syzbot


WARNING: refcount bug in j1939_session_put

Status: upstream: reported C repro on 2024/08/05 21:18
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+ad601904231505ad6617@syzkaller.appspotmail.com
First crash: 132d, last: 5d18h
Cause bisection: introduced by (bisect log) :
commit c9c0ee5f20c593faf289fa8850c3ed84031dd12a
Author: Breno Leitao <leitao@debian.org>
Date: Mon Jul 29 10:47:40 2024 +0000

  net: skbuff: Skip early return in skb_unref when debugging

Crash: WARNING: refcount bug in j1939_session_put (log)
Repro: C syz .config
  
Discussions (5)
Title Replies (including bot) Last reply
[syzbot] Monthly can report (Dec 2024) 0 (1) 2024/12/05 17:40
[syzbot] Monthly can report (Nov 2024) 0 (1) 2024/11/04 08:50
[PATCH net-next] can: j1939: fix uaf in j1939_session_destroy 8 (8) 2024/10/11 14:10
[syzbot] Monthly can report (Oct 2024) 0 (1) 2024/10/04 10:11
[syzbot] [can?] WARNING: refcount bug in j1939_session_put 13 (24) 2024/08/07 23:06
Last patch testing requests (11)
Created Duration User Patch Repo Result
2024/08/07 11:00 58m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc OK log
2024/08/07 09:29 49m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc OK log
2024/08/07 08:30 42m eadavis@qq.com upstream OK log
2024/08/07 06:56 1h23m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc OK log
2024/08/07 06:21 17m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc report log
2024/08/07 02:39 25m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc OK log
2024/08/07 01:42 16m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc report log
2024/08/07 01:19 16m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc report log
2024/08/07 00:56 24m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc OK log
2024/08/06 13:39 24m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc OK log
2024/08/06 13:13 18m eadavis@qq.com patch git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 743ff02152bc report log

