syzbot


KASAN: stack-out-of-bounds Read in strnlen

Status: public: reported C repro on 2019/04/13 00:00
Reported-by: syzbot+eb5a498710d12ff71b2d@syzkaller.appspotmail.com
First crash: 2315d, last: 2122d

Sample crash report:
IPVS: set_ctl: invalid protocol: 45975 236.44.193.237:56990 
IPVS: set_ctl: invalid protocol: 45975 236.44.193.237:56990 
==================================================================
BUG: KASAN: stack-out-of-bounds in strnlen+0xc1/0xd0 lib/string.c:498
Read of size 1 at addr ffff8801d0877d04 by task syzkaller968690/3469

CPU: 0 PID: 3469 Comm: syzkaller968690 Not tainted 4.4.107-g610c835 #12
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 32c3afb9a0a8afa3 ffff8801d0877758 ffffffff81d0457d
 ffffea0007421dc0 ffff8801d0877d04 0000000000000000 ffff8801d0877d04
 ffffffff856b29c0 ffff8801d0877790 ffffffff814fbb23 ffff8801d0877d04
Call Trace:
 [<ffffffff81d0457d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0457d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fbb23>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fc035>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fc035>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fc134>] __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:426
 [<ffffffff81d1ff51>] strnlen+0xc1/0xd0 lib/string.c:498
 [<ffffffff81d27bdc>] string.isra.4+0x4c/0x240 lib/vsprintf.c:518
 [<ffffffff81d2d086>] vsnprintf+0x766/0x15f0 lib/vsprintf.c:1907
 [<ffffffff81d2df3d>] vscnprintf+0x2d/0x60 lib/vsprintf.c:2010
 [<ffffffff81266f8b>] vprintk_emit+0xdb/0x850 kernel/printk/printk.c:1729
 [<ffffffff81267728>] vprintk+0x28/0x30 kernel/printk/printk.c:1843
 [<ffffffff8126774d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844
 [<ffffffff8141839d>] printk+0xb7/0xe2 kernel/printk/printk.c:1922
 [<ffffffff830982e7>] do_ip_vs_set_ctl+0x9b7/0xba0 net/netfilter/ipvs/ip_vs_ctl.c:2398
 [<ffffffff82f971a7>] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline]
 [<ffffffff82f971a7>] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114
 [<ffffffff830fe561>] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1226
 [<ffffffff831a4395>] udp_setsockopt+0x45/0x80 net/ipv4/udp.c:2154
 [<ffffffff82df2b55>] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2659
 [<ffffffff82defc20>] SYSC_setsockopt net/socket.c:1767 [inline]
 [<ffffffff82defc20>] SyS_setsockopt+0x160/0x250 net/socket.c:1746
 [<ffffffff83773d36>] entry_SYSCALL_64_fastpath+0x16/0x76

