syzbot |
sign-in | mailing list | source | docs |
🐞 Open [1168] ≡ Subsystems 🐞 Fixed [4404] 🐞 Invalid [9907] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes | 💬 Send us feedback |
Created | Duration | User | Patch | Repo | Result |
---|---|---|---|---|---|
2022/12/01 07:30 | 21m | retest repro | upstream | OK log | |
2022/12/01 05:30 | 21m | retest repro | upstream | OK log | |
2022/11/30 23:30 | 20m | retest repro | linux-next | error | |
2022/11/30 23:30 | 21m | retest repro | upstream | OK log | |
2022/11/30 23:30 | 19m | retest repro | upstream | OK log | |
2022/07/12 10:52 | 18m | hdanton@sina.com | patch | https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git cb71b93c2dc3 | OK log |
2022/07/11 11:11 | 10m | hdanton@sina.com | patch | https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git cb71b93c2dc3 | report log |
================================================================== BUG: KASAN: use-after-free in kill_fasync+0x45e/0x470 fs/fcntl.c:1014 Read of size 8 at addr ffff88807dc93168 by task kworker/0:2/144 CPU: 0 PID: 144 Comm: kworker/0:2 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Workqueue: events key_garbage_collector Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 kill_fasync+0x45e/0x470 fs/fcntl.c:1014 post_one_notification.isra.0+0x6e4/0x990 kernel/watch_queue.c:128 remove_watch_from_object+0x35a/0x9d0 kernel/watch_queue.c:527 remove_watch_list include/linux/watch_queue.h:115 [inline] key_gc_unused_keys.constprop.0+0x2e5/0x600 security/keys/gc.c:135 key_garbage_collector+0x3d7/0x920 security/keys/gc.c:297 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> Allocated by task 5494: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:733 [inline] alloc_pipe_info+0x105/0x590 fs/pipe.c:790 get_pipe_inode fs/pipe.c:881 [inline] create_pipe_files+0x8d/0x880 fs/pipe.c:913 __do_pipe_flags fs/pipe.c:962 [inline] do_pipe2+0x96/0x1b0 fs/pipe.c:1010 __do_sys_pipe2 fs/pipe.c:1028 [inline] __se_sys_pipe2 fs/pipe.c:1026 [inline] __x64_sys_pipe2+0x50/0x70 fs/pipe.c:1026 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 5494: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1754 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780 slab_free mm/slub.c:3534 [inline] kfree+0xe2/0x4d0 mm/slub.c:4562 put_pipe_info fs/pipe.c:711 [inline] pipe_release+0x2b6/0x310 fs/pipe.c:734 __fput+0x277/0x9d0 fs/file_table.c:317 task_work_run+0xdd/0x1a0 kernel/task_work.c:177 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaf1/0x29f0 kernel/exit.c:795 do_group_exit+0xd2/0x2f0 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff88807dc93000 which belongs to the cache kmalloc-cg-512 of size 512 The buggy address is located 360 bytes inside of 512-byte region [ffff88807dc93000, ffff88807dc93200) The buggy address belongs to the physical page: page:ffffea0001f72400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7dc90 head:ffffea0001f72400 order:2 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842dc0 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5470, tgid 5470 (syz-executor105), ts 76271246150, free_ts 76264094282 prep_new_page mm/page_alloc.c:2535 [inline] get_page_from_freelist+0x210d/0x3a30 mm/page_alloc.c:4282 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5506 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2280 alloc_slab_page mm/slub.c:1824 [inline] allocate_slab+0x27e/0x3d0 mm/slub.c:1969 new_slab mm/slub.c:2029 [inline] ___slab_alloc+0x89d/0xef0 mm/slub.c:3031 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118 slab_alloc_node mm/slub.c:3209 [inline] slab_alloc mm/slub.c:3251 [inline] kmem_cache_alloc_trace+0x323/0x3e0 mm/slub.c:3282 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:733 [inline] alloc_pipe_info+0x105/0x590 fs/pipe.c:790 get_pipe_inode fs/pipe.c:881 [inline] create_pipe_files+0x8d/0x880 fs/pipe.c:913 __do_pipe_flags fs/pipe.c:962 [inline] do_pipe2+0x96/0x1b0 fs/pipe.c:1010 __do_sys_pipe2 fs/pipe.c:1028 [inline] __se_sys_pipe2 fs/pipe.c:1026 [inline] __x64_sys_pipe2+0x50/0x70 fs/pipe.c:1026 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1453 [inline] free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1503 free_unref_page_prepare mm/page_alloc.c:3383 [inline] free_unref_page+0x19/0x4d0 mm/page_alloc.c:3479 __stack_depot_save+0x168/0x500 lib/stackdepot.c:489 kasan_save_stack+0x2e/0x40 mm/kasan/common.c:39 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524 kmalloc include/linux/slab.h:605 [inline] kzalloc include/linux/slab.h:733 [inline] kobject_get_path+0xbe/0x230 lib/kobject.c:147 kobject_uevent_env+0x254/0x1640 lib/kobject_uevent.c:529 call_crda+0x17e/0x3b0 net/wireless/reg.c:583 reg_query_database net/wireless/reg.c:1158 [inline] reg_process_hint_core net/wireless/reg.c:2693 [inline] reg_process_hint+0x925/0x1710 net/wireless/reg.c:3036 reg_process_pending_hints net/wireless/reg.c:3124 [inline] reg_todo+0x1a5/0x7d0 net/wireless/reg.c:3212 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 Memory state around the buggy address: ffff88807dc93000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807dc93080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807dc93100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807dc93180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807dc93200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================
