+0x73/0xb0 net/socket.c:1353
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 7350:
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
__do_kmalloc mm/slab.c:3727 [inline]
__kmalloc+0x15d/0x750 mm/slab.c:3736
kmalloc include/linux/slab.h:520 [inline]
sk_prot_alloc+0x19c/0x2e0 net/core/sock.c:1466
sk_alloc+0x39/0xf70 net/core/sock.c:1520
nr_create+0xb9/0x5e0 net/netrom/af_netrom.c:436
__sock_create+0x3d8/0x730 net/socket.c:1276
sock_create net/socket.c:1316 [inline]
__sys_socket+0x103/0x220 net/socket.c:1346
__do_sys_socket net/socket.c:1355 [inline]
__se_sys_socket net/socket.c:1353 [inline]
__x64_sys_socket+0x73/0xb0 net/socket.c:1353
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
sk_prot_free net/core/sock.c:1503 [inline]
__sk_destruct+0x4ef/0x6d0 net/core/sock.c:1585
sk_destruct+0x7b/0x90 net/core/sock.c:1593
__sk_free+0xce/0x300 net/core/sock.c:1604
sk_free+0x42/0x50 net/core/sock.c:1615
sock_put include/net/sock.h:1702 [inline]
nr_release+0x332/0x3b0 net/netrom/af_netrom.c:557
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
sk_prot_free net/core/sock.c:1503 [inline]
__sk_destruct+0x4ef/0x6d0 net/core/sock.c:1585
sk_destruct+0x7b/0x90 net/core/sock.c:1593
__sk_free+0xce/0x300 net/core/sock.c:1604
sk_free+0x42/0x50 net/core/sock.c:1615
sock_put include/net/sock.h:1702 [inline]
nr_release+0x332/0x3b0 net/netrom/af_netrom.c:557
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
do_exit+0x994/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
get_signal+0x3ec/0x1fc0 kernel/signal.c:2574
do_signal+0x95/0x1960 arch/x86/kernel/signal.c:821
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809efb4dc0
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 128 bytes inside of
2048-byte region [ffff88809efb4dc0, ffff88809efb55c0)
The buggy address is located 128 bytes inside of
The buggy address belongs to the page:
page:ffffea00027bed00 count:1 mapcount:0 mapping:ffff88812c3f0c40 index:0x0
compound_mapcount: 0
flags: 0x1fffc0000008100(slab|head)
raw: 01fffc0000008100 ffffea00021b3308 ffffea00025d6b08 ffff88812c3f0c40
flags: 0x1fffc0000008100(slab|head)
raw: 0000000000000000 ffff88809efb4540 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809efb4d00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
Memory state around the buggy address:
ffff88809efb4d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff88809efb4e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809efb4e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809efb4f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
syzbot
Sep 18, 2019, 10:43:08 AM9/18/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 968722f5 Linux 4.14.144
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=145b1e3d600000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4e2adafc1879954
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7e79fb...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
CPU: 1 PID: 6941 Comm: syz-executor.0 Not tainted 4.14.144 #0
RSP: 002b:00007fffb53c7fa0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004135d1
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff
R10: 00007fffb53c8080 R11: 0000000000000293 R12: 000000000075c9a0
R13: 000000000075c9a0 R14: 0000000000760c38 R15: 000000000075c124
Allocated by task 6945:
raw: ffffea00023471a0 ffffea0002177aa0 ffff8880aa800c40 0000000000000000
ffff888092b1ad80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff888092b1ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888092b1ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888092b1af00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
HEAD commit: 968722f5 Linux 4.14.144
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=145b1e3d600000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4e2adafc1879954
dashboard link: https://syzkaller.appspot.com/bug?extid=7e79fbe1b2d89a255fc2
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11cc23b5600000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7e79fb...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183
[inline]
BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:27
[inline]
BUG: KASAN: use-after-free in refcount_inc_not_zero+0xd3/0xe0
lib/refcount.c:120
Read of size 4 at addr ffff888092b1ae40 by task syz-executor.0/6941
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183
[inline]
BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:27
[inline]
BUG: KASAN: use-after-free in refcount_inc_not_zero+0xd3/0xe0
lib/refcount.c:120
CPU: 1 PID: 6941 Comm: syz-executor.0 Not tainted 4.14.144 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x197 lib/dump_stack.c:53
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
__read_once_size include/linux/compiler.h:183 [inline]
atomic_read arch/x86/include/asm/atomic.h:27 [inline]
refcount_inc_not_zero+0xd3/0xe0 lib/refcount.c:120
refcount_inc+0x16/0x40 lib/refcount.c:153
sock_hold include/net/sock.h:619 [inline]
nr_release+0x5e/0x390 net/netrom/af_netrom.c:523
__sock_release+0xce/0x2b0 net/socket.c:602
sock_close+0x1b/0x30 net/socket.c:1139
__fput+0x275/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x114/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4135d1
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
__read_once_size include/linux/compiler.h:183 [inline]
atomic_read arch/x86/include/asm/atomic.h:27 [inline]
