syzbot


KASAN: stack-out-of-bounds Read in strlcpy

Status: public: reported C repro on 2019/04/12 00:00
Reported-by: syzbot+c72cfdee740ef2dd5bbd@syzkaller.appspotmail.com
First crash: 2542d, last: 2263d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 KASAN: stack-out-of-bounds Read in strlcpy C 1784 2263d 2052d 0/2 public: reported C repro on 2019/04/12 00:00

Sample crash report:
==================================================================
BUG: KASAN: stack-out-of-bounds in strlen lib/string.c:481 [inline]
BUG: KASAN: stack-out-of-bounds in strlcpy+0x101/0x120 lib/string.c:141
Read of size 1 at addr ffff8801ca397b4c by task syzkaller680216/3319

CPU: 1 PID: 3319 Comm: syzkaller680216 Not tainted 4.9.75-g06fe41f #16
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ca397a28 ffffffff81d93049 ffffea000728e5c0 ffff8801ca397b4c
 0000000000000000 ffff8801ca397b4c ffff8801ca397c30 ffff8801ca397a60
 ffffffff8153ca53 ffff8801ca397b4c 0000000000000001 0000000000000000
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153ca53>] print_address_description+0x73/0x280 mm/kasan/report.c:252
 [<ffffffff8153cf75>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8153cf75>] kasan_report+0x275/0x360 mm/kasan/report.c:408
 [<ffffffff8153d074>] __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:426
 [<ffffffff81db1911>] strlen lib/string.c:481 [inline]
 [<ffffffff81db1911>] strlcpy+0x101/0x120 lib/string.c:141
 [<ffffffff8313b633>] xt_copy_counters_from_user+0x163/0x2e0 net/netfilter/x_tables.c:844
 [<ffffffff8351a9b6>] do_add_counters+0x96/0x590 net/ipv6/netfilter/ip6_tables.c:1213
 [<ffffffff83520b9f>] compat_do_ip6t_set_ctl+0xbf/0x150 net/ipv6/netfilter/ip6_tables.c:1588
 [<ffffffff8309fbe8>] compat_nf_sockopt net/netfilter/nf_sockopt.c:143 [inline]
 [<ffffffff8309fbe8>] compat_nf_setsockopt+0x88/0x130 net/netfilter/nf_sockopt.c:155
 [<ffffffff83478b2a>] compat_ipv6_setsockopt+0x13a/0x1e0 net/ipv6/ipv6_sockglue.c:947
 [<ffffffff83219205>] inet_csk_compat_setsockopt+0x95/0x120 net/ipv4/inet_connection_sock.c:914
 [<ffffffff8322f5dd>] compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2748
 [<ffffffff82edc362>] compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2717
 [<ffffffff82fdbaa9>] C_SYSC_setsockopt net/compat.c:398 [inline]
 [<ffffffff82fdbaa9>] compat_SyS_setsockopt+0x149/0x290 net/compat.c:381
 [<ffffffff81006fc7>] do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline]
 [<ffffffff81006fc7>] do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384
 [<ffffffff838b2334>] entry_SYSENTER_compat+0x74/0x83 arch/x86/entry/entry_64_compat.S:127

The buggy address belongs to the page:
page:ffffea000728e5c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801ca397a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801ca397a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801ca397b00: 00 f1 f1 f1 f1 00 00 00 00 04 f2 f2 f2 00 00 00
                                              ^
 ffff8801ca397b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801ca397c00: 00 00 f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2 00 00
==================================================================

