syzbot

 sign-in | mailing list | source | docs
🐞 Open [997] ≡ Subsystems 🐞 Fixed [5242] 🐞 Invalid [12511] ⬇ Missing Backports [84] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in free_netdev (2)

Status: fixed on 2022/03/08 16:11
Subsystems: net
[Documentation on labels]
Fix commit: f123cffdd8fe net: netlink: af_netlink: Prevent empty skb by adding a check on len.
First crash: 1511d, last: 877d
Cause bisection: introduced by (bisect log) :
commit d835b63cc4ee67e59eed9d1957f729c0a30b7331
Author: Allen Pais <allen.lkml@gmail.com>
Date: Mon Sep 25 07:30:05 2017 +0000

  net: nfc: llcp_core: use setup_timer() helper.

Crash: general protection fault in batadv_iv_ogm_queue_add (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit f123cffdd8fe8ea6c7fded4b88516a42798797d0
Author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Date: Mon Nov 29 17:53:27 2021 +0000

  net: netlink: af_netlink: Prevent empty skb by adding a check on len.

  
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 KASAN: use-after-free Read in free_netdev C error 2 646d 678d 2/2 upstream: reported C repro on 2022/06/18 00:20
linux-4.19 KASAN: use-after-free Read in free_netdev C error 142 464d 1511d 0/1 upstream: reported C repro on 2020/03/07 10:14
android-54 KASAN: use-after-free Read in free_netdev C 427 611d 1511d 0/2 auto-obsoleted due to no activity on 2023/04/24 02:54
upstream KASAN: use-after-free Read in free_netdev (3) net C inconclusive 130 519d 674d 22/26 fixed on 2023/02/24 13:50
upstream KASAN: use-after-free Read in free_netdev net C 42 2358d 2382d 3/26 fixed on 2017/11/28 03:36
upstream general protection fault in free_netdev (2) net 1 1038d 1038d 0/26 auto-closed as invalid on 2021/09/20 23:14
▶ ▼ Fix bisection attempts (14)
Created Duration User Patch Repo Result
2021/12/30 19:33 3h43m bisect fix upstream job log (1)
2021/11/30 19:00 18m bisect fix upstream job log (0) log
2021/10/02 19:38 18m bisect fix upstream job log (0) log
2021/09/02 19:17 19m bisect fix upstream job log (0) log
2021/08/02 11:26 18m bisect fix upstream job log (0) log
2021/07/02 03:39 19m bisect fix upstream job log (0) log
2021/06/01 19:45 20m bisect fix upstream job log (0) log
2021/05/02 13:18 20m bisect fix upstream job log (0) log
2021/04/02 12:56 20m bisect fix upstream job log (0) log
2021/03/02 18:58 19m bisect fix upstream job log (0) log
2021/01/21 07:52 16m bisect fix upstream job log (0) log
2020/12/22 07:31 18m bisect fix upstream job log (0) log
2020/11/22 07:15 15m bisect fix upstream job log (0) log
2020/10/22 12:39 17m bisect fix upstream job log (0) log

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in free_netdev+0x3fb/0x480 net/core/dev.c:10349
Read of size 8 at addr ffff8880944826f8 by task syz-executor223/8131

CPU: 1 PID: 8131 Comm: syz-executor223 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 free_netdev+0x3fb/0x480 net/core/dev.c:10349
 netdev_run_todo+0x88e/0xac0 net/core/dev.c:10101
 rtnl_unlock net/core/rtnetlink.c:112 [inline]
 rtnetlink_rcv_msg+0x45b/0xad0 net/core/rtnetlink.c:5564
 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2470
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:671
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2353
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2407
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2440
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x44a7f9
Code: e8 3c e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 06 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f57551ffce8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006e0c68 RCX: 000000000044a7f9
RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005
RBP: 00000000006e0c60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006e0c6c
R13: 00007ffc2e5ef59f R14: 00007f57552009c0 R15: 0000000000000000

