Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported |
---|---|---|---|---|---|---|
KASAN: stack-out-of-bounds Read in csd_lock_record kernel | C | 226 | 1632d | 1637d |
syzbot |
sign-in | mailing list | source | docs |
================================================================== BUG: KASAN: vmalloc-out-of-bounds in csd_lock_record+0xcb/0xe0 kernel/smp.c:118 Read of size 8 at addr ffffc90004b477f0 by task kworker/u4:7/12390 CPU: 1 PID: 12390 Comm: kworker/u4:7 Not tainted 5.8.0-rc3-next-20200703-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0x5/0x436 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 csd_lock_record+0xcb/0xe0 kernel/smp.c:118 flush_smp_call_function_queue+0x285/0x730 kernel/smp.c:391 __sysvec_call_function_single+0x98/0x490 arch/x86/kernel/smp.c:248 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline] sysvec_call_function_single+0xe0/0x120 arch/x86/kernel/smp.c:243 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:604 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:765 [inline] RIP: 0010:lock_acquire+0x270/0xad0 kernel/locking/lockdep.c:4962 Code: 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 f8 06 00 00 48 83 3d 6d c1 5a 08 00 0f 84 a6 05 00 00 48 8b 7c 24 08 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 48 03 44 24 10 48 c7 RSP: 0018:ffffc90001817a38 EFLAGS: 00000282 RAX: 1ffffffff1369fe0 RBX: ffff88804cb3c540 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 6c175b7e6c583a8b RDI: 0000000000000282 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8c5a7a27 R10: fffffbfff18b4f44 R11: 0000000000000000 R12: 0000000000000002 R13: ffffffff89bc3040 R14: 0000000000000000 R15: ffff88804cb3c540 rcu_lock_acquire include/linux/rcupdate.h:241 [inline] rcu_read_lock include/linux/rcupdate.h:634 [inline] inet_twsk_purge+0x112/0x7b0 net/ipv4/inet_timewait_sock.c:268 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:189 cleanup_net+0x4ea/0xa00 net/core/net_namespace.c:603 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 kthread+0x3b5/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Memory state around the buggy address: ffffc90004b47680: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 ffffc90004b47700: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 >ffffc90004b47780: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 ^ ffffc90004b47800: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 ffffc90004b47880: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2020/07/07 06:52 | linux-next | 9e50b94b3eb0 | 51095195 | .config | console log | report | ci-upstream-linux-next-kasan-gce-root |