syzbot


KASAN: use-after-free Read in pppol2tp_session_destruct

Status: closed as invalid on 2019/01/29 20:22
First crash: 2280d, last: 2055d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 KASAN: use-after-free Read in pppol2tp_session_destruct C 91 2073d 1829d 0/2 public: reported C repro on 2019/04/13 00:00

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
==================================================================
BUG: KASAN: use-after-free in pppol2tp_session_destruct+0xed/0x110 net/l2tp/l2tp_ppp.c:459
Read of size 4 at addr ffff8801b60a6000 by task syz-executor489/3812

CPU: 0 PID: 3812 Comm: syz-executor489 Not tainted 4.9.113-g47bbcd6 #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d93ffc30 ffffffff81eb32a9 ffffea0006d82980 ffff8801b60a6000
 0000000000000000 ffff8801b60a6000 ffffffff83013be0 ffff8801d93ffc68
 ffffffff81567bd9 ffff8801b60a6000 0000000000000004 0000000000000000
Call Trace:
 [<ffffffff81eb32a9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb32a9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81567bd9>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81567fe3>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81567fe3>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153bc14>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 [<ffffffff836c460d>] pppol2tp_session_destruct+0xed/0x110 net/l2tp/l2tp_ppp.c:459
 [<ffffffff83021095>] __sk_destruct+0x55/0x590 net/core/sock.c:1428
 [<ffffffff83028b23>] sk_destruct+0x63/0x80 net/core/sock.c:1463
 [<ffffffff83028b8f>] __sk_free+0x4f/0x220 net/core/sock.c:1471
 [<ffffffff83028d8b>] sk_free+0x2b/0x40 net/core/sock.c:1482
 [<ffffffff836c78f9>] sock_put include/net/sock.h:1588 [inline]
 [<ffffffff836c78f9>] pppol2tp_release+0x239/0x2e0 net/l2tp/l2tp_ppp.c:501
 [<ffffffff83013ab6>] sock_release+0x96/0x1c0 net/socket.c:599
 [<ffffffff83013bf6>] sock_close+0x16/0x20 net/socket.c:1046
 [<ffffffff815782e3>] __fput+0x263/0x700 fs/file_table.c:208
 [<ffffffff81578805>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8119838c>] task_work_run+0x10c/0x180 kernel/task_work.c:116
 [<ffffffff8100559c>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 [<ffffffff8100559c>] exit_to_usermode_loop+0xfc/0x120 arch/x86/entry/common.c:161
 [<ffffffff810064d4>] prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
 [<ffffffff810064d4>] syscall_return_slowpath arch/x86/entry/common.c:260 [inline]
 [<ffffffff810064d4>] do_syscall_64+0x364/0x490 arch/x86/entry/common.c:287
 [<ffffffff839f9f93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 3812:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 __kmalloc+0x11d/0x300 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 l2tp_session_create+0x38/0x16f0 net/l2tp/l2tp_core.c:1843
 pppol2tp_connect+0x10d7/0x18f0 net/l2tp/l2tp_ppp.c:718
 SYSC_connect+0x1b8/0x300 net/socket.c:1562
 SyS_connect+0x24/0x30 net/socket.c:1543
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 3810:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xfb/0x310 mm/slub.c:3878
 l2tp_session_free+0x166/0x200 net/l2tp/l2tp_core.c:1770
 l2tp_session_dec_refcount_1 net/l2tp/l2tp_core.h:297 [inline]
 l2tp_tunnel_closeall+0x284/0x350 net/l2tp/l2tp_core.c:1373
 l2tp_udp_encap_destroy+0x87/0xe0 net/l2tp/l2tp_core.c:1394
 udpv6_destroy_sock+0xb1/0xd0 net/ipv6/udp.c:1336
 sk_common_release+0x6d/0x300 net/core/sock.c:2727
 udp_lib_close+0x15/0x20 include/net/udp.h:203
 inet_release+0xff/0x1d0 net/ipv4/af_inet.c:434
 inet6_release+0x50/0x70 net/ipv6/af_inet6.c:440
 sock_release+0x96/0x1c0 net/socket.c:599
 sock_close+0x16/0x20 net/socket.c:1046
 __fput+0x263/0x700 fs/file_table.c:208
 ____fput+0x15/0x20 fs/file_table.c:244
 task_work_run+0x10c/0x180 kernel/task_work.c:116
 tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 exit_to_usermode_loop+0xfc/0x120 arch/x86/entry/common.c:161
 prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:260 [inline]
 do_syscall_64+0x364/0x490 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801b60a6000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
 512-byte region [ffff8801b60a6000, ffff8801b60a6200)
The buggy address belongs to the page:
page:ffffea0006d82980 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801b60a5f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801b60a5f80: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
