KASAN: global-out-of-bounds Read in detach_capi_ctr

Status: upstream: reported C repro on 2021/12/07 11:19
Reported-by: syzbot+9d567e08d3970bfd8271@syzkaller.appspotmail.com
First crash: 1698d, last: 1695d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
Re: Test patch for KASAN: global-out-of-bounds Read in detach_capi_ctr 7 (7) 2022/07/05 05:18
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2022/07/01 23:24 8m soumya.negi97@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git 3f8a27f9e27bd78604c0709224cec0ec85a8b106 error
2022/07/01 13:08 11m soumya.negi97@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git 3f8a27f9e27bd78604c0709224cec0ec85a8b106 error
2022/07/01 12:24 17m soumya.negi97@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master error

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
Bluetooth: hci0: command 0x0409 tx timeout
Bluetooth: hci0: command 0x041b tx timeout
Bluetooth: Found 0 CAPI controller(s) on device 10:aa:aa:aa:aa:aa
==================================================================
BUG: KASAN: global-out-of-bounds in detach_capi_ctr+0xaf/0x120 drivers/isdn/capi/kcapi.c:568
Read of size 8 at addr ffffffff8dd14538 by task kcmtpd_ctr_0/8130

CPU: 0 PID: 8130 Comm: kcmtpd_ctr_0 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_address_description.cold+0x5/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
 detach_capi_ctr+0xaf/0x120 drivers/isdn/capi/kcapi.c:568
 cmtp_session+0x162e/0x19e0 net/bluetooth/cmtp/core.c:316
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

The buggy address belongs to the variable:
 capi_applications+0x798/0x7a0

Memory state around the buggy address:
 ffffffff8dd14400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff8dd14480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff8dd14500: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
                                        ^
 ffffffff8dd14580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff8dd14600: 00 00 00 00 00 00 00 00 fa fa fa fa 00 fa fa fa
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/09 04:09 linux-4.19.y 3f8a27f9e27b a4a2a501 .config console log report syz C ci2-linux-4-19 KASAN: global-out-of-bounds Read in detach_capi_ctr
2021/12/07 11:50 linux-4.19.y 3f8a27f9e27b 0230ba3e .config console log report syz C ci2-linux-4-19 KASAN: global-out-of-bounds Read in detach_capi_ctr
2021/12/10 16:09 linux-4.19.y 3f8a27f9e27b fc17c959 .config console log report info ci2-linux-4-19 KASAN: global-out-of-bounds Read in detach_capi_ctr
2021/12/07 11:27 linux-4.19.y 3f8a27f9e27b 0230ba3e .config console log report info ci2-linux-4-19 KASAN: global-out-of-bounds Read in detach_capi_ctr
2021/12/07 11:23 linux-4.19.y 3f8a27f9e27b 0230ba3e .config console log report info ci2-linux-4-19 KASAN: global-out-of-bounds Read in detach_capi_ctr
2021/12/07 11:18 linux-4.19.y 3f8a27f9e27b 0230ba3e .config console log report info ci2-linux-4-19 KASAN: global-out-of-bounds Read in detach_capi_ctr
* Struck through repros no longer work on HEAD.