syzbot


KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto

Status: fixed on 2024/01/20 21:18
Subsystems: bpf net
[Documentation on labels]
Reported-by: syzbot+e8030702aefd3444fb9e@syzkaller.appspotmail.com
Fix commit: 8d6650646ce4 bpf: syzkaller found null ptr deref in unix_bpf proto add
First crash: 378d, last: 347d
Cause bisection: introduced by (bisect log) :
commit 8866730aed5100f06d3d965c22f1c61f74942541
Author: John Fastabend <john.fastabend@gmail.com>
Date: Wed Nov 29 01:25:56 2023 +0000

  bpf, sockmap: af_unix stream sockets need to hold ref for pair sock

Crash: KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto (log)
Repro: C syz .config
  
Discussions (3)
Title Replies (including bot) Last reply
[PATCH bpf v2 1/2] bpf: syzkaller found null ptr deref in unix_bpf proto add 1 (1) 2023/12/01 18:01
[PATCH bpf 1/2] bpf: syzkaller found null ptr deref in unix_bpf proto add 2 (2) 2023/12/01 09:24
[syzbot] [bpf?] [net?] KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto 0 (1) 2023/11/30 16:28
Last patch testing requests (1)
Created Duration User Patch Repo Result
2023/11/30 15:01 20m edumazet@google.com patch https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git main OK log

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
BUG: KASAN: null-ptr-deref in __refcount_add include/linux/refcount.h:193 [inline]
BUG: KASAN: null-ptr-deref in __refcount_inc include/linux/refcount.h:250 [inline]
BUG: KASAN: null-ptr-deref in refcount_inc include/linux/refcount.h:267 [inline]
BUG: KASAN: null-ptr-deref in sock_hold include/net/sock.h:777 [inline]
BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171
Write of size 4 at addr 0000000000000080 by task syz-executor360/5073

CPU: 1 PID: 5073 Comm: syz-executor360 Not tainted 6.7.0-rc2-syzkaller-00143-g300fbb247eb3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 kasan_report+0xda/0x110 mm/kasan/report.c:588
 check_region_inline mm/kasan/generic.c:181 [inline]
 kasan_check_range+0xef/0x190 mm/kasan/generic.c:187
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
 __refcount_add include/linux/refcount.h:193 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 sock_hold include/net/sock.h:777 [inline]
 unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171
 sock_map_init_proto net/core/sock_map.c:190 [inline]
 sock_map_link+0xb87/0x1100 net/core/sock_map.c:294
 sock_map_update_common+0xf6/0x870 net/core/sock_map.c:483
 sock_map_update_elem_sys+0x5b6/0x640 net/core/sock_map.c:577
 bpf_map_update_value+0x3af/0x820 kernel/bpf/syscall.c:167
 map_update_elem+0x622/0x890 kernel/bpf/syscall.c:1526
 __sys_bpf+0x1bfb/0x4920 kernel/bpf/syscall.c:5371
 __do_sys_bpf kernel/bpf/syscall.c:5487 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5485 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5485
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f1c8f3fe369
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd877e4a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007ffd877e4c28 RCX: 00007f1c8f3fe369
RDX: 0000000000000020 RSI: 0000000020000140 RDI: 0000000000000002
RBP: 00007f1c8f471610 R08: 00007ffd877e4c28 R09: 00007ffd877e4c28
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd877e4c18 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
==================================================================

Crashes (54):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/11/30 07:02 net 300fbb247eb3 f819d6f7 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/09 21:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d46efae31672 28b24332 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/14 16:57 upstream 5bd7ef53ffe5 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 19:30 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 19:22 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 19:16 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 19:01 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 18:51 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 18:39 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 18:36 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 18:13 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 18:00 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 17:33 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 17:31 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 17:31 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 16:59 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 16:58 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 16:51 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 16:48 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 16:44 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 16:43 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 16:05 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 15:34 upstream 994d5c58e50e f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 02:28 upstream 6172a5180fcc f819d6f7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 02:16 upstream 6172a5180fcc f819d6f7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 01:01 upstream 6172a5180fcc f819d6f7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 00:24 upstream 6172a5180fcc f819d6f7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/19 21:48 net 3dc5d4454545 3ad490ea .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/18 19:30 net 979e90173af8 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/17 14:57 net b1dfc0f76231 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/17 11:14 net b1dfc0f76231 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/11 23:19 net c3e041425af9 28b24332 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/11/30 05:54 net 300fbb247eb3 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/11/30 04:58 net 300fbb247eb3 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/21 05:28 net-next bee9705c679d 4f9530a3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/18 21:22 net-next 610a689d2a57 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/15 10:07 net-next 1b666016d0ad 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/13 12:04 net-next 9bab51bd662b ebcad15c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/10 00:15 net-next 5a08d0065a91 28b24332 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/06 16:44 net-next 074ac38d5b95 e3299f55 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 08:01 net-next 753c8608f3e5 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 07:27 net-next 753c8608f3e5 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/11 00:16 linux-next 8e00ce02066e 28b24332 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/03 01:50 linux-next 5eda217cee88 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 07:41 linux-next 5eda217cee88 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/01 03:47 linux-next 5eda217cee88 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/30 16:08 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci aafe7ad77b91 fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/22 21:53 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci aafe7ad77b91 fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/20 06:46 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci aafe7ad77b91 3ad490ea .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/05 18:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d46efae31672 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/05 17:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d46efae31672 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/05 17:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d46efae31672 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/05 16:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d46efae31672 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
2023/12/05 16:07 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d46efae31672 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in unix_stream_bpf_update_proto
* Struck through repros no longer work on HEAD.