refcount_inc_not_zero+0xd3/0xe0 lib/refcount.c:120
refcount_inc+0x16/0x40 lib/refcount.c:153
sock_hold include/net/sock.h:619 [inline]
nr_release+0x5e/0x390 net/netrom/af_netrom.c:523
__sock_release+0xce/0x2b0 net/socket.c:602
sock_close+0x1b/0x30 net/socket.c:1139
__fput+0x275/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x114/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RSP: 002b:00007fffb53c7fa0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004135d1
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff
R10: 00007fffb53c8080 R11: 0000000000000293 R12: 000000000075c9a0
R13: 000000000075c9a0 R14: 0000000000760c38 R15: 000000000075c124
Allocated by task 6945:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
__do_kmalloc mm/slab.c:3720 [inline]
__kmalloc+0x15d/0x7a0 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
sk_prot_alloc+0x171/0x2a0 net/core/sock.c:1467
sk_alloc+0x39/0xd70 net/core/sock.c:1521
nr_create+0xa1/0x5d0 net/netrom/af_netrom.c:436
__sock_create+0x2f6/0x620 net/socket.c:1275
sock_create net/socket.c:1315 [inline]
SYSC_socket net/socket.c:1345 [inline]
SyS_socket+0xd3/0x170 net/socket.c:1325
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
Freed by task 6941:
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
__do_kmalloc mm/slab.c:3720 [inline]
__kmalloc+0x15d/0x7a0 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
sk_prot_alloc+0x171/0x2a0 net/core/sock.c:1467
sk_alloc+0x39/0xd70 net/core/sock.c:1521
nr_create+0xa1/0x5d0 net/netrom/af_netrom.c:436
__sock_create+0x2f6/0x620 net/socket.c:1275
sock_create net/socket.c:1315 [inline]
SYSC_socket net/socket.c:1345 [inline]
SyS_socket+0xd3/0x170 net/socket.c:1325
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xcc/0x270 mm/slab.c:3815
sk_prot_free net/core/sock.c:1504 [inline]
__sk_destruct+0x493/0x5d0 net/core/sock.c:1583
sk_destruct+0x67/0x80 net/core/sock.c:1591
__sk_free+0x54/0x230 net/core/sock.c:1599
sk_free+0x35/0x40 net/core/sock.c:1610
sock_put include/net/sock.h:1653 [inline]
nr_release+0x309/0x390 net/netrom/af_netrom.c:557
__sock_release+0xce/0x2b0 net/socket.c:602
sock_close+0x1b/0x30 net/socket.c:1139
__fput+0x275/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x114/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x42/0xb7
The buggy address belongs to the object at ffff888092b1adc0
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xcc/0x270 mm/slab.c:3815
sk_prot_free net/core/sock.c:1504 [inline]
__sk_destruct+0x493/0x5d0 net/core/sock.c:1583
sk_destruct+0x67/0x80 net/core/sock.c:1591
__sk_free+0x54/0x230 net/core/sock.c:1599
sk_free+0x35/0x40 net/core/sock.c:1610
sock_put include/net/sock.h:1653 [inline]
nr_release+0x309/0x390 net/netrom/af_netrom.c:557
__sock_release+0xce/0x2b0 net/socket.c:602
sock_close+0x1b/0x30 net/socket.c:1139
__fput+0x275/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x114/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x42/0xb7
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 128 bytes inside of
2048-byte region [ffff888092b1adc0, ffff888092b1b5c0)
The buggy address is located 128 bytes inside of
The buggy address belongs to the page:
page:ffffea00024ac680 count:1 mapcount:0 mapping:ffff888092b1a540 index:0x0
compound_mapcount: 0
flags: 0x1fffc0000008100(slab|head)
raw: 01fffc0000008100 ffff888092b1a540 0000000000000000 0000000100000003
flags: 0x1fffc0000008100(slab|head)
raw: ffffea00023471a0 ffffea0002177aa0 ffff8880aa800c40 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888092b1ad00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
Memory state around the buggy address:
ffff888092b1ad80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff888092b1ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888092b1ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888092b1af00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
syzbot
Jun 17, 2022, 7:54:36 AM6/17/22
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 84bae26850e3 Linux 4.14.284
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13e1c9a7f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=3f2be884e0c5d592
dashboard link: https://syzkaller.appspot.com/bug?extid=7e79fbe1b2d89a255fc2
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11969017f00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e12017f00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7e79fb...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369
Read of size 8 at addr ffff88809ed2c978 by task syz-executor102/9371
CPU: 0 PID: 9371 Comm: syz-executor102 Not tainted 4.14.284-syzkaller #0
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
__lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
_raw_write_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:320
sock_orphan include/net/sock.h:1713 [inline]
nr_release+0x5b/0x340 net/netrom/af_netrom.c:524
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
get_signal+0x38d/0x1ca0 kernel/signal.c:2412
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fb887201179
RSP: 002b:00007fff28fb5f68 EFLAGS: 00000246 ORIG_RAX: 000000000000002b
RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007fb887201179
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004
RBP: 0000000000000003 R08: 00007fff28fb5f90 R09: 00007fff28fb5f90
