syzbot


WARNING in j1939_xtp_rx_abort_one
Status: upstream: reported C repro on 2021/08/04 08:16
Reported-by: syzbot+9981a614060dcee6eeca@syzkaller.appspotmail.com
First crash: 301d, last: 23d

Cause bisection: introduced by (bisect log) :
commit 9d71dd0c70099914fcd063135da3c580865e924c
Author: The j1939 authors <linux-can@vger.kernel.org>
Date: Mon Oct 8 09:48:36 2018 +0000

  can: add support of SAE J1939 protocol

Crash: KASAN: use-after-free Read in j1939_session_deactivate (log)
Repro: C syz .config

Sample crash report:
vcan0: j1939_xtp_rx_abort_one: 0xffff88806c5ddc00: 0x00000: (8) Duplicate sequence number (and software is not able to recover)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1090 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1100 [inline]
WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1090 j1939_xtp_rx_abort_one+0x609/0x720 net/can/j1939/transport.c:1340
Modules linked in:
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.18.0-rc4-syzkaller-00036-gcf424ef014ac #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1090 [inline]
RIP: 0010:j1939_session_deactivate_activate_next net/can/j1939/transport.c:1100 [inline]
RIP: 0010:j1939_xtp_rx_abort_one+0x609/0x720 net/can/j1939/transport.c:1340
Code: e9 e7 fa ff ff e8 f7 8a 5a f8 4c 89 f7 be 03 00 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bc 75 fd fa e8 d7 8a 5a f8 <0f> 0b e9 ac fd ff ff e8 cb 8a 5a f8 0f 0b e9 26 fe ff ff 89 e9 80
RSP: 0018:ffffc900001b7618 EFLAGS: 00010246
RAX: ffffffff892b7419 RBX: 0000000000000001 RCX: ffff888011641d80
RDX: 0000000000000301 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100d8bbb80 R08: ffffffff892b71be R09: ffffed100d8bbb86
R10: ffffed100d8bbb86 R11: 1ffff1100d8bbb85 R12: 000000000000000e
R13: ffff88806c5ddc00 R14: dffffc0000000000 R15: ffff888072039070
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3e971fe160 CR3: 0000000076754000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 j1939_xtp_rx_abort net/can/j1939/transport.c:1351 [inline]
 j1939_tp_cmd_recv net/can/j1939/transport.c:2100 [inline]
 j1939_tp_recv+0x91e/0x14f0 net/can/j1939/transport.c:2133
 j1939_can_recv+0x67c/0xa90 net/can/j1939/main.c:108
 deliver net/can/af_can.c:574 [inline]
 can_rcv_filter+0x35e/0x800 net/can/af_can.c:608
 can_receive+0x2e8/0x410 net/can/af_can.c:665
 can_rcv+0xda/0x200 net/can/af_can.c:696
 __netif_receive_skb_one_core net/core/dev.c:5405 [inline]
 __netif_receive_skb+0x1c5/0x500 net/core/dev.c:5519
 process_backlog+0x4f8/0x8b0 net/core/dev.c:5847
 __napi_poll+0xbe/0x4b0 net/core/dev.c:6413
 napi_poll net/core/dev.c:6480 [inline]
 net_rx_action+0x61c/0xf30 net/core/dev.c:6567
 __do_softirq+0x382/0x793 kernel/softirq.c:558
 run_ksoftirqd+0xc1/0x120 kernel/softirq.c:921
 smpboot_thread_fn+0x533/0x9d0 kernel/smpboot.c:164
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>

