From: syzbot <syzbot+8a821b383523654227bf@syzkaller.appspotmail.com>
To: aarcange@redhat.com, akpm@linux-foundation.org,
christian@brauner.io, ebiederm@xmission.com,
elena.reshetova@intel.com, guro@fb.com, keescook@chromium.org,
linux-kernel@vger.kernel.org, luto@amacapital.net,
mhocko@suse.com, mingo@kernel.org, namit@vmware.com,
netdev@vger.kernel.org, peterz@infradead.org, riel@surriel.com,
syzkaller-bugs@googlegroups.com, wad@chromium.org
Subject: KASAN: use-after-free Read in corrupted (3)
Date: Wed, 26 Jun 2019 04:37:05 -0700 [thread overview]
Message-ID: <000000000000f4f847058c387616@google.com> (raw)
Hello,
syzbot found the following crash on:
HEAD commit: 045df37e Merge branch 'cxgb4-Reference-count-MPS-TCAM-entr..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13c6217ea00000
kernel config: https://syzkaller.appspot.com/x/.config?x=dd16b8dc9d0d210c
dashboard link: https://syzkaller.appspot.com/bug?extid=8a821b383523654227bf
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1389f5b5a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8a821b383523654227bf@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in vsnprintf+0x1727/0x19a0 lib/vsprintf.c:2503
Read of size 8 at addr ffff8880952500a0 by task syz-executor.1/9180
CPU: 0 PID: 9180 Comm: syz-executor.1 Not tainted 5.2.0-rc5+ #43
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
Allocated by task 8:
save_stack+0x23/0x90 mm/kasan/common.c:71
set_track mm/kasan/common.c:79 [inline]
__kasan_kmalloc mm/kasan/common.c:489 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462
kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:497
slab_post_alloc_hook mm/slab.h:437 [inline]
slab_alloc mm/slab.c:3326 [inline]
kmem_cache_alloc+0x11a/0x6f0 mm/slab.c:3488
vm_area_dup+0x21/0x170 kernel/fork.c:343
dup_mmap kernel/fork.c:528 [inline]
dup_mm+0x8c4/0x13b0 kernel/fork.c:1341
copy_mm kernel/fork.c:1397 [inline]
copy_process.part.0+0x2cde/0x6790 kernel/fork.c:2032
copy_process kernel/fork.c:1800 [inline]
_do_fork+0x25d/0xfe0 kernel/fork.c:2369
__do_sys_clone kernel/fork.c:2476 [inline]
__se_sys_clone kernel/fork.c:2470 [inline]
__x64_sys_clone+0xbf/0x150 kernel/fork.c:2470
do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 2502230480:
------------[ cut here ]------------
Bad or missing usercopy whitelist? Kernel memory overwrite attempt detected
to SLAB object 'shmem_inode_cache' (offset 1040, size 1)!
WARNING: CPU: 0 PID: 9180 at mm/usercopy.c:74 usercopy_warn+0xeb/0x110
mm/usercopy.c:74
Kernel panic - not syncing: panic_on_warn set ...
Shutting down cpus with NMI
Kernel Offset: disabled
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
next reply other threads:[~2019-06-26 11:37 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-26 11:37 syzbot [this message]
2019-06-26 23:55 ` KASAN: use-after-free Read in corrupted (3) syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000f4f847058c387616@google.com \
--to=syzbot+8a821b383523654227bf@syzkaller.appspotmail.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=christian@brauner.io \
--cc=ebiederm@xmission.com \
--cc=elena.reshetova@intel.com \
--cc=guro@fb.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mhocko@suse.com \
--cc=mingo@kernel.org \
--cc=namit@vmware.com \
--cc=netdev@vger.kernel.org \
--cc=peterz@infradead.org \
--cc=riel@surriel.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=wad@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.