KASAN: stack-out-of-bounds Write in notify

KASAN: stack-out-of-bounds Write in notify_die

Status: closed as dup on 2018/05/26 09:26
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+cadaa9a49085b3cc83d3@syzkaller.appspotmail.com
First crash: 2446d, last: 2377d

▶ ▼ Duplicate of

Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported
KASAN: use-after-free Read in do_general_protection kernel	C	error	error	2	2410d	2440d

▶ ▼ Discussions (1)

Title	Replies (including bot)	Last reply
KASAN: stack-out-of-bounds Write in notify_die	1 (2)	2018/05/26 09:26

Sample crash report:

IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
8021q: adding VLAN 0 to HW filter on device team0
==================================================================
BUG: KASAN: stack-out-of-bounds in notify_die+0x2c2/0x2e0 kernel/notifier.c:539
Write of size 8 at addr ffff8801d6dbf1f8 by task syz-executor0/4607

CPU: 0 PID: 4607 Comm: syz-executor0 Not tainted 4.18.0-rc6-next-20180725+ #18
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

The buggy address belongs to the page:

Crashes (4):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	Manager
2018/07/28 07:08	linux-next	d1e0b8e0cb7a	ebf656d7	.config	console log	report	syz	ci-upstream-linux-next-kasan-gce-root
2018/07/25 16:11	linux-next	d1e0b8e0cb7a	375a3e31	.config	console log	report	syz	ci-upstream-linux-next-kasan-gce-root
2018/07/24 22:05	linux-next	3946cd385042	375a3e31	.config	console log	report	syz	ci-upstream-linux-next-kasan-gce-root
2018/05/20 18:59	upstream	203ec2fed17a	f48c20b8	.config	console log	report		ci-upstream-kasan-gce-root

* ~~Struck through~~ repros no longer work on HEAD.