syzbot

 sign-in | mailing list | source | docs
🐞 Open [99]
🐞 Fixed [70]
🐞 Invalid [197]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: slab-out-of-bounds Read in tc_setup_flow_action

Status: upstream: reported C repro on 2025/01/04 22:42
Reported-by: syzbot+7a1c3b8c6950bb246cfc@syzkaller.appspotmail.com
First crash: 17d, last: 9h49m
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 KASAN: slab-out-of-bounds Read in tc_setup_flow_action origin:lts C 55 1h49m 17d 0/2 upstream: reported C repro on 2025/01/04 22:41

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in is_tcf_tunnel_set include/net/tc_act/tc_tunnel_key.h:33 [inline]
BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0xbb8/0x3630 net/sched/cls_api.c:3639
Read of size 8 at addr ffff88810c890ec0 by task syz-executor120/289

CPU: 0 PID: 289 Comm: syz-executor120 Not tainted 5.10.232-syzkaller-00746-g49e8ba0a684f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x81/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x179/0x1c0 mm/kasan/report.c:452
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
 is_tcf_tunnel_set include/net/tc_act/tc_tunnel_key.h:33 [inline]
 tc_setup_flow_action+0xbb8/0x3630 net/sched/cls_api.c:3639
 mall_replace_hw_filter+0x394/0xc10 net/sched/cls_matchall.c:100
 mall_change+0x573/0x7a0 net/sched/cls_matchall.c:236
 tc_new_tfilter+0x168e/0x1dc0 net/sched/cls_api.c:2134
 rtnetlink_rcv_msg+0x77a/0xc50 net/core/rtnetlink.c:5598
 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2485
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5625
 netlink_unicast_kernel net/netlink/af_netlink.c:1307 [inline]
 netlink_unicast+0x8df/0xac0 net/netlink/af_netlink.c:1333
 netlink_sendmsg+0xa46/0xd00 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:652 [inline]
 __sock_sendmsg net/socket.c:664 [inline]
 ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2376
 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2430
 __sys_sendmsg net/socket.c:2459 [inline]
 __do_sys_sendmsg net/socket.c:2468 [inline]
 __se_sys_sendmsg+0x1b1/0x280 net/socket.c:2466
 __x64_sys_sendmsg+0x7b/0x90 net/socket.c:2466
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f140aa4b829
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffde91f0818 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffde91f09e8 RCX: 00007f140aa4b829
RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000003
RBP: 00007f140aabe610 R08: 0000000000000001 R09: 00007ffde91f09e8
R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffde91f09d8 R14: 0000000000000001 R15: 0000000000000001

Allocated by task 289:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:509
 __kasan_kmalloc+0x9/0x10 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x1aa/0x330 mm/slub.c:4033
 kmalloc include/linux/slab.h:557 [inline]
 kzalloc include/linux/slab.h:664 [inline]
 tcf_idr_create+0x5f/0x770 net/sched/act_api.c:430
 tcf_idr_create_from_flags+0x5f/0x70 net/sched/act_api.c:488
 tcf_gact_init+0x373/0x6e0 net/sched/act_gact.c:102
 tcf_action_init_1+0x584/0x830 net/sched/act_api.c:1052
 tcf_action_init+0x2b5/0x800 net/sched/act_api.c:1109
 tcf_exts_validate+0x232/0x540 net/sched/cls_api.c:3086
 mall_set_parms+0x4b/0x440 net/sched/cls_matchall.c:171
 mall_change+0x49e/0x7a0 net/sched/cls_matchall.c:230
 tc_new_tfilter+0x168e/0x1dc0 net/sched/cls_api.c:2134
 rtnetlink_rcv_msg+0x77a/0xc50 net/core/rtnetlink.c:5598
 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2485
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5625
 netlink_unicast_kernel net/netlink/af_netlink.c:1307 [inline]
 netlink_unicast+0x8df/0xac0 net/netlink/af_netlink.c:1333
 netlink_sendmsg+0xa46/0xd00 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:652 [inline]
 __sock_sendmsg net/socket.c:664 [inline]
 ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2376
 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2430
 __sys_sendmsg net/socket.c:2459 [inline]
 __do_sys_sendmsg net/socket.c:2468 [inline]
 __se_sys_sendmsg+0x1b1/0x280 net/socket.c:2466
 __x64_sys_sendmsg+0x7b/0x90 net/socket.c:2466
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff88810c890e00
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes to the right of
 192-byte region [ffff88810c890e00, ffff88810c890ec0)
The buggy address belongs to the page:
page:ffffea0004322400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c890
flags: 0x4000000000000200(slab)
raw: 4000000000000200 ffffea0004321e00 0000000400000004 ffff888100043380
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 3123548648, free_ts 0
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x166/0x180 mm/page_alloc.c:2462
 get_page_from_freelist+0x2d8c/0x2f30 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x435/0xaf0 mm/page_alloc.c:5348
 allocate_slab mm/slub.c:1808 [inline]
 new_slab+0x80/0x400 mm/slub.c:1869
 new_slab_objects mm/slub.c:2627 [inline]
 ___slab_alloc+0x302/0x4b0 mm/slub.c:2791
 __slab_alloc+0x63/0xa0 mm/slub.c:2831
 slab_alloc_node mm/slub.c:2913 [inline]
 slab_alloc mm/slub.c:2955 [inline]
 __kmalloc+0x204/0x330 mm/slub.c:4029
 kmalloc_array include/linux/slab.h:592 [inline]
 kcalloc include/linux/slab.h:603 [inline]
 security_get_permissions+0x9f/0x370 security/selinux/ss/services.c:3454
 sel_make_perm_files security/selinux/selinuxfs.c:1873 [inline]
 sel_make_class_dir_entries security/selinux/selinuxfs.c:1934 [inline]
 sel_make_classes security/selinux/selinuxfs.c:1965 [inline]
 sel_make_policy_nodes+0xfac/0x1b20 security/selinux/selinuxfs.c:571
 sel_write_load+0x3a2/0x550 security/selinux/selinuxfs.c:653
 vfs_write+0x36a/0xe70 fs/read_write.c:603
 ksys_write+0x199/0x2c0 fs/read_write.c:658
 __do_sys_write fs/read_write.c:670 [inline]
 __se_sys_write fs/read_write.c:667 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:667
 do_syscall_64+0x34/0x70
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88810c890d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88810c890e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88810c890e80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
                                           ^
 ffff88810c890f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88810c890f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================

