syzbot

 sign-in | mailing list | source | docs
🐞 Open [977] ≡ Subsystems 🐞 Fixed [5207] 🐞 Invalid [12453] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in rds_cong_queue_updates (2)

Status: auto-closed as invalid on 2019/09/29 03:19
Subsystems: rds
[Documentation on labels]
Reported-by: syzbot+470ae97a39f16146af45@syzkaller.appspotmail.com
First crash: 2095d, last: 1841d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
Reminder: 4 open syzbot bugs in "net/rds" subsystem 1 (1) 2019/07/24 02:34
KASAN: use-after-free Read in rds_cong_queue_updates (2) 1 (2) 2018/07/23 17:38
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in rds_cong_queue_updates rds C 18168 2113d 2244d 8/26 fixed on 2018/07/09 18:05

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:43 [inline]
BUG: KASAN: use-after-free in check_net include/net/net_namespace.h:254 [inline]
BUG: KASAN: use-after-free in rds_destroy_pending net/rds/rds.h:951 [inline]
BUG: KASAN: use-after-free in rds_cong_queue_updates+0x209/0x4d0 net/rds/cong.c:229
Read of size 4 at addr ffff88806d2a8184 by task syz-executor.3/30451

CPU: 0 PID: 30451 Comm: syz-executor.3 Not tainted 5.1.0-rc2+ #38
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x123/0x190 mm/kasan/generic.c:191
 kasan_check_read+0x11/0x20 mm/kasan/common.c:102
 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
 refcount_read include/linux/refcount.h:43 [inline]
 check_net include/net/net_namespace.h:254 [inline]
 rds_destroy_pending net/rds/rds.h:951 [inline]
 rds_cong_queue_updates+0x209/0x4d0 net/rds/cong.c:229
 rds_recv_rcvbuf_delta.part.0+0x34f/0x3f0 net/rds/recv.c:118
 rds_recv_rcvbuf_delta net/rds/recv.c:379 [inline]
 rds_recv_incoming+0x789/0x11f0 net/rds/recv.c:379
 rds_loop_xmit+0xf3/0x2a0 net/rds/loop.c:96
 rds_send_xmit+0x1113/0x2560 net/rds/send.c:355
 rds_sendmsg+0x3017/0x3550 net/rds/send.c:1369
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xdd/0x130 net/socket.c:632
 __sys_sendto+0x262/0x380 net/socket.c:1809
 __do_sys_sendto net/socket.c:1821 [inline]
 __se_sys_sendto net/socket.c:1817 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1817
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458209
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fa6cdd69c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458209
RDX: 0000000000000480 RSI: 0000000020000a00 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa6cdd6a6d4
R13: 00000000004c58b8 R14: 00000000004d9838 R15: 00000000ffffffff

