syzbot |
sign-in | mailing list | source | docs |
================================================================== BUG: KASAN: use-after-free in kfree_skb_list+0x5d/0x60 net/core/skbuff.c:706 Read of size 8 at addr ffff888085a3cbc0 by task syz-executor303/8947 CPU: 0 PID: 8947 Comm: syz-executor303 Not tainted 5.2.0-rc2+ #12 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188 __kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 kasan_report+0x12/0x20 mm/kasan/common.c:614 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 kfree_skb_list+0x5d/0x60 net/core/skbuff.c:706 ip6_fragment+0x1ef4/0x2680 net/ipv6/ip6_output.c:882 __ip6_finish_output+0x577/0xaa0 net/ipv6/ip6_output.c:144 ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:156 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0x235/0x7f0 net/ipv6/ip6_output.c:179 dst_output include/net/dst.h:433 [inline] ip6_local_out+0xbb/0x1b0 net/ipv6/output_core.c:179 ip6_send_skb+0xbb/0x350 net/ipv6/ip6_output.c:1796 ip6_push_pending_frames+0xc8/0xf0 net/ipv6/ip6_output.c:1816 rawv6_push_pending_frames net/ipv6/raw.c:617 [inline] rawv6_sendmsg+0x2993/0x35e0 net/ipv6/raw.c:947 inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:802 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:671 ___sys_sendmsg+0x803/0x920 net/socket.c:2292 __sys_sendmsg+0x105/0x1d0 net/socket.c:2330 __do_sys_sendmsg net/socket.c:2339 [inline] __se_sys_sendmsg net/socket.c:2337 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x44add9 Code: e8 7c e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 05 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f826f33bce8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000006e7a18 RCX: 000000000044add9 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 RBP: 00000000006e7a10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006e7a1c R13: 00007ffcec4f7ebf R14: 00007f826f33c9c0 R15: 20c49ba5e353f7cf Allocated by task 8947: save_stack+0x23/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_kmalloc mm/kasan/common.c:489 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:497 slab_post_alloc_hook mm/slab.h:437 [inline] slab_alloc_node mm/slab.c:3269 [inline] kmem_cache_alloc_node+0x131/0x710 mm/slab.c:3579 __alloc_skb+0xd5/0x5e0 net/core/skbuff.c:199 alloc_skb include/linux/skbuff.h:1058 [inline] __ip6_append_data.isra.0+0x2a24/0x3640 net/ipv6/ip6_output.c:1519 ip6_append_data+0x1e5/0x320 net/ipv6/ip6_output.c:1688 rawv6_sendmsg+0x1467/0x35e0 net/ipv6/raw.c:940 inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:802 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:671 ___sys_sendmsg+0x803/0x920 net/socket.c:2292 __sys_sendmsg+0x105/0x1d0 net/socket.c:2330 __do_sys_sendmsg net/socket.c:2339 [inline] __se_sys_sendmsg net/socket.c:2337 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8947: save_stack+0x23/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459 __cache_free mm/slab.c:3432 [inline] kmem_cache_free+0x86/0x260 mm/slab.c:3698 kfree_skbmem net/core/skbuff.c:625 [inline] kfree_skbmem+0xc5/0x150 net/core/skbuff.c:619 __kfree_skb net/core/skbuff.c:682 [inline] kfree_skb net/core/skbuff.c:699 [inline] kfree_skb+0xf0/0x390 net/core/skbuff.c:693 kfree_skb_list+0x44/0x60 net/core/skbuff.c:708 __dev_xmit_skb net/core/dev.c:3551 [inline] __dev_queue_xmit+0x3034/0x36b0 net/core/dev.c:3850 dev_queue_xmit+0x18/0x20 net/core/dev.c:3914 neigh_direct_output+0x16/0x20 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:511 [inline] ip6_finish_output2+0x1034/0x2550 net/ipv6/ip6_output.c:120 ip6_fragment+0x1ebb/0x2680 net/ipv6/ip6_output.c:863 __ip6_finish_output+0x577/0xaa0 net/ipv6/ip6_output.c:144 ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:156 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0x235/0x7f0 net/ipv6/ip6_output.c:179 dst_output include/net/dst.h:433 [inline] ip6_local_out+0xbb/0x1b0 net/ipv6/output_core.c:179 ip6_send_skb+0xbb/0x350 net/ipv6/ip6_output.c:1796 ip6_push_pending_frames+0xc8/0xf0 net/ipv6/ip6_output.c:1816 rawv6_push_pending_frames net/ipv6/raw.c:617 [inline] rawv6_sendmsg+0x2993/0x35e0 net/ipv6/raw.c:947 inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:802 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:671 ___sys_sendmsg+0x803/0x920 net/socket.c:2292 __sys_sendmsg+0x105/0x1d0 net/socket.c:2330 __do_sys_sendmsg net/socket.c:2339 [inline] __se_sys_sendmsg net/socket.c:2337 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888085a3cbc0 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 0 bytes inside of 224-byte region [ffff888085a3cbc0, ffff888085a3cca0) The buggy address belongs to the page: page:ffffea0002168f00 refcount:1 mapcount:0 mapping:ffff88821b6f63c0 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea00027bbf88 ffffea0002105b88 ffff88821b6f63c0 raw: 0000000000000000 ffff888085a3c080 000000010000000c 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888085a3ca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888085a3cb00: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc >ffff888085a3cb80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff888085a3cc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888085a3cc80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2019/06/01 18:13 | bpf-next | 0462eaacee49 | 53c81ea5 | .config | console log | report | syz | C | ci-upstream-bpf-next-kasan-gce | |||
2019/06/20 03:54 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/20 02:54 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/20 01:51 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/20 00:37 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 18:32 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 18:32 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 15:06 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 13:39 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 11:47 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 09:33 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 07:58 | bpf-next | 94079b64255f | 34bf9440 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 04:06 | bpf-next | 4d18f6de6ac1 | e3f76baa | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 03:05 | bpf-next | 4d18f6de6ac1 | e3f76baa | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/19 00:24 | bpf-next | 4d18f6de6ac1 | e3f76baa | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 22:12 | bpf-next | 4d18f6de6ac1 | e3f76baa | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 21:10 | bpf-next | 4d18f6de6ac1 | e3f76baa | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 20:41 | bpf-next | 4d18f6de6ac1 | e3f76baa | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 18:38 | bpf-next | 4d18f6de6ac1 | e3f76baa | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 17:26 | bpf-next | 4d18f6de6ac1 | e3f76baa | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 10:09 | bpf-next | 32b88d374357 | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 08:40 | bpf-next | 32b88d374357 | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 07:25 | bpf-next | 32b88d374357 | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 05:49 | bpf-next | 32b88d374357 | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 04:01 | bpf-next | 32b88d374357 | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/18 02:19 | bpf-next | 32b88d374357 | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 22:27 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 21:13 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 20:12 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 19:21 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 17:12 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 15:12 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 14:04 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 11:53 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 07:56 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/17 03:01 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/16 23:01 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/16 20:04 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/16 16:31 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/16 13:45 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/16 12:28 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/16 10:02 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/16 05:52 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/16 03:39 | bpf-next | 7f94208c8f9a | 442206d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2019/06/01 15:46 | bpf-next | 0462eaacee49 | 53c81ea5 | .config | console log | report | ci-upstream-bpf-next-kasan-gce |