syzbot

 sign-in | mailing list | source | docs
🐞 Open [987] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12505] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in tcp_write_timer_handler

Status: closed as invalid on 2019/04/19 22:15
Subsystems: net
[Documentation on labels]
First crash: 1930d, last: 1867d
▶ ▼ Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in tcp_write_timer_handler 1 1588d 1588d 0/1 auto-closed as invalid on 2020/04/17 21:22
linux-4.19 KASAN: use-after-free Read in tcp_write_timer_handler 1 1281d 1281d 0/1 auto-closed as invalid on 2021/02/18 23:19
upstream KASAN: use-after-free Read in tcp_write_timer_handler (2) net 5 1828d 1830d 0/26 closed as invalid on 2019/05/15 23:07
upstream KASAN: use-after-free Read in tcp_write_timer_handler (3) net 82 1680d 1742d 0/26 auto-closed as invalid on 2019/12/04 07:54
linux-5.15 KASAN: use-after-free Read in tcp_write_timer_handler origin:upstream C 230 9d02h 413d 0/3 upstream: reported C repro on 2023/03/09 08:35
linux-6.1 KASAN: use-after-free Read in tcp_write_timer_handler 138 16d 414d 0/3 upstream: reported on 2023/03/08 06:26
linux-4.19 KASAN: use-after-free Read in tcp_write_timer_handler (2) 12 575d 1090d 0/1 auto-obsoleted due to no activity on 2023/01/25 19:39
upstream KASAN: use-after-free Read in tcp_write_timer_handler (4) net 529 498d 1524d 0/26 closed as invalid on 2023/03/21 22:54

Sample crash report:
bridge0: received packet on veth0_to_bridge with own address as source address (addr:5e:49:01:6d:05:0d, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:5e:49:01:6d:05:0d, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:5e:49:01:6d:05:0d, vlan:0)
==================================================================
BUG: KASAN: use-after-free in tcp_orphan_retries net/ipv4/tcp_timer.c:127 [inline]
BUG: KASAN: use-after-free in tcp_probe_timer net/ipv4/tcp_timer.c:362 [inline]
BUG: KASAN: use-after-free in tcp_write_timer_handler+0x889/0x8a0 net/ipv4/tcp_timer.c:591
Read of size 4 at addr ffff88806aa2c8e8 by task ksoftirqd/1/16

CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.0.0+ #98
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:131
 tcp_orphan_retries net/ipv4/tcp_timer.c:127 [inline]
 tcp_probe_timer net/ipv4/tcp_timer.c:362 [inline]
 tcp_write_timer_handler+0x889/0x8a0 net/ipv4/tcp_timer.c:591
 tcp_write_timer+0x10e/0x1d0 net/ipv4/tcp_timer.c:607
 call_timer_fn+0x190/0x720 kernel/time/timer.c:1325
 expire_timers kernel/time/timer.c:1362 [inline]
 __run_timers kernel/time/timer.c:1681 [inline]
 __run_timers kernel/time/timer.c:1649 [inline]
 run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694
 __do_softirq+0x266/0x95a kernel/softirq.c:293
 run_ksoftirqd kernel/softirq.c:655 [inline]
 run_ksoftirqd+0x8e/0x110 kernel/softirq.c:647
 smpboot_thread_fn+0x6ab/0xa10 kernel/smpboot.c:164
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

The buggy address belongs to the page:
page:ffffea0001aa8b00 count:0 mapcount:-128 mapping:0000000000000000 index:0xffff88806aa2c180
flags: 0x1fffc0000000000()
raw: 01fffc0000000000 ffffea0002155b08 ffffea0001ac8408 0000000000000000
raw: ffff88806aa2c180 0000000000000002 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88806aa2c780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806aa2c800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88806aa2c880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                          ^
 ffff88806aa2c900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806aa2c980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/16 07:52 net-next-old 3b319ee220a8 bab43553 .config console log report ci-upstream-net-kasan-gce
2019/01/24 21:39 net-next-old 254764e55652 bfab9cd8 .config console log report ci-upstream-net-kasan-gce
2019/01/22 07:51 net-next-old fa7f3a8d56b3 badbbeee .config console log report ci-upstream-net-kasan-gce
2019/01/20 12:47 net-next-old 133bbb18ab1a 353f32ea .config console log report ci-upstream-net-kasan-gce
2019/01/14 19:49 net-next-old b71acb0e3721 95485883 .config console log report ci-upstream-net-kasan-gce
2019/01/12 02:24 net-next-old b71acb0e3721 c3f3344c .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.