KASAN: invalid-access Write in enqueue_timer

Status: auto-closed as invalid on 2021/07/08 00:48
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+95c862be69e37145543f@syzkaller.appspotmail.com
First crash: 2019d, last: 1978d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KASAN: invalid-access Write in enqueue_timer 6 (7) 2021/02/17 06:37
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: use-after-free Write in enqueue_timer (2) 22 syz, C 5369 440d 538d 0/2 upstream: reported C repro on 2025/02/17 15:17
upstream KASAN: slab-use-after-free Write in enqueue_timer net 22 18 1181d 1197d 0/29 auto-obsoleted due to no activity on 2023/08/22 15:17
android-54 KASAN: use-after-free Write in enqueue_timer 22 syz, C 4288 767d 1274d 0/2 auto-obsoleted due to no activity on 2024/09/11 16:22
upstream KASAN: use-after-free Write in enqueue_timer net 22 1 1363d 1363d 22/29 fixed on 2023/02/24 13:50
android-5-15 KASAN: use-after-free Write in enqueue_timer 22 1 934d 934d 0/2 auto-obsoleted due to no activity on 2024/04/17 12:01
android-6-1 KASAN: use-after-free Write in enqueue_timer origin:lts 22 syz, C 683 5d14h 745d 0/2 upstream: reported C repro on 2024/07/25 13:16
upstream KASAN: slab-out-of-bounds Write in enqueue_timer bluetooth 21 1 417d 412d 0/29 auto-obsoleted due to no activity on 2025/09/26 09:41
android-5-15 KASAN: use-after-free Write in enqueue_timer (2) 22 2 213d 281d 0/2 auto-obsoleted due to no activity on 2026/04/08 11:13
upstream KASAN: slab-use-after-free Write in enqueue_timer (2) wireguard 22 4 168d 200d 0/29 closed as invalid on 2026/04/08 13:13

Sample crash report:
==================================================================
BUG: KASAN: invalid-access in hlist_add_head include/linux/list.h:883 [inline]
BUG: KASAN: invalid-access in enqueue_timer+0x18/0xc0 kernel/time/timer.c:581
Write at addr f3ff0000289f7378 by task kworker/0:2/17733
Pointer tag: [f3], memory tag: [f5]

CPU: 0 PID: 17733 Comm: kworker/0:2 Not tainted 5.12.0-rc2-syzkaller-00059-g144c79ef3353 #0
Hardware name: linux,dummy-virt (DT)
Workqueue: events flush_stashed_error_work
Call trace:
 dump_backtrace+0x0/0x1b0 arch/arm64/kernel/stacktrace.c:112
 show_stack+0x18/0x70 arch/arm64/kernel/stacktrace.c:191
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xd0/0x12c lib/dump_stack.c:120
 print_address_description+0x70/0x29c mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report+0x134/0x380 mm/kasan/report.c:416
 report_tag_fault arch/arm64/mm/fault.c:324 [inline]
 do_tag_recovery arch/arm64/mm/fault.c:336 [inline]
 __do_kernel_fault+0x1a8/0x1dc arch/arm64/mm/fault.c:378
 do_bad_area arch/arm64/mm/fault.c:474 [inline]
 do_tag_check_fault+0x74/0x90 arch/arm64/mm/fault.c:729
 do_mem_abort+0x44/0xbc arch/arm64/mm/fault.c:805
 el1_abort+0x40/0x6c arch/arm64/kernel/entry-common.c:167
 el1_sync_handler+0xac/0xd0 arch/arm64/kernel/entry-common.c:259
 el1_sync+0x70/0x100 arch/arm64/kernel/entry.S:656
 hlist_add_head include/linux/list.h:883 [inline]
 enqueue_timer+0x18/0xc0 kernel/time/timer.c:581
 mod_timer+0x14/0x20 kernel/time/timer.c:1106
 ext4_update_super+0x36c/0x3c0 fs/ext4/super.c:5544
 ext4_commit_super+0x74/0x184 fs/ext4/super.c:5562
 flush_stashed_error_work+0x30/0xa4 fs/ext4/super.c:727
 process_one_work+0x1d8/0x364 kernel/workqueue.c:2275
 worker_thread+0x70/0x434 kernel/workqueue.c:2421
 kthread+0x174/0x180 kernel/kthread.c:292
 ret_from_fork+0x10/0x34 arch/arm64/kernel/entry.S:958

