KASAN: use-after-free Read in consume

Date	Name	Commit	Repro	Result
2023/09/21	lts (merge base)	aff03380bda4	C	[report] KASAN: use-after-free Read in consume_skb
2023/09/21	upstream (ToT)	42dc814987c1	C	Didn't crash

Date

Name

Commit

Repro

Result

2023/09/21

lts (merge base)

aff03380bda4

[report] KASAN: use-after-free Read in consume_skb

2023/09/21

upstream (ToT)

42dc814987c1

Didn't crash

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-6-1	KASAN: use-after-free Read in consume_skb	C	error	done	4	172d	231d	0/2	auto-obsoleted due to no activity on 2024/02/15 15:09
upstream	KASAN: use-after-free Read in consume_skb bpf net	C	done	inconclusive	33	651d	930d	0/26	closed as invalid on 2022/10/12 18:37
upstream	KASAN: slab-use-after-free Read in consume_skb net bpf	C	error		6	234d	235d	0/26	closed as invalid on 2023/10/04 10:50

android-6-1

KASAN: use-after-free Read in consume_skb

error

done

172d

231d

0/2

auto-obsoleted due to no activity on 2024/02/15 15:09

upstream

KASAN: use-after-free Read in consume_skb bpf net

done

inconclusive

651d

930d

0/26

closed as invalid on 2022/10/12 18:37

upstream

KASAN: slab-use-after-free Read in consume_skb net bpf

error

234d

235d

0/26

closed as invalid on 2023/10/04 10:50


Created	Duration	User	Repo	Result
2024/04/12 06:30	5m	retest repro	android13-5.15-lts	report log
2024/03/20 06:42	14m	retest repro	android13-5.15-lts	report log
2024/03/05 22:28	9m	retest repro	android13-5.15-lts	report log
2024/02/20 22:12	5m	retest repro	android13-5.15-lts	report log
2024/02/02 05:29	5m	retest repro	android13-5.15-lts	report log
2023/12/26 22:15	10m	retest repro	android13-5.15-lts	report log
2023/12/26 22:15	12m	retest repro	android13-5.15-lts	report log

Created	Duration	User	Patch	Repo	Result
2023/12/12 21:16	54m	bisect fix		android13-5.15-lts	job log (0) log
2023/11/12 13:30	38m	bisect fix		android13-5.15-lts	job log (0) log