Crashes (306):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2022/04/27 05:33 upstream cf424ef014ac 1fa34c1b .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/12 14:36 upstream ce522ba9ef7e af01ee7d .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/12 03:27 upstream ce522ba9ef7e af01ee7d .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/19 18:10 upstream 34e047aa16c0 e2d91b1d .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/02 05:10 upstream 575115360652 45a13a73 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/08 11:19 upstream d1587f7bfe9a 2ca0d385 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/04 09:12 upstream c9e6606c7fe9 7f723fbe .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/03 20:20 upstream c9e6606c7fe9 4a3f34f2 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/10/25 09:37 upstream 87066fdd2e30 4f0000ee .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/08/21 00:23 upstream d992fe5318d8 b599f2fc .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 14:25 upstream c7d102232649 6c236867 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 13:18 upstream c7d102232649 6c236867 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/17 03:54 upstream 56e337f2cf13 dfa9a8ed .config log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/13 19:41 upstream aad611a868d1 9e8eaa75 .config log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/05 05:25 upstream a7391ad35724 dc9e5259 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/04 16:51 upstream 107c948d1d3e dc9e5259 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/03 06:59 upstream 9050ba3a61a4 7ee63e2c .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/02 10:01 upstream 672c0c517342 2df221f6 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/01 23:51 upstream b2da7df52e16 2df221f6 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/13 16:55 upstream a19944809fe9 faabdb86 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/02 20:23 upstream 88e6c0207623 79a2a8fc .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/02/03 10:27 upstream 27bb0b18c208 4ebb2798 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/02/01 21:45 upstream 9f7fb8de5d9b c1c1631d .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/02/01 11:28 upstream 26291c54e111 c1c1631d .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/30 15:34 upstream 24f4db1f3a27 495e00c5 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/29 00:09 upstream df0001545b27 495e00c5 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/27 04:15 upstream 0280e3c58f92 2cbffd88 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/26 17:06 upstream 0280e3c58f92 2cbffd88 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/25 19:27 upstream a08b41ab9e2e 2cbffd88 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/24 14:58 upstream dd81e1c7d5fb 214351e1 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/16 13:22 upstream d0a231f01e5b 723cfaf0 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/16 10:39 upstream d0a231f01e5b 723cfaf0 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/14 16:42 upstream fb3b0673b7d5 53e00b45 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/13 01:46 upstream f079ab01b560 44d1319a .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/12 06:06 upstream 6f38be8f2ccd 44d1319a .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/11 22:09 upstream 6f38be8f2ccd 44d1319a .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/11 20:12 upstream 6f38be8f2ccd 44d1319a .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/11 17:25 upstream fe8152b38d3a 1884f55a .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/07 14:42 upstream ddec8ed2d490 2ca0d385 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/05 14:49 upstream c9e6606c7fe9 6acc789a .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/04 15:43 upstream c9e6606c7fe9 0a2584dd .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/03 06:49 upstream c9e6606c7fe9 e1768e9c .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/01 23:37 upstream 278218f6778b e1768e9c .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/01 10:39 upstream 800829388818 e1768e9c .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/01 03:45 upstream 4f3d93c6eaff e1768e9c .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/31 16:28 upstream 4f3d93c6eaff 36bd2e48 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/31 02:43 upstream 74c78b4291b4 36bd2e48 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/30 05:27 upstream eec4df26e24e 6cc879d4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/29 13:36 upstream e7c124bd0463 6cc879d4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/29 12:27 upstream e7c124bd0463 6cc879d4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/29 11:18 upstream e7c124bd0463 76c8cf06 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/28 23:29 upstream ecf71de775a0 76c8cf06 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/28 10:20 upstream a8ad9a2434dc 6b3c5e64 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/27 18:01 upstream a8ad9a2434dc 5140bd58 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/27 07:37 upstream fc74e0a40e4f e4f103c4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/26 20:24 upstream 438645193e59 e4f103c4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/26 12:55 upstream 438645193e59 e4f103c4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/26 04:46 upstream e2ae0d4a6b0b 6caa12e4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/25 01:48 upstream b927dfc67d05 6caa12e4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/12/25 00:42 upstream b927dfc67d05 6caa12e4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 08:14 upstream c7d102232649 6c236867 .config log report info WARNING in j1939_xtp_rx_abort_one