>ffff8801b60a6000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8801b60a6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801b60a6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (480):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/21 08:10 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 8cc079c3 .config console log report syz C ci-android-49-kasan-gce-root
2018/06/30 10:59 https://android.googlesource.com/kernel/common android-4.9 00a0bcbfcfb6 dba0b50e .config console log report syz C ci-android-49-kasan-gce
2018/06/30 10:57 https://android.googlesource.com/kernel/common android-4.9 00a0bcbfcfb6 dba0b50e .config console log report syz C ci-android-49-kasan-gce-root
2018/04/16 08:09 https://android.googlesource.com/kernel/common android-4.9 8683408f8e81 7a67784c .config console log report syz C ci-android-49-kasan-gce
2018/03/24 02:45 https://android.googlesource.com/kernel/common android-4.9 ebc27895e954 2e9d9054 .config console log report syz C ci-android-49-kasan-gce
2018/03/15 14:05 https://android.googlesource.com/kernel/common android-4.9 3a3a0844ac38 08dacaa0 .config console log report syz C ci-android-49-kasan-gce
2018/02/24 00:28 https://android.googlesource.com/kernel/common android-4.9 72766d75b085 5c1e0207 .config console log report syz C ci-android-49-kasan-gce
2018/02/10 20:35 https://android.googlesource.com/kernel/common android-4.9 8a174b4749d3 e67d44e0 .config console log report syz C ci-android-49-kasan-gce
2018/02/05 00:27 https://android.googlesource.com/kernel/common android-4.9 b30d2b5deba5 a1bc9d40 .config console log report syz C ci-android-49-kasan-gce
2018/02/02 18:06 https://android.googlesource.com/kernel/common android-4.9 71f146972231 632a8c2c .config console log report syz C ci-android-49-kasan-gce
2018/01/31 02:34 https://android.googlesource.com/kernel/common android-4.9 7be198545491 02553e22 .config console log report syz C ci-android-49-kasan-gce
2018/01/29 10:56 https://android.googlesource.com/kernel/common android-4.9 68d447c0a37b 08d47756 .config console log report syz C ci-android-49-kasan-gce
2018/01/19 13:56 https://android.googlesource.com/kernel/common android-4.9 9c3804bc9b62 161c1d64 .config console log report syz C ci-android-49-kasan-gce
2018/01/19 09:10 https://android.googlesource.com/kernel/common android-4.9 9c3804bc9b62 161c1d64 .config console log report syz C ci-android-49-kasan-gce
2018/01/18 16:24 https://android.googlesource.com/kernel/common android-4.9 033d019ce29c 56cc113a .config console log report syz C ci-android-49-kasan-gce
2018/01/18 06:23 https://android.googlesource.com/kernel/common android-4.9 033d019ce29c b8970f31 .config console log report syz C ci-android-49-kasan-gce
2018/01/18 02:19 https://android.googlesource.com/kernel/common android-4.9 033d019ce29c b8970f31 .config console log report syz C ci-android-49-kasan-gce
2018/01/16 22:11 https://android.googlesource.com/kernel/common android-4.9 8dec074e888a a46e5318 .config console log report syz C ci-android-49-kasan-gce
2018/01/16 21:33 https://android.googlesource.com/kernel/common android-4.9 8dec074e888a a46e5318 .config console log report syz C ci-android-49-kasan-gce
2018/02/17 14:08 https://android.googlesource.com/kernel/common android-4.9 a25ea24f7b7d c8b3f7c1 .config console log report syz C ci-android-49-kasan-gce-386
2018/02/12 13:59 https://android.googlesource.com/kernel/common android-4.9 8a174b4749d3 88bc17df .config console log report syz C ci-android-49-kasan-gce-386
2018/01/30 12:10 https://android.googlesource.com/kernel/common android-4.9 7be198545491 08d47756 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/29 10:57 https://android.googlesource.com/kernel/common android-4.9 68d447c0a37b 08d47756 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/22 13:56 https://android.googlesource.com/kernel/common android-4.9 e12a9c4458ff 228e3d95 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/21 10:27 https://android.googlesource.com/kernel/common android-4.9 e12a9c4458ff fbbdcd92 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/21 09:34 https://android.googlesource.com/kernel/common android-4.9 e12a9c4458ff fbbdcd92 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/21 07:50 https://android.googlesource.com/kernel/common android-4.9 e12a9c4458ff fbbdcd92 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/20 21:35 https://android.googlesource.com/kernel/common android-4.9 e12a9c4458ff fbbdcd92 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/20 07:48 https://android.googlesource.com/kernel/common android-4.9 e12a9c4458ff fbbdcd92 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/20 06:41 https://android.googlesource.com/kernel/common android-4.9 e12a9c4458ff fbbdcd92 .config console log report syz C ci-android-49-kasan-gce-386
