syzbot

 sign-in | mailing list | source | docs
🐞 Open [993] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12518] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: null-ptr-deref Read in refcount_inc_not_zero

Status: fixed on 2018/05/08 18:30
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+6a35cd2d9559c909d570@syzkaller.appspotmail.com
Fix commit: 3a04ce7130a7 llc: fix NULL pointer deref for SOCK_ZAPPED
First crash: 2198d, last: 2194d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KASAN: null-ptr-deref Read in refcount_inc_not_zero 1 (2) 2018/04/23 20:05

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
==================================================================
BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
BUG: KASAN: null-ptr-deref in refcount_inc_not_zero+0x8f/0x2d0 lib/refcount.c:120
Read of size 4 at addr 0000000000000004 by task syzkaller821394/4488

CPU: 1 PID: 4488 Comm: syzkaller821394 Not tainted 4.17.0-rc1+ #12
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 kasan_report_error mm/kasan/report.c:352 [inline]
 kasan_report.cold.7+0x6d/0x2fe mm/kasan/report.c:412
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
 refcount_inc_not_zero+0x8f/0x2d0 lib/refcount.c:120
 refcount_inc+0x15/0x70 lib/refcount.c:153
 llc_sap_hold include/net/llc.h:116 [inline]
 llc_ui_release+0xba/0x2b0 net/llc/af_llc.c:207
 sock_release+0x96/0x1b0 net/socket.c:594
 sock_close+0x16/0x20 net/socket.c:1149
 __fput+0x34d/0x890 fs/file_table.c:209
 ____fput+0x15/0x20 fs/file_table.c:243
 task_work_run+0x1e4/0x290 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x1aee/0x2730 kernel/exit.c:865
 do_group_exit+0x16f/0x430 kernel/exit.c:968
 __do_sys_exit_group kernel/exit.c:979 [inline]
 __se_sys_exit_group kernel/exit.c:977 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:977
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x43e878
RSP: 002b:00007fffa13cebb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043e878
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004be220 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006cc160 R14: 0000000000000000 R15: 0000000000000000
==================================================================

Crashes (2352):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/22 15:28 upstream 285848b0f407 d23fcf6c .config console log report syz C ci-upstream-kasan-gce-root
2018/04/22 10:14 upstream 285848b0f407 d23fcf6c .config console log report syz C ci-upstream-kasan-gce-root
2018/04/21 03:14 upstream 83beed7b2b26 ca03d688 .config console log report syz C ci-upstream-kasan-gce-root
2018/04/24 18:35 upstream 6d08b06e67cd 37e76fe2 .config console log report ci-upstream-kasan-gce-root
2018/04/24 14:23 upstream 6d08b06e67cd 2bf86f40 .config console log report ci-upstream-kasan-gce-root
2018/04/24 07:06 upstream 6d08b06e67cd e7e85d36 .config console log report ci-upstream-kasan-gce-root
2018/04/24 04:32 upstream 6d08b06e67cd e7e85d36 .config console log report ci-upstream-kasan-gce-root
2018/04/23 16:27 upstream 6d08b06e67cd 0d8e591c .config console log report ci-upstream-kasan-gce-root
2018/04/23 12:02 upstream 6d08b06e67cd 20941ab3 .config console log report ci-upstream-kasan-gce-root
2018/04/22 22:08 upstream 5ec83b22a2dd d23fcf6c .config console log report ci-upstream-kasan-gce-root
2018/04/22 09:12 upstream 285848b0f407 d23fcf6c .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:55 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:55 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:54 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:54 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:54 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:52 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:52 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:50 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:50 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:50 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:50 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:50 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:48 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:47 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:46 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:46 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:45 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:45 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:44 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:44 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:44 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:43 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:42 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:42 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:41 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:40 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:40 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:39 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:39 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:39 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:38 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:36 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
2018/04/21 01:36 upstream 83beed7b2b26 ca03d688 .config console log report ci-upstream-kasan-gce-root
* Struck through repros no longer work on HEAD.