Manager | Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
ci-upstream-linux-next-kasan-gce-root | 2022/07/08 06:08 | linux-next | cb71b93c2dc3 | bff65f44 | .config | console log | report | syz | C | KASAN: use-after-free Read in kill_fasync | ||
ci-upstream-kasan-gce-root | 2022/07/17 15:27 | upstream | 972a278fe60c | 95cb00d1 | .config | console log | report | syz | C | KASAN: use-after-free Read in kill_fasync | ||
ci-upstream-kasan-gce | 2022/07/08 07:21 | upstream | e8a4e1c1bb69 | bff65f44 | .config | console log | report | syz | C | KASAN: use-after-free Read in kill_fasync | ||
ci-upstream-kasan-gce-smack-root | 2022/07/08 06:53 | upstream | e8a4e1c1bb69 | bff65f44 | .config | console log | report | syz | C | KASAN: use-after-free Read in kill_fasync | ||
ci-upstream-kasan-gce | 2022/07/08 06:51 | upstream | e8a4e1c1bb69 | bff65f44 | .config | console log | report | syz | C | KASAN: use-after-free Read in kill_fasync | ||
ci-upstream-kasan-gce | 2022/07/08 06:29 | upstream | e8a4e1c1bb69 | bff65f44 | .config | console log | report | syz | C | KASAN: use-after-free Read in kill_fasync | ||
ci-upstream-kasan-gce-selinux-root | 2022/07/20 00:39 | upstream | ca85855bdcae | 775344bc | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/19 17:22 | upstream | ca85855bdcae | 72a3cc0c | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/19 05:46 | upstream | ca85855bdcae | ff988920 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/18 17:43 | upstream | ff6992735ade | ff988920 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-qemu-upstream | 2022/07/18 13:56 | upstream | 4a57a8400075 | ff988920 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-root | 2022/07/17 10:37 | upstream | 972a278fe60c | 95cb00d1 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/16 23:14 | upstream | c658cabbfd32 | 95cb00d1 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-qemu-upstream | 2022/07/15 21:03 | upstream | 4a57a8400075 | 95cb00d1 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/15 13:06 | upstream | e5d523f1ae8f | 5d921b08 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce | 2022/07/14 00:29 | upstream | 4a57a8400075 | 5d921b08 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/13 21:55 | upstream | 4a57a8400075 | 5d921b08 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce | 2022/07/13 20:55 | upstream | 4a57a8400075 | 5d921b08 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/13 10:19 | upstream | b047602d579b | 5d921b08 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-root | 2022/07/13 10:11 | upstream | b047602d579b | 5d921b08 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-smack-root | 2022/07/13 09:46 | upstream | b047602d579b | 5d921b08 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-root | 2022/07/12 19:13 | upstream | 72a8e05d4f66 | d91dd8ea | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce | 2022/07/12 17:53 | upstream | 72a8e05d4f66 | d91dd8ea | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/12 16:58 | upstream | 72a8e05d4f66 | d91dd8ea | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-root | 2022/07/12 14:43 | upstream | 5a29232d870d | d91dd8ea | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce | 2022/07/12 03:19 | upstream | 5a29232d870d | da3d6955 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-smack-root | 2022/07/11 14:03 | upstream | 32346491ddf2 | da3d6955 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-qemu-upstream | 2022/07/11 12:34 | upstream | 32346491ddf2 | f3f217ff | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/11 12:15 | upstream | 32346491ddf2 | da3d6955 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-smack-root | 2022/07/11 10:52 | upstream | 32346491ddf2 | da3d6955 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-qemu-upstream | 2022/07/11 09:25 | upstream | 32346491ddf2 | b5765a15 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/10 23:21 | upstream | d9919d43cbf6 | b5765a15 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-selinux-root | 2022/07/10 03:13 | upstream | b1c428b6c368 | b5765a15 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-smack-root | 2022/07/10 03:10 | upstream | b1c428b6c368 | b5765a15 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-qemu-upstream | 2022/07/10 02:39 | upstream | b1c428b6c368 | b5765a15 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-qemu-upstream | 2022/07/09 09:58 | upstream | e5524c2a1fc4 | b5765a15 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-root | 2022/07/09 08:34 | upstream | e5524c2a1fc4 | b5765a15 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce | 2022/07/08 06:02 | upstream | e8a4e1c1bb69 | bff65f44 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-kasan-gce-smack-root | 2022/07/08 05:45 | upstream | e8a4e1c1bb69 | bff65f44 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync | |||
ci-upstream-linux-next-kasan-gce-root | 2022/07/08 05:49 | linux-next | cb71b93c2dc3 | bff65f44 | .config | console log | report | info | KASAN: use-after-free Read in kill_fasync |