syzbot

 sign-in | mailing list | source | docs
🐞 Open [71]
🐞 Fixed [22]
🐞 Invalid [335]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert

Status: upstream: reported C repro on 2025/01/30 23:29
Reported-by: syzbot+a3eab7156d554167eeda@syzkaller.appspotmail.com
First crash: 6d00h, last: 2h00m
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert C 14 5d05h 10d 0/2 upstream: reported C repro on 2025/01/26 21:48
android-5-15 KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert origin:lts C 14 5d01h 5d20h 0/2 upstream: reported C repro on 2025/01/31 02:52
linux-5.15 KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert C 18 4d20h 5d20h 0/3 upstream: reported C repro on 2025/01/31 02:56

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x599/0x650 net/xfrm/xfrm_policy.c:855
Read of size 1 at addr ffff8881eee5bbd8 by task syz-executor357/363

CPU: 0 PID: 363 Comm: syz-executor357 Not tainted 5.4.289-syzkaller-00030-gcb850525fc3e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 xfrm_policy_inexact_list_reinsert+0x599/0x650 net/xfrm/xfrm_policy.c:855
 xfrm_policy_inexact_node_merge net/xfrm/xfrm_policy.c:987 [inline]
 xfrm_policy_inexact_insert_node+0x8f3/0xb00 net/xfrm/xfrm_policy.c:1043
 xfrm_policy_inexact_alloc_chain+0x4f9/0xb10 net/xfrm/xfrm_policy.c:1159
 xfrm_policy_inexact_insert+0x69/0x10e0 net/xfrm/xfrm_policy.c:1202
 xfrm_policy_insert+0xe1/0x8a0 net/xfrm/xfrm_policy.c:1585
 xfrm_add_policy+0x4f2/0x980 net/xfrm/xfrm_user.c:1720
 xfrm_user_rcv_msg+0x689/0x9b0 net/xfrm/xfrm_user.c:2775
 netlink_rcv_skb+0x1d5/0x420 net/netlink/af_netlink.c:2467
 xfrm_netlink_rcv+0x6e/0x80 net/xfrm/xfrm_user.c:2797
 netlink_unicast_kernel net/netlink/af_netlink.c:1306 [inline]
 netlink_unicast+0x936/0xb20 net/netlink/af_netlink.c:1332
 netlink_sendmsg+0xa18/0xcf0 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec net/socket.c:638 [inline]
 __sock_sendmsg net/socket.c:650 [inline]
 ____sys_sendmsg+0x5ac/0x8f0 net/socket.c:2306
 ___sys_sendmsg net/socket.c:2360 [inline]
 __sys_sendmsg+0x28b/0x380 net/socket.c:2406
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f7eaca73ae9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe0d424388 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7eaca73ae9
RDX: 0000000000004000 RSI: 0000200000000580 RDI: 0000000000000005
RBP: 0000200000000580 R08: 0000200000000017 R09: 0000000000000000
R10: 0000200000000012 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a

Allocated by task 363:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
 kmalloc include/linux/slab.h:561 [inline]
 sk_prot_alloc+0xbd/0x3e0 net/core/sock.c:1622
 sk_alloc+0x35/0x2f0 net/core/sock.c:1680
 pfkey_create+0x122/0x670 net/key/af_key.c:154
 __sock_create+0x3cb/0x7a0 net/socket.c:1427
 sock_create net/socket.c:1478 [inline]
 __sys_socket+0x132/0x370 net/socket.c:1520
 __do_sys_socket net/socket.c:1529 [inline]
 __se_sys_socket net/socket.c:1527 [inline]
 __x64_sys_socket+0x76/0x80 net/socket.c:1527
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Freed by task 10:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1494 [inline]
 slab_free mm/slub.c:3080 [inline]
 kfree+0x123/0x370 mm/slub.c:4071
 blk_stat_free_callback_rcu+0x5d/0x70 block/blk-stat.c:173
 __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
 rcu_do_batch+0x492/0xa00 kernel/rcu/tree.c:2167
 rcu_core+0x4c8/0xcb0 kernel/rcu/tree.c:2387
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292

The buggy address belongs to the object at ffff8881eee5b800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 984 bytes inside of
 1024-byte region [ffff8881eee5b800, ffff8881eee5bc00)
The buggy address belongs to the page:
page:ffffea0007bb9600 refcount:1 mapcount:0 mapping:ffff8881f5c02280 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5c02280
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893
 alloc_slab_page+0x39/0x3c0 mm/slub.c:343
 allocate_slab mm/slub.c:1683 [inline]
 new_slab+0x97/0x440 mm/slub.c:1749
 new_slab_objects mm/slub.c:2505 [inline]
 ___slab_alloc+0x2fe/0x490 mm/slub.c:2667
 __slab_alloc+0x62/0xa0 mm/slub.c:2707
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc+0x19b/0x2e0 mm/slub.c:3909
 __kmalloc_node include/linux/slab.h:422 [inline]
 kmalloc_node include/linux/slab.h:599 [inline]
 kzalloc_node include/linux/slab.h:701 [inline]
 blk_mq_alloc_hctx block/blk-mq.c:2498 [inline]
 blk_mq_alloc_and_init_hctx block/blk-mq.c:2918 [inline]
 blk_mq_realloc_hw_ctxs+0x303/0x13b0 block/blk-mq.c:2954
 blk_mq_init_allocated_queue+0x52d/0x1990 block/blk-mq.c:3035
 blk_mq_init_queue+0x49/0xa0 block/blk-mq.c:2857
 scsi_mq_alloc_queue+0x40/0x110 drivers/scsi/scsi_lib.c:1881
 scsi_alloc_sdev+0x654/0x960 drivers/scsi/scsi_scan.c:269
 scsi_probe_and_add_lun+0x1aa/0x4010 drivers/scsi/scsi_scan.c:1079
 __scsi_scan_target+0x1fb/0xe80 drivers/scsi/scsi_scan.c:1562
 scsi_scan_channel drivers/scsi/scsi_scan.c:1650 [inline]
 scsi_scan_host_selected+0x349/0x620 drivers/scsi/scsi_scan.c:1679
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881eee5ba80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881eee5bb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881eee5bb80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
                                                    ^
 ffff8881eee5bc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881eee5bc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Disabling lock debugging due to

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/05 21:51 android12-5.4 cb850525fc3e 4dc70884 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/02/05 20:56 android12-5.4 cb850525fc3e 4dc70884 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/30 23:28 android12-5.4 49530c73f82d 4c6ac32f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/02/01 00:07 android12-5.4 49530c73f82d aa47157c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/02/01 00:07 android12-5.4 49530c73f82d aa47157c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 19:21 android12-5.4 49530c73f82d aa47157c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 19:20 android12-5.4 49530c73f82d aa47157c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 18:44 android12-5.4 49530c73f82d aa47157c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 18:44 android12-5.4 49530c73f82d aa47157c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 07:04 android12-5.4 49530c73f82d 4c6ac32f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 07:04 android12-5.4 49530c73f82d 4c6ac32f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 02:33 android12-5.4 49530c73f82d 4c6ac32f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 02:32 android12-5.4 49530c73f82d 4c6ac32f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
2025/01/31 02:32 android12-5.4 49530c73f82d 4c6ac32f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan KASAN: slab-out-of-bounds Read in xfrm_policy_inexact_list_reinsert
* Struck through repros no longer work on HEAD.