ci2 starts bisection 2023-04-21 16:15:28.730079693 +0000 UTC m=+24469.844907059 bisecting fixing commit since 7eaef76fbc4621ced374c85dbc000dd80dc681d7 building syzkaller on 7939252e4ddf50bbb9912069a40d32f6c83c4f8e ensuring issue is reproducible on original commit 7eaef76fbc4621ced374c85dbc000dd80dc681d7 testing commit 7eaef76fbc4621ced374c85dbc000dd80dc681d7 gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 934fdd26c9958ec6ee8b0b794ff58a995d0a14662c951c7d163dc1df4352c81b run #0: crashed: INFO: rcu detected stall in corrupted run #1: crashed: INFO: rcu detected stall in corrupted run #2: crashed: INFO: rcu detected stall in corrupted run #3: crashed: INFO: rcu detected stall in corrupted run #4: crashed: INFO: rcu detected stall in corrupted run #5: crashed: INFO: rcu detected stall in corrupted run #6: crashed: INFO: rcu detected stall in corrupted run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: INFO: rcu detected stall in corrupted run #9: crashed: INFO: rcu detected stall in corrupted run #10: crashed: KASAN: use-after-free Read in dev_uevent run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: crashed: KASAN: use-after-free Read in dev_uevent run #18: OK run #19: OK testing current HEAD f17b0ab65d17988d5e6d6fe22f708ef3721080bf testing commit f17b0ab65d17988d5e6d6fe22f708ef3721080bf gcc compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 78a3115a17b9f81c7062abba918d0a97b79bb23b3088cbb1a54c718408803203 run #0: crashed: INFO: rcu detected stall in corrupted run #1: crashed: INFO: rcu detected stall in corrupted run #2: crashed: INFO: rcu detected stall in corrupted run #3: crashed: INFO: rcu detected stall in corrupted run #4: crashed: INFO: rcu detected stall in corrupted run #5: crashed: INFO: rcu detected stall in corrupted run #6: crashed: INFO: rcu detected stall in corrupted run #7: crashed: INFO: rcu detected stall in corrupted run #8: crashed: KASAN: use-after-free Read in dev_uevent run #9: OK revisions tested: 2, total time: 59m59.029090073s (build: 36m5.317395689s, test: 23m6.991980721s) the crash still happens on HEAD commit msg: Linux 6.1.25 crash: KASAN: use-after-free Read in dev_uevent ================================================================== BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:643 [inline] BUG: KASAN: use-after-free in string+0x1d7/0x240 lib/vsprintf.c:725 Read of size 1 at addr ffff88807a055c0b by task udevd/2998 CPU: 0 PID: 2998 Comm: udevd Not tainted 6.1.25-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x163/0x213 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15f/0x4f0 mm/kasan/report.c:395 kasan_report+0x136/0x160 mm/kasan/report.c:495 string_nocheck lib/vsprintf.c:643 [inline] string+0x1d7/0x240 lib/vsprintf.c:725 vsnprintf+0xba9/0x1a90 lib/vsprintf.c:2800 add_uevent_var+0x177/0x450 lib/kobject_uevent.c:665 dev_uevent+0x37a/0x7c0 drivers/base/core.c:2568 uevent_show+0x168/0x290 drivers/base/core.c:2639 dev_attr_show+0x4b/0x90 drivers/base/core.c:2342 sysfs_kf_seq_show+0x290/0x3d0 fs/sysfs/file.c:59 seq_read_iter+0x3c0/0xb40 fs/seq_file.c:230 call_read_iter include/linux/fs.h:2199 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x7db/0xae0 fs/read_write.c:470 ksys_read+0x15f/0x240 fs/read_write.c:613 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f24165258fe Code: c0 e9 e6 fe ff ff 50 48 8d 3d 0e c7 09 00 e8 c9 cf 01 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28 RSP: 002b:00007ffdbcf85ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000055e8e0152ec0 RCX: 00007f24165258fe RDX: 0000000000001000 RSI: 000055e8e01359f0 RDI: 000000000000000c RBP: 00007f24165f2380 R08: 000000000000000c R09: 00007f24165f5a60 R10: 0000000000008000 R11: 0000000000000246 R12: 000055e8e0152ec0 R13: 0000000000000d68 R14: 00007f24165f1780 R15: 0000000000000d68 Allocated by task 5707: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:383 kmalloc include/linux/slab.h:553 [inline] raw_ioctl_init drivers/usb/gadget/legacy/raw_gadget.c:460 [inline] raw_ioctl+0x758/0x3900 drivers/usb/gadget/legacy/raw_gadget.c:1250 