syzbot

 sign-in | mailing list | source | docs
🐞 Open [1005] ≡ Subsystems 🐞 Fixed [5249] 🐞 Invalid [12556] ⬇ Missing Backports [84] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Write in __internal_add_timer

Status: closed as invalid on 2017/11/01 19:41
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+e99ef70b1aab1991b9bf8d3749bb440eb5dd5c41@syzkaller.appspotmail.com
First crash: 2445d, last: 2384d
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: use-after-free Write in __internal_add_timer C 155 456d 1397d 0/2 upstream: reported C repro on 2020/07/04 17:00

Sample crash report:
BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:673 [inline]
BUG: KASAN: use-after-free in enqueue_timer kernel/time/timer.c:520 [inline]
BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0 kernel/time/timer.c:531
Write of size 8 at addr ffff8801d27b3600 by task syzkaller319675/2997

CPU: 1 PID: 2997 Comm: syzkaller319675 Not tainted 4.14.0-rc5+ #52
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:435
 hlist_add_head include/linux/list.h:673 [inline]
 enqueue_timer kernel/time/timer.c:520 [inline]
 __internal_add_timer+0x275/0x2d0 kernel/time/timer.c:531
 internal_add_timer kernel/time/timer.c:573 [inline]
 __mod_timer kernel/time/timer.c:1024 [inline]
 mod_timer+0x622/0x15b0 kernel/time/timer.c:1071
 tun_flow_init drivers/net/tun.c:1098 [inline]
 tun_set_iff drivers/net/tun.c:2060 [inline]
 __tun_chr_ioctl+0x1b17/0x3d20 drivers/net/tun.c:2278
 tun_chr_compat_ioctl+0x29/0x30 drivers/net/tun.c:2551
 C_SYSC_ioctl fs/compat_ioctl.c:1593 [inline]
 compat_SyS_ioctl+0x1d7/0x3290 fs/compat_ioctl.c:1540
 do_syscall_32_irqs_on arch/x86/entry/common.c:329 [inline]
 do_fast_syscall_32+0x3f2/0xf05 arch/x86/entry/common.c:391
 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124
RIP: 0023:0xf7fb1c79
RSP: 002b:00000000ffdfb76c EFLAGS: 00000282 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400454ca
RDX: 00000000209fa000 RSI: 00000000080ef00c RDI: 000000000000003f
RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 2997:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 __do_kmalloc_node mm/slab.c:3689 [inline]
 __kmalloc_node+0x47/0x70 mm/slab.c:3696
 kmalloc_node include/linux/slab.h:535 [inline]
 kvmalloc_node+0x64/0xd0 mm/util.c:397
 kvmalloc include/linux/mm.h:529 [inline]
 kvzalloc include/linux/mm.h:537 [inline]
 alloc_netdev_mqs+0x16e/0xed0 net/core/dev.c:8023
 tun_set_iff drivers/net/tun.c:2024 [inline]
 __tun_chr_ioctl+0x12b2/0x3d20 drivers/net/tun.c:2278
 tun_chr_compat_ioctl+0x29/0x30 drivers/net/tun.c:2551
 C_SYSC_ioctl fs/compat_ioctl.c:1593 [inline]
 compat_SyS_ioctl+0x1d7/0x3290 fs/compat_ioctl.c:1540
 do_syscall_32_irqs_on arch/x86/entry/common.c:329 [inline]
 do_fast_syscall_32+0x3f2/0xf05 arch/x86/entry/common.c:391
 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124

Freed by task 2997:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xca/0x250 mm/slab.c:3820
 kvfree+0x36/0x60 mm/util.c:416
 netdev_freemem net/core/dev.c:7975 [inline]
 free_netdev+0x2cf/0x360 net/core/dev.c:8137
 tun_set_iff drivers/net/tun.c:2107 [inline]
 __tun_chr_ioctl+0x2cea/0x3d20 drivers/net/tun.c:2278
 tun_chr_compat_ioctl+0x29/0x30 drivers/net/tun.c:2551
 C_SYSC_ioctl fs/compat_ioctl.c:1593 [inline]
 compat_SyS_ioctl+0x1d7/0x3290 fs/compat_ioctl.c:1540
 do_syscall_32_irqs_on arch/x86/entry/common.c:329 [inline]
 do_fast_syscall_32+0x3f2/0xf05 arch/x86/entry/common.c:391
 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124