Allocated by task 17760:
 stack_trace_save+0x50/0x80 kernel/stacktrace.c:121
 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 ____kasan_kmalloc mm/kasan/common.c:506 [inline]
 ____kasan_kmalloc mm/kasan/common.c:465 [inline]
 __kasan_kmalloc+0xc8/0x100 mm/kasan/common.c:515
 kasan_kmalloc include/linux/kasan.h:233 [inline]
 __kmalloc_node+0x1d8/0x3dc mm/slub.c:4103
 kmalloc_node include/linux/slab.h:577 [inline]
 kvmalloc_node+0x40/0xe0 mm/util.c:587
 kvmalloc include/linux/mm.h:785 [inline]
 kvmalloc_array include/linux/mm.h:803 [inline]
 alloc_fdtable+0xb0/0x150 fs/file.c:120
 dup_fd+0x240/0x320 fs/file.c:325
 copy_files kernel/fork.c:1466 [inline]
 copy_process+0x5f8/0x1500 kernel/fork.c:2087
 kernel_clone+0x5c/0x3c0 kernel/fork.c:2492
 __do_sys_clone+0x54/0x80 kernel/fork.c:2609
 __se_sys_clone kernel/fork.c:2577 [inline]
 __arm64_sys_clone+0x24/0x30 kernel/fork.c:2577
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
 el0_svc_common.constprop.0+0x60/0x120 arch/arm64/kernel/syscall.c:129
 do_el0_svc+0x74/0x90 arch/arm64/kernel/syscall.c:168
 el0_svc+0x2c/0x54 arch/arm64/kernel/entry-common.c:416
 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432
 el0_sync+0x18c/0x1c0 arch/arm64/kernel/entry.S:699

Freed by task 548:
 stack_trace_save+0x50/0x80 kernel/stacktrace.c:121
 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38
 kasan_set_track+0x28/0x40 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/hw_tags.c:174
 ____kasan_slab_free.constprop.0+0x1e0/0x230 mm/kasan/common.c:360
 __kasan_slab_free+0x10/0x1c mm/kasan/common.c:367
 kasan_slab_free include/linux/kasan.h:199 [inline]
 slab_free_hook mm/slub.c:1562 [inline]
 slab_free_freelist_hook+0xbc/0x210 mm/slub.c:1600
 slab_free mm/slub.c:3161 [inline]
 kfree+0x348/0x4d0 mm/slub.c:4213
 sk_prot_free net/core/sock.c:1739 [inline]
 __sk_destruct+0x1dc/0x220 net/core/sock.c:1824
 sk_destruct net/core/sock.c:1839 [inline]
 __sk_free+0x78/0x114 net/core/sock.c:1850
 sk_free+0x5c/0x80 net/core/sock.c:1861
 sock_put include/net/sock.h:1803 [inline]
 packet_release+0x374/0x464 net/packet/af_packet.c:3106
 __sock_release+0x44/0xbc net/socket.c:599
 sock_close+0x18/0x30 net/socket.c:1258
 __fput+0x78/0x230 fs/file_table.c:280
 ____fput+0x10/0x20 fs/file_table.c:313
 task_work_run+0x80/0x160 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939
 work_pending+0xc/0x3d4

The buggy address belongs to the object at ffff0000289f7000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 888 bytes inside of
 2048-byte region [ffff0000289f7000, ffff0000289f7800)
The buggy address belongs to the page:
page:00000000e7fca950 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x689f0
head:00000000e7fca950 order:3 compound_mapcount:0 compound_pincount:0
memcg:f6ff0000283f8501
flags: 0x1ffffc000010200(slab|head)
raw: 01ffffc000010200 fffffc0000a02c00 0000000200000002 f7ff000004401600
raw: 0000000000000000 0000000000080008 00000001ffffffff f6ff0000283f8501
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000289f7100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
 ffff0000289f7200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
>ffff0000289f7300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
                                        ^
 ffff0000289f7400: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
 ffff0000289f7500: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
==================================================================

Crashes (20):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/03/10 00:47 upstream 144c79ef3353 26967e35 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/03/05 14:48 upstream 280d542f6ffa 9d751681 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/03/04 08:21 upstream f69d02e37a85 d7e4e604 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/03/03 10:07 upstream f69d02e37a85 e5b64d68 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/03/03 02:36 upstream 7a7fd0de4a98 e5b64d68 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/03/02 15:54 upstream 7a7fd0de4a98 92ead296 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/03/01 05:38 upstream cd278456d4ca 4c37c133 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/20 17:56 upstream f40ddce88593 053a2b26 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/19 02:32 upstream f40ddce88593 14052202 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/18 14:03 upstream f40ddce88593 14052202 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/18 07:56 upstream f40ddce88593 14052202 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/18 05:25 upstream f40ddce88593 14052202 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/17 06:02 upstream f40ddce88593 98682e5e .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/16 15:32 upstream f40ddce88593 98682e5e .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/16 10:17 upstream f40ddce88593 98682e5e .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/16 00:06 upstream f40ddce88593 98682e5e .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/15 09:18 upstream 28a173387388 98682e5e .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/02/08 03:31 upstream b75dba7f472c 2ce644fc .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/01/30 08:17 upstream 0e9bcda5d286 fc9fd31e .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
2021/01/28 14:51 upstream 76c057c84d28 eefc07f2 .config console log report info ci-qemu2-arm64-mte KASAN: invalid-access Write in enqueue_timer
* Struck through repros no longer work on HEAD.