Crashes (1769):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/06 15:14 https://android.googlesource.com/kernel/common android-4.9 06fe41f85237 053171ea .config console log report syz C ci-android-49-kasan-gce-386
2017/12/26 16:11 https://android.googlesource.com/kernel/common android-4.9 250637879165 73aba437 .config console log report syz C ci-android-49-kasan-gce-386
2017/12/26 15:59 https://android.googlesource.com/kernel/common android-4.9 250637879165 73aba437 .config console log report syz C ci-android-49-kasan-gce-386
2017/12/26 08:54 https://android.googlesource.com/kernel/common android-4.9 250637879165 73aba437 .config console log report syz C ci-android-49-kasan-gce-386
2017/12/23 04:32 https://android.googlesource.com/kernel/common android-4.9 250637879165 8e409090 .config console log report syz C ci-android-49-kasan-gce-386
2018/04/16 05:00 https://android.googlesource.com/kernel/common android-4.9 8683408f8e81 7a67784c .config console log report syz ci-android-49-kasan-gce-386
2018/09/13 03:57 https://android.googlesource.com/kernel/common android-4.9 a8c1ea6c63ed 71907daf .config console log report ci-android-49-kasan-gce-386
2018/09/12 05:50 https://android.googlesource.com/kernel/common android-4.9 a8c1ea6c63ed 3c88136c .config console log report ci-android-49-kasan-gce-386
2018/09/11 05:24 https://android.googlesource.com/kernel/common android-4.9 a8c1ea6c63ed 8c88323f .config console log report ci-android-49-kasan-gce-386
2018/09/10 23:51 https://android.googlesource.com/kernel/common android-4.9 a8c1ea6c63ed f167cb6b .config console log report ci-android-49-kasan-gce-386
2018/09/10 20:12 https://android.googlesource.com/kernel/common android-4.9 a8c1ea6c63ed f167cb6b .config console log report ci-android-49-kasan-gce-386
2018/09/09 23:44 https://android.googlesource.com/kernel/common android-4.9 dcae9fa1319b 6b5120a4 .config console log report ci-android-49-kasan-gce-386
2018/09/09 14:44 https://android.googlesource.com/kernel/common android-4.9 dcae9fa1319b 6b5120a4 .config console log report ci-android-49-kasan-gce-386
2018/09/07 06:43 https://android.googlesource.com/kernel/common android-4.9 dcae9fa1319b e30d3b52 .config console log report ci-android-49-kasan-gce-386
2018/09/06 13:44 https://android.googlesource.com/kernel/common android-4.9 dcae9fa1319b 0bb7a7eb .config console log report ci-android-49-kasan-gce-386
2018/09/05 01:39 https://android.googlesource.com/kernel/common android-4.9 797b085724f7 a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/04 01:41 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/04 00:11 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/03 18:46 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/03 16:08 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/03 10:41 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/02 13:48 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/01 22:37 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/01 20:05 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/09/01 18:26 https://android.googlesource.com/kernel/common android-4.9 a06ea261bc2a a4718693 .config console log report ci-android-49-kasan-gce-386
2018/08/31 04:16 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 938220fd .config console log report ci-android-49-kasan-gce-386
2018/08/28 12:19 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 7ef1de9e .config console log report ci-android-49-kasan-gce-386
2018/08/25 17:15 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 9be5aa1d .config console log report ci-android-49-kasan-gce-386
2018/08/25 15:25 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 9be5aa1d .config console log report ci-android-49-kasan-gce-386
2018/08/25 12:12 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 9be5aa1d .config console log report ci-android-49-kasan-gce-386
2018/08/25 10:21 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 9be5aa1d .config console log report ci-android-49-kasan-gce-386
2018/08/24 21:50 https://android.googlesource.com/kernel/common android-4.9 6a1b5923548a 9b0f5c75 .config console log report ci-android-49-kasan-gce-386
2018/08/24 18:49 https://android.googlesource.com/kernel/common android-4.9 6a1b5923548a 9b0f5c75 .config console log report ci-android-49-kasan-gce-386
2018/08/24 10:41 https://android.googlesource.com/kernel/common android-4.9 520d10d31ca4 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/23 23:35 https://android.googlesource.com/kernel/common android-4.9 7fa8c15e72a4 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/23 02:52 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/23 00:59 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/22 13:19 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/22 10:40 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/22 03:01 https://android.googlesource.com/kernel/common android-4.9 54068d61e7d8 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/21 01:50 https://android.googlesource.com/kernel/common android-4.9 54068d61e7d8 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/18 12:25 https://android.googlesource.com/kernel/common android-4.9 681e57bb080a db1858f6 .config console log report ci-android-49-kasan-gce-386
2018/08/18 06:04 https://android.googlesource.com/kernel/common android-4.9 681e57bb080a db1858f6 .config console log report ci-android-49-kasan-gce-386
2018/08/15 14:04 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 9ccc1d45 .config console log report ci-android-49-kasan-gce-386
2018/08/13 23:37 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/13 01:05 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/12 23:44 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/12 19:03 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/12 14:49 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/12 01:58 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/11 07:03 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/10 12:48 https://android.googlesource.com/kernel/common android-4.9 92e87041ed2d 1fb62d58 .config console log report ci-android-49-kasan-gce-386
2018/08/08 23:26 https://android.googlesource.com/kernel/common android-4.9 856452b4f22e 2eeda842 .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.