Allocated by task 8131:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461
 __do_kmalloc mm/slab.c:3655 [inline]
 __kmalloc+0x1a8/0x320 mm/slab.c:3664
 kmalloc include/linux/slab.h:559 [inline]
 sk_prot_alloc+0x17a/0x300 net/core/sock.c:1685
 sk_alloc+0x32/0xbd0 net/core/sock.c:1739
 tun_chr_open+0x7b/0x540 drivers/net/tun.c:3372
 misc_open+0x372/0x4a0 drivers/char/misc.c:141
 chrdev_open+0x266/0x770 fs/char_dev.c:414
 do_dentry_open+0x4b9/0x11b0 fs/open.c:817
 do_open fs/namei.c:3251 [inline]
 path_openat+0x1b9a/0x2730 fs/namei.c:3368
 do_filp_open+0x17e/0x3c0 fs/namei.c:3395
 do_sys_openat2+0x16d/0x420 fs/open.c:1168
 do_sys_open fs/open.c:1184 [inline]
 __do_sys_openat fs/open.c:1200 [inline]
 __se_sys_openat fs/open.c:1195 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1195
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 8126:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422
 __cache_free mm/slab.c:3418 [inline]
 kfree+0x103/0x2c0 mm/slab.c:3756
 sk_prot_free net/core/sock.c:1722 [inline]
 __sk_destruct+0x63b/0x860 net/core/sock.c:1807
 sk_destruct+0xbd/0xe0 net/core/sock.c:1822
 __sk_free+0xef/0x3d0 net/core/sock.c:1833
 sk_free+0x78/0xa0 net/core/sock.c:1844
 sock_put include/net/sock.h:1781 [inline]
 __tun_detach+0xd69/0x1310 drivers/net/tun.c:696
 tun_detach drivers/net/tun.c:708 [inline]
 tun_chr_close+0x10e/0x180 drivers/net/tun.c:3408
 __fput+0x285/0x920 fs/file_table.c:281
 task_work_run+0xdd/0x190 kernel/task_work.c:141
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:139 [inline]
 exit_to_user_mode_prepare+0x195/0x1c0 kernel/entry/common.c:166
 syscall_exit_to_user_mode+0x59/0x2b0 kernel/entry/common.c:241
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff888094482000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1784 bytes inside of
 4096-byte region [ffff888094482000, ffff888094483000)
The buggy address belongs to the page:
page:00000000f2b2664d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x94482
head:00000000f2b2664d order:1 compound_mapcount:0
flags: 0xfffe0000010200(slab|head)
raw: 00fffe0000010200 ffffea0002436688 ffffea000224f508 ffff8880aa040900
raw: 0000000000000000 ffff888094482000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888094482580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888094482600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888094482680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                                ^
 ffff888094482700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888094482780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (1715):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/17 05:53 upstream 2cc3c4b3c2e9 424dd8e7 .config console log report syz C ci-upstream-kasan-gce-root
2020/06/10 12:15 upstream 7ae77150d94d 860c4de9 .config console log report syz C ci-upstream-kasan-gce-root
2020/05/17 09:09 upstream 3d1c1e5931ce 37bccd4e .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/06/10 09:01 net-old 4d3da2d8d91f 860c4de9 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/03/08 04:08 net-old aeaa925bff84 2e9971bb .config console log report syz C ci-upstream-net-this-kasan-gce
2020/08/16 07:27 upstream d84835b118ed 424dd8e7 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/08/15 21:29 upstream c9c9735c46f5 424dd8e7 .config console log report syz ci-upstream-kasan-gce-smack-root
2020/07/05 02:26 upstream 7cc2a8ea1048 51095195 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/07/04 22:26 upstream 7cc2a8ea1048 51095195 .config console log report syz ci-upstream-kasan-gce-root
2020/07/04 14:27 upstream 7cc2a8ea1048 51095195 .config console log report syz ci-upstream-kasan-gce-smack-root
2020/06/18 04:43 upstream 7ae77150d94d b9f3810b .config console log report syz ci-upstream-kasan-gce-root
2020/06/10 08:51 upstream 7ae77150d94d 860c4de9 .config console log report syz ci-upstream-kasan-gce-smack-root
2020/05/04 05:54 upstream 262f7a6b8317 58ae5e18 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/04/08 05:22 upstream 763dede1b248 db9bcd4b .config console log report syz ci-upstream-kasan-gce-smack-root