Sample crash report:
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 16 at lib/refcount.c:28 refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28
Modules linked in:
CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-syzkaller-09073-g9f16d5e6f220 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28
Code: e0 64 5f 8c e8 17 33 a9 fc 90 0f 0b 90 90 eb 99 e8 8b 8d e8 fc c6 05 d6 15 59 0b 01 90 48 c7 c7 40 65 5f 8c e8 f7 32 a9 fc 90 <0f> 0b 90 90 e9 76 ff ff ff e8 68 8d e8 fc c6 05 b0 15 59 0b 01 90
RSP: 0018:ffffc900001574e0 EFLAGS: 00010246
RAX: 8f8c4778d0f82800 RBX: ffff88803015fd64 RCX: ffff88801beeda00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000003 R08: ffffffff815687d2 R09: 1ffff9200002ae38
R10: dffffc0000000000 R11: fffff5200002ae39 R12: ffff8880346d2468
R13: ffff88803015fd64 R14: 1ffff110068da498 R15: ffff8880346d2400
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001000 CR3: 000000002f6f4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kfree_skb_reason include/linux/skbuff.h:1263 [inline]
 kfree_skb include/linux/skbuff.h:1272 [inline]
 j1939_session_destroy net/can/j1939/transport.c:282 [inline]
 __j1939_session_release net/can/j1939/transport.c:294 [inline]
 kref_put include/linux/kref.h:65 [inline]
 j1939_session_put+0x1ed/0x440 net/can/j1939/transport.c:299
 j1939_tp_cmd_recv net/can/j1939/transport.c:2113 [inline]
 j1939_tp_recv+0x7fe/0x1050 net/can/j1939/transport.c:2161
 j1939_can_recv+0x732/0xb20 net/can/j1939/main.c:108
 deliver net/can/af_can.c:573 [inline]
 can_rcv_filter+0x359/0x7f0 net/can/af_can.c:607
 can_receive+0x327/0x480 net/can/af_can.c:664
 can_rcv+0x144/0x260 net/can/af_can.c:688
 __netif_receive_skb_one_core net/core/dev.c:5672 [inline]
 __netif_receive_skb+0x2e0/0x650 net/core/dev.c:5785
 process_backlog+0x662/0x15b0 net/core/dev.c:6117
 __napi_poll+0xcb/0x490 net/core/dev.c:6877
 napi_poll net/core/dev.c:6946 [inline]
 net_rx_action+0x89b/0x1240 net/core/dev.c:7068
 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943
 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Crashes (11551):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/25 05:40 upstream 9f16d5e6f220 68da6d95 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: refcount bug in j1939_session_put
2024/11/06 08:08 upstream 2e1b3cc9d7f7 3a465482 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: refcount bug in j1939_session_put
2024/09/25 07:55 upstream 68e5c7d4cefb 349a68c4 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/11/10 22:57 net-next 774ca6d3bf24 6b856513 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/08/02 10:12 net-next 743ff02152bc 1e9c4cf3 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/08/02 08:41 net-next 743ff02152bc 1e9c4cf3 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/08/02 07:20 net-next 743ff02152bc 1e9c4cf3 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/08/02 05:23 net-next 743ff02152bc 1e9c4cf3 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/08/02 03:11 net-next 743ff02152bc 1e9c4cf3 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/08/02 01:57 net-next 743ff02152bc 1e9c4cf3 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/06 12:34 upstream 5076001689e4 946d28f0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/06 07:41 upstream 5076001689e4 946d28f0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/06 06:20 upstream 5076001689e4 946d28f0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/05 23:32 upstream 5076001689e4 6e50d07b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: refcount bug in j1939_session_put
2024/12/05 22:51 upstream 5076001689e4 6e50d07b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/05 19:53 upstream feffde684ac2 6e50d07b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/05 18:24 upstream feffde684ac2 6e50d07b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/05 14:33 upstream feffde684ac2 6e50d07b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/05 13:48 upstream feffde684ac2 6e50d07b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/05 08:44 upstream feffde684ac2 29f61fce .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/05 08:44 upstream feffde684ac2 29f61fce .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/05 05:14 upstream feffde684ac2 29f61fce .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/05 01:25 upstream feffde684ac2 29f61fce .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/04 21:56 upstream feffde684ac2 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/04 18:02 upstream feffde684ac2 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/04 15:21 upstream feffde684ac2 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: refcount bug in j1939_session_put
2024/12/04 05:28 upstream ceb8bf2ceaa7 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in j1939_session_put
2024/12/04 04:03 upstream feffde684ac2 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/04 02:14 upstream feffde684ac2 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: refcount bug in j1939_session_put
2024/12/03 21:17 upstream ceb8bf2ceaa7 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: refcount bug in j1939_session_put
2024/12/03 19:56 upstream ceb8bf2ceaa7 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/03 18:36 upstream ceb8bf2ceaa7 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/06 00:32 upstream 5076001689e4 6e50d07b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 WARNING: refcount bug in j1939_session_put
2024/12/05 03:36 upstream feffde684ac2 29f61fce .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 WARNING: refcount bug in j1939_session_put
2024/12/05 01:58 upstream feffde684ac2 29f61fce .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 WARNING: refcount bug in j1939_session_put
2024/12/04 16:00 upstream feffde684ac2 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 WARNING: refcount bug in j1939_session_put
2024/12/06 04:14 upstream 5076001689e4 946d28f0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/06 02:05 upstream 5076001689e4 946d28f0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/05 15:56 upstream feffde684ac2 1c533826 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/05 10:41 upstream feffde684ac2 29f61fce .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/05 05:00 upstream feffde684ac2 29f61fce .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/04 23:11 upstream feffde684ac2 b50eb251 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/04 20:47 upstream feffde684ac2 b50eb251 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/04 12:58 upstream feffde684ac2 b50eb251 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/04 06:51 upstream ceb8bf2ceaa7 b50eb251 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/04 03:25 upstream ceb8bf2ceaa7 b50eb251 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/04 01:06 upstream ceb8bf2ceaa7 b50eb251 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/03 23:29 upstream ceb8bf2ceaa7 b50eb251 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/03 16:28 upstream cdd30ebb1b9f 330db277 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in j1939_session_put
2024/12/03 00:23 net 28866d6e84b8 bb326ffb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/05 07:29 net-next a9ab02ed97c6 29f61fce .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/05 06:16 net-next a9ab02ed97c6 29f61fce .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/05 00:20 net-next bb18265c3aba b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/04 19:10 net-next bb18265c3aba b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/04 17:41 net-next bb18265c3aba b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/04 08:49 net-next ebf7f7d61681 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/04 01:10 net-next e8e7be7d212d b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/03 19:52 net-next e8e7be7d212d 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/08/01 21:15 net-next 743ff02152bc 1e9c4cf3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in j1939_session_put
2024/12/03 06:38 linux-next f486c8aa16b8 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING: refcount bug in j1939_session_put
* Struck through repros no longer work on HEAD.