KASAN: global-out-of-bounds Read in in_dev_finish_destroy

Status: auto-obsoleted due to no activity on 2025/08/05 22:28
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+dd3b9802ae13f63906d7@syzkaller.appspotmail.com
First crash: 464d, last: 438d
▶ ▼ Duplicate bugs (1)
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: slab-out-of-bounds Read in stack_trace_print net 17 1 433d 432d 0/29 closed as dup on 2025/06/03 12:10
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] KASAN: global-out-of-bounds Read in in_dev_finish_destroy 0 (1) 2025/05/12 23:22

Sample crash report:
==================================================================
BUG: KASAN: global-out-of-bounds in ref_tracker_free+0x6df/0x7d0 lib/ref_tracker.c:244
Read of size 1 at addr ffffffff99d1d890 by task syz-executor/7195

CPU: 0 UID: 0 PID: 7195 Comm: syz-executor Not tainted 6.15.0-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xb4/0x290 mm/kasan/report.c:521
 kasan_report+0x118/0x150 mm/kasan/report.c:634
 ref_tracker_free+0x6df/0x7d0 lib/ref_tracker.c:244
 netdev_tracker_free include/linux/netdevice.h:4351 [inline]
 netdev_put include/linux/netdevice.h:4368 [inline]
 in_dev_finish_destroy+0x9b/0x190 net/ipv4/devinet.c:258
 in_dev_put include/linux/inetdevice.h:290 [inline]
 inetdev_destroy net/ipv4/devinet.c:338 [inline]
 inetdev_event+0x81c/0x15b0 net/ipv4/devinet.c:1656
 notifier_call_chain+0x1b6/0x3e0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2214 [inline]
 call_netdevice_notifiers net/core/dev.c:2228 [inline]
 unregister_netdevice_many_notify+0x15d8/0x2330 net/core/dev.c:11972
 unregister_netdevice_many net/core/dev.c:12036 [inline]
 unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:11879
 unregister_netdevice include/linux/netdevice.h:3374 [inline]
 nsim_destroy+0x1f6/0x670 drivers/net/netdevsim/netdev.c:1064
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1428
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1440 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1661
 nsim_drv_remove+0x58/0x160 drivers/net/netdevsim/dev.c:1676
 device_remove drivers/base/dd.c:567 [inline]
 __device_release_driver drivers/base/dd.c:1272 [inline]
 device_release_driver_internal+0x46f/0x7c0 drivers/base/dd.c:1295
 bus_remove_device+0x34d/0x410 drivers/base/bus.c:579
 device_del+0x511/0x8e0 drivers/base/core.c:3881
 device_unregister+0x20/0xc0 drivers/base/core.c:3922
 nsim_bus_dev_del drivers/net/netdevsim/bus.c:462 [inline]
 del_device_store+0x2aa/0x360 drivers/net/netdevsim/bus.c:226
 kernfs_fop_write_iter+0x378/0x4f0 fs/kernfs/file.c:334
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x54b/0xa90 fs/read_write.c:684
 ksys_write+0x145/0x250 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f039938d41f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007ffc09da2b90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f039938d41f
RDX: 0000000000000001 RSI: 00007ffc09da2be0 RDI: 0000000000000005
RBP: 00007f0399411d05 R08: 0000000000000000 R09: 00007ffc09da29e7
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 00007ffc09da2be0 R14: 00007f039a0e4620 R15: 0000000000000003
 </TASK>

The buggy address belongs to the variable:
 binder_devices+0x10/0x20

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x19d1d
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea0000674748 ffffea0000674748 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff99d1d780: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 ffffffff99d1d800: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
>ffffffff99d1d880: 00 f9 f9 f9 00 00 f9 f9 00 00 00 00 00 00 00 00
                         ^
 ffffffff99d1d900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff99d1d980: 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 00 f9 f9 f9
==================================================================

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/27 05:15 upstream 0ff41df1cb26 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/19 22:00 upstream a5806cd506af 8f9cf946 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/17 13:30 upstream 172a9d94339c f41472b0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/05 17:32 upstream 92a09c47464d 6ca47dd8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/04 16:27 upstream 081bc61f9312 b0714e37 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/26 03:14 upstream 0f8c0258bf04 2d4582d0 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/04 09:45 upstream 2a239ffbebb5 b0714e37 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-compat KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/02 09:13 upstream ebd297a2affa d7f099d1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/27 22:27 bpf-next db22b1382b96 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/12 23:21 bpf-next 149e0cf4c99c f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce KASAN: global-out-of-bounds Read in in_dev_finish_destroy
2025/05/26 06:08 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 2d4582d0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: global-out-of-bounds Read in in_dev_finish_destroy
* Struck through repros no longer work on HEAD.