The buggy address belongs to the object at ffff8801d27b02c0
 which belongs to the cache kmalloc-16384 of size 16384
The buggy address is located 13120 bytes inside of
 16384-byte region [ffff8801d27b02c0, ffff8801d27b42c0)
The buggy address belongs to the page:
page:ffffea000749ec00 count:1 mapcount:0 mapping:ffff8801d27b02c0 index:0x0 compound_mapcount: 0
flags: 0x200000000008100(slab|head)
raw: 0200000000008100 ffff8801d27b02c0 0000000000000000 0000000100000001
raw: ffffea0007659020 ffffea00074cc220 ffff8801dac02200 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d27b3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d27b3580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801d27b3600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8801d27b3680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d27b3700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (36071):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/10/22 06:18 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 06:18 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 05:46 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 05:33 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 04:05 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 03:01 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 03:00 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 01:19 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 01:18 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/22 00:24 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/21 22:59 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/21 22:59 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/21 21:38 upstream 0787643a5f6a 4d9c0713 .config console log report syz C ci-upstream-kasan-gce
2017/10/19 11:03 upstream 73d3393ada4f 3704c601 .config console log report syz C ci-upstream-kasan-gce
2017/10/19 11:02 upstream 73d3393ada4f 3704c601 .config console log report syz C ci-upstream-kasan-gce
2017/10/13 08:31 upstream 3206e7d5e25e c26ea367 .config console log report syz C ci-upstream-kasan-gce
2017/09/07 10:40 upstream ec3604c7a5aa 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/07 10:29 upstream ec3604c7a5aa 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/07 09:28 upstream ec3604c7a5aa 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/07 06:58 upstream ec3604c7a5aa 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/06 22:42 upstream ec3604c7a5aa 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/06 15:03 upstream e7d0c41ecc2e 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/06 13:49 upstream e7d0c41ecc2e 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/06 10:33 upstream e7d0c41ecc2e 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/06 05:43 upstream bafb0762cb6a 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/06 03:33 upstream bafb0762cb6a 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/06 01:46 upstream bafb0762cb6a 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/05 23:06 upstream bafb0762cb6a 0ed1da4a .config console log report syz C ci-upstream-kasan-gce
2017/09/05 09:12 upstream 24e700e291d5 c34180fc .config console log report syz C ci-upstream-kasan-gce
2017/09/04 12:44 upstream 81a84ad3cb57 f400a0da .config console log report syz C ci-upstream-kasan-gce
2017/09/03 02:51 upstream d0d6ab53c9ab a54dce00 .config console log report syz C ci-upstream-kasan-gce
2017/09/02 01:26 upstream 54f70f52e3b3 aa51461a .config console log report syz C ci-upstream-kasan-gce
2017/08/31 08:44 upstream 42ff72cf2702 4ccdd782 .config console log report syz C ci-upstream-kasan-gce
2017/08/30 22:09 upstream 36fde05f3fb5 1d000225 .config console log report syz C ci-upstream-kasan-gce
2017/08/23 08:22 upstream 98b9f8a45499 f238fbd4 .config console log report syz C ci-upstream-kasan-gce
2017/08/21 21:23 upstream 05ab303b4f9e f238fbd4 .config console log report syz C ci-upstream-kasan-gce
2017/10/21 17:35 upstream 9c323bff13f9 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/21 16:33 upstream 9c323bff13f9 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/21 12:28 upstream 9c323bff13f9 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/21 04:57 upstream 9c323bff13f9 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/21 04:29 upstream 9c323bff13f9 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/21 04:28 upstream 9c323bff13f9 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/21 03:57 upstream 9c323bff13f9 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/20 22:55 upstream ce43f4fd6f10 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/20 22:55 upstream ce43f4fd6f10 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/20 16:03 upstream ce43f4fd6f10 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/20 16:03 upstream ce43f4fd6f10 4d9c0713 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/20 06:19 upstream 96f893abc87b 355f57c5 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/20 01:43 upstream 96f893abc87b 355f57c5 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/19 06:53 upstream 73d3393ada4f 3704c601 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/19 03:31 upstream 3e0cc09a3a2c fe864987 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/18 18:58 upstream 3e0cc09a3a2c fe864987 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/18 18:17 upstream 3e0cc09a3a2c fe864987 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/18 18:04 upstream 3e0cc09a3a2c fe864987 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/18 17:32 upstream 3e0cc09a3a2c fe864987 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/17 04:50 upstream 33d930e59a98 766bfcfd .config console log report syz C ci-upstream-kasan-gce-386
