syzbot


KASAN: null-ptr-deref Write in dst_release (5)

Status: closed as invalid on 2025/01/28 16:15
Subsystems: net
[Documentation on labels]
First crash: 20d, last: 20d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in dst_release (4) net 23 113d 300d 28/28 fixed on 2024/11/29 14:58
upstream KASAN: null-ptr-deref Write in dst_release (2) net syz error 148 1145d 1395d 0/28 closed as invalid on 2021/12/14 20:12
upstream KASAN: null-ptr-deref Write in dst_release net 27 2052d 2214d 0/28 auto-closed as invalid on 2019/10/25 08:50
upstream KASAN: null-ptr-deref Write in dst_release (3) net 2 1140d 1140d 20/28 fixed on 2022/03/08 16:11

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_add_negative_release include/linux/atomic/atomic-instrumented.h:1457 [inline]
BUG: KASAN: null-ptr-deref in __rcuref_put include/linux/rcuref.h:87 [inline]
BUG: KASAN: null-ptr-deref in rcuref_put include/linux/rcuref.h:150 [inline]
BUG: KASAN: null-ptr-deref in dst_release+0x4e/0x270 net/core/dst.c:167
Write of size 4 at addr 0000000000000060 by task kworker/u8:21/6310

CPU: 1 UID: 0 PID: 6310 Comm: kworker/u8:21 Not tainted 6.13.0-rc6-syzkaller-00051-geea6e4b4dfb8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xd9/0x110 mm/kasan/report.c:602
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_add_negative_release include/linux/atomic/atomic-instrumented.h:1457 [inline]
 __rcuref_put include/linux/rcuref.h:87 [inline]
 rcuref_put include/linux/rcuref.h:150 [inline]
 dst_release+0x4e/0x270 net/core/dst.c:167
 dst_cache_destroy net/core/dst_cache.c:163 [inline]
 dst_cache_destroy+0x119/0x270 net/core/dst_cache.c:155
 netdev_run_todo+0x760/0x12d0 net/core/dev.c:10919
 cleanup_net+0x591/0xbd0 net/core/net_namespace.c:644
 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/09 21:17 upstream eea6e4b4dfb8 9220929f .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: null-ptr-deref Write in dst_release
* Struck through repros no longer work on HEAD.