syzbot |
sign-in | mailing list | source | docs |
🐞 Open [979] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12499] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes | 💬 Send us feedback |
================================================================== BUG: KASAN: use-after-free in rawv6_send_hdrinc net/ipv6/raw.c:692 [inline] BUG: KASAN: use-after-free in rawv6_sendmsg+0x4421/0x4630 net/ipv6/raw.c:921 Read of size 8 at addr ffff8801c1310c70 by task syz-executor645/20842 CPU: 1 PID: 20842 Comm: syz-executor645 Not tainted 4.19.0-rc3+ #231 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 rawv6_send_hdrinc net/ipv6/raw.c:692 [inline] rawv6_sendmsg+0x4421/0x4630 net/ipv6/raw.c:921 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:631 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2114 __sys_sendmsg+0x11d/0x280 net/socket.c:2152 __do_sys_sendmsg net/socket.c:2161 [inline] __se_sys_sendmsg net/socket.c:2159 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x443759 Code: e8 bc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 02 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffebd1ec3d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443759 RDX: 0000000000000000 RSI: 0000000020003840 RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000000000a0a R09: 0000000000000a0a R10: 0000000000000004 R11: 0000000000000246 R12: 000000000000091d R13: 00000000000f8d82 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 20842: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490 kmem_cache_alloc+0x12e/0x730 mm/slab.c:3554 dst_alloc+0xbb/0x1d0 net/core/dst.c:105 ip6_dst_alloc+0x35/0xa0 net/ipv6/route.c:353 ip6_rt_cache_alloc+0x247/0x7b0 net/ipv6/route.c:1186 ip6_pol_route+0x8f8/0xd90 net/ipv6/route.c:1895 ip6_pol_route_output+0x54/0x70 net/ipv6/route.c:2093 fib6_rule_lookup+0x13a/0x860 net/ipv6/fib6_rules.c:118 ip6_route_output_flags+0x2c5/0x350 net/ipv6/route.c:2121 ip6_route_output include/net/ip6_route.h:88 [inline] ip6_dst_lookup_tail+0xe27/0x1d60 net/ipv6/ip6_output.c:951 ip6_dst_lookup_flow+0xc8/0x270 net/ipv6/ip6_output.c:1079 rawv6_sendmsg+0x12d9/0x4630 net/ipv6/raw.c:905 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:631 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2114 __sys_sendmsg+0x11d/0x280 net/socket.c:2152 __do_sys_sendmsg net/socket.c:2161 [inline] __se_sys_sendmsg net/socket.c:2159 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 5357: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kmem_cache_free+0x83/0x290 mm/slab.c:3756 dst_destroy+0x267/0x3c0 net/core/dst.c:141 dst_destroy_rcu+0x16/0x19 net/core/dst.c:154 __rcu_reclaim kernel/rcu/rcu.h:236 [inline] rcu_do_batch kernel/rcu/tree.c:2576 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2847 [inline] rcu_process_callbacks+0xf23/0x2670 kernel/rcu/tree.c:2864 __do_softirq+0x30b/0xad8 kernel/softirq.c:292 The buggy address belongs to the object at ffff8801c1310bc0 which belongs to the cache ip6_dst_cache of size 240 The buggy address is located 176 bytes inside of 240-byte region [ffff8801c1310bc0, ffff8801c1310cb0) The buggy address belongs to the page: page:ffffea000704c400 count:1 mapcount:0 mapping:ffff8801cb5d21c0 index:0x0 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffffea000716c988 ffffea0007020508 ffff8801cb5d21c0 raw: 0000000000000000 ffff8801c1310080 000000010000000c 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801c1310b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ffff8801c1310b80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >ffff8801c1310c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801c1310c80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc ffff8801c1310d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2018/09/11 00:37 | upstream | 11da3a7f84f1 | f167cb6b | .config | console log | report | syz | C | ci-upstream-kasan-gce-root | |||
2018/09/08 19:00 | bpf-next | f6f3bac08ff9 | 6b5120a4 | .config | console log | report | syz | C | ci-upstream-bpf-next-kasan-gce | |||
2018/10/04 10:41 | upstream | cec4de302c5f | 8b311eaf | .config | console log | report | syz | ci-upstream-kasan-gce-smack-root | ||||
2018/10/04 10:40 | upstream | cec4de302c5f | 8b311eaf | .config | console log | report | syz | ci-upstream-kasan-gce-root | ||||
2018/09/28 02:15 | upstream | c127e59bee3e | 0c2fa87b | .config | console log | report | syz | ci-upstream-kasan-gce | ||||
2018/09/28 02:12 | upstream | c127e59bee3e | 0c2fa87b | .config | console log | report | syz | ci-upstream-kasan-gce-smack-root | ||||
2018/09/08 19:30 | bpf | 28619527b8a7 | 6b5120a4 | .config | console log | report | syz | ci-upstream-bpf-kasan-gce | ||||
2018/10/04 10:57 | linux-next | 25bcda3e8b9f | 8b311eaf | .config | console log | report | syz | ci-upstream-linux-next-kasan-gce-root | ||||
2018/10/06 09:31 | upstream | 091a1eaa0e30 | 8b311eaf | .config | console log | report | ci-upstream-kasan-gce | |||||
2018/10/03 06:44 | upstream | 1d2ba7fee28b | 0f3e0261 | .config | console log | report | ci-upstream-kasan-gce-selinux-root | |||||