2018/01/18 06:08 https://android.googlesource.com/kernel/common android-4.9 033d019ce29c b8970f31 .config console log report syz C ci-android-49-kasan-gce-386
2018/08/22 23:58 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report syz ci-android-49-kasan-gce
2018/08/22 14:51 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report syz ci-android-49-kasan-gce-386
2018/07/20 23:28 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 af255b09 .config console log report syz ci-android-49-kasan-gce-386
2018/07/12 08:47 https://android.googlesource.com/kernel/common android-4.9 9e7903954483 2e0e3130 .config console log report syz ci-android-49-kasan-gce-386
2018/06/30 12:04 https://android.googlesource.com/kernel/common android-4.9 00a0bcbfcfb6 dba0b50e .config console log report syz ci-android-49-kasan-gce-386
2018/04/16 08:25 https://android.googlesource.com/kernel/common android-4.9 8683408f8e81 7a67784c .config console log report syz ci-android-49-kasan-gce-386
2018/03/24 02:44 https://android.googlesource.com/kernel/common android-4.9 ebc27895e954 2e9d9054 .config console log report syz ci-android-49-kasan-gce-386
2018/03/15 13:44 https://android.googlesource.com/kernel/common android-4.9 3a3a0844ac38 08dacaa0 .config console log report syz ci-android-49-kasan-gce-386
2018/02/28 13:45 https://android.googlesource.com/kernel/common android-4.9 e7f51a5b0be6 05b5a32c .config console log report syz ci-android-49-kasan-gce-386
2018/08/29 15:53 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 53ff8784 .config console log report ci-android-49-kasan-gce
2018/08/25 01:14 https://android.googlesource.com/kernel/common android-4.9 6a1b5923548a 9b0f5c75 .config console log report ci-android-49-kasan-gce
2018/08/22 01:40 https://android.googlesource.com/kernel/common android-4.9 54068d61e7d8 95b5c82b .config console log report ci-android-49-kasan-gce
2018/08/13 03:55 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce
2018/08/10 15:25 https://android.googlesource.com/kernel/common android-4.9 92e87041ed2d 1fb62d58 .config console log report ci-android-49-kasan-gce
2018/08/10 00:17 https://android.googlesource.com/kernel/common android-4.9 92e87041ed2d 1fb62d58 .config console log report ci-android-49-kasan-gce-root
2018/08/07 20:32 https://android.googlesource.com/kernel/common android-4.9 47b77b8d01c4 1beb8136 .config console log report ci-android-49-kasan-gce
2018/08/05 02:00 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 3476a2df .config console log report ci-android-49-kasan-gce
2018/08/04 13:44 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c df7f6947 .config console log report ci-android-49-kasan-gce
2018/08/03 20:27 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c cc4f6d0a .config console log report ci-android-49-kasan-gce
2018/07/30 14:21 https://android.googlesource.com/kernel/common android-4.9 990559158c7b 1a381291 .config console log report ci-android-49-kasan-gce
2018/07/23 03:42 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 8cc079c3 .config console log report ci-android-49-kasan-gce
2018/07/22 04:45 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 8cc079c3 .config console log report ci-android-49-kasan-gce
2018/07/21 19:50 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 8cc079c3 .config console log report ci-android-49-kasan-gce
2018/07/19 16:48 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 49f35839 .config console log report ci-android-49-kasan-gce-root
2018/07/16 05:42 https://android.googlesource.com/kernel/common android-4.9 9e7903954483 92a49505 .config console log report ci-android-49-kasan-gce
2018/07/04 17:05 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 317fc8ea .config console log report ci-android-49-kasan-gce