2020/04/07 12:49 upstream 7e63420847ae 99a96044 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/04/02 13:24 upstream 919dce24701f a34e2c33 .config console log report syz ci-upstream-kasan-gce-root
2020/03/23 23:42 upstream 16fbf79b0f83 84f999d6 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/03/22 05:43 upstream b74b991fb8b9 78267cec .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/03/20 23:19 upstream 6c90b86a745a 2c31c529 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/03/17 04:59 upstream fb33c6510d55 749688d2 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/03/16 20:10 upstream fb33c6510d55 749688d2 .config console log report syz ci-upstream-kasan-gce-root
2020/06/10 22:08 upstream 435faf5c218a b4eca550 .config console log report syz ci-qemu-upstream-386
2020/07/04 20:50 net-old 1ca0fafd73c5 51095195 .config console log report syz ci-upstream-net-this-kasan-gce
2020/03/12 19:31 net-old e1f550dc44a4 d850e9d0 .config console log report syz ci-upstream-net-this-kasan-gce
2020/07/04 19:49 net-next-old e44f65fd666c 51095195 .config console log report syz ci-upstream-net-kasan-gce
2020/06/18 01:38 net-next-old cb8e59cc8720 b9f3810b .config console log report syz ci-upstream-net-kasan-gce
2020/03/10 07:25 net-next-old 34a568a244be 35f53e45 .config console log report syz ci-upstream-net-kasan-gce
2020/03/07 01:41 net-next-old 68e2c37690b0 fd2a5f28 .config console log report syz ci-upstream-net-kasan-gce
2020/07/04 19:14 linux-next 9e50b94b3eb0 51095195 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/04/07 17:50 linux-next 5fab54423a0a 99a96044 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/04/03 07:11 linux-next 770fbb32d34e a34e2c33 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/04/02 17:42 linux-next 770fbb32d34e a34e2c33 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/04/02 10:59 linux-next 770fbb32d34e a34e2c33 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/04/01 12:37 linux-next 770fbb32d34e a34e2c33 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/29 12:30 linux-next 770fbb32d34e 05736b29 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/28 08:39 linux-next 770fbb32d34e 831e9a81 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/27 22:35 linux-next 770fbb32d34e 831e9a81 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/27 12:22 linux-next 770fbb32d34e 7d95711b .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/27 03:47 linux-next 770fbb32d34e 6d25c5a0 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/26 10:13 linux-next 770fbb32d34e e8e6c7d2 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/25 22:38 linux-next 770fbb32d34e 41f049cc .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/25 18:03 linux-next 770fbb32d34e 41f049cc .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/03/25 10:20 linux-next 770fbb32d34e 41f049cc .config console log report syz ci-upstream-linux-next-kasan-gce-root
2021/10/31 13:47 bpf-next f48ad69097fe 098b5d53 .config console log report info ci-upstream-bpf-next-kasan-gce KASAN: use-after-free Read in free_netdev
2021/10/09 01:05 bpf-next e52a8b96c5ad efe0f24d .config console log report info ci-upstream-bpf-next-kasan-gce KASAN: use-after-free Read in free_netdev
2020/09/21 06:21 upstream ba4f184e126b 9564d2e9 .config console log report info ci-upstream-kasan-gce-root
2020/09/19 03:03 upstream 92ab97adeefc 53ce8104 .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/18 13:42 upstream 10b82d517648 38962c8b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/18 10:58 upstream 10b82d517648 38962c8b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/18 05:16 upstream 10b82d517648 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/17 10:54 upstream 5925fa68fe82 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/16 19:48 upstream fc4f28bb3daf 18d7d030 .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/14 06:42 upstream e4c26faa426c 2d3cdd63 .config console log report ci-upstream-kasan-gce-smack-root
2020/09/14 02:45 upstream e4c26faa426c 2d3cdd63 .config console log report ci-upstream-kasan-gce-root
