syzbot

 sign-in | mailing list | source | docs
🐞 Open [977] ≡ Subsystems 🐞 Fixed [5215] 🐞 Invalid [12468] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

UBSAN: array-index-out-of-bounds in ieee80211_del_key

Status: fixed on 2020/11/16 12:12
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Fix commit: 3dc289f8f139 net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
First crash: 1303d, last: 1258d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: C syz .config
  
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH 5.8 000/124] 5.8.15-rc1 review 136 (136) 2020/10/14 18:31
[PATCH 4.4 00/39] 4.4.239-rc1 review 46 (46) 2020/10/14 10:18
[PATCH 4.19 00/49] 4.19.151-rc1 review 56 (56) 2020/10/14 08:34
[PATCH 4.9 00/54] 4.9.239-rc1 review 58 (58) 2020/10/14 01:39
[PATCH 4.14 00/70] 4.14.201-rc1 review 74 (74) 2020/10/14 01:28
[PATCH 5.4 00/85] 5.4.71-rc1 review 89 (89) 2020/10/14 01:24
[PATCH] net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() 2 (2) 2020/10/08 20:00
UBSAN: array-index-out-of-bounds in ieee80211_del_key 0 (1) 2020/09/24 09:26
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in ieee80211_del_key (2) wireless C error 3 1226d 1234d 19/26 fixed on 2021/03/10 01:48
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2020/10/06 20:02 16m anant.thazhemadam@gmail.com patch upstream OK
2020/10/06 13:45 10m anant.thazhemadam@gmail.com upstream report log
2020/10/06 12:43 17m anant.thazhemadam@gmail.com patch upstream OK

Sample crash report:
================================================================================
UBSAN: array-index-out-of-bounds in net/mac80211/cfg.c:524:9
index 255 is out of range for type 'ieee80211_key *[8]'
CPU: 1 PID: 6910 Comm: syz-executor574 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:356
 ieee80211_del_key+0x428/0x440 net/mac80211/cfg.c:524
 rdev_del_key net/wireless/rdev-ops.h:107 [inline]
 nl80211_del_key+0x493/0x980 net/wireless/nl80211.c:4201
 genl_family_rcv_msg_doit net/netlink/genetlink.c:669 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:714 [inline]
 genl_rcv_msg+0x61d/0x980 net/netlink/genetlink.c:731
 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2470
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:742
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:671
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2353
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2407
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2440
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x441759
Code: e8 dc 05 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc4e8ac508 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffc4e8ac530 RCX: 0000000000441759
RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000002000000000 R09: 0000002000000000
R10: 0000002000000000 R11: 0000000000000246 R12: 0000000000000032
R13: 0000000000000000 R14: 000000000000000c R15: 0000000000000004
================================================================================

