syzbot

 sign-in | mailing list | source | docs
🐞 Open [978] ≡ Subsystems 🐞 Fixed [5235] 🐞 Invalid [12492] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: use-after-free in cryptd_hash_init

Status: auto-closed as invalid on 2020/04/10 14:48
Subsystems: crypto
[Documentation on labels]
First crash: 1569d, last: 1534d

Sample crash report:
=====================================================
BUG: KMSAN: use-after-free in __read_once_size include/linux/compiler.h:206 [inline]
BUG: KMSAN: use-after-free in arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline]
BUG: KMSAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
BUG: KMSAN: use-after-free in refcount_read include/linux/refcount.h:134 [inline]
BUG: KMSAN: use-after-free in cryptd_hash_complete crypto/cryptd.c:524 [inline]
BUG: KMSAN: use-after-free in cryptd_hash_init+0x431/0x4f0 crypto/cryptd.c:552
CPU: 0 PID: 28445 Comm: kworker/0:31 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: cryptd cryptd_queue_worker
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 __read_once_size include/linux/compiler.h:206 [inline]
 arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline]
 atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
 refcount_read include/linux/refcount.h:134 [inline]
 cryptd_hash_complete crypto/cryptd.c:524 [inline]
 cryptd_hash_init+0x431/0x4f0 crypto/cryptd.c:552
 cryptd_queue_worker+0x174/0x2e0 crypto/cryptd.c:180
 process_one_work+0x1552/0x1ef0 kernel/workqueue.c:2264
 worker_thread+0xef6/0x2450 kernel/workqueue.c:2410
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:353

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
 kmsan_slab_free+0x6e/0xb0 mm/kmsan/kmsan_hooks.c:107
 slab_free_freelist_hook mm/slub.c:1458 [inline]
 slab_free mm/slub.c:3021 [inline]
 kfree+0x565/0x30a0 mm/slub.c:3974
 skb_free_head net/core/skbuff.c:591 [inline]
 skb_release_data+0x7ea/0xa10 net/core/skbuff.c:611
 skb_release_all net/core/skbuff.c:665 [inline]
 __kfree_skb+0x90/0x240 net/core/skbuff.c:679
 consume_skb+0x2ae/0x320 net/core/skbuff.c:838
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:387 [inline]
 nsim_dev_trap_report_work+0xaed/0x1030 drivers/net/netdevsim/dev.c:412
 process_one_work+0x1552/0x1ef0 kernel/workqueue.c:2264
 worker_thread+0xef6/0x2450 kernel/workqueue.c:2410
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:353
=====================================================

Crashes (183):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/10 14:40 https://github.com/google/kmsan.git master 686a4f77cb0c 18847f55 .config console log report ci-upstream-kmsan-gce
2020/02/09 23:01 https://github.com/google/kmsan.git master 686a4f77cb0c 35f5e45e .config console log report ci-upstream-kmsan-gce
2020/02/09 21:45 https://github.com/google/kmsan.git master 686a4f77cb0c 35f5e45e .config console log report ci-upstream-kmsan-gce
2020/02/09 09:58 https://github.com/google/kmsan.git master 686a4f77cb0c 6ece2ea5 .config console log report ci-upstream-kmsan-gce
2020/02/09 08:55 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/09 06:58 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/09 05:55 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/09 04:37 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/09 03:17 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/09 02:10 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/08 21:03 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/08 18:30 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/08 16:04 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/08 06:17 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/08 02:15 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/07 23:56 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/07 20:26 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/07 15:45 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/07 12:54 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/07 09:16 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/07 02:17 https://github.com/google/kmsan.git master 686a4f77cb0c 06150bf1 .config console log report ci-upstream-kmsan-gce
2020/02/06 14:18 https://github.com/google/kmsan.git master 686a4f77cb0c c91cbc9d .config console log report ci-upstream-kmsan-gce
2020/02/06 06:01 https://github.com/google/kmsan.git master 686a4f77cb0c 662cf49a .config console log report ci-upstream-kmsan-gce
2020/02/05 14:59 https://github.com/google/kmsan.git master 686a4f77cb0c 662cf49a .config console log report ci-upstream-kmsan-gce
2020/02/05 11:46 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/05 10:31 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/05 07:09 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/05 05:07 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 22:09 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 21:51 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 20:10 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 17:53 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 14:06 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 12:09 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 09:51 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 07:13 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 04:50 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/04 00:35 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/03 16:32 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/03 11:04 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/03 03:38 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/03 01:20 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/02/02 14:00 https://github.com/google/kmsan.git master 686a4f77cb0c 93e5e335 .config console log report ci-upstream-kmsan-gce
2020/01/06 00:56 https://github.com/google/kmsan.git master 997a8b55bc92 438e1227 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.