syzbot


WARNING: refcount bug in rds_tcp_tune

Status: internal: reported on 2022/05/03 16:48
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 6997fbd7a3da net: rds: use maybe_get_net() when acquiring refcount on TCP sockets
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 56d, last: 47d

Sample crash report:
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 5437 at lib/refcount.c:25 refcount_warn_saturate+0x13d/0x1a0 lib/refcount.c:25
Modules linked in:
CPU: 1 PID: 5437 Comm: kworker/u4:15 Not tainted 5.18.0-rc6-syzkaller-00015-g0ac824f379fb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: krdsd rds_connect_worker
RIP: 0010:refcount_warn_saturate+0x13d/0x1a0 lib/refcount.c:25
Code: c7 20 4a e8 8a 31 c0 e8 21 81 26 fd 0f 0b eb a3 e8 98 15 5d fd c6 05 38 00 c5 09 01 48 c7 c7 80 4a e8 8a 31 c0 e8 03 81 26 fd <0f> 0b eb 85 e8 7a 15 5d fd c6 05 1b 00 c5 09 01 48 c7 c7 e0 4a e8
RSP: 0018:ffffc9000aa1fa48 EFLAGS: 00010246
RAX: 4efec6e383203200 RBX: 0000000000000002 RCX: ffff88801b035880
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000002 R08: ffffffff816ad542 R09: ffffed1017366809
R10: ffffed1017366809 R11: 1ffff11017366808 R12: ffff88802540d3cc
R13: ffff88802540d280 R14: ffff888058c97700 R15: ffff88804cbc8cc0
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33421000 CR3: 000000000c88e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 get_net include/net/net_namespace.h:248 [inline]
 get_net_track include/net/net_namespace.h:334 [inline]
 rds_tcp_tune+0x2bc/0x3a0 net/rds/tcp.c:503
 rds_tcp_conn_path_connect+0x2f6/0xb40 net/rds/tcp_connect.c:127
 rds_connect_worker+0x1c3/0x270 net/rds/threads.c:176
 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289
 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>

Crashes (166):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2022/05/12 19:22 upstream 0ac824f379fb 9ad6612a .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-root 2022/05/10 23:30 upstream feb9c5e19e91 8d7b3b67 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-root 2022/05/10 18:30 upstream 9be9ed2612b5 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-root 2022/05/10 12:28 upstream 9be9ed2612b5 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/10 11:13 upstream 9be9ed2612b5 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce 2022/05/10 01:37 upstream 9be9ed2612b5 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/09 19:54 upstream 9be9ed2612b5 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/09 18:39 upstream 9be9ed2612b5 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/09 08:43 upstream c5eb0a61238d e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-root 2022/05/09 00:15 upstream 379c72654524 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/08 13:16 upstream 30c8e80f7932 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/08 09:03 upstream 30c8e80f7932 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/08 01:26 upstream 30c8e80f7932 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/07 02:55 upstream 4b97bac0756a e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-selinux-root 2022/05/07 00:52 upstream 4b97bac0756a e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-smack-root 2022/05/05 19:47 upstream 0f5d752b1395 efeff0a5 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-qemu-upstream-386 2022/05/11 16:45 upstream feb9c5e19e91 beb0b407 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-qemu-upstream-386 2022/05/09 10:44 upstream c5eb0a61238d 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-kasan-gce-386 2022/05/08 20:13 upstream 379c72654524 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-qemu-upstream-386 2022/05/06 23:07 upstream 4b97bac0756a e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-this-kasan-gce 2022/05/05 23:15 net 4071bf121d59 efeff0a5 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-this-kasan-gce 2022/05/03 16:47 net 3a58f13a881e dc9e5259 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/12 14:52 net-next b33177f1d62b 9ad6612a .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/12 04:18 net-next bb709987f104 beb0b407 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/11 15:44 net-next 01f4685797a5 beb0b407 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/11 14:14 net-next 01f4685797a5 beb0b407 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/11 12:44 net-next 01f4685797a5 8d7b3b67 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/10 15:25 net-next ecd17a87eb78 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/10 04:30 net-next eef0dc7e517e 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/09 12:32 net-next 6da3c47264b2 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/09 09:46 net-next c908565eecf2 8b277b8e .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/09 07:16 net-next c908565eecf2 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/08 23:07 net-next c908565eecf2 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/08 22:04 net-next c908565eecf2 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/08 17:40 net-next eb60020411fc e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/08 16:34 net-next eb60020411fc e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/08 14:23 net-next eb60020411fc e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/08 11:53 net-next eb60020411fc e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/08 06:30 net-next 8fc0b6992a06 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/08 03:39 net-next 8fc0b6992a06 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/07 17:50 net-next 8fc0b6992a06 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/07 16:19 net-next 8fc0b6992a06 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/07 11:52 net-next 8fc0b6992a06 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/07 09:27 net-next 8fc0b6992a06 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/07 06:23 net-next 8fc0b6992a06 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/07 05:11 net-next 53e2cb3b2a5a e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/06 21:21 net-next 95730d657083 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-net-kasan-gce 2022/05/06 13:52 net-next 95730d657083 e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-linux-next-kasan-gce-root 2022/05/11 01:36 linux-next 38a288f5941e 8d7b3b67 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-linux-next-kasan-gce-root 2022/05/08 18:47 linux-next 38a288f5941e e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-linux-next-kasan-gce-root 2022/05/07 18:55 linux-next 38a288f5941e e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-linux-next-kasan-gce-root 2022/05/07 10:43 linux-next 38a288f5941e e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune
ci-upstream-linux-next-kasan-gce-root 2022/05/06 17:24 linux-next 38a288f5941e e60b1103 .config log report info WARNING: refcount bug in rds_tcp_tune