syzbot


WARNING in j1939_xtp_rx_abort_one

Status: upstream: reported C repro on 2021/08/04 08:16
Reported-by: syzbot+9981a614060dcee6eeca@syzkaller.appspotmail.com
First crash: 432d, last: 1d12h

Cause bisection: introduced by (bisect log) :
commit 9d71dd0c70099914fcd063135da3c580865e924c
Author: The j1939 authors <linux-can@vger.kernel.org>
Date: Mon Oct 8 09:48:36 2018 +0000

  can: add support of SAE J1939 protocol

Crash: KASAN: use-after-free Read in j1939_session_deactivate (log)
Repro: C syz .config

Sample crash report:
vxcan0: j1939_tp_rxtimer: 0xffff88806fd79400: rx timeout, send abort
vxcan0: j1939_xtp_rx_abort_one: 0xffff88807f18d000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 15 at net/can/j1939/transport.c:1096 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1106 [inline]
WARNING: CPU: 0 PID: 15 at net/can/j1939/transport.c:1096 j1939_xtp_rx_abort_one+0x609/0x720 net/can/j1939/transport.c:1346
Modules linked in:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.0.0-rc4-syzkaller-00302-gb96fbd602d35 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1096 [inline]
RIP: 0010:j1939_session_deactivate_activate_next net/can/j1939/transport.c:1106 [inline]
RIP: 0010:j1939_xtp_rx_abort_one+0x609/0x720 net/can/j1939/transport.c:1346
Code: e9 e7 fa ff ff e8 77 bf 43 f8 4c 89 f7 be 03 00 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 6c 08 f0 fa e8 57 bf 43 f8 <0f> 0b e9 ac fd ff ff e8 4b bf 43 f8 0f 0b e9 26 fe ff ff 89 e9 80
RSP: 0018:ffffc900001475f8 EFLAGS: 00010246
RAX: ffffffff8945d8a9 RBX: 0000000000000001 RCX: ffff888012353b00
RDX: 0000000000000301 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100fe31a00 R08: ffffffff8945d64e R09: ffffed100fe31a06
R10: ffffed100fe31a06 R11: 1ffff1100fe31a05 R12: 0000000000000009
R13: ffff88807f18d000 R14: dffffc0000000000 R15: ffff88807dd7d070
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001740 CR3: 0000000072d51000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 j1939_xtp_rx_abort net/can/j1939/transport.c:1357 [inline]
 j1939_tp_cmd_recv net/can/j1939/transport.c:2106 [inline]
 j1939_tp_recv+0x91e/0x14f0 net/can/j1939/transport.c:2139
 j1939_can_recv+0x67c/0xa90 net/can/j1939/main.c:108
 deliver net/can/af_can.c:574 [inline]
 can_rcv_filter+0x35e/0x800 net/can/af_can.c:608
 can_receive+0x2e8/0x410 net/can/af_can.c:665
 can_rcv+0xda/0x200 net/can/af_can.c:696
 __netif_receive_skb_one_core net/core/dev.c:5485 [inline]
 __netif_receive_skb+0x1c5/0x500 net/core/dev.c:5599
 process_backlog+0x4f8/0x8b0 net/core/dev.c:5927
 __napi_poll+0xbe/0x4b0 net/core/dev.c:6511
 napi_poll net/core/dev.c:6578 [inline]
 net_rx_action+0x76c/0x10b0 net/core/dev.c:6689
 __do_softirq+0x382/0x793 kernel/softirq.c:571
 run_ksoftirqd+0xc1/0x120 kernel/softirq.c:934
 smpboot_thread_fn+0x533/0x9d0 kernel/smpboot.c:164
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>

