syzbot

 sign-in | mailing list | source | docs
🐞 Open [984] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12476] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in dev_queue_xmit_nit (3)

Status: closed as invalid on 2018/12/05 17:50
Subsystems: net
[Documentation on labels]
First crash: 2047d, last: 2037d
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 KASAN: use-after-free Read in dev_queue_xmit_nit 1 1619d 1619d 0/1 auto-closed as invalid on 2020/03/12 11:34
upstream KASAN: use-after-free Read in dev_queue_xmit_nit (2) net syz 2 2338d 2340d 0/26 closed as invalid on 2018/01/22 17:57
linux-4.19 KASAN: use-after-free Read in dev_queue_xmit_nit C error 90 439d 1641d 0/1 upstream: reported C repro on 2019/10/22 19:23
upstream KASAN: use-after-free Read in dev_queue_xmit_nit C 13 2399d 2410d 3/26 fixed on 2017/11/06 08:47
linux-4.14 KASAN: use-after-free Read in dev_queue_xmit_nit (2) syz error 18 627d 1417d 0/1 upstream: reported syz repro on 2020/06/02 08:57
linux-4.14 KASAN: use-after-free Read in dev_queue_xmit_nit 5 1652d 1763d 0/1 auto-closed as invalid on 2020/02/08 07:01

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:188 [inline]
BUG: KASAN: use-after-free in dev_queue_xmit_nit+0x8ff/0xaf0 net/core/dev.c:1971
Read of size 8 at addr ffff8801d3868d70 by task syz-executor3/12926

CPU: 0 PID: 12926 Comm: syz-executor3 Not tainted 4.19.0-rc4+ #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 __read_once_size include/linux/compiler.h:188 [inline]
 dev_queue_xmit_nit+0x8ff/0xaf0 net/core/dev.c:1971
 xmit_one net/core/dev.c:3212 [inline]
 dev_hard_start_xmit+0x170/0xc70 net/core/dev.c:3232
 __dev_queue_xmit+0x2f3b/0x3980 net/core/dev.c:3802
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3835
 neigh_hh_output include/net/neighbour.h:473 [inline]
 neigh_output include/net/neighbour.h:481 [inline]
 ip6_finish_output2+0x1345/0x27a0 net/ipv6/ip6_output.c:120
 ip6_finish_output+0x5fe/0xbc0 net/ipv6/ip6_output.c:154
 NF_HOOK_COND include/linux/netfilter.h:276 [inline]
 ip6_output+0x23e/0xa00 net/ipv6/ip6_output.c:171
 dst_output include/net/dst.h:444 [inline]
 NF_HOOK include/linux/netfilter.h:287 [inline]
 mld_sendpack+0xae7/0xfb0 net/ipv6/mcast.c:1683
 mld_send_cr net/ipv6/mcast.c:1979 [inline]
 mld_ifc_timer_expire+0x447/0x8a0 net/ipv6/mcast.c:2478
 call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
 run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
 __do_softirq+0x30b/0xad8 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x17f/0x1c0 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:184
Code: e8 29 52 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 28 48 83 3d 00 6a 92 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb ad e8 cc bd 40 f9 eb bb 0f 0b 0f 0b e8 6a 75 02
RSP: 0018:ffff880191a37548 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 1ffff10030c9cd6c
RDX: 1ffffffff12a453d RSI: ffff8801864e6b68 RDI: 0000000000000286
RBP: ffff880191a37558 R08: ffff8801864e6b60 R09: 0000000000000006
R10: 0000000000000000 R11: ffff8801864e62c0 R12: ffffffff895a3398
R13: ffffffff895a3398 R14: ffff880191a37668 R15: 1ffff10032346ec5
 swake_up_one+0x25f/0x440 kernel/sched/swait.c:41
 __rcu_report_exp_rnp+0x150/0x1b0 kernel/rcu/tree_exp.h:215
 rcu_report_exp_rnp kernel/rcu/tree_exp.h:238 [inline]
 rcu_read_unlock_special.part.39+0x8d8/0x11f0 kernel/rcu/tree_plugin.h:599
 rcu_read_unlock_special kernel/rcu/tree_plugin.h:484 [inline]
 __rcu_read_unlock+0x2e5/0x2f0 kernel/rcu/tree_plugin.h:428
 rcu_read_unlock include/linux/rcupdate.h:682 [inline]
 igmp_mc_seq_stop+0xbb/0x140 net/ipv4/igmp.c:2810
 seq_read+0x8b6/0x1150 fs/seq_file.c:249
 proc_reg_read+0x2a3/0x3d0 fs/proc/inode.c:231
 do_loop_readv_writev fs/read_write.c:700 [inline]
 do_iter_read+0x4a3/0x650 fs/read_write.c:924
 vfs_readv+0x175/0x1c0 fs/read_write.c:986
 do_preadv+0x1cc/0x280 fs/read_write.c:1070
 __do_sys_preadv fs/read_write.c:1120 [inline]
 __se_sys_preadv fs/read_write.c:1115 [inline]
 __x64_sys_preadv+0x9a/0xf0 fs/read_write.c:1115
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457679
Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fe947617c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 00007fe9476186d4 RCX: 0000000000457679
RDX: 00000000000001c1 RSI: 00000000200017c0 RDI: 0000000000000003
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000400000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004d4878 R14: 00000000004c30ca R15: 0000000000000000

