bisecting fixing commit since dce0f88600e49746b4bda873965b671a23ff4313 building syzkaller on ada108d08bee29122bf15427630464265c555cbc testing commit dce0f88600e49746b4bda873965b671a23ff4313 with gcc (GCC) 8.1.0 kernel signature: 1cab0d7359438a9291d6785d7b1d4613ae5e70dedd4d082d8675c696fee9a806 run #0: crashed: KASAN: out-of-bounds Write in tls_push_record run #1: crashed: KASAN: use-after-free Write in tls_push_record run #2: crashed: KASAN: use-after-free Write in tls_push_record run #3: crashed: KASAN: use-after-free Write in tls_push_record run #4: crashed: KASAN: use-after-free Write in tls_push_record run #5: crashed: KASAN: use-after-free Write in tls_push_record run #6: crashed: KASAN: use-after-free Write in tls_push_record run #7: crashed: KASAN: use-after-free Write in tls_push_record run #8: crashed: KASAN: use-after-free Write in tls_push_record run #9: crashed: KASAN: use-after-free Write in tls_push_record testing current HEAD a87f96283793d58b042618c689630db264715274 testing commit a87f96283793d58b042618c689630db264715274 with gcc (GCC) 8.1.0 kernel signature: cca2873ac0203e937c69f4e48731721f316e76892a325abbfbb33592eca59666 run #0: crashed: KASAN: use-after-free Write in tls_push_record run #1: crashed: KASAN: use-after-free Write in tls_push_record run #2: crashed: KASAN: use-after-free Write in tls_push_record run #3: crashed: KASAN: use-after-free Write in tls_push_record run #4: crashed: KASAN: out-of-bounds Write in tls_push_record run #5: crashed: KASAN: use-after-free Write in tls_push_record run #6: crashed: KASAN: out-of-bounds Write in tls_push_record run #7: crashed: KASAN: use-after-free Write in tls_push_record run #8: crashed: KASAN: use-after-free Write in tls_push_record run #9: crashed: KASAN: use-after-free Write in tls_push_record revisions tested: 2, total time: 23m2.711465398s (build: 16m27.912602345s, test: 6m4.227181128s) the crash still happens on HEAD commit msg: Linux 4.19.145 crash: KASAN: use-after-free Write in tls_push_record do_anonymous_page+0xdb8/0x1f40 mm/memory.c:3148 handle_pte_fault mm/memory.c:4039 [inline] __handle_mm_fault+0x1c9c/0x41a0 mm/memory.c:4165 handle_mm_fault+0x3dd/0x8ab mm/memory.c:4202 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412 ================================================================== BUG: KASAN: use-after-free in tls_fill_prepend include/net/tls.h:373 [inline] BUG: KASAN: use-after-free in tls_push_record+0x116e/0x15f0 net/tls/tls_sw.c:220 Write of size 1 at addr ffff8880924f8000 by task syz-executor.0/7884 do_page_fault+0x64/0x3a7 arch/x86/mm/fault.c:1487 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 arch/x86/lib/copy_user_64.S:181 Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 RSP: 0018:ffff8880a8aaf910 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000200005c0 RCX: 0000000000000580 RDX: 0000000000000580 RSI: 00000000200005c0 RDI: ffff8880a81c9240 RBP: ffff8880a8aaf938 R08: 0000000000000000 R09: 0000000000000016 R10: ffffed10150392f7 R11: ffff8880a81c97bf R12: ffff8880a81c9240 R13: ffff88808a384700 R14: ffff8880a8aafd78 R15: ffff8880a8aafd28 _copy_from_iter_full+0x166/0x770 lib/iov_iter.c:724 copy_from_iter_full include/linux/uio.h:124 [inline] skb_do_copy_data_nocache include/net/sock.h:1968 [inline] skb_add_data_nocache include/net/sock.h:1979 [inline] tcp_sendmsg_locked+0x1863/0x3590 net/ipv4/tcp.c:1337 tcp_sendmsg+0x27/0x40 net/ipv4/tcp.c:1460 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45cba9 Code: 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3cc3027c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000504760 RCX: 000000000045cba9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000078bfa0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000a99 R14: 00000000004cd6c7 R15: 00007f3cc30286d4 CPU: 1 PID: 7884 Comm: syz-executor.0 Not tainted 4.19.145-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x22a lib/dump_stack.c:118 print_address_description.cold.6+0x9/0x211 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.7+0x242/0x307 mm/kasan/report.c:412 __asan_report_store1_noabort+0x17/0x20 mm/kasan/report.c:435 tls_fill_prepend include/net/tls.h:373 [inline] tls_push_record+0x116e/0x15f0 net/tls/tls_sw.c:220 tls_sw_push_pending_record+0xe/0x10 net/tls/tls_sw.c:257 tls_push_pending_closed_record+0xbc/0x100 net/tls/tls_main.c:203 tls_complete_pending_work include/net/tls.h:303 [inline] tls_sk_proto_close+0x479/0x980 net/tls/tls_main.c:270 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 inet6_release+0x46/0x60 net/ipv6/af_inet6.c:472 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 