syzbot

 sign-in | mailing list | source | docs
🐞 Open [1651]
≡ Subsystems
🐞 Fixed [6000]
🐞 Invalid [14793]
⬇ Missing Backports [135]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: null-ptr-deref Read in ip6_hold_safe

Status: auto-closed as invalid on 2019/10/25 08:46
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+8433ca0841e308ef4cc7@syzkaller.appspotmail.com
First crash: 2210d, last: 2050d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
Reminder: 99 open syzbot bugs in net subsystem 14 (14) 2019/07/31 15:13
Reminder: 94 open syzbot bugs in net subsystem 1 (1) 2019/06/25 05:48
KASAN: null-ptr-deref Read in ip6_hold_safe 1 (2) 2019/01/14 06:55

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: null-ptr-deref in atomic_fetch_add_unless include/linux/atomic-fallback.h:1086 [inline]
BUG: KASAN: null-ptr-deref in atomic_add_unless include/linux/atomic-fallback.h:1111 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc_not_zero include/linux/atomic-fallback.h:1127 [inline]
BUG: KASAN: null-ptr-deref in dst_hold_safe include/net/dst.h:297 [inline]
BUG: KASAN: null-ptr-deref in ip6_hold_safe+0xad/0x380 net/ipv6/route.c:1046
Read of size 4 at addr 0000000000000059 by task syz-executor.0/9905

CPU: 0 PID: 9905 Comm: syz-executor.0 Not tainted 5.2.0-rc5 #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 __kasan_report.cold+0x5/0x40 mm/kasan/report.c:321
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x123/0x190 mm/kasan/generic.c:191
 kasan_check_read+0x11/0x20 mm/kasan/common.c:94
 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
 atomic_fetch_add_unless include/linux/atomic-fallback.h:1086 [inline]
 atomic_add_unless include/linux/atomic-fallback.h:1111 [inline]
 atomic_inc_not_zero include/linux/atomic-fallback.h:1127 [inline]
 dst_hold_safe include/net/dst.h:297 [inline]
 ip6_hold_safe+0xad/0x380 net/ipv6/route.c:1046
 rt6_get_pcpu_route net/ipv6/route.c:1273 [inline]
 ip6_pol_route+0x339/0x1050 net/ipv6/route.c:1952
 ip6_pol_route_output+0x54/0x70 net/ipv6/route.c:2128
 fib6_rule_lookup+0x133/0x5a0 net/ipv6/fib6_rules.c:113
 ip6_route_output_flags+0x2c4/0x350 net/ipv6/route.c:2157
 ip6_route_output include/net/ip6_route.h:89 [inline]
 ip6_dst_lookup_tail+0xd10/0x1b30 net/ipv6/ip6_output.c:962
 ip6_dst_lookup_flow+0xa8/0x220 net/ipv6/ip6_output.c:1090
 sctp_v6_get_dst+0x785/0x1ce0 net/sctp/ipv6.c:278
 sctp_transport_route+0x12d/0x360 net/sctp/transport.c:297
 sctp_assoc_add_peer+0x53e/0xfc0 net/sctp/associola.c:663
 sctp_process_param net/sctp/sm_make_chunk.c:2522 [inline]
 sctp_process_init+0x2458/0x2ad0 net/sctp/sm_make_chunk.c:2343
 sctp_sf_do_unexpected_init net/sctp/sm_statefuns.c:1541 [inline]
 sctp_sf_do_unexpected_init.isra.0+0x7cd/0x1350 net/sctp/sm_statefuns.c:1441
 sctp_sf_do_5_2_1_siminit+0x35/0x40 net/sctp/sm_statefuns.c:1670
 sctp_do_sm+0x121/0x5190 net/sctp/sm_sideeffect.c:1152
 sctp_assoc_bh_rcv+0x343/0x660 net/sctp/associola.c:1059
 sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80
 sctp_backlog_rcv+0x196/0xbe0 net/sctp/input.c:339
 sk_backlog_rcv include/net/sock.h:945 [inline]
 __release_sock+0x129/0x390 net/core/sock.c:2412
 release_sock+0x59/0x1c0 net/core/sock.c:2928
 sctp_wait_for_connect+0x316/0x540 net/sctp/socket.c:9039
 __sctp_connect+0xab2/0xcd0 net/sctp/socket.c:1226
 sctp_connect net/sctp/socket.c:4846 [inline]
 sctp_inet_connect+0x29c/0x340 net/sctp/socket.c:4862
 __sys_connect+0x264/0x330 net/socket.c:1834
 __do_sys_connect net/socket.c:1845 [inline]
 __se_sys_connect net/socket.c:1842 [inline]
 __x64_sys_connect+0x73/0xb0 net/socket.c:1842
 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4592c9
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f11f13f8c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004592c9
RDX: 000000000000001c RSI: 0000000020000200 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f11f13f96d4
R13: 00000000004bf7b5 R14: 00000000004d0f38 R15: 00000000ffffffff
==================================================================