2020/09/14 01:26 upstream e4c26faa426c 2d3cdd63 .config console log report ci-upstream-kasan-gce-root
2020/09/10 15:30 upstream 7fe10096c150 409809d8 .config console log report ci-upstream-kasan-gce-selinux-root
2020/06/16 11:31 upstream 435faf5c218a 4ea9d964 .config console log report ci-qemu-upstream
2020/09/21 09:58 net-old e1b81391421b 9564d2e9 .config console log report info ci-upstream-net-this-kasan-gce
2020/09/20 16:39 net-old f13d783a184e 9564d2e9 .config console log report info ci-upstream-net-this-kasan-gce
2020/09/19 05:58 net-old fc25fa97976b 53ce8104 .config console log report info ci-upstream-net-this-kasan-gce
2020/09/18 11:39 net-old 5f6857e808a8 38962c8b .config console log report info ci-upstream-net-this-kasan-gce
2020/09/18 08:26 net-old 5f6857e808a8 38962c8b .config console log report info ci-upstream-net-this-kasan-gce
2020/09/17 21:22 net-old fd944dc24336 8247808b .config console log report info ci-upstream-net-this-kasan-gce
2020/09/17 02:03 net-old d5d325eae782 8247808b .config console log report info ci-upstream-net-this-kasan-gce
2020/09/16 09:47 net-old 2e5117ba9f58 18d7d030 .config console log report info ci-upstream-net-this-kasan-gce
2020/09/16 02:53 net-old 8e1b3ac47866 6989d6f6 .config console log report info ci-upstream-net-this-kasan-gce
2020/09/15 16:09 net-old 8e1b3ac47866 6989d6f6 .config console log report info ci-upstream-net-this-kasan-gce
2020/09/15 13:34 net-old 8e1b3ac47866 6989d6f6 .config console log report info ci-upstream-net-this-kasan-gce
2020/09/15 08:19 net-old 8e1b3ac47866 6989d6f6 .config console log report info ci-upstream-net-this-kasan-gce
2020/09/14 11:42 net-old 5760d9acbe95 2d3cdd63 .config console log report ci-upstream-net-this-kasan-gce
2020/09/14 10:39 net-old 5760d9acbe95 2d3cdd63 .config console log report ci-upstream-net-this-kasan-gce
2020/09/14 09:34 net-old 5760d9acbe95 2d3cdd63 .config console log report ci-upstream-net-this-kasan-gce
2020/09/13 23:23 net-old 5760d9acbe95 2d3cdd63 .config console log report ci-upstream-net-this-kasan-gce
2020/09/13 22:16 net-old 5760d9acbe95 2d3cdd63 .config console log report ci-upstream-net-this-kasan-gce
2020/09/13 20:25 net-old 5760d9acbe95 2d3cdd63 .config console log report ci-upstream-net-this-kasan-gce
2020/09/12 01:38 net-old cdb0e6dccc1f 79fb24e2 .config console log report ci-upstream-net-this-kasan-gce
2020/09/12 00:16 net-old ee460417d254 79fb24e2 .config console log report ci-upstream-net-this-kasan-gce
2020/09/22 09:27 net-next-old b696db590f5d 9e1fa68e .config console log report info ci-upstream-net-kasan-gce
2020/09/22 04:26 net-next-old b696db590f5d 9e1fa68e .config console log report info ci-upstream-net-kasan-gce
2020/09/15 17:15 net-next-old ed6d9b022813 6989d6f6 .config console log report info ci-upstream-net-kasan-gce
2020/09/15 10:05 net-next-old ed6d9b022813 6989d6f6 .config console log report info ci-upstream-net-kasan-gce
2020/09/12 23:45 net-next-old 5a6bd84f8154 ce441f06 .config console log report ci-upstream-net-kasan-gce
2020/09/12 14:45 net-next-old 5a6bd84f8154 ce441f06 .config console log report ci-upstream-net-kasan-gce
2020/09/12 11:16 net-next-old 12913f745934 79fb24e2 .config console log report ci-upstream-net-kasan-gce
2020/09/12 10:01 net-next-old 12913f745934 79fb24e2 .config console log report ci-upstream-net-kasan-gce
2020/09/12 09:53 net-next-old 12913f745934 79fb24e2 .config console log report ci-upstream-net-kasan-gce
2020/09/12 07:51 net-next-old 12913f745934 79fb24e2 .config console log report ci-upstream-net-kasan-gce
2020/09/12 06:42 net-next-old 12913f745934 79fb24e2 .config console log report ci-upstream-net-kasan-gce
2020/09/11 16:04 net-next-old 9984c0bb22dc adfb8b4e .config console log report ci-upstream-net-kasan-gce
2020/09/11 06:50 net-next-old 4f6a5caf187f 409809d8 .config console log report ci-upstream-net-kasan-gce
2020/09/11 05:47 net-next-old 4f6a5caf187f 409809d8 .config console log report ci-upstream-net-kasan-gce
2020/03/06 19:59 net-next-old 3b3e808cd883 c88c7b75 .config console log report ci-upstream-net-kasan-gce
2020/09/14 04:55 linux-next d5b2251d63b5 2d3cdd63 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.