syzbot

 sign-in | mailing list | source | docs
๐Ÿž Open [1216]
โ‰ก Subsystems
๐Ÿž Fixed [5619]
๐Ÿž Invalid [13511]
โฌ‡ Missing Backports [99]
Kernel Health Bugs/Month Bug Lifetimes Fuzzing Crashes
Total Repo Heatmap Subsystems Heatmap
๐Ÿ’ฌ Send us feedback

KASAN: null-ptr-deref Write in rhashtable_free_and_destroy (2)

Status: fixed on 2022/03/08 16:11
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+860268315ba86ea6b96b@syzkaller.appspotmail.com
Fix commit: 8b5cb7e41d9d mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
First crash: 1254d, last: 979d
Cause bisection: introduced by (bisect log) [no-op commit]:
commit 4078c983feb930bc2a3e3f8ffa6fa65fdf466c8f
Author: Ville Syrjรคlรค <ville.syrjala@linux.intel.com>
Date: Fri Sep 27 13:14:27 2019 +0000

  drm/i915: Switch intel_legacy_cursor_update() to intel_ types

Crash: WARNING in rhashtable_free_and_destroy (log)
Repro: C syz .config
  
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH 5.4/5.10 0/1] mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh 4 (4) 2023/02/23 10:39
[PATCH 5.15 00/72] 5.15.14-rc1 review 82 (82) 2022/01/11 12:41
[PATCH] mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh 1 (1) 2021/12/30 19:55
[syzbot] KASAN: null-ptr-deref Write in rhashtable_free_and_destroy (2) 0 (2) 2021/04/26 07:17
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in rhashtable_free_and_destroy wireless 11 1298d 1375d 19/27 fixed on 2021/03/10 01:49
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy C error 31 830d 1419d 0/1 upstream: reported C repro on 2020/10/21 05:32
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2021/12/30 15:49 17m paskripkin@gmail.com patch upstream OK
2021/08/31 14:16 10m phind.uet@gmail.com linux-next report log
2021/05/07 20:00 9m alaaemadhossney.ae@gmail.com upstream error
2021/05/07 14:51 10m alaaemadhossney.ae@gmail.com upstream error
2021/04/27 01:30 10m alaaemadhossney.ae@gmail.com upstream report log
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2021/10/31 04:16 20m bisect fix upstream OK (0) job log log

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:70 [inline]
BUG: KASAN: null-ptr-deref in try_to_grab_pending.part.0+0x26/0x770 kernel/workqueue.c:1257
Write of size 8 at addr 0000000000000088 by task kworker/0:0/5

CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events cfg80211_destroy_iface_wk
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 __kasan_report mm/kasan/report.c:403 [inline]
 kasan_report.cold+0x5f/0xd8 mm/kasan/report.c:416
 check_region_inline mm/kasan/generic.c:180 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:186
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:70 [inline]
 try_to_grab_pending.part.0+0x26/0x770 kernel/workqueue.c:1257
 try_to_grab_pending+0xa1/0xd0 kernel/workqueue.c:1310
 __cancel_work_timer+0xa6/0x570 kernel/workqueue.c:3098
 rhashtable_free_and_destroy+0x2b/0x920 lib/rhashtable.c:1137
 mesh_table_free net/mac80211/mesh_pathtbl.c:70 [inline]
 mesh_pathtbl_unregister+0x42/0xa0 net/mac80211/mesh_pathtbl.c:812
 ieee80211_teardown_sdata+0x216/0x2d0 net/mac80211/iface.c:691
 unregister_netdevice_many+0xc4c/0x1760 net/core/dev.c:10953
 unregister_netdevice_queue+0x2dd/0x3c0 net/core/dev.c:10870
 unregister_netdevice include/linux/netdevice.h:2884 [inline]
 _cfg80211_unregister_wdev+0x485/0x740 net/wireless/core.c:1127
 ieee80211_if_remove+0x1df/0x300 net/mac80211/iface.c:2020
 ieee80211_del_iface+0x12/0x20 net/mac80211/cfg.c:144
 rdev_del_virtual_intf net/wireless/rdev-ops.h:57 [inline]
 cfg80211_destroy_ifaces+0x223/0x770 net/wireless/core.c:341
 cfg80211_destroy_iface_wk+0x2c/0x40 net/wireless/core.c:354
 process_one_work+0x98d/0x1600 kernel/workqueue.c:2275
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
==================================================================