Crashes (62):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/04 22:55 android13-5.10-lts 49e8ba0a684f f3558dbf .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/04 22:39 android13-5.10-lts 49e8ba0a684f f3558dbf .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/22 01:12 android13-5.10-lts fbe98d68b6b3 da72ac06 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/21 22:32 android13-5.10-lts fbe98d68b6b3 da72ac06 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/21 16:00 android13-5.10-lts fbe98d68b6b3 6e87cfa2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/21 12:51 android13-5.10-lts fbe98d68b6b3 6e87cfa2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/20 21:09 android13-5.10-lts fbe98d68b6b3 6e87cfa2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/20 18:35 android13-5.10-lts fbe98d68b6b3 6e87cfa2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/20 11:00 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/20 03:42 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/20 01:00 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/19 23:20 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/19 11:30 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/19 04:08 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/19 04:08 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/19 04:08 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/18 23:43 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/18 23:43 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/18 05:15 android13-5.10-lts fbe98d68b6b3 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/16 00:58 android13-5.10-lts fbe98d68b6b3 968edaf4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/16 00:58 android13-5.10-lts fbe98d68b6b3 968edaf4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 15:54 android13-5.10-lts 49e8ba0a684f f310a27d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 15:54 android13-5.10-lts 49e8ba0a684f f310a27d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 10:18 android13-5.10-lts 49e8ba0a684f b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 10:18 android13-5.10-lts 49e8ba0a684f b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 10:18 android13-5.10-lts 49e8ba0a684f b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 10:18 android13-5.10-lts 49e8ba0a684f b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 10:18 android13-5.10-lts 49e8ba0a684f b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 10:17 android13-5.10-lts 49e8ba0a684f b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/14 10:17 android13-5.10-lts 49e8ba0a684f b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/12 11:43 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/12 11:43 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/12 11:42 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/12 08:33 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/12 08:33 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/12 08:33 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/12 02:24 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/12 02:23 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/11 22:12 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/11 22:12 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/11 22:11 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/11 22:11 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/11 05:20 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/11 05:20 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/10 23:50 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/10 23:50 android13-5.10-lts 49e8ba0a684f 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/10 17:39 android13-5.10-lts 49e8ba0a684f 67d7ec0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/10 17:39 android13-5.10-lts 49e8ba0a684f 67d7ec0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/09 01:35 android13-5.10-lts 49e8ba0a684f f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/09 01:35 android13-5.10-lts 49e8ba0a684f f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
2025/01/04 22:20 android13-5.10-lts 49e8ba0a684f f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: slab-out-of-bounds Read in tc_setup_flow_action
* Struck through repros no longer work on HEAD.