Title | Replies (including bot) | Last reply |
---|---|---|
KASAN: invalid-access Write in enqueue_timer | 6 (7) | 2021/02/17 06:37 |
syzbot |
sign-in | mailing list | source | docs |
Title | Replies (including bot) | Last reply |
---|---|---|
KASAN: invalid-access Write in enqueue_timer | 6 (7) | 2021/02/17 06:37 |
Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
upstream | KASAN: slab-use-after-free Write in enqueue_timer net | 18 | 577d | 592d | 0/28 | auto-obsoleted due to no activity on 2023/08/22 15:17 | |||
android-54 | KASAN: use-after-free Write in enqueue_timer | C | 4288 | 162d | 669d | 0/2 | auto-obsoleted due to no activity on 2024/09/11 16:22 | ||
upstream | KASAN: use-after-free Write in enqueue_timer net | 1 | 759d | 759d | 22/28 | fixed on 2023/02/24 13:50 | |||
android-5-15 | KASAN: use-after-free Write in enqueue_timer | 1 | 329d | 329d | 0/2 | auto-obsoleted due to no activity on 2024/04/17 12:01 | |||
android-6-1 | KASAN: use-after-free Write in enqueue_timer origin:lts | C | 36 | 3d20h | 140d | 0/2 | upstream: reported C repro on 2024/07/25 13:16 |
================================================================== BUG: KASAN: invalid-access in hlist_add_head include/linux/list.h:883 [inline] BUG: KASAN: invalid-access in enqueue_timer+0x18/0xc0 kernel/time/timer.c:581 Write at addr f3ff0000289f7378 by task kworker/0:2/17733 Pointer tag: [f3], memory tag: [f5] CPU: 0 PID: 17733 Comm: kworker/0:2 Not tainted 5.12.0-rc2-syzkaller-00059-g144c79ef3353 #0 Hardware name: linux,dummy-virt (DT) Workqueue: events flush_stashed_error_work Call trace: dump_backtrace+0x0/0x1b0 arch/arm64/kernel/stacktrace.c:112 show_stack+0x18/0x70 arch/arm64/kernel/stacktrace.c:191 __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0xd0/0x12c lib/dump_stack.c:120 print_address_description+0x70/0x29c mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report+0x134/0x380 mm/kasan/report.c:416 report_tag_fault arch/arm64/mm/fault.c:324 [inline] do_tag_recovery arch/arm64/mm/fault.c:336 [inline] __do_kernel_fault+0x1a8/0x1dc arch/arm64/mm/fault.c:378 do_bad_area arch/arm64/mm/fault.c:474 [inline] do_tag_check_fault+0x74/0x90 arch/arm64/mm/fault.c:729 do_mem_abort+0x44/0xbc arch/arm64/mm/fault.c:805 el1_abort+0x40/0x6c arch/arm64/kernel/entry-common.c:167 el1_sync_handler+0xac/0xd0 arch/arm64/kernel/entry-common.c:259 el1_sync+0x70/0x100 arch/arm64/kernel/entry.S:656 hlist_add_head include/linux/list.h:883 [inline] enqueue_timer+0x18/0xc0 kernel/time/timer.c:581 mod_timer+0x14/0x20 kernel/time/timer.c:1106 ext4_update_super+0x36c/0x3c0 fs/ext4/super.c:5544 ext4_commit_super+0x74/0x184 fs/ext4/super.c:5562 flush_stashed_error_work+0x30/0xa4 fs/ext4/super.c:727 process_one_work+0x1d8/0x364 kernel/workqueue.c:2275 worker_thread+0x70/0x434 kernel/workqueue.c:2421 kthread+0x174/0x180 kernel/kthread.c:292 ret_from_fork+0x10/0x34 arch/arm64/kernel/entry.S:958 Allocated by task 17760: stack_trace_save+0x50/0x80 kernel/stacktrace.c:121 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:427 [inline] ____kasan_kmalloc mm/kasan/common.c:506 [inline] ____kasan_kmalloc mm/kasan/common.c:465 [inline] __kasan_kmalloc+0xc8/0x100 mm/kasan/common.c:515 kasan_kmalloc include/linux/kasan.h:233 [inline] __kmalloc_node+0x1d8/0x3dc mm/slub.c:4103 kmalloc_node include/linux/slab.h:577 [inline] kvmalloc_node+0x40/0xe0 mm/util.c:587 kvmalloc include/linux/mm.h:785 [inline] kvmalloc_array include/linux/mm.h:803 [inline] alloc_fdtable+0xb0/0x150 fs/file.c:120 dup_fd+0x240/0x320 fs/file.c:325 copy_files kernel/fork.c:1466 [inline] copy_process+0x5f8/0x1500 kernel/fork.c:2087 kernel_clone+0x5c/0x3c0 kernel/fork.c:2492 __do_sys_clone+0x54/0x80 kernel/fork.c:2609 __se_sys_clone kernel/fork.c:2577 [inline] __arm64_sys_clone+0x24/0x30 kernel/fork.c:2577 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.0+0x60/0x120 arch/arm64/kernel/syscall.c:129 do_el0_svc+0x74/0x90 arch/arm64/kernel/syscall.c:168 el0_svc+0x2c/0x54 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432 el0_sync+0x18c/0x1c0 arch/arm64/kernel/entry.S:699 Freed by task 548: stack_trace_save+0x50/0x80 kernel/stacktrace.c:121 