Crashes (86):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/17 14:58 upstream 9e0babf2c06c 442206d7 .config console log report ci-upstream-kasan-gce
2019/03/17 01:56 upstream a9dce6679d73 bab43553 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/11 21:38 upstream a089e4fed5c5 12365b99 .config console log report ci-upstream-kasan-gce-root
2019/03/11 13:29 upstream 12ad143e1b80 12365b99 .config console log report ci-upstream-kasan-gce
2019/02/26 17:26 upstream 7d762d69145a a36ecd98 .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/16 21:45 upstream 5ded5871030e f42dee6d .config console log report ci-upstream-kasan-gce
2019/02/10 09:41 upstream df3865f8f568 b4f792e4 .config console log report ci-upstream-kasan-gce-root
2019/02/07 03:42 upstream 8834f5600cf3 d25487bc .config console log report ci-upstream-kasan-gce
2019/02/05 17:14 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-root
2019/01/22 19:43 upstream 48b161983ae5 985f75cc .config console log report ci-upstream-kasan-gce-smack-root
2019/06/18 15:33 net-old 29f785ff76b6 e3f76baa .config console log report ci-upstream-net-this-kasan-gce
2019/06/16 06:44 net-old ef7bfa84725d 442206d7 .config console log report ci-upstream-net-this-kasan-gce
2019/06/15 20:33 net-old 35fc07aee8f6 442206d7 .config console log report ci-upstream-net-this-kasan-gce
2019/06/15 01:11 net-old 385097a36757 442206d7 .config console log report ci-upstream-net-this-kasan-gce
2019/06/11 22:26 net-old 93c65f83f25b ea2f4006 .config console log report ci-upstream-net-this-kasan-gce
2019/06/02 05:47 net-old e8d67fa5696e 53c81ea5 .config console log report ci-upstream-net-this-kasan-gce
2019/06/01 21:42 net-old e8d67fa5696e 53c81ea5 .config console log report ci-upstream-net-this-kasan-gce
2019/05/30 11:43 net-old 58e8b37069ff d9aaf3c2 .config console log report ci-upstream-net-this-kasan-gce
2019/05/27 20:41 net-old 3e66b7cc50ef 562efd79 .config console log report ci-upstream-net-this-kasan-gce
2019/05/27 10:38 net-old 3e66b7cc50ef 562efd79 .config console log report ci-upstream-net-this-kasan-gce
2019/05/26 17:36 net-old f4bcf14e3997 85c57315 .config console log report ci-upstream-net-this-kasan-gce
2019/05/26 09:22 net-old f4bcf14e3997 85c57315 .config console log report ci-upstream-net-this-kasan-gce
2019/05/25 08:23 net-old ce8d24f9a596 85c57315 .config console log report ci-upstream-net-this-kasan-gce
2019/05/24 15:30 net-old b5730061d105 0dadcd9d .config console log report ci-upstream-net-this-kasan-gce
2019/05/23 20:32 net-old 903869bd10e6 0dadcd9d .config console log report ci-upstream-net-this-kasan-gce
2019/05/16 06:30 net-old 858f50174467 051c49fe .config console log report ci-upstream-net-this-kasan-gce
2019/05/10 10:25 net-old 601e6bcc4ef0 018207ef .config console log report ci-upstream-net-this-kasan-gce
2019/05/10 08:15 net-old 601e6bcc4ef0 018207ef .config console log report ci-upstream-net-this-kasan-gce
2019/05/09 18:42 net-old 5f05836831f6 6fc130d3 .config console log report ci-upstream-net-this-kasan-gce
2019/05/02 04:17 net-old d2f0c961148f 7516d9fa .config console log report ci-upstream-net-this-kasan-gce
2019/04/28 10:49 net-old b2a20fd0725e b617407b .config console log report ci-upstream-net-this-kasan-gce
2019/04/26 02:28 net-old cd8dead0c394 f46aabc8 .config console log report ci-upstream-net-this-kasan-gce