Created

Duration

User

Patch

Repo

Result

2023/12/12 21:16

54m

bisect fix

android13-5.15-lts

job log (0) log

2023/11/12 13:30

38m

bisect fix

android13-5.15-lts

job log (0) log

RBP: 0000000000000001 R08: 00007ffd684f9bd7 R09: 00000010684f0037 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd684f9e90 R13: 00007ffd684f9eb0 R14: 00007ffd684f9e88 R15: 00007fe4f7977032 </TASK> ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:71 [inline] BUG: KASAN: use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline] BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:147 [inline] BUG: KASAN: use-after-free in skb_unref include/linux/skbuff.h:1131 [inline] BUG: KASAN: use-after-free in consume_skb+0x3c/0x250 net/core/skbuff.c:926 Read of size 4 at addr ffff88811cf220ec by task syz-executor141/299 CPU: 0 PID: 299 Comm: syz-executor141 Not tainted 5.15.147-syzkaller-00327-g1c3a1f32bcbd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description+0x87/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x179/0x1c0 mm/kasan/report.c:444 kasan_check_range+0x293/0x2a0 mm/kasan/generic.c:189 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 instrument_atomic_read include/linux/instrumented.h:71 [inline] atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline] refcount_read include/linux/refcount.h:147 [inline] skb_unref include/linux/skbuff.h:1131 [inline] consume_skb+0x3c/0x250 net/core/skbuff.c:926 __sk_msg_free+0x2dd/0x370 net/core/skmsg.c:205 sk_msg_free net/core/skmsg.c:218 [inline] __sk_psock_purge_ingress_msg net/core/skmsg.c:768 [inline] __sk_psock_zap_ingress net/core/skmsg.c:786 [inline] sk_psock_stop+0x44c/0x4d0 net/core/skmsg.c:804 sock_map_close+0x2b9/0x4c0 net/core/sock_map.c:1548 unix_release+0x82/0xc0 net/unix/af_unix.c:949 __sock_release net/socket.c:649 [inline] sock_close+0xdf/0x270 net/socket.c:1336 __fput+0x3fe/0x910 fs/file_table.c:280 ____fput+0x15/0x20 fs/file_table.c:308 task_work_run+0x129/0x190 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xc48/0x2ca0 kernel/exit.c:878 do_group_exit+0x141/0x310 kernel/exit.c:1000 __do_sys_exit_group kernel/exit.c:1011 [inline] __se_sys_exit_group kernel/exit.c:1009 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1009 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe4f7925ec9 Code: Unable to access opcode bytes at RIP 0x7fe4f7925e9f. RSP: 002b:00007ffd684f9e08 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fe4f7925ec9 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 00007fe4f79a9390 R08: ffffffffffffffb8 R09: 00000010684f0037 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe4f79a9390 R13: 0000000000000000 R14: 00007fe4f79aae60 R15: 00007fe4f78f6740 </TASK> Allocated by task 299: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] __kasan_slab_alloc+0xb1/0xe0 mm/kasan/common.c:466 kasan_slab_alloc include/linux/kasan.h:217 [inline] slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:550 slab_alloc_node mm/slub.c:3240 [inline] slab_alloc mm/slub.c:3248 [inline] kmem_cache_alloc+0xf5/0x200 mm/slub.c:3253 skb_clone+0x1d1/0x360 net/core/skbuff.c:1547 sk_psock_verdict_recv+0x53/0x840 net/core/skmsg.c:1182 unix_read_sock+0x132/0x370 net/unix/af_unix.c:2433 sk_psock_verdict_data_ready+0x147/0x1a0 net/core/skmsg.c:1225 unix_dgram_sendmsg+0x15fa/0x2090 net/unix/af_unix.c:1949 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2485 __sys_sendmmsg+0x2bf/0x530 net/socket.c:2571 __do_sys_sendmmsg net/socket.c:2600 [inline] __se_sys_sendmmsg net/socket.c:2597 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2597 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 20: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749 slab_free mm/slub.c:3519 [inline] kmem_cache_free+0x116/0x2e0 mm/slub.c:3535 kfree_skbmem+0x104/0x170 __kfree_skb net/core/skbuff.c:758 [inline] kfree_skb_reason net/core/skbuff.c:778 [inline] kfree_skb+0xc2/0x360 net/core/skbuff.c:792 sock_drop include/linux/skmsg.h:312 [inline] sk_psock_backlog+0xc21/0xd90 net/core/skmsg.c:681 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2317 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2464 kthread+0x421/0x510 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff88811cf22000 which belongs to the cache skbuff_head_cache of size 248 The buggy address is located 236 bytes inside of 248-byte region [ffff88811cf22000, ffff88811cf220f8) The buggy address belongs to the page: page:ffffea000473c880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cf22 flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 0000000000000000 dead000000000122 ffff8881003fec00 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 20, ts 36844734042, free_ts 18756012831 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2604 prep_new_page+0x1b/0x110 mm/page_alloc.c:2610 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4484 __alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5776 allocate_slab mm/slub.c:1932 [inline] new_slab+0x9a/0x4e0 mm/slub.c:1995 ___slab_alloc+0x39e/0x830 mm/slub.c:3028 __slab_alloc+0x4a/0x90 mm/slub.c:3115 slab_alloc_node mm/slub.c:3206 [inline] slab_alloc mm/slub.c:3248 [inline] kmem_cache_alloc+0x134/0x200 mm/slub.c:3253 kmem_cache_alloc_node include/linux/slab.h:474 [inline] __alloc_skb+0xbe/0x550 net/core/skbuff.c:416 alloc_skb include/linux/skbuff.h:1183 [inline] alloc_skb_with_frags+0xa6/0x680 net/core/skbuff.c:6156 sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2525 sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2542 mld_newpack+0x1b4/0xa20 net/ipv6/mcast.c:1748 add_grhead net/ipv6/mcast.c:1851 [inline] add_grec+0xdc8/0x13a0 net/ipv6/mcast.c:1989 mld_send_cr net/ipv6/mcast.c:2115 [inline] mld_ifc_work+0x72e/0xbb0 net/ipv6/mcast.c:2653 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2317 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1471 [inline] free_pcp_prepare mm/page_alloc.c:1543 [inline] free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3533 free_unref_page+0xe8/0x750 mm/page_alloc.c:3615 __put_single_page mm/swap.c:98 [inline] __put_page+0xb0/0xe0 mm/swap.c:129 put_page include/linux/mm.h:1295 [inline] anon_pipe_buf_release+0x187/0x200 fs/pipe.c:137 pipe_buf_release include/linux/pipe_fs_i.h:203 [inline] pipe_read+0x5a6/0x1040 fs/pipe.c:323 call_read_iter include/linux/fs.h:2196 [inline] new_sync_read fs/read_write.c:404 [inline] vfs_read+0xa7e/0xd40 fs/read_write.c:485 ksys_read+0x199/0x2c0 fs/read_write.c:623 __do_sys_read fs/read_write.c:633 [inline] __se_sys_read fs/read_write.c:631 [inline] __x64_sys_read+0x7b/0x90 