2018/07/03 00:36 https://android.googlesource.com/kernel/common android-4.9 00a0bcbfcfb6 574780b0 .config console log report ci-android-49-kasan-gce
2018/07/01 04:50 https://android.googlesource.com/kernel/common android-4.9 00a0bcbfcfb6 dba0b50e .config console log report ci-android-49-kasan-gce
2018/06/28 11:17 https://android.googlesource.com/kernel/common android-4.9 00a0bcbfcfb6 dba0b50e .config console log report ci-android-49-kasan-gce
2018/06/26 10:29 https://android.googlesource.com/kernel/common android-4.9 7143cbff9ce1 2064fc5c .config console log report ci-android-49-kasan-gce
2018/06/21 07:16 https://android.googlesource.com/kernel/common android-4.9 e1815b3eba5b 095ef806 .config console log report ci-android-49-kasan-gce
2018/06/16 09:49 https://android.googlesource.com/kernel/common android-4.9 b7d377b4640b 27c5f59f .config console log report ci-android-49-kasan-gce
2018/06/14 09:17 https://android.googlesource.com/kernel/common android-4.9 b7d377b4640b 27c5f59f .config console log report ci-android-49-kasan-gce
2018/06/09 23:23 https://android.googlesource.com/kernel/common android-4.9 db2c520bb56b 866118af .config console log report ci-android-49-kasan-gce-root
2018/06/07 12:29 https://android.googlesource.com/kernel/common android-4.9 42a730adb6e2 8b06421c .config console log report ci-android-49-kasan-gce
2018/06/06 09:12 https://android.googlesource.com/kernel/common android-4.9 8b94b87fe783 41f9540d .config console log report ci-android-49-kasan-gce
2018/06/01 21:18 https://android.googlesource.com/kernel/common android-4.9 d7e64f8022e4 2f93b54f .config console log report ci-android-49-kasan-gce
2018/06/01 00:40 https://android.googlesource.com/kernel/common android-4.9 a56900fabe12 2f93b54f .config console log report ci-android-49-kasan-gce
2018/05/31 09:36 https://android.googlesource.com/kernel/common android-4.9 0c296e3d878b 2f93b54f .config console log report ci-android-49-kasan-gce-root
2018/05/30 06:42 https://android.googlesource.com/kernel/common android-4.9 7fd40752c316 2f93b54f .config console log report ci-android-49-kasan-gce-root
2018/05/29 14:34 https://android.googlesource.com/kernel/common android-4.9 0cecdf831513 e276de77 .config console log report ci-android-49-kasan-gce
2018/05/29 07:06 https://android.googlesource.com/kernel/common android-4.9 0cecdf831513 f48c20b8 .config console log report ci-android-49-kasan-gce
2018/08/21 08:38 https://android.googlesource.com/kernel/common android-4.9 54068d61e7d8 95b5c82b .config console log report ci-android-49-kasan-gce-386
2018/08/13 08:50 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/11 11:06 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 7a88b141 .config console log report ci-android-49-kasan-gce-386
2018/08/10 07:45 https://android.googlesource.com/kernel/common android-4.9 92e87041ed2d 1fb62d58 .config console log report ci-android-49-kasan-gce-386
2018/08/09 02:05 https://android.googlesource.com/kernel/common android-4.9 856452b4f22e 2eeda842 .config console log report ci-android-49-kasan-gce-386
2018/08/05 07:25 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 3476a2df .config console log report ci-android-49-kasan-gce-386
2018/08/02 21:48 https://android.googlesource.com/kernel/common android-4.9 0137ea2134c0 5b7e23bb .config console log report ci-android-49-kasan-gce-386
2018/07/19 05:15 https://android.googlesource.com/kernel/common android-4.9 47bbcd6bf8f9 49f35839 .config console log report ci-android-49-kasan-gce-386
2018/07/07 15:52 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 ab89aea9 .config console log report ci-android-49-kasan-gce-386
2018/06/29 19:40 https://android.googlesource.com/kernel/common android-4.9 00a0bcbfcfb6 dba0b50e .config console log report ci-android-49-kasan-gce-386
2018/06/28 00:41 https://android.googlesource.com/kernel/common android-4.9 00a0bcbfcfb6 43e60f7e .config console log report ci-android-49-kasan-gce-386
2018/06/26 06:22 https://android.googlesource.com/kernel/common android-4.9 7143cbff9ce1 2064fc5c .config console log report ci-android-49-kasan-gce-386
2018/06/25 03:25 https://android.googlesource.com/kernel/common android-4.9 7cecc756ceae 2064fc5c .config console log report ci-android-49-kasan-gce-386
2018/06/09 20:11 https://android.googlesource.com/kernel/common android-4.9 db2c520bb56b 866118af .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.