syzbot |
sign-in | mailing list | source | docs |
================================================================== BUG: KASAN: use-after-free in cpu_map_generic_redirect+0x1b9/0x5d0 kernel/bpf/cpumap.c:786 Read of size 8 at addr ffff88801817fa18 by task kworker/0:9/4637 CPU: 0 PID: 4637 Comm: kworker/0:9 Not tainted 5.15.179-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: wg-crypt-wg0 wg_packet_tx_worker Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 print_address_description+0x63/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x16b/0x1c0 mm/kasan/report.c:451 cpu_map_generic_redirect+0x1b9/0x5d0 kernel/bpf/cpumap.c:786 xdp_do_generic_redirect_map net/core/filter.c:4189 [inline] xdp_do_generic_redirect+0x406/0x850 net/core/filter.c:4236 do_xdp_generic+0x4f5/0x6c0 net/core/dev.c:4942 __netif_receive_skb_core+0x1bf1/0x3df0 net/core/dev.c:5347 __netif_receive_skb_one_core net/core/dev.c:5522 [inline] __netif_receive_skb+0x11c/0x530 net/core/dev.c:5638 process_backlog+0x363/0x7f0 net/core/dev.c:6515 __napi_poll+0xc7/0x440 net/core/dev.c:7074 napi_poll net/core/dev.c:7141 [inline] net_rx_action+0x617/0xda0 net/core/dev.c:7231 handle_softirqs+0x3a7/0x930 kernel/softirq.c:558 do_softirq+0x162/0x240 kernel/softirq.c:459 </IRQ> <TASK> __local_bh_enable_ip+0x1b1/0x1f0 kernel/softirq.c:383 wg_socket_send_skb_to_peer+0x172/0x1d0 drivers/net/wireguard/socket.c:184 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline] wg_packet_tx_worker+0x1a1/0x7a0 drivers/net/wireguard/send.c:276 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 </TASK> Allocated by task 5929: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513 kasan_kmalloc include/linux/kasan.h:264 [inline] __kmalloc_node+0x199/0x390 mm/slub.c:4455 kmalloc_node include/linux/slab.h:614 [inline] bpf_map_kmalloc_node+0xdb/0x160 kernel/bpf/syscall.c:430 __cpu_map_entry_alloc kernel/bpf/cpumap.c:442 [inline] cpu_map_update_elem+0x273/0xe50 kernel/bpf/cpumap.c:600 map_update_elem+0x6a0/0x7c0 kernel/bpf/syscall.c:1185 __sys_bpf+0x2fd/0x670 kernel/bpf/syscall.c:4636 __do_sys_bpf kernel/bpf/syscall.c:4752 [inline] __se_sys_bpf kernel/bpf/syscall.c:4750 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4750 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 5930: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x80 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0xf1/0x270 mm/slub.c:4559 put_cpu_map_entry+0x6e8/0x760 kernel/bpf/cpumap.c:160 cpu_map_kthread_run+0x252b/0x25f0 kernel/bpf/cpumap.c:407 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Last potentially related work creation: kasan_save_stack+0x36/0x60 mm/kasan/common.c:38 kasan_record_aux_stack+0xba/0x100 mm/kasan/generic.c:348 insert_work+0x54/0x3e0 kernel/workqueue.c:1366 __queue_work+0x963/0xd00 kernel/workqueue.c:1532 queue_work_on+0x14b/0x250 kernel/workqueue.c:1559 cpu_map_free+0xd7/0x1b0 kernel/bpf/cpumap.c:638 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Second to last potentially related work creation: kasan_save_stack+0x36/0x60 mm/kasan/common.c:38 kasan_record_aux_stack+0xba/0x100 mm/kasan/generic.c:348 __call_rcu kernel/rcu/tree.c:3007 [inline] call_rcu+0x1c4/0xa70 kernel/rcu/tree.c:3087 __cpu_map_entry_replace+0x74/0x170 kernel/bpf/cpumap.c:553 cpu_map_free+0xd7/0x1b0 kernel/bpf/cpumap.c:638 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 The buggy address belongs to the object at ffff88801817fa00 which belongs to the cache kmalloc-cg-256 of size 256 The buggy address is located 24 bytes inside of 256-byte region [ffff88801817fa00, ffff88801817fb00) The buggy address belongs to the page: page:ffffea0000605f80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1817e head:ffffea0000605f80 order:1 compound_mapcount:0 memcg:ffff88805ee07b01 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888017442c80 raw: 0000000000000000 0000000080100010 00000001ffffffff ffff88805ee07b01 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, ts 2045938752, free_ts 0 create_dummy_stack mm/page_owner.c:59 [inline] register_early_stack+0x86/0xe0 mm/page_owner.c:75 init_page_owner+0x3a/0x730 mm/page_owner.c:85 kernel_init_freeable+0x420/0x5c0 init/main.c:1613 kernel_init+0x19/0x290 init/main.c:1506 page_owner free stack trace missing Memory state around the buggy address: ffff88801817f900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88801817f980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88801817fa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801817fa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801817fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2025/03/21 22:35 | linux-5.15.y | 0c935c049b5c | c6512ef7 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/03/10 16:12 | linux-5.15.y | c16c81c81336 | 16256247 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/03/10 16:12 | linux-5.15.y | c16c81c81336 | 16256247 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/03/10 16:11 | linux-5.15.y | c16c81c81336 | 16256247 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/03/06 00:08 | linux-5.15.y | c16c81c81336 | 831e3629 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/03/06 00:08 | linux-5.15.y | c16c81c81336 | 831e3629 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/02/19 16:52 | linux-5.15.y | c16c81c81336 | b257a9b7 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/02/19 16:52 | linux-5.15.y | c16c81c81336 | b257a9b7 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/02/19 16:52 | linux-5.15.y | c16c81c81336 | b257a9b7 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/02/06 04:03 | linux-5.15.y | c16c81c81336 | 577d049b | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | KASAN: use-after-free Read in cpu_map_generic_redirect | ||
2025/03/10 16:12 | linux-5.15.y | c16c81c81336 | 16256247 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-5-15-kasan | general protection fault in cpu_map_generic_redirect |