The buggy address belongs to the page:
page:ffffea0007421dc0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d0877c00: 00 00 00 00 00 04 f2 f2 f2 f2 f2 f2 00 00 00 00
 ffff8801d0877c80: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00
>ffff8801d0877d00: 04 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
                   ^
 ffff8801d0877d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d0877e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (80):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/22 03:31 https://android.googlesource.com/kernel/common android-4.4 610c835673f3 81fe66b4 .config console log report syz C ci-android-44-kasan-gce
2017/12/22 03:06 https://android.googlesource.com/kernel/common android-4.4 610c835673f3 81fe66b4 .config console log report syz C ci-android-44-kasan-gce
2017/12/22 01:30 https://android.googlesource.com/kernel/common android-4.4 610c835673f3 81fe66b4 .config console log report syz C ci-android-44-kasan-gce-386
2017/12/22 01:05 https://android.googlesource.com/kernel/common android-4.4 610c835673f3 81fe66b4 .config console log report syz C ci-android-44-kasan-gce-386
2018/07/03 14:11 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 317fc8ea .config console log report ci-android-44-kasan-gce
2018/07/01 17:00 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 dba0b50e .config console log report ci-android-44-kasan-gce
2018/07/01 02:45 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 dba0b50e .config console log report ci-android-44-kasan-gce
2018/06/30 06:41 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 dba0b50e .config console log report ci-android-44-kasan-gce
2018/06/29 18:39 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 dba0b50e .config console log report ci-android-44-kasan-gce
2018/06/28 21:13 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 dba0b50e .config console log report ci-android-44-kasan-gce
2018/06/28 00:36 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 43e60f7e .config console log report ci-android-44-kasan-gce
2018/06/24 10:48 https://android.googlesource.com/kernel/common android-4.4 226f96b03dc2 2064fc5c .config console log report ci-android-44-kasan-gce
2018/06/21 07:30 https://android.googlesource.com/kernel/common android-4.4 226f96b03dc2 095ef806 .config console log report ci-android-44-kasan-gce
2018/06/18 22:15 https://android.googlesource.com/kernel/common android-4.4 07c01385fb82 45c54f75 .config console log report ci-android-44-kasan-gce
2018/06/18 14:34 https://android.googlesource.com/kernel/common android-4.4 07c01385fb82 27c5f59f .config console log report ci-android-44-kasan-gce
2018/06/16 11:36 https://android.googlesource.com/kernel/common android-4.4 07c01385fb82 27c5f59f .config console log report ci-android-44-kasan-gce
2018/06/15 02:21 https://android.googlesource.com/kernel/common android-4.4 a2e2217bd824 27c5f59f .config console log report ci-android-44-kasan-gce
2018/06/11 19:33 https://android.googlesource.com/kernel/common android-4.4 fb7e31963455 ae8bdb50 .config console log report ci-android-44-kasan-gce
2018/06/09 05:25 https://android.googlesource.com/kernel/common android-4.4 fb7e31963455 866118af .config console log report ci-android-44-kasan-gce
2018/06/08 06:32 https://android.googlesource.com/kernel/common android-4.4 fb7e31963455 f7b27b7a .config console log report ci-android-44-kasan-gce
2018/06/04 15:28 https://android.googlesource.com/kernel/common android-4.4 e75204cc0ad5 6cbe7c26 .config console log report ci-android-44-kasan-gce
2018/06/03 22:19 https://android.googlesource.com/kernel/common android-4.4 e75204cc0ad5 2f93b54f .config console log report ci-android-44-kasan-gce
2018/06/03 07:10 https://android.googlesource.com/kernel/common android-4.4 e75204cc0ad5 2f93b54f .config console log report ci-android-44-kasan-gce
2018/06/02 07:16 https://android.googlesource.com/kernel/common android-4.4 e75204cc0ad5 2f93b54f .config console log report ci-android-44-kasan-gce
2018/06/02 04:19 https://android.googlesource.com/kernel/common android-4.4 e75204cc0ad5 2f93b54f .config console log report ci-android-44-kasan-gce
2018/06/01 04:48 https://android.googlesource.com/kernel/common android-4.4 e75204cc0ad5 2f93b54f .config console log report ci-android-44-kasan-gce
2018/05/31 18:13 https://android.googlesource.com/kernel/common android-4.4 b68f27c36219 2f93b54f .config console log report ci-android-44-kasan-gce
2018/05/28 23:47 https://android.googlesource.com/kernel/common android-4.4 3f51ea2db97d f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/27 03:42 https://android.googlesource.com/kernel/common android-4.4 3f51ea2db97d f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/26 10:52 https://android.googlesource.com/kernel/common android-4.4 4b08356a76b8 f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/24 04:56 https://android.googlesource.com/kernel/common android-4.4 c3c51ea38a92 f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/23 23:22 https://android.googlesource.com/kernel/common android-4.4 ecf86ddd92cf f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/23 20:27 https://android.googlesource.com/kernel/common android-4.4 ecf86ddd92cf f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/22 19:05 https://android.googlesource.com/kernel/common android-4.4 1a2b3e7807da f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/22 03:40 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/21 09:49 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/20 12:43 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/20 07:57 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 f48c20b8 .config console log report ci-android-44-kasan-gce
2018/05/19 19:44 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 849705db .config console log report ci-android-44-kasan-gce
2018/05/19 18:52 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 849705db .config console log report ci-android-44-kasan-gce
2018/05/19 14:40 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 849705db .config console log report ci-android-44-kasan-gce
2018/07/03 11:06 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 317fc8ea .config console log report ci-android-44-kasan-gce-386
2018/07/03 02:24 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 574780b0 .config console log report ci-android-44-kasan-gce-386
2018/06/30 13:22 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 dba0b50e .config console log report ci-android-44-kasan-gce-386
2018/06/29 14:33 https://android.googlesource.com/kernel/common android-4.4 cf21a9ac5ee4 dba0b50e .config console log report ci-android-44-kasan-gce-386
2018/06/08 01:50 https://android.googlesource.com/kernel/common android-4.4 fb7e31963455 645e75f8 .config console log report ci-android-44-kasan-gce-386
2018/06/07 23:25 https://android.googlesource.com/kernel/common android-4.4 fb7e31963455 645e75f8 .config console log report ci-android-44-kasan-gce-386
2018/06/05 04:03 https://android.googlesource.com/kernel/common android-4.4 e75204cc0ad5 a50d873b .config console log report ci-android-44-kasan-gce-386
2018/05/30 18:00 https://android.googlesource.com/kernel/common android-4.4 54f36eadd123 2f93b54f .config console log report ci-android-44-kasan-gce-386
2018/05/29 05:08 https://android.googlesource.com/kernel/common android-4.4 3f51ea2db97d f48c20b8 .config console log report ci-android-44-kasan-gce-386
2018/05/28 05:18 https://android.googlesource.com/kernel/common android-4.4 3f51ea2db97d f48c20b8 .config console log report ci-android-44-kasan-gce-386
2018/05/21 13:14 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 f48c20b8 .config console log report ci-android-44-kasan-gce-386
2018/05/20 20:32 https://android.googlesource.com/kernel/common android-4.4 4f75c34feee6 f48c20b8 .config console log report ci-android-44-kasan-gce-386
* Struck through repros no longer work on HEAD.