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Memory state around the buggy address: ffff88811cf21f80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc ffff88811cf22000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811cf22080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc ^ ffff88811cf22100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff88811cf22180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ================================================================== BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3519 [inline] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x116/0x2e0 mm/slub.c:3535 CPU: 0 PID: 299 Comm: syz-executor141 Tainted: G B 5.15.147-syzkaller-00327-g1c3a1f32bcbd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description+0x87/0x3b0 mm/kasan/report.c:248 kasan_report_invalid_free+0x6b/0xa0 mm/kasan/report.c:370 ____kasan_slab_free+0x13e/0x160 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749 slab_free mm/slub.c:3519 [inline] kmem_cache_free+0x116/0x2e0 mm/slub.c:3535 kfree_skbmem+0x104/0x170 __kfree_skb net/core/skbuff.c:758 [inline] consume_skb+0xb4/0x250 net/core/skbuff.c:930 __sk_msg_free+0x2dd/0x370 net/core/skmsg.c:205 sk_msg_free net/core/skmsg.c:218 [inline] __sk_psock_purge_ingress_msg net/core/skmsg.c:768 [inline] __sk_psock_zap_ingress net/core/skmsg.c:786 [inline] sk_psock_stop+0x44c/0x4d0 net/core/skmsg.c:804 sock_map_close+0x2b9/0x4c0 net/core/sock_map.c:1548 unix_release+0x82/0xc0 net/unix/af_unix.c:949 __sock_release net/socket.c:649 [inline] sock_close+0xdf/0x270 net/socket.c:1336 __fput+0x3fe/0x910 fs/file_table.c:280 ____fput+0x15/0x20 fs/file_table.c:308 task_work_run+0x129/0x190 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xc48/0x2ca0 kernel/exit.c:878 do_group_exit+0x141/0x310 kernel/exit.c:1000 __do_sys_exit_group kernel/exit.c:1011 [inline] __se_sys_exit_group kernel/exit.c:1009 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1009 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe4f7925ec9 Code: Unable to access opcode bytes at RIP 0x7fe4f7925e9f. RSP: 002b:00007ffd684f9e08 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fe4f7925ec9 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 00007fe4f79a9390 R08: ffffffffffffffb8 R09: 00000010684f0037 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe4f79a9390 R13: 0000000000000000 R14: 00007fe4f79aae60 R15: 00007fe4f78f6740 </TASK> Allocated by task 299: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] __kasan_slab_alloc+0xb1/0xe0 mm/kasan/common.c:466 kasan_slab_alloc include/linux/kasan.h:217 [inline] slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:550 slab_alloc_node mm/slub.c:3240 [inline] slab_alloc mm/slub.c:3248 [inline] kmem_cache_alloc+0xf5/0x200 mm/slub.c:3253 skb_clone+0x1d1/0x360 net/core/skbuff.c:1547 sk_psock_verdict_recv+0x53/0x840 net/core/skmsg.c:1182 unix_read_sock+0x132/0x370 net/unix/af_unix.c:2433 sk_psock_verdict_data_ready+0x147/0x1a0 net/core/skmsg.c:1225 unix_dgram_sendmsg+0x15fa/0x2090 net/unix/af_unix.c:1949 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2431 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2485 __sys_sendmmsg+0x2bf/0x530 net/socket.c:2571 __do_sys_sendmmsg net/socket.c:2600 [inline] __se_sys_sendmmsg net/socket.c:2597 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2597 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 20: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749 slab_free mm/slub.c:3519 [inline] kmem_cache_free+0x116/0x2e0 mm/slub.c:3535 kfree_skbmem+0x104/0x170 __kfree_skb net/core/skbuff.c:758 [inline] kfree_skb_reason net/core/skbuff.c:778 [inline] kfree_skb+0xc2/0x360 net/core/skbuff.c:792 sock_drop include/linux/skmsg.h:312 [inline] sk_psock_backlog+0xc21/0xd90 net/core/skmsg.c:681 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2317 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2464 kthread+0x421/0x510 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff88811cf22000 which belongs to the cache skbuff_head_cache of size 248 The buggy address is located 0 bytes inside of 248-byte region [ffff88811cf22000, ffff88811cf220f8) The buggy address belongs to the page: page:ffffea000473c880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cf22 flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 0000000000000000 dead000000000122 ffff8881003fec00 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 20, ts 36844734042, free_ts 18756012831 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2604 prep_new_page+0x1b/0x110 mm/page_alloc.c:2610 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4484 __alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5776 allocate_slab mm/slub.c:1932 [inline] new_slab+0x9a/0x4e0 mm/slub.c:1995 ___slab_alloc+0x39e/0x830 mm/slub.c:3028 __slab_alloc+0x4a/0x90 mm/slub.c:3115 slab_alloc_node mm/slub.c:3206 [inline] slab_alloc mm/slub.c:3248 [inline] kmem_cache_alloc+0x134/0x200 mm/slub.c:3253 kmem_cache_alloc_node include/linux/slab.h:474 [inline] __alloc_skb+0xbe/0x550 net/core/skbuff.c:416 alloc_skb include/linux/skbuff.h:1183 [inline] alloc_skb_with_frags+0xa6/0x680 net/core/skbuff.c:6156 sock_alloc_send_pskb+0x915/0xa50 net/core/sock.c:2525 sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2542 mld_newpack+0x1b4/0xa20 net/ipv6/mcast.c:1748 add_grhead net/ipv6/mcast.c:1851 [inline] add_grec+0xdc8/0x13a0 net/ipv6/mcast.c:1989 mld_send_cr net/ipv6/mcast.c:2115 [inline] mld_ifc_work+0x72e/0xbb0 net/ipv6/mcast.c:2653 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2317 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1471 [inline] free_pcp_prepare mm/page_alloc.c:1543 [inline] free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3533 free_unref_page+0xe8/0x750 mm/page_alloc.c:3615 __put_single_page mm/swap.c:98 [inline] __put_page+0xb0/0xe0 mm/swap.c:129 put_page include/linux/mm.h:1295 [inline] anon_pipe_buf_release+0x187/0x200 fs/pipe.c:137 pipe_buf_release include/linux/pipe_fs_i.h:203 [inline] pipe_read+0x5a6/0x1040 fs/pipe.c:323 call_read_iter include/linux/fs.h:2196 [inline] new_sync_read fs/read_write.c:404 [inline] vfs_read+0xa7e/0xd40 fs/read_write.c:485 ksys_read+0x199/0x2c0 fs/read_write.c:623 __do_sys_read fs/read_write.c:633 [inline] __se_sys_read fs/read_write.c:631 [inline] __x64_sys_read+0x7b/0x90 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Memory state around the buggy address: ffff88811cf21f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88811cf21f80: fa fb fb fb fc

