syzbot


WARNING in net_free (2)

Status: fixed on 2024/04/12 05:52
Subsystems: net
[Documentation on labels]
Fix commit: 2a750d6a5b36 rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
First crash: 88d, last: 42d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in net_free net 1 398d 398d 22/26 fixed on 2023/06/08 14:41

Sample crash report:
     __do_sys_unshare kernel/fork.c:3499 [inline]
     __se_sys_unshare kernel/fork.c:3497 [inline]
     __arm64_sys_unshare+0x3c/0x50 kernel/fork.c:3497
     __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
     invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
     el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
     do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6294 at lib/ref_tracker.c:179 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
WARNING: CPU: 1 PID: 6294 at lib/ref_tracker.c:179 ref_tracker_dir_exit+0x390/0x4b4 lib/ref_tracker.c:178
Modules linked in:
CPU: 1 PID: 6294 Comm: kworker/u4:2 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: netns cleanup_net
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ref_tracker_dir_exit+0x390/0x4b4 include/linux/spinlock.h:406
lr : spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
lr : ref_tracker_dir_exit+0x390/0x4b4 lib/ref_tracker.c:178
sp : ffff800097da7980
x29: ffff800097da7a00 x28: ffff0000d99fbb60 x27: 1ffff00012fb4f34
x26: dfff800000000000 x25: ffff0000d99fbbb0 x24: dead000000000100
x23: ffff0000d99fbbb0 x22: ffff0000d99fbb60 x21: ffff0000d99fbbb0
x20: ffff0000d99fbbb0 x19: 1fffe0001a7d2590 x18: 1fffe00036804396
x17: ffff80008ec9d000 x16: ffff80008032116c x15: 0000000000000001
x14: 1fffe00036806be8 x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000001
x8 : 0000000000000008 x7 : ffff800080297c0c x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff80008aedea60 x0 : ffff800125436000
Call trace:
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 ref_tracker_dir_exit+0x390/0x4b4 lib/ref_tracker.c:178
 net_free+0x80/0xf4 net/core/net_namespace.c:452
 cleanup_net+0x82c/0x8d0 net/core/net_namespace.c:639
 process_one_work+0x694/0x1204 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x938/0xef4 kernel/workqueue.c:2787
 kthread+0x288/0x310 kernel/kthread.c:388
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 1193246
hardirqs last  enabled at (1193245): [<ffff800080297cac>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1397 [inline]
hardirqs last  enabled at (1193245): [<ffff800080297cac>] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:5154
hardirqs last disabled at (1193246): [<ffff80008ad66988>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:470
softirqs last  enabled at (1193242): [<ffff80008002189c>] softirq_handle_end kernel/softirq.c:399 [inline]
softirqs last  enabled at (1193242): [<ffff80008002189c>] __do_softirq+0xac8/0xce4 kernel/softirq.c:582
softirqs last disabled at (1193227): [<ffff80008002ab48>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
---[ end trace 0000000000000000 ]---
netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0

Crashes (27):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/05 20:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 18ea8213 .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/22 01:49 upstream 23956900041d 7a239ce7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 WARNING in net_free
2024/03/20 14:34 upstream a4145ce1e7bc 5b7d42ae .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 WARNING in net_free
2024/03/16 19:16 upstream 66a27abac311 d615901c .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 WARNING in net_free
2024/04/04 00:34 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 fed899ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/04/03 15:14 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 fed899ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/04/02 13:25 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/04/02 13:24 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/04/02 07:48 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/04/02 01:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/04/01 13:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/04/01 06:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/31 13:23 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/31 02:58 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/30 18:42 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/30 16:41 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/30 13:46 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/30 11:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/29 12:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 c52bcb23 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/28 08:58 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 454571b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/27 00:59 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 454571b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/20 21:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 5b7d42ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/19 22:34 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 a485f239 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/16 11:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 d615901c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/13 19:28 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 f919f202 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/03/07 17:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9910665503b3 2b789849 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
2024/02/19 11:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 905b00721763 578f7538 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in net_free
* Struck through repros no longer work on HEAD.