syzbot

 sign-in | mailing list | source | docs
🐞 Open [106]
🐞 Fixed [1]
🐞 Invalid [166]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: stack-out-of-bounds Read in xfrm_state_find

Status: public: reported C repro on 2019/04/11 00:00
Reported-by: syzbot+a98ad023c84d44183880@syzkaller.appspotmail.com
First crash: 2275d, last: 2124d
▶ ▼ Similar bugs (13)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in xfrm_state_find (3) net C 10353 2490d 2557d 4/28 fixed on 2018/01/31 00:24
android-44 KASAN: stack-out-of-bounds Read in xfrm_state_find C 842 1818d 2050d 0/2 public: reported C repro on 2019/04/12 00:00
android-54 KASAN: stack-out-of-bounds Read in xfrm_state_find C 1 690d 690d 0/2 upstream: reported C repro on 2023/01/01 01:05
android-5-15 KASAN: stack-out-of-bounds Read in xfrm_state_find origin:upstream missing-backport C error error 2 205d 690d 0/2 upstream: reported C repro on 2023/01/01 00:40
upstream KASAN: stack-out-of-bounds Read in xfrm_state_find (5) net C done 654 2123d 2425d 13/28 fixed on 2019/11/11 16:48
upstream KMSAN: uninit-value in xfrm_state_find net C error done 215 552d 2351d 22/28 fixed on 2023/07/01 16:05
android-5-10 KASAN: stack-out-of-bounds Read in xfrm_state_find (2) syz error error 1 690d 690d 0/2 auto-obsoleted due to no activity on 2023/05/14 02:28
upstream KASAN: stack-out-of-bounds Read in xfrm_state_find net C 365 2586d 2659d 0/28 closed as invalid on 2017/10/23 16:19
android-5-10 KASAN: stack-out-of-bounds Read in xfrm_state_find 1 1110d 1110d 0/2 closed as invalid on 2022/02/03 13:56
android-49 KASAN: stack-out-of-bounds Read in xfrm_state_find C 4151 2151d 2662d 0/3 closed as invalid on 2019/01/01 20:10
upstream KASAN: stack-out-of-bounds Read in xfrm_state_find (2) net C 93 2568d 2576d 3/28 fixed on 2017/11/18 01:42
android-49 KASAN: stack-out-of-bounds Read in xfrm_state_find (2) C 392 1814d 2051d 0/3 public: reported C repro on 2019/04/11 08:44
upstream KASAN: stack-out-of-bounds Read in xfrm_state_find (4) net C 102 2435d 2486d 4/28 fixed on 2018/03/23 18:14

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
urandom_read: 1 callbacks suppressed
random: sshd: uninitialized urandom read (32 bytes read)
audit: type=1400 audit(1546400560.893:7): avc:  denied  { map } for  pid=1783 comm="syz-executor044" path="/root/syz-executor044447084" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
==================================================================
BUG: KASAN: stack-out-of-bounds in __xfrm6_daddr_saddr_hash net/xfrm/xfrm_hash.h:29 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm_dst_hash net/xfrm/xfrm_hash.h:96 [inline]
BUG: KASAN: stack-out-of-bounds in xfrm_dst_hash net/xfrm/xfrm_state.c:60 [inline]
BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x2519/0x25a0 net/xfrm/xfrm_state.c:953
Read of size 4 at addr ffff8881d07e76d0 by task syz-executor044/1783

CPU: 0 PID: 1783 Comm: syz-executor044 Not tainted 4.14.91+ #1
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 print_address_description+0x60/0x226 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0x88/0x2a5 mm/kasan/report.c:393

