syzbot

 sign-in | mailing list | source | docs
🐞 Open [994] ≡ Subsystems 🐞 Fixed [5242] 🐞 Invalid [12515] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Write in check_noncircular

Status: closed as dup on 2019/07/20 13:02
Subsystems: tomoyo
[Documentation on labels]
Reported-by: syzbot+f5ceb7c55f59455035ca@syzkaller.appspotmail.com
First crash: 1746d, last: 1737d
Cause bisection: introduced by (bisect log) :
commit e9db4ef6bf4ca9894bb324c76e01b8f1a16b2650
Author: John Fastabend <john.fastabend@gmail.com>
Date: Sat Jun 30 13:17:47 2018 +0000

  bpf: sockhash fix omitted bucket lock in sock_close

Crash: KASAN: use-after-free Write in bpf_tcp_close (log)
Repro: syz .config
  
▶ ▼ Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
KASAN: slab-out-of-bounds Write in check_noncircular kernel syz done 1 1743d 1743d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KASAN: use-after-free Write in check_noncircular 1 (2) 2019/07/17 10:13

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in check_noncircular+0x91/0x560 kernel/locking/lockdep.c:1722
Write of size 56 at addr ffff888095615560 by task syz-executor.0/9845

CPU: 0 PID: 9845 Comm: syz-executor.0 Not tainted 5.3.0-rc1+ #49
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

Allocated by task 4045389940:
BUG: unable to handle page fault for address: ffffffff8b001f28
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 8c70067 P4D 8c70067 PUD 8c71063 PMD 0 
Thread overran stack, or stack corrupted
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9845 Comm: syz-executor.0 Not tainted 5.3.0-rc1+ #49
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:stack_depot_fetch+0x7/0x30 lib/stackdepot.c:201
Code: 44 00 00 31 c0 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 2a 02 f7 fd 0f 0b e8 23 02 f7 fd 0f 0b 90 89 f8 25 ff ff 1f 00 <48> 8b 04 c5 30 1f 00 8a c1 ef 11 81 e7 f0 3f 00 00 48 8d 4c 38 18
RSP: 0018:ffff888095615338 EFLAGS: 00010006
RAX: 00000000001fffff RBX: ffffea0002558500 RCX: 88b9880b547c8700
RDX: 0000000000000000 RSI: ffff888095615370 RDI: 000000001fffffff
RBP: ffff8880956153f0 R08: ffffffff81823129 R09: ffffed1015d444c6
R10: ffffed1015d444c6 R11: 0000000000000000 R12: ffff8880aa5918c0
R13: ffff888095615640 R14: ffff888095615560 R15: ffff888095614640
FS:  000055555685d940(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8b001f28 CR3: 000000007bf0e000 CR4: 00000000001406f0
Call Trace:
Modules linked in:
CR2: ffffffff8b001f28
---[ end trace d5c487c927b1af45 ]---
RIP: 0010:stack_depot_fetch+0x7/0x30 lib/stackdepot.c:201
Code: 44 00 00 31 c0 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 2a 02 f7 fd 0f 0b e8 23 02 f7 fd 0f 0b 90 89 f8 25 ff ff 1f 00 <48> 8b 04 c5 30 1f 00 8a c1 ef 11 81 e7 f0 3f 00 00 48 8d 4c 38 18
RSP: 0018:ffff888095615338 EFLAGS: 00010006
RAX: 00000000001fffff RBX: ffffea0002558500 RCX: 88b9880b547c8700
RDX: 0000000000000000 RSI: ffff888095615370 RDI: 000000001fffffff
RBP: ffff8880956153f0 R08: ffffffff81823129 R09: ffffed1015d444c6
R10: ffffed1015d444c6 R11: 0000000000000000 R12: ffff8880aa5918c0
R13: ffff888095615640 R14: ffff888095615560 R15: ffff888095614640
FS:  000055555685d940(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8b001f28 CR3: 000000007bf0e000 CR4: 00000000001406f0

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/25 10:19 upstream bed38c3e2dca 32329ceb .config console log report syz ci-upstream-kasan-gce-smack-root
2019/07/16 17:19 upstream 9637d517347e db842eb6 .config console log report syz ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.