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xa7/0xf0 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 5705: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook mm/slub.c:1750 [inline] slab_free mm/slub.c:3661 [inline] __kmem_cache_free+0x25c/0x3c0 mm/slub.c:3674 dev_free drivers/usb/gadget/legacy/raw_gadget.c:210 [inline] kref_put+0xa1/0x6c0 include/linux/kref.h:65 raw_release+0x10a/0x1b0 drivers/usb/gadget/legacy/raw_gadget.c:424 __fput+0x33f/0x720 fs/file_table.c:320 task_work_run+0x206/0x290 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xd9/0x100 kernel/entry/common.c:171 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:297 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88807a055c00 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 11 bytes inside of 32-byte region [ffff88807a055c00, ffff88807a055c20) The buggy address belongs to the physical page: page:ffffea0001e81540 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a055 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 0000000000000000 dead000000000001 ffff888011041500 raw: 0000000000000000 0000000000400040 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 4111, tgid 4111 (syz-executor.3), ts 70354552391, free_ts 70057494090 prep_new_page mm/page_alloc.c:2540 [inline] get_page_from_freelist+0x32ed/0x3480 mm/page_alloc.c:4292 __alloc_pages+0x28d/0x770 mm/page_alloc.c:5559 alloc_slab_page+0x6a/0x150 mm/slub.c:1794 allocate_slab mm/slub.c:1939 [inline] new_slab+0x84/0x2d0 mm/slub.c:1992 ___slab_alloc+0xa71/0x1080 mm/slub.c:3180 __slab_alloc mm/slub.c:3279 [inline] slab_alloc_node mm/slub.c:3364 [inline] __kmem_cache_alloc_node+0x19f/0x260 mm/slub.c:3437 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1045 kmalloc include/linux/slab.h:553 [inline] kzalloc include/linux/slab.h:689 [inline] ref_tracker_alloc+0x10b/0x3a0 lib/ref_tracker.c:85 __netdev_tracker_alloc include/linux/netdevice.h:4004 [inline] netdev_tracker_alloc include/linux/netdevice.h:4016 [inline] fib6_nh_init+0x72a/0x1c10 net/ipv6/route.c:3621 ip6_route_info_create+0x874/0x1170 net/ipv6/route.c:3799 ip6_route_add+0x13/0xe0 net/ipv6/route.c:3843 addrconf_prefix_route net/ipv6/addrconf.c:2425 [inline] fixup_permanent_addr net/ipv6/addrconf.c:3500 [inline] addrconf_permanent_addr+0x684/0xa20 net/ipv6/addrconf.c:3524 addrconf_notify+0x151/0xc20 net/ipv6/addrconf.c:3596 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xc4/0xf0 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:1945 [inline] call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] __dev_notify_flags+0x289/0x550 net/core/dev.c:8584 dev_change_flags+0xce/0x180 net/core/dev.c:8622 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1460 [inline] free_pcp_prepare mm/page_alloc.c:1510 [inline] free_unref_page_prepare+0xf5e/0x1110 mm/page_alloc.c:3388 free_unref_page+0x98/0x570 mm/page_alloc.c:3484 qlist_free_all+0x22/0x60 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x162/0x180 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x50/0x370 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] __kmem_cache_alloc_node+0x137/0x260 mm/slub.c:3437 __do_kmalloc_node mm/slab_common.c:954 [inline] __kmalloc+0xa1/0x230 mm/slab_common.c:968 kmalloc include/linux/slab.h:558 [inline] load_elf_phdrs fs/binfmt_elf.c:481 [inline] load_elf_binary+0x22a/0x23e0 fs/binfmt_elf.c:861 search_binary_handler fs/exec.c:1727 [inline] exec_binprm fs/exec.c:1768 [inline] bprm_execve+0x8e9/0x13f0 fs/exec.c:1837 kernel_execve+0x733/0x820 fs/exec.c:2002 call_usermodehelper_exec_async+0x1fc/0x310 kernel/umh.c:113 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 Memory state around the buggy address: ffff88807a055b00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ffff88807a055b80: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc >ffff88807a055c00: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc ^ ffff88807a055c80: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc ffff88807a055d00: 00 00 00 fc fc fc fc fc 00 00 00 00 fc fc fc fc ==================================================================