Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
linux-4.14 | KASAN: use-after-free Read in inet_twsk_purge (2) | 2 | 1286d | 1322d | 0/1 | auto-closed as invalid on 2021/07/30 01:43 |
syzbot |
sign-in | mailing list | source | docs |
================================================================== BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183 [inline] BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:27 [inline] BUG: KASAN: use-after-free in inet_twsk_purge+0x50e/0x570 net/ipv4/inet_timewait_sock.c:276 Read of size 4 at addr ffff88807ef38304 by task kworker/u4:8/16758 CPU: 0 PID: 16758 Comm: kworker/u4:8 Not tainted 4.14.157-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429 __read_once_size include/linux/compiler.h:183 [inline] atomic_read arch/x86/include/asm/atomic.h:27 [inline] inet_twsk_purge+0x50e/0x570 net/ipv4/inet_timewait_sock.c:276 dccp_v6_exit_batch+0x1a/0x20 net/dccp/ipv6.c:1113 ops_exit_list.isra.0+0xfc/0x150 net/core/net_namespace.c:145 cleanup_net+0x3ba/0x870 net/core/net_namespace.c:484 process_one_work+0x863/0x1600 kernel/workqueue.c:2114 worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248 kthread+0x319/0x430 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Allocated by task 8198: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x45/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:489 kmem_cache_alloc+0x12e/0x780 mm/slab.c:3552 kmem_cache_zalloc include/linux/slab.h:651 [inline] net_alloc net/core/net_namespace.c:362 [inline] copy_net_ns+0xfa/0x440 net/core/net_namespace.c:402 create_new_namespaces+0x37b/0x720 kernel/nsproxy.c:107 unshare_nsproxy_namespaces+0xab/0x1e0 kernel/nsproxy.c:206 SYSC_unshare kernel/fork.c:2406 [inline] SyS_unshare+0x2f3/0x7e0 kernel/fork.c:2356 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 22: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x45/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kmem_cache_free+0x83/0x2b0 mm/slab.c:3758 net_free net/core/net_namespace.c:378 [inline] net_drop_ns+0x6e/0x80 net/core/net_namespace.c:385 cleanup_net+0x4e9/0x870 net/core/net_namespace.c:502 process_one_work+0x863/0x1600 kernel/workqueue.c:2114 worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248 kthread+0x319/0x430 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 The buggy address belongs to the object at ffff88807ef38300 which belongs to the cache net_namespace of size 8832 The buggy address is located 4 bytes inside of 8832-byte region [ffff88807ef38300, ffff88807ef3a580) The buggy address belongs to the page: page:ffffea0001fbce00 count:1 mapcount:0 mapping:ffff88807ef38300 index:0x0 compound_mapcount: 0 flags: 0xfffe0000008100(slab|head) raw: 00fffe0000008100 ffff88807ef38300 0000000000000000 0000000100000001 raw: ffffea00016fca20 ffffea000292c520 ffff88821f8b5e00 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88807ef38200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807ef38280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88807ef38300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807ef38380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807ef38400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2019/12/02 12:08 | linux-4.14.y | fbc5fe7a54d0 | f879db37 | .config | console log | report | ci2-linux-4-14 | |||||
2019/11/18 23:56 | linux-4.14.y | 775d01b65b5d | d5696d51 | .config | console log | report | ci2-linux-4-14 | |||||
2019/08/25 03:40 | linux-4.14.y | 45f092f9e9cb | d21c5d9d | .config | console log | report | ci2-linux-4-14 |