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38 kasan_set_track+0x28/0x40 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/hw_tags.c:174 ____kasan_slab_free.constprop.0+0x1e0/0x230 mm/kasan/common.c:360 __kasan_slab_free+0x10/0x1c mm/kasan/common.c:367 kasan_slab_free include/linux/kasan.h:199 [inline] slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0xbc/0x210 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kfree+0x348/0x4d0 mm/slub.c:4213 sk_prot_free net/core/sock.c:1739 [inline] __sk_destruct+0x1dc/0x220 net/core/sock.c:1824 sk_destruct net/core/sock.c:1839 [inline] __sk_free+0x78/0x114 net/core/sock.c:1850 sk_free+0x5c/0x80 net/core/sock.c:1861 sock_put include/net/sock.h:1803 [inline] packet_release+0x374/0x464 net/packet/af_packet.c:3106 __sock_release+0x44/0xbc net/socket.c:599 sock_close+0x18/0x30 net/socket.c:1258 __fput+0x78/0x230 fs/file_table.c:280 ____fput+0x10/0x20 fs/file_table.c:313 task_work_run+0x80/0x160 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939 work_pending+0xc/0x3d4 The buggy address belongs to the object at ffff0000289f7000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 888 bytes inside of 2048-byte region [ffff0000289f7000, ffff0000289f7800) The buggy address belongs to the page: page:00000000e7fca950 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x689f0 head:00000000e7fca950 order:3 compound_mapcount:0 compound_pincount:0 memcg:f6ff0000283f8501 flags: 0x1ffffc000010200(slab|head) raw: 01ffffc000010200 fffffc0000a02c00 0000000200000002 f7ff000004401600 raw: 0000000000000000 0000000000080008 00000001ffffffff f6ff0000283f8501 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000289f7100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 ffff0000289f7200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 >ffff0000289f7300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 ^ ffff0000289f7400: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 ffff0000289f7500: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2021/03/10 00:47 | upstream | 144c79ef3353 | 26967e35 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/03/05 14:48 | upstream | 280d542f6ffa | 9d751681 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/03/04 08:21 | upstream | f69d02e37a85 | d7e4e604 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/03/03 10:07 | upstream | f69d02e37a85 | e5b64d68 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/03/03 02:36 | upstream | 7a7fd0de4a98 | e5b64d68 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/03/02 15:54 | upstream | 7a7fd0de4a98 | 92ead296 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/03/01 05:38 | upstream | cd278456d4ca | 4c37c133 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/20 17:56 | upstream | f40ddce88593 | 053a2b26 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/19 02:32 | upstream | f40ddce88593 | 14052202 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/18 14:03 | upstream | f40ddce88593 | 14052202 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/18 07:56 | upstream | f40ddce88593 | 14052202 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/18 05:25 | upstream | f40ddce88593 | 14052202 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/17 06:02 | upstream | f40ddce88593 | 98682e5e | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/16 15:32 | upstream | f40ddce88593 | 98682e5e | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/16 10:17 | upstream | f40ddce88593 | 98682e5e | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/16 00:06 | upstream | f40ddce88593 | 98682e5e | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/15 09:18 | upstream | 28a173387388 | 98682e5e | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/02/08 03:31 | upstream | b75dba7f472c | 2ce644fc | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/01/30 08:17 | upstream | 0e9bcda5d286 | fc9fd31e | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer | |||
2021/01/28 14:51 | upstream | 76c057c84d28 | eefc07f2 | .config | console log | report | info | ci-qemu2-arm64-mte | KASAN: invalid-access Write in enqueue_timer |