Crashes (10):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2024/01/19 05:05	android13-5.15-lts	1c3a1f32bcbd	21772ce4	.config	console log	report	syz	C		[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in consume_skb
2023/09/25 17:24	android13-5.15-lts	ea586874d2f9	0b6a67ac	.config	strace log	report	syz	C		[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in consume_skb
2023/09/21 03:10	android13-5.15-lts	ea586874d2f9	0b6a67ac	.config	strace log	report	syz	C		[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in consume_skb
2023/09/21 02:28	android13-5.15-lts	ea586874d2f9	0b6a67ac	.config	strace log	report	syz	C		[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in consume_skb
2024/04/20 17:36	android13-5.15-lts	ad06eaf051cd	af24b050	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15-perf	KASAN: use-after-free Read in consume_skb
2024/04/20 09:25	android13-5.15-lts	ad06eaf051cd	af24b050	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15-perf	KASAN: use-after-free Read in consume_skb
2024/04/19 14:55	android13-5.15-lts	ad06eaf051cd	af24b050	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15-perf	KASAN: use-after-free Read in consume_skb
2024/04/19 14:39	android13-5.15-lts	ad06eaf051cd	af24b050	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15-perf	KASAN: use-after-free Read in consume_skb
2024/03/06 06:40	android13-5.15-lts	993bed180178	f39a7eed	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in consume_skb
2024/01/19 04:43	android13-5.15-lts	1c3a1f32bcbd	21772ce4	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in consume_skb

Crashes (10):

Assets (help?)