2018/10/02 13:40 | upstream | 385afbf8c3e8 | e06f7713 | .config | console log | report | ci-upstream-kasan-gce-root | |||||
2018/10/01 14:47 | upstream | 17b57b1883c1 | 48a50c6b | .config | console log | report | ci-upstream-kasan-gce | |||||
2018/10/01 00:12 | upstream | 17b57b1883c1 | 41e4b329 | .config | console log | report | ci-upstream-kasan-gce | |||||
2018/09/30 16:26 | upstream | 291d0e5d81e1 | 41e4b329 | .config | console log | report | ci-upstream-kasan-gce | |||||
2018/09/30 03:41 | upstream | 82ec752cce8b | 41e4b329 | .config | console log | report | ci-upstream-kasan-gce-root | |||||
2018/09/25 11:22 | upstream | 2dd68cc7fd8c | 0e7547d7 | .config | console log | report | ci-upstream-kasan-gce-selinux-root | |||||
2018/09/23 06:19 | upstream | 10dc890d4228 | 37079712 | .config | console log | report | ci-upstream-kasan-gce-selinux-root | |||||
2018/09/21 05:04 | upstream | ae596de1a0c8 | 6cee973c | .config | console log | report | ci-upstream-kasan-gce-root | |||||
2018/09/09 22:25 | upstream | 9a5682765a2e | 6b5120a4 | .config | console log | report | ci-upstream-kasan-gce-smack-root | |||||
2018/09/22 17:03 | upstream | 10dc890d4228 | 37079712 | .config | console log | report | ci-upstream-kasan-gce-386 | |||||
2018/09/22 10:44 | upstream | 10dc890d4228 | 37079712 | .config | console log | report | ci-upstream-kasan-gce-386 | |||||
2018/10/07 22:04 | bpf | b799207e1e18 | 8b311eaf | .config | console log | report | ci-upstream-bpf-kasan-gce | |||||
2018/10/05 16:06 | net-old | 9d2f67e43b73 | 8b311eaf | .config | console log | report | ci-upstream-net-this-kasan-gce | |||||
2018/09/30 00:13 | net-old | 43955a45dc0b | 41e4b329 | .config | console log | report | ci-upstream-net-this-kasan-gce | |||||
2018/09/26 08:12 | bpf | f4a518797b40 | b7e11289 | .config | console log | report | ci-upstream-bpf-kasan-gce | |||||
2018/09/25 05:32 | bpf | fad0c40fab14 | 0e7547d7 | .config | console log | report | ci-upstream-bpf-kasan-gce | |||||
2018/09/24 15:00 | bpf | fad0c40fab14 | 2f485cdf | .config | console log | report | ci-upstream-bpf-kasan-gce | |||||
2018/09/22 21:24 | net-old | 8ac1ee6f4d62 | 37079712 | .config | console log | report | ci-upstream-net-this-kasan-gce | |||||
2018/09/21 06:47 | bpf | 080220b68714 | 37079712 | .config | console log | report | ci-upstream-bpf-kasan-gce | |||||
2018/10/10 02:19 | bpf-next | df3f94a0bbeb | 8b311eaf | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/10/08 14:07 | bpf-next | a2046de99193 | 8b311eaf | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/10/07 19:53 | bpf-next | df1ea77bc51d | 8b311eaf | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/10/06 19:25 | bpf-next | df1ea77bc51d | 8b311eaf | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/10/04 08:44 | net-next-old | 7bdaae270cb5 | 8b311eaf | .config | console log | report | ci-upstream-net-kasan-gce | |||||
2018/10/03 19:12 | bpf-next | 33d9a7fd6756 | 8b311eaf | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/10/03 16:05 | bpf-next | 33d9a7fd6756 | 8b311eaf | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/10/03 14:56 | bpf-next | 33d9a7fd6756 | 8b311eaf | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/10/02 00:16 | net-next-old | 3bd09b05b068 | e06f7713 | .config | console log | report | ci-upstream-net-kasan-gce | |||||
2018/10/01 09:07 | bpf-next | 5bf7a60b8e70 | 48a50c6b | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/09/30 13:47 | bpf-next | 5bf7a60b8e70 | 41e4b329 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/09/29 03:22 | bpf-next | 5bf7a60b8e70 | 41e4b329 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/09/26 11:15 | bpf-next | d0e13a1488ad | 455b6354 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/09/25 20:47 | net-next-old | edad8d260e25 | b7e11289 | .config | console log | report | ci-upstream-net-kasan-gce | |||||
2018/09/25 14:06 | bpf-next | 788758d1fe87 | 0e7547d7 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/09/24 11:00 | net-next-old | 12ba7e104552 | e029c3e0 | .config | console log | report | ci-upstream-net-kasan-gce | |||||
2018/09/22 11:31 | bpf-next | 788758d1fe87 | 37079712 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/09/22 01:49 | bpf-next | 788758d1fe87 | 37079712 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/09/08 03:03 | bpf-next | f6f3bac08ff9 | 6b5120a4 | .config | console log | report | ci-upstream-bpf-next-kasan-gce | |||||
2018/09/29 09:21 | linux-next | 4794a36bf08d | 41e4b329 | .config | console log | report | ci-upstream-linux-next-kasan-gce-root | |||||
2018/09/28 07:13 | linux-next | 4794a36bf08d | 0c2fa87b | .config | console log | report | ci-upstream-linux-next-kasan-gce-root | |||||
2018/09/25 03:05 | linux-next | dad486875956 | 0e7547d7 | .config | console log | report | ci-upstream-linux-next-kasan-gce-root | |||||
2018/09/24 02:35 | linux-next | 46c163a036b4 | 28d9ac76 | .config | console log | report | ci-upstream-linux-next-kasan-gce-root |