syzbot


KFENCE: memory corruption in ctrl_dumppolicy_done

Status: closed as invalid on 2024/11/22 15:03
Subsystems: net
[Documentation on labels]
First crash: 83d, last: 79d

Sample crash report:
==================================================================
BUG: KFENCE: memory corruption in ctrl_dumppolicy_done+0x5f/0x70 net/netlink/genetlink.c:1767

Corrupted memory at 0xffff88823bf60290 [ 0x00 0x64 0x13 0x8d 0xff 0xff 0xff 0xff 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00 ] (in kfence-#175):
 ctrl_dumppolicy_done+0x5f/0x70 net/netlink/genetlink.c:1767
 genl_done+0x136/0x210 net/netlink/genetlink.c:1043
 netlink_sock_destruct+0x82/0x270 net/netlink/af_netlink.c:400
 __sk_destruct+0x58/0x5f0 net/core/sock.c:2259
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

kfence-#175: 0xffff88823bf60000-0xffff88823bf6028f, size=656, cache=kmalloc-1k

allocated by task 12360 on cpu 1 at 935.679633s (0.216966s ago):
 __do_krealloc mm/slub.c:4784 [inline]
 krealloc_noprof+0xd6/0x2e0 mm/slub.c:4838
 add_policy net/netlink/policy.c:50 [inline]
 netlink_policy_dump_add_policy+0x2a2/0x980 net/netlink/policy.c:146
 ctrl_dumppolicy_start+0x6d6/0xca0 net/netlink/genetlink.c:1607
 genl_start+0x4d6/0x6d0 net/netlink/genetlink.c:1005
 __netlink_dump_start+0x45c/0x790 net/netlink/af_netlink.c:2431
 genl_family_rcv_msg_dumpit net/netlink/genetlink.c:1076 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
 genl_rcv_msg+0x88c/0xec0 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
 netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357
 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:729 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:744
 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2602
 ___sys_sendmsg net/socket.c:2656 [inline]
 __sys_sendmsg+0x292/0x380 net/socket.c:2685
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

freed by task 9 on cpu 0 at 935.805572s (0.174182s ago):
 ctrl_dumppolicy_done+0x5f/0x70 net/netlink/genetlink.c:1767
 genl_done+0x136/0x210 net/netlink/genetlink.c:1043
 netlink_sock_destruct+0x82/0x270 net/netlink/af_netlink.c:400
 __sk_destruct+0x58/0x5f0 net/core/sock.c:2259
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.12.0-rc1-next-20241003-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events netlink_sock_destruct_work
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/08 06:53 linux-next c02d24a5af66 402f1df0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KFENCE: memory corruption in ctrl_dumppolicy_done
2024/10/03 19:53 linux-next c02d24a5af66 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KFENCE: memory corruption in ctrl_dumppolicy_done
* Struck through repros no longer work on HEAD.