2017/10/15 11:34 upstream e7a36a6ec9cf c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/07 19:38 upstream 1c86f2e4c84f c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/07 07:01 upstream dbeb1a8ff547 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/01 19:18 upstream a8c964eacb21 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/01 15:11 upstream a8c964eacb21 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/01 13:56 upstream a8c964eacb21 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/01 11:27 upstream a8c964eacb21 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/01 06:19 upstream a8c964eacb21 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/01 03:06 upstream a8c964eacb21 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/09/30 22:33 upstream 74d83ec2b734 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/09/27 22:26 upstream 225d3b674829 c26ea367 .config console log report syz C ci-upstream-kasan-gce-386
2017/10/18 03:05 mmots 4eb4a4191fe5 441d64d9 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/10/18 02:04 linux-next 49827b977a2e 441d64d9 .config console log report syz C ci-upstream-next-kasan-gce
2017/10/16 09:17 mmots 4eb4a4191fe5 441d64d9 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/10/15 21:15 mmots 4eb4a4191fe5 441d64d9 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/10/14 12:46 mmots 4eb4a4191fe5 441d64d9 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/09/29 05:12 linux-next 00d47fc93ae9 c26ea367 .config console log report syz C ci-upstream-next-kasan-gce
2017/09/28 17:40 linux-next 00d47fc93ae9 c26ea367 .config console log report syz C ci-upstream-next-kasan-gce
2017/09/26 19:31 linux-next d35adcbe86c1 c26ea367 .config console log report syz C ci-upstream-next-kasan-gce
2017/09/20 21:19 mmots 720bbe532b7c c26ea367 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/09/20 19:47 mmots 720bbe532b7c c26ea367 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/09/20 19:35 mmots 720bbe532b7c c26ea367 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/09/20 19:25 mmots 720bbe532b7c c26ea367 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/09/20 03:25 mmots 720bbe532b7c c26ea367 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/09/19 10:00 mmots 720bbe532b7c c26ea367 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/09/14 02:23 linux-next 6f20b7a58cb9 96b8e399 .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/13 22:08 linux-next 6f20b7a58cb9 96b8e399 .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/10 19:00 linux-next 58bcd35f859b d18bfda0 .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/10 13:47 linux-next 58bcd35f859b d18bfda0 .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/10 11:19 linux-next 58bcd35f859b d18bfda0 .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/08 06:13 linux-next 58bcd35f859b d18bfda0 .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/08 03:18 linux-next c6be5a0e3ceb 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/07 18:24 linux-next c6be5a0e3ceb 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/07 09:05 linux-next c6be5a0e3ceb 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/06 16:18 linux-next e9fcbcd00963 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/06 15:51 linux-next e9fcbcd00963 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/05 23:06 linux-next 744c56def809 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/05 19:32 linux-next 744c56def809 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/05 09:12 linux-next 744c56def809 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/05 08:49 linux-next 744c56def809 0ed1da4a .config console log report syz C skylake-linux-next-kasan-qemu
2017/09/02 00:41 linux-next 1d53d908b79d a54dce00 .config console log report syz C ci-upstream-next-kasan-gce
2017/08/31 09:58 linux-next e8b684315214 4ccdd782 .config console log report syz C skylake-linux-next-kasan-qemu
2017/08/23 10:39 linux-next cc6d46bb99b5 f238fbd4 .config console log report syz C ci-upstream-next-kasan-gce
2017/08/23 09:10 linux-next cc6d46bb99b5 f238fbd4 .config console log report syz C ci-upstream-next-kasan-gce
2017/10/18 08:50 mmots 4eb4a4191fe5 441d64d9 .config console log report syz ci-upstream-mmots-kasan-gce
2017/10/22 02:46 upstream 0787643a5f6a 4d9c0713 .config console log report ci-upstream-kasan-gce
2017/10/19 12:18 upstream 73d3393ada4f 3704c601 .config console log report ci-upstream-kasan-gce
2017/09/25 09:33 upstream a141fd55f262 c26ea367 .config console log report ci-upstream-kasan-gce
2017/09/24 02:02 upstream cd4175b11685 c26ea367 .config console log report ci-upstream-kasan-gce
2017/09/13 14:33 upstream 6d8ef53e8b2f c12eb94a .config console log report ci-upstream-kasan-gce
2017/10/17 01:55 upstream 33d930e59a98 766bfcfd .config console log report ci-upstream-kasan-gce-386
2017/10/13 20:31 upstream 3d7882769b5d c26ea367 .config console log report ci-upstream-kasan-gce-386
2017/10/11 12:16 upstream a957fd420ca8 c26ea367 .config console log report ci-upstream-kasan-gce-386
2017/10/08 04:03 upstream 85b1bb248071 c26ea367 .config console log report ci-upstream-kasan-gce-386
2017/10/05 06:15 upstream b7e141644178 c26ea367 .config console log report ci-upstream-kasan-gce-386
2017/09/29 22:31 upstream 770b782f555d c26ea367 .config console log report ci-upstream-kasan-gce-386
2017/09/26 05:13 upstream 19240e6b2a6c c26ea367 .config console log report ci-upstream-kasan-gce-386
2017/09/25 23:46 linux-next 73527316e3fd c26ea367 .config console log report ci-upstream-next-kasan-gce
2017/09/23 17:52 mmots 720bbe532b7c c26ea367 .config console log report ci-upstream-mmots-kasan-gce
2017/09/20 09:16 linux-next 0b093a564fe0 4e341009 .config console log report ci-upstream-next-kasan-gce
2017/09/17 11:53 linux-next 1f183459b514 da1873aa .config console log report skylake-linux-next-kasan-qemu
2017/09/15 15:57 linux-next 1f183459b514 da1873aa .config console log report skylake-linux-next-kasan-qemu
2017/09/13 12:14 linux-next 6f20b7a58cb9 96b8e399 .config console log report skylake-linux-next-kasan-qemu
2017/09/12 02:42 linux-next a31cc455c512 449b6f15 .config console log report ci-upstream-next-kasan-gce
2017/08/30 06:53 linux-next 9458bf6edfa8 ed7f9598 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.