syzbot

 sign-in | mailing list | source | docs
🐞 Open [985] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: slab-out-of-bounds Write in validate_chain

Status: fixed on 2019/08/27 17:15
Subsystems: mm hardening
[Documentation on labels]
Reported-by: syzbot+8893700724999566d6a9@syzkaller.appspotmail.com
Fix commit: 95fa145479fb bpf: sockmap/tls, close can race with map free
First crash: 1770d, last: 1755d
Cause bisection: introduced by (bisect log) :
commit e9db4ef6bf4ca9894bb324c76e01b8f1a16b2650
Author: John Fastabend <john.fastabend@gmail.com>
Date: Sat Jun 30 13:17:47 2018 +0000

  bpf: sockhash fix omitted bucket lock in sock_close

Crash: KASAN: use-after-free Write in bpf_tcp_close (log)
Repro: syz .config
  
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
Reminder: 36 open syzbot bugs in "net/bpf" subsystem 1 (1) 2019/07/03 06:01
KASAN: slab-out-of-bounds Write in validate_chain 2 (4) 2019/06/26 22:24
Reminder: 30 open syzbot bugs in "net/bpf" subsystem 1 (1) 2019/06/24 05:01

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in check_prev_add kernel/locking/lockdep.c:2298 [inline]
BUG: KASAN: slab-out-of-bounds in check_prevs_add kernel/locking/lockdep.c:2418 [inline]
BUG: KASAN: slab-out-of-bounds in validate_chain+0x1a35/0x84f0 kernel/locking/lockdep.c:2800
Write of size 8 at addr ffff88809024c630 by task syz-executor.2/9771

CPU: 1 PID: 9771 Comm: syz-executor.2 Not tainted 5.2.0-rc7+ #16
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

Allocated by task 2257001088:
------------[ cut here ]------------
kernel BUG at mm/slab.c:4178!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9771 Comm: syz-executor.2 Not tainted 5.2.0-rc7+ #16
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__check_heap_object+0xcb/0xd0 mm/slab.c:4202
Code: 4c 89 d1 4d 89 c8 e8 04 4c 07 00 5b 41 5e 5d c3 49 8b 73 58 41 0f b6 d0 48 c7 c7 a1 a9 5d 88 4c 89 d1 4d 89 c8 e8 a5 4c 07 00 <0f> 0b 0f 1f 00 55 48 89 e5 41 56 53 48 83 ff 10 74 4a 48 89 fb 48
RSP: 0018:ffff88809024b270 EFLAGS: 00010046
RAX: 0000000000000f70 RBX: 0000000000001180 RCX: 000000000000000c
RDX: 000000000000000c RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff88809024b280 R08: 0000000000000000 R09: ffffffff81b5c7fa
R10: ffff88809024b380 R11: ffff8880aa400dc0 R12: ffff88809024b382
R13: 0000000000000200 R14: ffff88809024a200 R15: ffff88809024b380
FS:  0000555555f4a940(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8aded608 CR3: 000000009201a000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace d2fa545f8754a02c ]---
RIP: 0010:__check_heap_object+0xcb/0xd0 mm/slab.c:4202
Code: 4c 89 d1 4d 89 c8 e8 04 4c 07 00 5b 41 5e 5d c3 49 8b 73 58 41 0f b6 d0 48 c7 c7 a1 a9 5d 88 4c 89 d1 4d 89 c8 e8 a5 4c 07 00 <0f> 0b 0f 1f 00 55 48 89 e5 41 56 53 48 83 ff 10 74 4a 48 89 fb 48
RSP: 0018:ffff88809024b270 EFLAGS: 00010046
RAX: 0000000000000f70 RBX: 0000000000001180 RCX: 000000000000000c
RDX: 000000000000000c RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff88809024b280 R08: 0000000000000000 R09: ffffffff81b5c7fa
R10: ffff88809024b380 R11: ffff8880aa400dc0 R12: ffff88809024b382
R13: 0000000000000200 R14: ffff88809024a200 R15: ffff88809024b380
FS:  0000555555f4a940(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8aded608 CR3: 000000009201a000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/06 17:07 upstream 69bf4b6b54fb f62e1e85 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/07/01 10:41 upstream 6fbc7275c7a9 699d6448 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/06/26 06:29 upstream 249155c20f9b 0a8d1a96 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/06/25 15:44 upstream 4b972a01a7da 82c13b6b .config console log report syz ci-upstream-kasan-gce-smack-root
2019/06/24 18:28 upstream 241e39004581 472f0082 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/06/21 12:15 upstream abf02e2964b3 34bf9440 .config console log report syz ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.