syzbot

 sign-in | mailing list | source | docs
🐞 Open [997] ≡ Subsystems 🐞 Fixed [5242] 🐞 Invalid [12511] ⬇ Missing Backports [84] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: user-memory-access Read in ip6_hold_safe

Status: closed as invalid on 2019/04/02 18:33
Subsystems: net
[Documentation on labels]
First crash: 1930d, last: 1851d
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: user-memory-access Read in ip6_hold_safe (3) net 456 1772d 1791d 13/26 fixed on 2019/10/04 12:05
linux-4.19 KASAN: user-memory-access Read in ip6_hold_safe 1 1773d 1773d 0/1 auto-closed as invalid on 2019/10/25 08:37
upstream KASAN: user-memory-access Read in ip6_hold_safe (2) net 3 1820d 1831d 0/26 closed as invalid on 2019/05/15 22:57

Sample crash report:
==================================================================
BUG: KASAN: user-memory-access in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: user-memory-access in atomic_fetch_add_unless include/linux/atomic-fallback.h:1086 [inline]
BUG: KASAN: user-memory-access in atomic_add_unless include/linux/atomic-fallback.h:1111 [inline]
BUG: KASAN: user-memory-access in atomic_inc_not_zero include/linux/atomic-fallback.h:1127 [inline]
BUG: KASAN: user-memory-access in dst_hold_safe include/net/dst.h:308 [inline]
BUG: KASAN: user-memory-access in ip6_hold_safe+0xb3/0x3a0 net/ipv6/route.c:1023
Read of size 4 at addr 0000000000001ec4 by task syz-executor.0/21583

CPU: 1 PID: 21583 Comm: syz-executor.0 Not tainted 5.1.0-rc2 #36
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 kasan_report.cold+0x5/0x40 mm/kasan/report.c:321
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x123/0x190 mm/kasan/generic.c:191
 kasan_check_read+0x11/0x20 mm/kasan/common.c:102
 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
 atomic_fetch_add_unless include/linux/atomic-fallback.h:1086 [inline]
 atomic_add_unless include/linux/atomic-fallback.h:1111 [inline]
 atomic_inc_not_zero include/linux/atomic-fallback.h:1127 [inline]
 dst_hold_safe include/net/dst.h:308 [inline]
 ip6_hold_safe+0xb3/0x3a0 net/ipv6/route.c:1023
 rt6_get_pcpu_route net/ipv6/route.c:1243 [inline]
 ip6_pol_route+0x348/0x1040 net/ipv6/route.c:1904
 ip6_pol_route_input+0x65/0x80 net/ipv6/route.c:1923
 fib6_rule_lookup+0x128/0x560 net/ipv6/fib6_rules.c:118
 ip6_route_input_lookup+0xb7/0xd0 net/ipv6/route.c:1935
 ip6_route_input+0x5e2/0x9e0 net/ipv6/route.c:2070
 ip6_rcv_finish_core.isra.0+0x174/0x590 net/ipv6/ip6_input.c:63
 ip6_rcv_finish+0x17d/0x320 net/ipv6/ip6_input.c:74
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 ipv6_rcv+0x10e/0x420 net/ipv6/ip6_input.c:272
 __netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4973
 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083
 netif_receive_skb_internal+0x117/0x660 net/core/dev.c:5186
 napi_frags_finish net/core/dev.c:5753 [inline]
 napi_gro_frags+0xade/0xd10 net/core/dev.c:5827
 tun_get_user+0x2c17/0x3d70 drivers/net/tun.c:1974
 tun_chr_write_iter+0xbd/0x160 drivers/net/tun.c:2019
 call_write_iter include/linux/fs.h:1863 [inline]
 do_iter_readv_writev+0x5e1/0x8e0 fs/read_write.c:680
 do_iter_write fs/read_write.c:956 [inline]
 do_iter_write+0x184/0x610 fs/read_write.c:937
 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1001
 do_writev+0xf6/0x290 fs/read_write.c:1036
 __do_sys_writev fs/read_write.c:1109 [inline]
 __se_sys_writev fs/read_write.c:1106 [inline]
 __x64_sys_writev+0x75/0xb0 fs/read_write.c:1106
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4580c1
Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b9 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007f9dad98eba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 000000000000004a RCX: 00000000004580c1
RDX: 0000000000000001 RSI: 00007f9dad98ec00 RDI: 00000000000000f0
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f9dad98f6d4
R13: 00000000004c6848 R14: 00000000004dbd70 R15: 00000000ffffffff
==================================================================

Crashes (20):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/25 18:49 upstream 8c2ffd917477 2c86e0a5 .config console log report ci-upstream-kasan-gce-root
2019/03/21 16:48 upstream 54c490164523 dce6e62f .config console log report ci-upstream-kasan-gce-smack-root
2019/03/12 10:56 upstream ea295481b6e3 12365b99 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/10 19:16 upstream aadaa8061189 b4f792e4 .config console log report ci-upstream-kasan-gce
2019/03/06 22:58 upstream afe6fe7036c6 18215b8d .config console log report ci-upstream-kasan-gce-386
2019/03/05 19:35 upstream 63bdf4284c38 16559f86 .config console log report ci-upstream-kasan-gce-386
2019/03/25 13:17 net-old 526949e877f4 2c86e0a5 .config console log report ci-upstream-net-this-kasan-gce
2019/03/14 23:19 net-old 3b319ee220a8 d72db19b .config console log report ci-upstream-net-this-kasan-gce
2019/03/06 17:29 net-old 4177c5d94264 05cf83bf .config console log report ci-upstream-net-this-kasan-gce
2019/02/24 23:43 net-old 4c8e0459b585 7a06e792 .config console log report ci-upstream-net-this-kasan-gce
2019/02/23 15:07 net-old ea34a003645c 18107ce0 .config console log report ci-upstream-net-this-kasan-gce
2019/02/19 17:38 net-old 1f43f400a2cb 4df543c9 .config console log report ci-upstream-net-this-kasan-gce
2019/04/02 03:48 net-next-old f5d547676ca0 a9ca43d4 .config console log report ci-upstream-net-kasan-gce
2019/03/23 11:30 net-next-old 1d965c4def07 3361bde5 .config console log report ci-upstream-net-kasan-gce
2019/03/18 22:01 net-next-old 3b319ee220a8 4656beca .config console log report ci-upstream-net-kasan-gce
2019/03/12 06:47 net-next-old d9862cfbe209 12365b99 .config console log report ci-upstream-net-kasan-gce
2019/02/25 16:43 net-next-old bd16693f359b a70141bf .config console log report ci-upstream-net-kasan-gce
2019/02/10 11:34 net-next-old 99c864667c9f b4f792e4 .config console log report ci-upstream-net-kasan-gce
2019/01/28 07:39 net-next-old 085c4c7dd2b6 c73f090a .config console log report ci-upstream-net-kasan-gce
2019/01/13 10:47 net-next-old b71acb0e3721 c3f3344c .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.