R10: 00007fff28fb5f90 R11: 0000000000000246 R12: 000055555593d2c0
R13: 0000000000000016 R14: 00007fff28fb5fe0 R15: 0000000000000001
Allocated by task 9371:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
__do_kmalloc mm/slab.c:3720 [inline]
__kmalloc+0x15a/0x400 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
sk_prot_alloc+0x1ba/0x290 net/core/sock.c:1484
sk_alloc+0x36/0xcd0 net/core/sock.c:1538
nr_create+0x99/0x5c0 net/netrom/af_netrom.c:436
__sock_create+0x303/0x620 net/socket.c:1275
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
Freed by task 9371:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
sk_prot_free net/core/sock.c:1521 [inline]
__sk_destruct+0x5e3/0x760 net/core/sock.c:1600
sk_destruct net/core/sock.c:1615 [inline]
__sk_free+0xd9/0x2d0 net/core/sock.c:1623
sk_free+0x2b/0x40 net/core/sock.c:1634
sock_put include/net/sock.h:1664 [inline]
nr_release+0x2b7/0x340 net/netrom/af_netrom.c:557
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
get_signal+0x38d/0x1ca0 kernel/signal.c:2412
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
entry_SYSCALL_64_after_hwframe+0x46/0xbb
The buggy address belongs to the object at ffff88809ed2c600
2048-byte region [ffff88809ed2c600, ffff88809ed2ce00)
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffff88809ed2c600 0000000000000000 0000000100000003
raw: ffffea0002d2aea0 ffffea00027b5020 ffff88813fe74c40 0000000000000000
ffff88809ed2c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88809ed2c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809ed2c980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809ed2ca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
HEAD commit: 84bae26850e3 Linux 4.14.284
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13e1c9a7f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=3f2be884e0c5d592
dashboard link: https://syzkaller.appspot.com/bug?extid=7e79fbe1b2d89a255fc2
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11969017f00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e12017f00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7e79fb...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369
Read of size 8 at addr ffff88809ed2c978 by task syz-executor102/9371
CPU: 0 PID: 9371 Comm: syz-executor102 Not tainted 4.14.284-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
__lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
_raw_write_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:320
sock_orphan include/net/sock.h:1713 [inline]
nr_release+0x5b/0x340 net/netrom/af_netrom.c:524
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
get_signal+0x38d/0x1ca0 kernel/signal.c:2412
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fb887201179
RSP: 002b:00007fff28fb5f68 EFLAGS: 00000246 ORIG_RAX: 000000000000002b
RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007fb887201179
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004
RBP: 0000000000000003 R08: 00007fff28fb5f90 R09: 00007fff28fb5f90
R10: 00007fff28fb5f90 R11: 0000000000000246 R12: 000055555593d2c0
R13: 0000000000000016 R14: 00007fff28fb5fe0 R15: 0000000000000001
Allocated by task 9371:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
__do_kmalloc mm/slab.c:3720 [inline]
__kmalloc+0x15a/0x400 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
sk_prot_alloc+0x1ba/0x290 net/core/sock.c:1484
sk_alloc+0x36/0xcd0 net/core/sock.c:1538
nr_create+0x99/0x5c0 net/netrom/af_netrom.c:436
__sock_create+0x303/0x620 net/socket.c:1275
sock_create net/socket.c:1315 [inline]
SYSC_socket net/socket.c:1345 [inline]
SyS_socket+0xd1/0x1b0 net/socket.c:1325
SYSC_socket net/socket.c:1345 [inline]
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
Freed by task 9371:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
sk_prot_free net/core/sock.c:1521 [inline]
__sk_destruct+0x5e3/0x760 net/core/sock.c:1600
sk_destruct net/core/sock.c:1615 [inline]
__sk_free+0xd9/0x2d0 net/core/sock.c:1623
sk_free+0x2b/0x40 net/core/sock.c:1634
sock_put include/net/sock.h:1664 [inline]
nr_release+0x2b7/0x340 net/netrom/af_netrom.c:557
__sock_release+0xcd/0x2b0 net/socket.c:602
sock_close+0x15/0x20 net/socket.c:1139
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa44/0x2850 kernel/exit.c:868
do_group_exit+0x100/0x2e0 kernel/exit.c:965
get_signal+0x38d/0x1ca0 kernel/signal.c:2412
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
entry_SYSCALL_64_after_hwframe+0x46/0xbb
The buggy address belongs to the object at ffff88809ed2c600
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 888 bytes inside of
2048-byte region [ffff88809ed2c600, ffff88809ed2ce00)
The buggy address belongs to the page:
page:ffffea00027b4b00 count:1 mapcount:0 mapping:ffff88809ed2c600 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffff88809ed2c600 0000000000000000 0000000100000003
raw: ffffea0002d2aea0 ffffea00027b5020 ffff88813fe74c40 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809ed2c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Memory state around the buggy address:
ffff88809ed2c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88809ed2c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809ed2c980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809ed2ca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Reply all
Reply to author
Forward
0 new messages