The buggy address belongs to the page:
page:ffffea0001b4aa00 count:0 mapcount:-128 mapping:0000000000000000 index:0xffff88806d2a8480
flags: 0x1fffc0000000000()
raw: 01fffc0000000000 ffffea00025fee88 ffffea0002943588 0000000000000000
raw: ffff88806d2a8480 0000000000000001 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88806d2a8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806d2a8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88806d2a8180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff88806d2a8200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806d2a8280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (257):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/26 23:45 upstream 65ae689329c5 55684ce1 .config console log report ci-upstream-kasan-gce
2019/03/25 22:14 upstream 8c2ffd917477 55684ce1 .config console log report ci-upstream-kasan-gce
2019/03/24 03:35 upstream a5ed1e96cafd a2cef203 .config console log report ci-upstream-kasan-gce
2019/03/23 14:37 upstream a5ed1e96cafd a2cef203 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/17 11:29 upstream a9dce6679d73 ba18afea .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/12 14:17 upstream ea295481b6e3 a71bfb62 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/07 11:27 upstream f90d64483ebd 8c085c5e .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/06 08:43 upstream 3717f613f48d 05cf83bf .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/05 19:32 upstream 63bdf4284c38 16559f86 .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/27 23:24 upstream 7d762d69145a 34ec456b .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/20 02:13 upstream 40e196a906d9 4df543c9 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/27 11:08 upstream fc2fd5f0f1aa 43cf01dd .config console log report ci-upstream-kasan-gce-root
2019/02/27 18:20 upstream 7d762d69145a 083cfd0e .config console log report ci-upstream-kasan-gce-386
2019/03/19 01:42 net-old 25208dd856e7 46264c32 .config console log report ci-upstream-net-this-kasan-gce
2019/03/17 17:39 net-old 517ccc2aa50d ba18afea .config console log report ci-upstream-net-this-kasan-gce
2019/03/16 21:45 net-old 9180bb4f0460 bab43553 .config console log report ci-upstream-net-this-kasan-gce
2018/07/21 18:44 net-old fcf4793e278e 8cc079c3 .config console log report ci-upstream-net-this-kasan-gce
2019/04/02 03:17 net-next-old f5d547676ca0 a9ca43d4 .config console log report ci-upstream-net-kasan-gce
2019/04/01 23:38 net-next-old f5d547676ca0 a9ca43d4 .config console log report ci-upstream-net-kasan-gce
2019/04/01 07:13 net-next-old 6578229d4efb ccf2355a .config console log report ci-upstream-net-kasan-gce
2019/03/30 09:38 net-next-old 35f861e3c58e c35ee0ea .config console log report ci-upstream-net-kasan-gce
2019/03/29 09:58 net-next-old 113e59d09fbc 98c1bf1c .config console log report ci-upstream-net-kasan-gce
2019/03/27 22:34 net-next-old 5133a4a800fd 4e668495 .config console log report ci-upstream-net-kasan-gce
2019/03/27 11:43 net-next-old be67101fbf27 55684ce1 .config console log report ci-upstream-net-kasan-gce
2019/03/27 03:48 net-next-old be67101fbf27 55684ce1 .config console log report ci-upstream-net-kasan-gce
2019/03/26 13:51 net-next-old 68cc2999f692 55684ce1 .config console log report ci-upstream-net-kasan-gce
2019/03/26 08:20 net-next-old 68cc2999f692 55684ce1 .config console log report ci-upstream-net-kasan-gce
2019/03/24 20:35 net-next-old e6d1407013a9 acbc5b7d .config console log report ci-upstream-net-kasan-gce
2019/03/23 10:27 net-next-old 1d965c4def07 3361bde5 .config console log report ci-upstream-net-kasan-gce
2019/03/22 17:16 net-next-old 0b03a5ca8b14 dce6e62f .config console log report ci-upstream-net-kasan-gce
2019/03/17 21:33 net-next-old 3b319ee220a8 ba18afea .config console log report ci-upstream-net-kasan-gce
2019/03/16 13:20 net-next-old 3b319ee220a8 bab43553 .config console log report ci-upstream-net-kasan-gce
2019/03/16 07:06 net-next-old 3b319ee220a8 bab43553 .config console log report ci-upstream-net-kasan-gce
2019/03/15 12:29 net-next-old 3b319ee220a8 bab43553 .config console log report ci-upstream-net-kasan-gce
2019/03/13 01:02 net-next-old d9862cfbe209 a71bfb62 .config console log report ci-upstream-net-kasan-gce
2019/03/09 20:37 net-next-old d9862cfbe209 12365b99 .config console log report ci-upstream-net-kasan-gce
2019/03/09 04:41 net-next-old d9862cfbe209 12365b99 .config console log report ci-upstream-net-kasan-gce
2019/03/08 18:57 net-next-old d9862cfbe209 12365b99 .config console log report ci-upstream-net-kasan-gce
2019/03/08 15:48 net-next-old d9862cfbe209 12365b99 .config console log report ci-upstream-net-kasan-gce
2019/03/07 23:40 net-next-old d9862cfbe209 4b69c3cb .config console log report ci-upstream-net-kasan-gce
2019/03/07 17:53 net-next-old d9862cfbe209 8c085c5e .config console log report ci-upstream-net-kasan-gce
2019/03/06 04:26 net-next-old d9862cfbe209 16559f86 .config console log report ci-upstream-net-kasan-gce
2019/03/05 13:46 net-next-old 18a4d8bf250a bb91cf81 .config console log report ci-upstream-net-kasan-gce
2019/03/05 00:58 net-next-old 9e9322e5d28e 7c693b52 .config console log report ci-upstream-net-kasan-gce
2019/03/04 21:42 net-next-old 9e9322e5d28e 7c693b52 .config console log report ci-upstream-net-kasan-gce
2019/03/04 16:35 net-next-old a9836336dddf 7c693b52 .config console log report ci-upstream-net-kasan-gce
2019/03/04 06:00 net-next-old 41bc0ddb80e0 1c0e457a .config console log report ci-upstream-net-kasan-gce
2019/03/03 18:21 net-next-old d5fa9c55e5f3 1c0e457a .config console log report ci-upstream-net-kasan-gce
2019/03/03 06:05 net-next-old cf29576fee60 1c0e457a .config console log report ci-upstream-net-kasan-gce
2019/03/02 12:24 net-next-old 9bfc445e0eec 1c0e457a .config console log report ci-upstream-net-kasan-gce
2019/03/01 10:48 net-next-old be9cefe796f3 8a4b3a6b .config console log report ci-upstream-net-kasan-gce
2019/02/28 23:06 net-next-old 2ecba2d1e45b 09aeeba4 .config console log report ci-upstream-net-kasan-gce
2019/02/28 16:59 net-next-old 2ecba2d1e45b 09aeeba4 .config console log report ci-upstream-net-kasan-gce
2019/02/27 21:00 net-next-old ff8285f81822 083cfd0e .config console log report ci-upstream-net-kasan-gce
2018/11/17 18:05 linux-next 442b8cea2477 b08ee62a .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.