get_signal+0x1359/0x1970 kernel/signal.c:2399 do_signal+0x87/0x1860 arch/x86/kernel/signal.c:821 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45cba9 Code: 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3d946d7c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: 0000000000004000 RBX: 0000000000504760 RCX: 000000000045cba9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000078bf00 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000a99 R14: 00000000004cd6c7 R15: 00007f3d946d86d4 The buggy address belongs to the page: page:ffffea0002493e00 count:0 mapcount:-128 mapping:0000000000000000 index:0x0 flags: 0xfffe0000000000() raw: 00fffe0000000000 ffffea00022b2c08 ffff88812fffb8f8 0000000000000000 raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880924f7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880924f7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880924f8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8880924f8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880924f8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 7922 Comm: syz-executor.5 Tainted: G B 4.19.145-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x22a lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xb lib/fault-inject.c:149 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x14 mm/slab_common.c:1588 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] __do_kmalloc mm/slab.c:3725 [inline] __kmalloc+0x6f/0x3d0 mm/slab.c:3736 kmalloc include/linux/slab.h:520 [inline] gcmaes_encrypt.constprop.5+0x630/0xda0 arch/x86/crypto/aesni-intel_glue.c:952 generic_gcmaes_encrypt+0xfd/0x150 arch/x86/crypto/aesni-intel_glue.c:1297 crypto_aead_encrypt include/crypto/aead.h:335 [inline] gcmaes_wrapper_encrypt+0x109/0x180 arch/x86/crypto/aesni-intel_glue.c:1130 crypto_aead_encrypt include/crypto/aead.h:335 [inline] tls_do_encryption net/tls/tls_sw.c:193 [inline] tls_push_record+0x9ae/0x15f0 net/tls/tls_sw.c:228 tls_sw_sendmsg+0xb42/0x1010 net/tls/tls_sw.c:467 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45cba9 Code: 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3cc3048c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000504760 RCX: 000000000045cba9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000078bf00 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000a99 R14: 00000000004cd6c7 R15: 00007f3cc30496d4 CPU: 1 PID: 7918 Comm: syz-executor.4 Tainted: G B 4.19.145-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x22a lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xb lib/fault-inject.c:149 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x14 mm/slab_common.c:1588 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc_node mm/slab.c:3304 [inline] kmem_cache_alloc_node+0x25a/0x3e0 mm/slab.c:3647 __alloc_skb+0xa7/0x580 net/core/skbuff.c:193 alloc_skb_fclone include/linux/skbuff.h:1037 [inline] sk_stream_alloc_skb+0x9e/0x800 net/ipv4/tcp.c:882 tcp_sendmsg_locked+0x9da/0x3590 net/ipv4/tcp.c:1310 tcp_sendmsg+0x27/0x40 net/ipv4/tcp.c:1460 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45cba9 Code: 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f9809763c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000504760 RCX: 000000000045cba9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000078bfa0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000a99 R14: 00000000004cd6c7 R15: 00007f98097646d4 FAULT_INJECTION: forcing a failure. name fail_page_alloc, interval 1, probability 0, space 0, times 1 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 7969 Comm: syz-executor.3 Tainted: G B 4.19.145-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x22a lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xb lib/fault-inject.c:149 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x14 mm/slab_common.c:1588 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc_node mm/slab.c:3304 [inline] kmem_cache_alloc_node+0x25a/0x3e0 mm/slab.c:3647 __alloc_skb+0xa7/0x580 net/core/skbuff.c:193 alloc_skb_fclone include/linux/skbuff.h:1037 [inline] sk_stream_alloc_skb+0x9e/0x800 net/ipv4/tcp.c:882 tcp_sendmsg_locked+0x9da/0x3590 net/ipv4/tcp.c:1310 tcp_sendmsg+0x27/0x40 net/ipv4/tcp.c:1460 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45cba9 Code: 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f144ada8c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000504760 RCX: 000000000045cba9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000078bfa0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000a99 R14: 00000000004cd6c7 R15: 00007f144ada96d4