Crashes (351):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2022/09/11 04:54 upstream b96fbd602d35 356d8217 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/09 22:44 upstream 9b4509495418 356d8217 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/07/05 06:26 upstream c1084b6c5620 bff65f44 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/27 05:33 upstream cf424ef014ac 1fa34c1b .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/12 14:36 upstream ce522ba9ef7e af01ee7d .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/12 03:27 upstream ce522ba9ef7e af01ee7d .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/19 18:10 upstream 34e047aa16c0 e2d91b1d .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/02 05:10 upstream 575115360652 45a13a73 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/08 11:19 upstream d1587f7bfe9a 2ca0d385 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/04 09:12 upstream c9e6606c7fe9 7f723fbe .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/03 20:20 upstream c9e6606c7fe9 4a3f34f2 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/10/25 09:37 upstream 87066fdd2e30 4f0000ee .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/08/21 00:23 upstream d992fe5318d8 b599f2fc .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 14:25 upstream c7d102232649 6c236867 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 13:18 upstream c7d102232649 6c236867 .config log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/23 15:03 upstream bf682942cd26 0042f2b4 .config log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/06/24 06:11 upstream de5c208d533a 912f5df7 .config log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/29 22:54 upstream 664a393a2663 a46af346 .config log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/17 03:54 upstream 56e337f2cf13 dfa9a8ed .config log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/13 19:41 upstream aad611a868d1 9e8eaa75 .config log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/03 00:31 upstream a962b54e162c feb56351 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/02 23:16 upstream a962b54e162c feb56351 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/01 20:33 upstream b357fd1c2afc feb56351 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/01 12:51 upstream ffb4d94b4314 feb56351 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/29 09:47 upstream c3e0e1e23c70 1d385642 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/28 23:13 upstream 49c13ed0316d e2556bc3 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/27 12:07 upstream a1375562c0a8 87840e00 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/27 00:51 upstream 3800a713b607 10323ddf .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/26 04:23 upstream f76349cf4145 0042f2b4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/18 20:35 upstream 38eddeedbbea dd9a85ff .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/15 18:13 upstream 3245cb65fd91 dd9a85ff .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/06 23:08 upstream d2ec799d1c1b 5fc30c37 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/05 22:35 upstream 7e18e42e4b28 9dcd38fc .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/05 06:29 upstream 7e18e42e4b28 28811d0a .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/04 08:15 upstream 7726d4c3e60b 28811d0a .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/27 01:39 upstream 3e5c673f0d75 07177916 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/26 21:56 upstream 3e5c673f0d75 e5a303f1 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/25 21:37 upstream 3f5c20055a64 9b5bf4cd .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/25 01:34 upstream c40e8341e3b3 514514f6 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/19 20:19 upstream 4c2d0b039c5c 26a13b38 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/18 00:10 upstream 274a2eebf80c d58e263f .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/13 04:38 upstream 7ebfc85e2cd7 8dfcaa3d .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/11 01:51 upstream 200e340f2196 a6201f11 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/05 17:41 upstream 200e340f2196 e853abd9 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/03 09:04 upstream e2b542100719 1c9013ac .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/07/23 13:19 upstream 70664fc10c0d 22343af4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/07/12 14:45 upstream 5a29232d870d d91dd8ea .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/07/05 17:41 upstream e35e5b6f695d bff65f44 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/07/04 19:20 upstream c1084b6c5620 bff65f44 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/06/30 23:55 upstream 1a0e93df1e10 1434eec0 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/06/30 07:54 upstream d9b2ba67917c 1434eec0 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/06/28 10:26 upstream 941e3e791269 ef82eb2c .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/05 05:25 upstream a7391ad35724 dc9e5259 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/04 16:51 upstream 107c948d1d3e dc9e5259 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/03 06:59 upstream 9050ba3a61a4 7ee63e2c .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/02 10:01 upstream 672c0c517342 2df221f6 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/01 23:51 upstream b2da7df52e16 2df221f6 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/13 16:55 upstream a19944809fe9 faabdb86 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 08:14 upstream c7d102232649 6c236867 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/10/05 10:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 267e3bb1 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/09/22 20:53 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 16c9f284e746 0042f2b4 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/09/16 01:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a6b443748715 dd9a85ff .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/08/24 22:50 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a41a877bc12d 514514f6 .config log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/08/24 04:02 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 1c23f9e627a7 cea8b0f7 .config log report info WARNING in j1939_xtp_rx_abort_one
* Struck through repros no longer work on HEAD.