syzbot


WARNING in j1939_xtp_rx_abort_one

Status: upstream: reported C repro on 2021/08/04 08:16
Reported-by: syzbot+9981a614060dcee6eeca@syzkaller.appspotmail.com
Fix commit: d0553680f94c can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci2-upstream-usb]
First crash: 554d, last: 12d

Cause bisection: introduced by (bisect log) :
commit 9d71dd0c70099914fcd063135da3c580865e924c
Author: The j1939 authors <linux-can@vger.kernel.org>
Date: Mon Oct 8 09:48:36 2018 +0000

  can: add support of SAE J1939 protocol

Crash: KASAN: use-after-free Read in j1939_session_deactivate (log)
Repro: C syz .config

Sample crash report:
vxcan0: j1939_xtp_rx_abort_one: 0xffff88807a69d800: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1098 j1939_session_deactivate_activate_next net/can/j1939/transport.c:1108 [inline]
WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1098 j1939_xtp_rx_abort_one+0x609/0x720 net/can/j1939/transport.c:1348
Modules linked in:
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 6.2.0-rc3-syzkaller-00349-g97ec4d559d93 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:j1939_session_deactivate net/can/j1939/transport.c:1098 [inline]
RIP: 0010:j1939_session_deactivate_activate_next net/can/j1939/transport.c:1108 [inline]
RIP: 0010:j1939_xtp_rx_abort_one+0x609/0x720 net/can/j1939/transport.c:1348
Code: e9 e7 fa ff ff e8 c7 a0 c8 f7 4c 89 f7 be 03 00 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4c 2f 7e fa e8 a7 a0 c8 f7 <0f> 0b e9 ac fd ff ff e8 9b a0 c8 f7 0f 0b e9 26 fe ff ff 89 e9 80
RSP: 0018:ffffc900001b75f8 EFLAGS: 00010246
RAX: ffffffff89c52809 RBX: 0000000000000001 RCX: ffff888012a49d40
RDX: 0000000000000301 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100f4d3b00 R08: ffffffff89c525ae R09: ffffed100f4d3b06
R10: ffffed100f4d3b06 R11: 1ffff1100f4d3b05 R12: 0000000000000009
R13: ffff88807a69d800 R14: dffffc0000000000 R15: ffff888077c05070
FS:  0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdb9e95bf8 CR3: 0000000072429000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 j1939_xtp_rx_abort net/can/j1939/transport.c:1359 [inline]
 j1939_tp_cmd_recv net/can/j1939/transport.c:2108 [inline]
 j1939_tp_recv+0x91e/0x14f0 net/can/j1939/transport.c:2141
 j1939_can_recv+0x700/0xb50 net/can/j1939/main.c:112
 deliver net/can/af_can.c:572 [inline]
 can_rcv_filter+0x35e/0x800 net/can/af_can.c:606
 can_receive+0x2e8/0x410 net/can/af_can.c:663
 can_rcv+0x13c/0x250 net/can/af_can.c:687
 __netif_receive_skb_one_core net/core/dev.c:5482 [inline]
 __netif_receive_skb+0x1c5/0x500 net/core/dev.c:5596
 process_backlog+0x568/0x920 net/core/dev.c:5924
 __napi_poll+0xbe/0x4b0 net/core/dev.c:6485
 napi_poll net/core/dev.c:6552 [inline]
 net_rx_action+0x76c/0x1100 net/core/dev.c:6663
 __do_softirq+0x277/0x75b kernel/softirq.c:571
 run_ksoftirqd+0xc1/0x120 kernel/softirq.c:934
 smpboot_thread_fn+0x533/0xa10 kernel/smpboot.c:164
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>

