syzbot


WARNING in __check_heap_object

Status: fixed on 2018/02/04 23:45
Subsystems: hardening mm
[Documentation on labels]
Reported-by: syzbot+2357afb48acb76780f3c18867ccfb7aa6fd6c4c9@syzkaller.appspotmail.com
Fix commit: ab9ee8e38b29 sctp: Define usercopy region in SCTP proto slab cache
First crash: 2394d, last: 2318d

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3011 at mm/slab.c:4434 __check_heap_object+0xbc/0xd0 mm/slab.c:4433
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 3011 Comm: syzkaller186406 Not tainted 4.14.0-rc7-next-20171103+ #38
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1c4/0x1e0 kernel/panic.c:546
 report_bug+0x211/0x2d0 lib/bug.c:184
 fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:177
 do_trap_no_signal arch/x86/kernel/traps.c:211 [inline]
 do_trap+0x260/0x390 arch/x86/kernel/traps.c:260
 do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:297
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:310
 invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:906
RIP: 0010:__check_heap_object+0xbc/0xd0 mm/slab.c:4433
RSP: 0018:ffff8801cdcbf0d8 EFLAGS: 00010282
RAX: 000000000000004a RBX: 0000000000000000 RCX: 0000000000000000
RDX: 000000000000004a RSI: 1ffff10039b97ddb RDI: ffffed0039b97e0f
RBP: ffff8801cdcbf0e0 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8801cf048300 R11: 0000000000000000 R12: ffffea00074a6880
R13: ffff8801d29a26b0 R14: 000000000000000b R15: ffffea00074a6880
 check_heap_object mm/usercopy.c:222 [inline]
 __check_object_size+0x22c/0x4f0 mm/usercopy.c:248
 check_object_size include/linux/thread_info.h:112 [inline]
 check_copy_size include/linux/thread_info.h:143 [inline]
 copy_to_user include/linux/uaccess.h:154 [inline]
 sctp_getsockopt_events net/sctp/socket.c:4972 [inline]
 sctp_getsockopt+0x2b90/0x70b0 net/sctp/socket.c:7012
 sock_common_getsockopt+0x95/0xd0 net/core/sock.c:2924
 SYSC_getsockopt net/socket.c:1882 [inline]
 SyS_getsockopt+0x178/0x340 net/socket.c:1864
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x43fc99
RSP: 002b:00007ffec2fb00c8 EFLAGS: 00000203 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fc99
RDX: 000000000000000b RSI: 0000000000000084 RDI: 0000000000000003
RBP: 0000000000000086 R08: 0000000020673000 R09: 0000000000000000
R10: 0000000020cd1000 R11: 0000000000000203 R12: 0000000000401600
R13: 0000000000401690 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (5173):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/11/03 10:29 linux-next 5a3517e009e9 e0a2b195 .config console log report syz C skylake-linux-next-kasan-qemu
2017/11/03 10:12 linux-next 5a3517e009e9 e0a2b195 .config console log report syz C skylake-linux-next-kasan-qemu
2017/11/03 10:09 linux-next 5a3517e009e9 e0a2b195 .config console log report syz C skylake-linux-next-kasan-qemu
2017/11/03 10:04 linux-next 5a3517e009e9 e0a2b195 .config console log report syz C skylake-linux-next-kasan-qemu
2018/01/18 14:53 mmots ce3c209f6733 56cc113a .config console log report ci-upstream-mmots-kasan-gce
2018/01/17 18:03 mmots ce3c209f6733 a46e5318 .config console log report ci-upstream-mmots-kasan-gce
2018/01/14 20:35 mmots ce3c209f6733 66d492a6 .config console log report ci-upstream-mmots-kasan-gce
2018/01/14 06:29 linux-next 3e53c7415294 c9e7aeae .config console log report ci-upstream-next-kasan-gce
2018/01/12 20:51 linux-next 3e53c7415294 9dc808a6 .config console log report ci-upstream-next-kasan-gce
2018/01/12 01:05 mmots 4147d50978df 9dc808a6 .config console log report ci-upstream-mmots-kasan-gce
2018/01/11 22:49 linux-next 8418f8876404 9dc808a6 .config console log report ci-upstream-next-kasan-gce
2018/01/11 13:00 linux-next 8418f8876404 9dc808a6 .config console log report ci-upstream-next-kasan-gce
2018/01/08 17:40 linux-next 895c0dde3985 93b4c6f1 .config console log report ci-upstream-next-kasan-gce
2018/01/04 15:06 mmots ad036b63ee57 00193447 .config console log report ci-upstream-mmots-kasan-gce
2018/01/03 17:39 linux-next 73005e1a35fd 00193447 .config console log report ci-upstream-next-kasan-gce
2018/01/01 03:51 linux-next 0e08c463db38 00193447 .config console log report ci-upstream-next-kasan-gce
2017/12/31 10:47 mmots 37759fa6d0fa bb6384b8 .config console log report ci-upstream-mmots-kasan-gce
2017/12/29 17:22 mmots 37759fa6d0fa 7d240098 .config console log report ci-upstream-mmots-kasan-gce
2017/12/29 14:19 mmots 37759fa6d0fa 7d240098 .config console log report ci-upstream-mmots-kasan-gce
2017/12/29 01:48 mmots 37759fa6d0fa 7d240098 .config console log report ci-upstream-mmots-kasan-gce
2017/12/28 09:55 linux-next 0e08c463db38 7d240098 .config console log report ci-upstream-next-kasan-gce
2017/12/26 22:55 mmots 37759fa6d0fa 73aba437 .config console log report ci-upstream-mmots-kasan-gce
2017/12/23 11:10 linux-next 0e08c463db38 73aba437 .config console log report ci-upstream-next-kasan-gce
2017/12/23 09:23 linux-next 0e08c463db38 73aba437 .config console log report ci-upstream-next-kasan-gce
2017/12/23 02:06 mmots 37759fa6d0fa 8e409090 .config console log report ci-upstream-mmots-kasan-gce
2017/12/22 11:54 mmots 37759fa6d0fa 81fe66b4 .config console log report ci-upstream-mmots-kasan-gce
2017/12/20 20:04 linux-next 7dc9f647127d 90a46995 .config console log report ci-upstream-next-kasan-gce
2017/12/19 16:16 linux-next 6084b576dca2 af9163c7 .config console log report ci-upstream-next-kasan-gce
2017/12/05 03:00 linux-next 7ceb97a071e8 de212f1a .config console log report ci-upstream-next-kasan-gce
2017/11/09 01:55 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/08 14:37 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/07 23:33 linux-next 5a3517e009e9 e0a2b195 .config console log report skylake-linux-next-kasan-qemu
2017/11/07 20:42 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/07 19:49 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/07 12:43 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/07 09:18 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/07 05:06 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/06 21:40 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/06 19:47 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/06 11:30 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/06 07:58 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/05 07:22 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/05 07:02 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/11/05 00:40 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.