Crashes (685):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/10/05 16:17 upstream 549738f15da0 5ef9c291 .config console log report syz C ci-upstream-kasan-gce
2020/10/05 14:07 upstream 549738f15da0 5ef9c291 .config console log report syz C ci-upstream-kasan-gce-root
2020/10/03 14:08 upstream d3d45f8220d6 2653fa43 .config console log report syz C ci-upstream-kasan-gce
2020/09/25 12:38 upstream 171d4ff79f96 54289b08 .config console log report syz C ci-upstream-kasan-gce
2020/09/25 11:54 upstream 171d4ff79f96 54289b08 .config console log report syz C ci-upstream-kasan-gce
2020/10/07 06:44 upstream c85fb28b6f99 1880b4a9 .config console log report syz C ci-upstream-kasan-gce-386
2020/09/25 07:47 upstream 171d4ff79f96 54289b08 .config console log report syz C ci-upstream-kasan-gce-386
2020/09/22 20:12 upstream 98477740630f 3e8f6c27 .config console log report syz C ci-upstream-kasan-gce-386
2020/10/07 23:15 net-old d91dc434f2ba 1880b4a9 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/10/06 15:29 net-old 7575fdda569b 1880b4a9 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/09/22 20:38 net-old b334ec66d455 3e8f6c27 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/09/22 20:15 net-old b334ec66d455 3e8f6c27 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/10/06 00:56 net-next-old c2568c8c9e63 1880b4a9 .config console log report syz C ci-upstream-net-kasan-gce
2020/10/05 19:15 net-next-old c2568c8c9e63 1880b4a9 .config console log report syz C ci-upstream-net-kasan-gce
2020/10/04 09:23 net-next-old 186e26eb139a 1a3f9408 .config console log report syz C ci-upstream-net-kasan-gce
2020/10/04 04:18 net-next-old 186e26eb139a 1a3f9408 .config console log report syz C ci-upstream-net-kasan-gce
2020/09/22 21:40 net-next-old 92ec804f3dbf 3e8f6c27 .config console log report syz C ci-upstream-net-kasan-gce
2020/09/22 21:19 net-next-old 92ec804f3dbf 3e8f6c27 .config console log report syz C ci-upstream-net-kasan-gce
2020/10/09 05:18 upstream 3d006ee42dde 92390980 .config console log report info ci-upstream-kasan-gce
2020/10/09 03:36 upstream 3d006ee42dde 92390980 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/09 02:12 upstream 3d006ee42dde 92390980 .config console log report info ci-upstream-kasan-gce
2020/10/09 00:22 upstream 3d006ee42dde 92390980 .config console log report info ci-upstream-kasan-gce-root
2020/10/08 17:59 upstream c85fb28b6f99 92390980 .config console log report info ci-upstream-kasan-gce-root
2020/10/08 15:38 upstream c85fb28b6f99 92390980 .config console log report info ci-upstream-kasan-gce
2020/10/08 09:30 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-root
2020/10/08 00:30 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce
2020/10/07 22:29 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-root
2020/10/07 18:11 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/07 13:22 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-root
2020/10/07 06:22 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce
2020/10/07 03:13 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/07 01:51 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/06 23:09 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/10/08 18:37 upstream c85fb28b6f99 92390980 .config console log report info ci-upstream-kasan-gce-386
2020/10/08 13:17 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-386
2020/10/08 02:03 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-386
2020/10/07 15:57 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-386
2020/10/07 08:03 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-386
2020/10/07 02:04 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-upstream-kasan-gce-386
2020/10/06 21:36 upstream c85fb28b6f99 1880b4a9 .config console log report info ci-qemu-upstream-386
2020/10/06 19:01 upstream 7575fdda569b 1880b4a9 .config console log report info ci-upstream-kasan-gce-386
2020/09/22 19:52 upstream 98477740630f 3e8f6c27 .config console log report info ci-upstream-kasan-gce-386
2020/11/07 06:58 net-old bf3e76289cd2 64069d48 .config console log report info ci-upstream-net-this-kasan-gce
2020/10/08 04:21 net-old d91dc434f2ba 1880b4a9 .config console log report info ci-upstream-net-this-kasan-gce
2020/10/07 21:28 net-old d91dc434f2ba 1880b4a9 .config console log report info ci-upstream-net-this-kasan-gce
2020/10/07 12:11 net-old d91dc434f2ba 1880b4a9 .config console log report info ci-upstream-net-this-kasan-gce
2020/10/07 11:09 net-old d91dc434f2ba 1880b4a9 .config console log report info ci-upstream-net-this-kasan-gce
2020/10/07 09:46 net-old d91dc434f2ba 1880b4a9 .config console log report info ci-upstream-net-this-kasan-gce
2020/10/07 07:49 net-old d91dc434f2ba 1880b4a9 .config console log report info ci-upstream-net-this-kasan-gce
2020/10/08 23:03 net-next-old 9faebeb2d800 92390980 .config console log report info ci-upstream-net-kasan-gce
2020/10/08 21:57 net-next-old 9faebeb2d800 92390980 .config console log report info ci-upstream-net-kasan-gce
2020/10/08 14:36 net-next-old 9faebeb2d800 92390980 .config console log report info ci-upstream-net-kasan-gce
2020/10/08 07:54 net-next-old 9faebeb2d800 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/08 06:31 net-next-old 9faebeb2d800 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/07 22:29 net-next-old 9faebeb2d800 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/07 16:36 net-next-old 9faebeb2d800 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/07 10:48 net-next-old 9faebeb2d800 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/07 04:53 net-next-old 9faebeb2d800 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/06 20:17 net-next-old 8b0308fe319b 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/06 18:00 net-next-old 8b0308fe319b 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/06 14:23 net-next-old 8b0308fe319b 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/06 14:17 net-next-old 8b0308fe319b 1880b4a9 .config console log report info ci-upstream-net-kasan-gce
2020/10/08 20:33 linux-next e4fb79c771fb 92390980 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/10/08 16:58 linux-next e4fb79c771fb 92390980 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/10/07 14:43 linux-next 8b787da7ba8c 1880b4a9 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/10/07 09:06 linux-next a804ab086e9d 1880b4a9 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/10/07 04:15 linux-next a804ab086e9d 1880b4a9 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/10/07 00:20 linux-next a804ab086e9d 1880b4a9 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/10/06 16:38 linux-next a804ab086e9d 1880b4a9 .config console log report info ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.