Allocated by task 12938:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 __do_kmalloc mm/slab.c:3718 [inline]
 __kmalloc+0x14e/0x760 mm/slab.c:3727
 kmalloc include/linux/slab.h:518 [inline]
 sk_prot_alloc+0x1b0/0x2e0 net/core/sock.c:1468
 sk_alloc+0x10d/0x1690 net/core/sock.c:1522
 packet_create+0x1af/0xbd0 net/packet/af_packet.c:3196
 __sock_create+0x536/0x930 net/socket.c:1277
 sock_create net/socket.c:1317 [inline]
 __sys_socket+0x106/0x260 net/socket.c:1347
 __do_sys_socket net/socket.c:1356 [inline]
 __se_sys_socket net/socket.c:1354 [inline]
 __x64_sys_socket+0x73/0xb0 net/socket.c:1354
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 12935:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3813
 sk_prot_free net/core/sock.c:1505 [inline]
 __sk_destruct+0x7e9/0xbd0 net/core/sock.c:1587
 sk_destruct+0x78/0x90 net/core/sock.c:1595
 __sk_free+0xcf/0x300 net/core/sock.c:1606
 sk_free+0x42/0x50 net/core/sock.c:1617
 sock_put include/net/sock.h:1691 [inline]
 packet_release+0xa57/0xda0 net/packet/af_packet.c:3025
 __sock_release+0xd7/0x250 net/socket.c:579
 sock_close+0x19/0x20 net/socket.c:1141
 __fput+0x385/0xa30 fs/file_table.c:278
 ____fput+0x15/0x20 fs/file_table.c:309
 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8801d3868600
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 1904 bytes inside of
 2048-byte region [ffff8801d3868600, ffff8801d3868e00)
The buggy address belongs to the page:
page:ffffea00074e1a00 count:1 mapcount:0 mapping:ffff8801da800c40 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffffea00071eaf08 ffffea000709aa88 ffff8801da800c40
raw: 0000000000000000 ffff8801d3868600 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d3868c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d3868c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801d3868d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff8801d3868d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d3868e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/09/21 18:12 upstream 234b69e3e089 37079712 .config console log report ci-upstream-kasan-gce-smack-root
2018/09/12 03:31 upstream 5e335542de83 3c88136c .config console log report ci-upstream-kasan-gce-386
2018/09/11 04:53 bpf 28619527b8a7 8c88323f .config console log report ci-upstream-bpf-kasan-gce
* Struck through repros no longer work on HEAD.