Crashes (379):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce-smack-root 2023/01/14 23:19 upstream 97ec4d559d93 a63719e7 .config strace log report syz C [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/12/28 10:56 upstream 1b929c02afd3 44712fbc .config strace log report syz C [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/12/26 23:57 upstream 1b929c02afd3 9da18ae8 .config strace log report syz C [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/12/26 14:03 upstream 1b929c02afd3 9da18ae8 .config strace log report syz C [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/11 04:54 upstream b96fbd602d35 356d8217 .config console log report syz C [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/09 22:44 upstream 9b4509495418 356d8217 .config strace log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/07/05 06:26 upstream c1084b6c5620 bff65f44 .config strace log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/27 05:33 upstream cf424ef014ac 1fa34c1b .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/12 14:36 upstream ce522ba9ef7e af01ee7d .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/04/12 03:27 upstream ce522ba9ef7e af01ee7d .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/19 18:10 upstream 34e047aa16c0 e2d91b1d .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/02 05:10 upstream 575115360652 45a13a73 .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/08 11:19 upstream d1587f7bfe9a 2ca0d385 .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/04 09:12 upstream c9e6606c7fe9 7f723fbe .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/01/03 20:20 upstream c9e6606c7fe9 4a3f34f2 .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/10/25 09:37 upstream 87066fdd2e30 4f0000ee .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/08/21 00:23 upstream d992fe5318d8 b599f2fc .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 14:25 upstream c7d102232649 6c236867 .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 13:18 upstream c7d102232649 6c236867 .config console log report syz C WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2023/01/14 01:40 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9598c377d828 529798b0 .config console log report syz C [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2023/01/10 01:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 358a161a6a9e 1dac8c7a .config console log report syz C [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2023/01/08 06:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci ae87308093bc 1dac8c7a .config console log report syz C [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/10/15 06:59 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 67cb024c .config console log report syz C [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/10/09 05:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 aea5da89 .config console log report syz C [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/23 15:03 upstream bf682942cd26 0042f2b4 .config console log report syz [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/06/24 06:11 upstream de5c208d533a 912f5df7 .config console log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/05/29 22:54 upstream 664a393a2663 a46af346 .config console log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/17 03:54 upstream 56e337f2cf13 dfa9a8ed .config console log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/03/13 19:41 upstream aad611a868d1 9e8eaa75 .config console log report syz WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/10/08 19:24 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 aea5da89 .config console log report syz [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2023/01/18 19:23 upstream c1649ec55708 42660d9e .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2023/01/18 03:32 upstream 6e50979a9c87 aedf5331 .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2023/01/07 16:09 upstream a689b938df39 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2023/01/06 15:22 upstream 1f5abbd77e2c 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2023/01/01 14:31 upstream e4cf7c25bae5 ab32d508 .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/12/08 22:44 upstream ce19275f0103 1034e5fa .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/27 21:42 upstream b229b6ca5abb 86777b7f .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/23 17:37 upstream d47136c28015 23bf86af .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/23 14:39 upstream d47136c28015 23bf86af .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/12 16:40 upstream 55be6084c8e0 89b5a509 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/11 06:58 upstream 55be6084c8e0 2b253ced .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/10 21:13 upstream 4899a36f91a9 aea5da89 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/03 00:31 upstream a962b54e162c feb56351 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/02 23:16 upstream a962b54e162c feb56351 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/01 20:33 upstream b357fd1c2afc feb56351 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/10/01 12:51 upstream ffb4d94b4314 feb56351 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/29 09:47 upstream c3e0e1e23c70 1d385642 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/28 23:13 upstream 49c13ed0316d e2556bc3 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/27 12:07 upstream a1375562c0a8 87840e00 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/27 00:51 upstream 3800a713b607 10323ddf .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/26 04:23 upstream f76349cf4145 0042f2b4 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/18 20:35 upstream 38eddeedbbea dd9a85ff .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/15 18:13 upstream 3245cb65fd91 dd9a85ff .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/06 23:08 upstream d2ec799d1c1b 5fc30c37 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/05 22:35 upstream 7e18e42e4b28 9dcd38fc .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/05 06:29 upstream 7e18e42e4b28 28811d0a .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/09/04 08:15 upstream 7726d4c3e60b 28811d0a .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/27 01:39 upstream 3e5c673f0d75 07177916 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/26 21:56 upstream 3e5c673f0d75 e5a303f1 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/25 21:37 upstream 3f5c20055a64 9b5bf4cd .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/25 01:34 upstream c40e8341e3b3 514514f6 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/19 20:19 upstream 4c2d0b039c5c 26a13b38 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/18 00:10 upstream 274a2eebf80c d58e263f .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/13 04:38 upstream 7ebfc85e2cd7 8dfcaa3d .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/11 01:51 upstream 200e340f2196 a6201f11 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2022/08/05 17:41 upstream 200e340f2196 e853abd9 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-kasan-gce-smack-root 2021/07/31 08:14 upstream c7d102232649 6c236867 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2023/01/24 02:02 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci edb2f0dc90f2 9dfcf09c .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2023/01/07 08:06 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci ae87308093bc 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/11/04 17:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 6d752409 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/10/23 14:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 23bf86af .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/10/18 15:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 b31320fc .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/10/07 00:10 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 8a212197 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/10/05 10:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 267e3bb1 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/09/22 20:53 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 16c9f284e746 0042f2b4 .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/09/16 01:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a6b443748715 dd9a85ff .config console log report info [disk image] [vmlinux] WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/08/24 22:50 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a41a877bc12d 514514f6 .config console log report info WARNING in j1939_xtp_rx_abort_one
ci-upstream-gce-arm64 2022/08/24 04:02 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 1c23f9e627a7 cea8b0f7 .config console log report info WARNING in j1939_xtp_rx_abort_one
* Struck through repros no longer work on HEAD.