Crashes (38):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/04/26 07:16 upstream 9f4ad9e425a1 2a82f1b3 .config console log report syz C ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2022/01/03 03:16 upstream 1286cc4893cf e1768e9c .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2022/01/01 07:51 upstream 4f3d93c6eaff e1768e9c .config console log report info ci-upstream-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/22 07:13 upstream 2f47a9a4dfa3 6caa12e4 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/22 06:48 upstream 2f47a9a4dfa3 6caa12e4 .config console log report info ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/16 11:44 upstream 2b14864acbaa 572bcb40 .config console log report info ci-upstream-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/16 09:57 upstream 2b14864acbaa 572bcb40 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/08 10:55 upstream 2a987e65025e 0230ba3e .config console log report info ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/11/30 02:52 upstream d58071a8a76d d0830353 .config console log report info ci-upstream-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/11/18 06:04 upstream ee1703cda8dc cafff8b6 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/11/09 08:23 upstream e851dfae4371 8ab17e57 .config console log report info ci-upstream-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/09/07 19:09 upstream 4b93c544e90e 6ca60148 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/09/07 08:32 upstream 0319b848b155 6ca60148 .config console log report info ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/09/06 06:24 upstream 0319b848b155 d236a457 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/09/05 17:06 upstream 49624efa65ac d236a457 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/08/25 23:46 upstream fe67f4dd8daa b599f2fc .config console log report info ci-upstream-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/08/19 08:47 upstream d6d09a694205 a2fe1cb5 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/07/10 11:24 upstream 3dbdb38e2869 8f5a7b8c .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/06/28 20:23 upstream 62fb9874f5da 9d2ab5df .config console log report info ci-upstream-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/06/02 08:08 upstream 231bc5390667 032639db .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/05/14 14:06 upstream 315d99318179 8bdd5343 .config console log report info ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/05/10 14:31 upstream 6efb943b8616 ca873091 .config console log report info ci-upstream-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/04/29 15:35 upstream d72cd4ad4174 77e2b668 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/04/26 07:00 upstream 9f4ad9e425a1 2a82f1b3 .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/04/18 09:13 upstream 194cf4825638 7e2b734b .config console log report info ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/04/03 16:25 upstream d93a0d43e3d0 6a81331a .config console log report info ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/11/06 04:22 upstream fe91c4725aee 4c1be0be .config console log report info ci-upstream-kasan-gce-386 KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/09/03 00:42 upstream 4ac6d90867a4 15cea0a3 .config console log report info ci-upstream-kasan-gce-386 KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2022/01/03 10:29 net-old 29262e1f773b e1768e9c .config console log report info ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/30 13:35 net-old f7397cd24c59 2e49f10d .config console log report info ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/22 15:54 net-old 99d7fbb5cedf 6caa12e4 .config console log report info ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/21 20:16 net-old ac8c58f5b535 a938f0b8 .config console log report info ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/12/06 14:19 net-old 2be6d4d16a08 579a8754 .config console log report info ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/08/03 10:41 net-old 0541a6293298 6c236867 .config console log report info ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/11/09 02:34 net-next-old cc0356d6a02e 8ab17e57 .config console log report info ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/09/30 07:25 net-next-old ef91abfb20c7 be530f6c .config console log report info ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/09/22 05:14 net-next-old 07b855628c22 169724fe .config console log report info ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
2021/07/25 15:02 net-next-old c5381154393d 4d1b57d4 .config console log report info ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in rhashtable_free_and_destroy
* Struck through repros no longer work on HEAD.