syzbot


KMSAN: use-after-free in skb_queue_purge

Status: auto-closed as invalid on 2020/02/23 02:27
Subsystems: net
[Documentation on labels]
First crash: 1614d, last: 1614d

Sample crash report:
=====================================================
BUG: KMSAN: use-after-free in __write_once_size include/linux/compiler.h:233 [inline]
BUG: KMSAN: use-after-free in __skb_unlink include/linux/skbuff.h:2025 [inline]
BUG: KMSAN: use-after-free in __skb_dequeue include/linux/skbuff.h:2040 [inline]
BUG: KMSAN: use-after-free in skb_dequeue net/core/skbuff.c:3040 [inline]
BUG: KMSAN: use-after-free in skb_queue_purge+0x3b6/0x450 net/core/skbuff.c:3077
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108
 __msan_warning+0x64/0xc0 mm/kmsan/kmsan_instr.c:245
 __write_once_size include/linux/compiler.h:233 [inline]
 __skb_unlink include/linux/skbuff.h:2025 [inline]
 __skb_dequeue include/linux/skbuff.h:2040 [inline]
 skb_dequeue net/core/skbuff.c:3040 [inline]
 skb_queue_purge+0x3b6/0x450 net/core/skbuff.c:3077
 netlink_sock_destruct+0x17b/0x3d0 net/netlink/af_netlink.c:394
 __sk_destruct+0x83/0x820 net/core/sock.c:1697
 sk_destruct net/core/sock.c:1741 [inline]
 __sk_free+0x633/0x6e0 net/core/sock.c:1752
 sk_free+0x6c/0x90 net/core/sock.c:1763
 deferred_put_nlk_sk+0x2bb/0x340 net/netlink/af_netlink.c:729
 __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
 rcu_do_batch kernel/rcu/tree.c:2157 [inline]
 rcu_core+0xc99/0x1b10 kernel/rcu/tree.c:2377
 rcu_core_si+0xe/0x10 kernel/rcu/tree.c:2386
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 run_ksoftirqd+0x25/0x40 kernel/softirq.c:607
 smpboot_thread_fn+0x4a3/0x990 kernel/smpboot.c:165
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:353

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
 kmsan_internal_poison_shadow+0x60/0x120 mm/kmsan/kmsan.c:132
 kmsan_slab_free+0x7a/0xe0 mm/kmsan/kmsan_hooks.c:107
 slab_free_freelist_hook mm/slub.c:1457 [inline]
 slab_free mm/slub.c:3020 [inline]
 kmem_cache_free+0x5ce/0x2c00 mm/slub.c:3036
 kfree_skbmem net/core/skbuff.c:644 [inline]
 __kfree_skb+0x1dd/0x210 net/core/skbuff.c:680
 consume_skb+0x2b0/0x2e0 net/core/skbuff.c:838
 arp_process+0x2d13/0x4aa0 net/ipv4/arp.c:915
 NF_HOOK include/linux/netfilter.h:305 [inline]
 arp_rcv+0x913/0x9f0 net/ipv4/arp.c:961
 __netif_receive_skb_one_core net/core/dev.c:4929 [inline]
 __netif_receive_skb net/core/dev.c:5043 [inline]
 process_backlog+0x12a6/0x13c0 net/core/dev.c:5874
 napi_poll net/core/dev.c:6311 [inline]
 net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6379
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 run_ksoftirqd+0x25/0x40 kernel/softirq.c:607
 smpboot_thread_fn+0x4a3/0x990 kernel/smpboot.c:165
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:353
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/25 02:20 https://github.com/google/kmsan.git master 4a1d41e39c62 598ca6c8 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.