2019/04/22 03:10 net-old 26d1b8586b4f b0e8efcb .config console log report ci-upstream-net-this-kasan-gce
2019/04/20 04:44 net-old d1bcf2b65177 b0e8efcb .config console log report ci-upstream-net-this-kasan-gce
2019/04/19 15:39 net-old 9188d5ca454f b0e8efcb .config console log report ci-upstream-net-this-kasan-gce
2019/04/16 00:01 net-old 9c69a1320515 505ab413 .config console log report ci-upstream-net-this-kasan-gce
2019/04/12 15:58 net-old e30584509659 8916f5e1 .config console log report ci-upstream-net-this-kasan-gce
2019/04/09 22:58 net-old c03fd0171ba6 65b612b7 .config console log report ci-upstream-net-this-kasan-gce
2019/04/08 01:33 net-old 6491d698396f c34fde03 .config console log report ci-upstream-net-this-kasan-gce
2019/03/25 23:05 net-old 27602e2c44da 55684ce1 .config console log report ci-upstream-net-this-kasan-gce
2019/03/25 00:59 net-old 526949e877f4 2c86e0a5 .config console log report ci-upstream-net-this-kasan-gce
2019/06/14 16:01 net-next-old 514fcaac371e 998ccc76 .config console log report ci-upstream-net-kasan-gce
2019/06/12 08:09 net-next-old 758a0a4d60ab ea2f4006 .config console log report ci-upstream-net-kasan-gce
2019/06/11 19:20 net-next-old 48debfd736d5 5b5826d0 .config console log report ci-upstream-net-kasan-gce
2019/06/09 12:13 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/03 11:17 net-next-old b33bc2b878e0 53c81ea5 .config console log report ci-upstream-net-kasan-gce
2019/06/03 02:28 net-next-old 57f041027909 53c81ea5 .config console log report ci-upstream-net-kasan-gce
2019/06/01 05:58 net-next-old c9bb6165a16e 53c81ea5 .config console log report ci-upstream-net-kasan-gce
2019/05/31 09:24 net-next-old 517f4c49aafc d9aaf3c2 .config console log report ci-upstream-net-kasan-gce
2019/05/30 00:08 net-next-old 36f18439ea16 5457ef34 .config console log report ci-upstream-net-kasan-gce
2019/05/28 06:31 net-next-old cec4f328c929 6bd61501 .config console log report ci-upstream-net-kasan-gce
2019/05/27 21:50 net-next-old cec4f328c929 6bd61501 .config console log report ci-upstream-net-kasan-gce
2019/05/27 06:22 net-next-old 9b3c520e9628 85c57315 .config console log report ci-upstream-net-kasan-gce
2019/05/27 01:55 net-next-old 9b3c520e9628 85c57315 .config console log report ci-upstream-net-kasan-gce
2019/05/25 02:20 net-next-old af5136f95045 85c57315 .config console log report ci-upstream-net-kasan-gce
2019/03/30 19:22 net-next-old 35f861e3c58e c35ee0ea .config console log report ci-upstream-net-kasan-gce
2019/02/17 23:50 net-next-old f186a82b10dc 3e98cc30 .config console log report ci-upstream-net-kasan-gce
2019/02/03 06:12 net-next-old a68a8481353a c198d5dd .config console log report ci-upstream-net-kasan-gce
2019/01/28 18:54 net-next-old 085c4c7dd2b6 629c2a27 .config console log report ci-upstream-net-kasan-gce
2019/01/26 23:07 net-next-old a4b829949326 c73f090a .config console log report ci-upstream-net-kasan-gce
2019/01/22 14:28 net-next-old fa7f3a8d56b3 985f75cc .config console log report ci-upstream-net-kasan-gce
2019/01/20 19:59 net-next-old 4e15cbe82996 fd37a550 .config console log report ci-upstream-net-kasan-gce
2019/01/09 20:05 net-next-old b71acb0e3721 45c0c1b1 .config console log report ci-upstream-net-kasan-gce
2019/03/16 22:30 linux-next cf08baa29613 bab43553 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.