The buggy address belongs to the page:
page:ffffea000741f9c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 ffffea000741f9e0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881d07e7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881d07e7600: 00 f1 f1 f1 f1 00 00 00 f2 f2 f2 00 00 00 00 f2
>ffff8881d07e7680: f2 f2 f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00
                                                 ^
 ffff8881d07e7700: 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00
 ffff8881d07e7780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (137):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/02 03:45 android-4.14 7d2d5fc1acda 3d85f48c .config console log report syz C ci-android-414-kasan-gce-root
2018/12/04 20:57 android-4.14 d11d7f1ccfb1 6ad0ae61 .config console log report syz C ci-android-414-kasan-gce-root
2018/09/29 09:40 android-4.14 56aae8ee7423 41e4b329 .config console log report syz C ci-android-414-kasan-gce-root
2018/08/30 05:19 android-4.14 47350a9f13c6 6c7e9d3d .config console log report syz C ci-android-414-kasan-gce-root
2019/01/27 18:32 android-4.14 70014b13c28c c73f090a .config console log report ci-android-414-kasan-gce-root
2019/01/24 07:50 android-4.14 87a15f6d2289 56558f63 .config console log report ci-android-414-kasan-gce-root
2019/01/22 09:30 android-4.14 5a76363f1262 985f75cc .config console log report ci-android-414-kasan-gce-root
2019/01/19 19:20 android-4.14 5a76363f1262 8aa587b0 .config console log report ci-android-414-kasan-gce-root
2019/01/19 03:00 android-4.14 5f2fd5217aa2 2103a236 .config console log report ci-android-414-kasan-gce-root
2019/01/18 00:27 android-4.14 42506d99b820 769e75ed .config console log report ci-android-414-kasan-gce-root
2019/01/13 09:40 android-4.14 fab7352ca8d1 c3f3344c .config console log report ci-android-414-kasan-gce-root
2019/01/12 13:35 android-4.14 fab7352ca8d1 c3f3344c .config console log report ci-android-414-kasan-gce-root
2019/01/12 12:19 android-4.14 fab7352ca8d1 c3f3344c .config console log report ci-android-414-kasan-gce-root
2019/01/11 10:43 android-4.14 fab7352ca8d1 80dde172 .config console log report ci-android-414-kasan-gce-root
2019/01/05 19:41 android-4.14 3c207c880674 53be0a37 .config console log report ci-android-414-kasan-gce-root
2019/01/04 23:33 android-4.14 3c207c880674 0127e3ba .config console log report ci-android-414-kasan-gce-root
2019/01/04 07:48 android-4.14 3c207c880674 7da23925 .config console log report ci-android-414-kasan-gce-root
2019/01/02 17:17 android-4.14 7d2d5fc1acda f0491811 .config console log report ci-android-414-kasan-gce-root
2018/12/31 20:19 android-4.14 7d2d5fc1acda 2b42fdc8 .config console log report ci-android-414-kasan-gce-root
2018/12/30 08:02 android-4.14 7d2d5fc1acda 35e3f847 .config console log report ci-android-414-kasan-gce-root
2018/12/30 06:27 android-4.14 7d2d5fc1acda 35e3f847 .config console log report ci-android-414-kasan-gce-root
2018/12/28 18:27 android-4.14 815e34f802d8 fc6ae81a .config console log report ci-android-414-kasan-gce-root
2018/12/27 18:07 android-4.14 815e34f802d8 43cf01dd .config console log report ci-android-414-kasan-gce-root
2018/12/27 06:52 android-4.14 815e34f802d8 e747ec98 .config console log report ci-android-414-kasan-gce-root
2018/12/26 09:12 android-4.14 815e34f802d8 8a41a0ad .config console log report ci-android-414-kasan-gce-root
2018/12/25 22:13 android-4.14 815e34f802d8 8a41a0ad .config console log report ci-android-414-kasan-gce-root
2018/12/20 02:53 android-4.14 2eaa69bd84cf 02e69052 .config console log report ci-android-414-kasan-gce-root
2018/12/17 00:29 android-4.14 4ee7197c44f6 def91db3 .config console log report ci-android-414-kasan-gce-root
2018/12/16 11:26 android-4.14 4ee7197c44f6 def91db3 .config console log report ci-android-414-kasan-gce-root
2018/12/16 04:05 android-4.14 4ee7197c44f6 def91db3 .config console log report ci-android-414-kasan-gce-root
2018/12/15 18:19 android-4.14 4ee7197c44f6 c9128939 .config console log report ci-android-414-kasan-gce-root
2018/12/15 16:14 android-4.14 4ee7197c44f6 c9128939 .config console log report ci-android-414-kasan-gce-root
2018/12/14 16:38 android-4.14 4ee7197c44f6 7624ddd6 .config console log report ci-android-414-kasan-gce-root
2018/12/14 06:56 android-4.14 4ee7197c44f6 fe7127be .config console log report ci-android-414-kasan-gce-root
2018/12/05 01:56 android-4.14 d11d7f1ccfb1 f162ad97 .config console log report ci-android-414-kasan-gce-root
2018/12/04 13:07 android-4.14 d11d7f1ccfb1 6ad0ae61 .config console log report ci-android-414-kasan-gce-root
2018/12/03 08:41 android-4.14 d11d7f1ccfb1 7dcaeaf3 .config console log report ci-android-414-kasan-gce-root
2018/11/28 03:31 android-4.14 0e1d81608a8a 4b6d14f2 .config console log report ci-android-414-kasan-gce-root
2018/11/26 17:43 android-4.14 ea91d158d712 ac912200 .config console log report ci-android-414-kasan-gce-root
2018/11/26 13:53 android-4.14 ea91d158d712 ac912200 .config console log report ci-android-414-kasan-gce-root
2018/11/25 19:12 android-4.14 ea91d158d712 3d3ec907 .config console log report ci-android-414-kasan-gce-root
2018/11/25 04:04 android-4.14 ea91d158d712 ecc7c870 .config console log report ci-android-414-kasan-gce-root
2018/11/24 03:40 android-4.14 ea91d158d712 eb9ed731 .config console log report ci-android-414-kasan-gce-root
2018/11/21 07:29 android-4.14 4e76528bd48d 5d9a3924 .config console log report ci-android-414-kasan-gce-root
2018/11/21 03:03 android-4.14 4e76528bd48d 9aca6b52 .config console log report ci-android-414-kasan-gce-root
2018/11/18 18:51 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/18 11:29 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/18 03:55 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/17 21:25 android-4.14 4e76528bd48d adf636a8 .config console log report ci-android-414-kasan-gce-root
2018/11/13 17:45 android-4.14 97c308ca4091 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/11/12 01:42 android-4.14 494c2659e60e 7b5f8621 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.