* WARNING: refcount bug in sctp_transport_put
@ 2018-08-14 0:55 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2018-08-14 0:55 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev, nhorman,
syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: 112cbae26d18 Merge branch 'linus' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x\x12401622400000
kernel config: https://syzkaller.appspot.com/x/.config?x\x152cb8ccd35b1f70
dashboard link: https://syzkaller.appspot.com/bug?extidj15c8ad0f0632ccd7f3
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6a15c8ad0f0632ccd7f3@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 7203 at lib/refcount.c:187
refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 7203 Comm: udevd Not tainted 4.18.0-rc8+ #182
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
panic+0x238/0x4e7 kernel/panic.c:184
__warn.cold.8+0x163/0x1ba kernel/panic.c:536
report_bug+0x252/0x2d0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Code: 89 de e8 fc b4 1c fe 84 db 74 07 31 db e9 46 ff ff ff e8 1c b4 1c fe
48 c7 c7 80 48 3a 87 c6 05 82 f2 25 05 01 e8 f9 cc e7 fd <0f> 0b 31 db e9
25 ff ff ff 48 8b bd 28 ff ff ff 89 85 34 ff ff ff
RSP: 0018:ffff8801db107598 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff81632481 RDI: ffff8801db107270
RBP: ffff8801db107680 R08: ffff8801b9a22780 R09: 0000000000000002
R10: ffff8801b9a22780 R11: 0000000000000000 R12: 00000000ffffffff
R13: ffff8801db107658 R14: 0000000000000001 R15: ffff8801aefee088
refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
sctp_transport_put+0x76/0x200 net/sctp/transport.c:331
sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7a6/0xc70 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2e8/0xb17 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x1d4/0x210 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:527 [inline]
smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1055
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:update_stack_state+0xcc/0x690 arch/x86/kernel/unwind_frame.c:215
Code: 06 49 8d 7e 50 48 89 fa 89 85 24 ff ff ff 48 c1 ea 03 48 b8 00 00 00
00 00 fc ff df 80 3c 02 00 0f 85 04 05 00 00 49 8b 46 50 <48> 85 c0 0f 84
66 03 00 00 48 05 a8 00 00 00 48 89 85 10 ff ff ff
RSP: 0018:ffff88018d816a60 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffff88018d816cc8 RCX: ffff88018d816c40
RDX: 1ffff10031b02da3 RSI: ffff88018d816d48 RDI: ffff88018d816d18
RBP: ffff88018d816b68 R08: ffff88018d816d00 R09: ffff8801b9a22780
R10: ffffed0031b02da3 R11: ffff88018d816d1f R12: 1ffff10031b02d54
R13: ffff88018d816d48 R14: ffff88018d816cc8 R15: ffff88018d816d18
unwind_next_frame.part.7+0x1ae/0x9e0 arch/x86/kernel/unwind_frame.c:329
unwind_next_frame arch/x86/include/asm/unwind.h:40 [inline]
__unwind_start+0x166/0x330 arch/x86/kernel/unwind_frame.c:414
unwind_start arch/x86/include/asm/unwind.h:54 [inline]
__save_stack_trace+0x59/0xf0 arch/x86/kernel/stacktrace.c:43
save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
slab_post_alloc_hook mm/slab.h:444 [inline]
slab_alloc mm/slab.c:3392 [inline]
kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
anon_vma_chain_alloc mm/rmap.c:129 [inline]
anon_vma_clone+0x140/0x740 mm/rmap.c:269
anon_vma_fork+0xf0/0x960 mm/rmap.c:332
dup_mmap kernel/fork.c:498 [inline]
dup_mm kernel/fork.c:1266 [inline]
copy_mm kernel/fork.c:1320 [inline]
copy_process.part.39+0x4e53/0x70b0 kernel/fork.c:1826
copy_process kernel/fork.c:1639 [inline]
_do_fork+0x291/0x12a0 kernel/fork.c:2122
__do_sys_clone kernel/fork.c:2229 [inline]
__se_sys_clone kernel/fork.c:2223 [inline]
__x64_sys_clone+0xbf/0x150 kernel/fork.c:2223
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1b0bf66f46
Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81
c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff
ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00
RSP: 002b:00007ffc9eb9ddb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc9eb9ddb0 RCX: 00007f1b0bf66f46
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc9eb9de10 R08: 0000000000001c23 R09: 0000000000001c23
R10: 00007f1b0c883a70 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc9eb9ddd0 R14: 0000000000000005 R15: 0000000000000005
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
^ permalink raw reply [flat|nested] 7+ messages in thread
* WARNING: refcount bug in sctp_transport_put
@ 2018-08-14 0:55 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2018-08-14 0:55 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev, nhorman,
syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: 112cbae26d18 Merge branch 'linus' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12401622400000
kernel config: https://syzkaller.appspot.com/x/.config?x=152cb8ccd35b1f70
dashboard link: https://syzkaller.appspot.com/bug?extid=6a15c8ad0f0632ccd7f3
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6a15c8ad0f0632ccd7f3@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 7203 at lib/refcount.c:187
refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 7203 Comm: udevd Not tainted 4.18.0-rc8+ #182
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
panic+0x238/0x4e7 kernel/panic.c:184
__warn.cold.8+0x163/0x1ba kernel/panic.c:536
report_bug+0x252/0x2d0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Code: 89 de e8 fc b4 1c fe 84 db 74 07 31 db e9 46 ff ff ff e8 1c b4 1c fe
48 c7 c7 80 48 3a 87 c6 05 82 f2 25 05 01 e8 f9 cc e7 fd <0f> 0b 31 db e9
25 ff ff ff 48 8b bd 28 ff ff ff 89 85 34 ff ff ff
RSP: 0018:ffff8801db107598 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff81632481 RDI: ffff8801db107270
RBP: ffff8801db107680 R08: ffff8801b9a22780 R09: 0000000000000002
R10: ffff8801b9a22780 R11: 0000000000000000 R12: 00000000ffffffff
R13: ffff8801db107658 R14: 0000000000000001 R15: ffff8801aefee088
refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
sctp_transport_put+0x76/0x200 net/sctp/transport.c:331
sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7a6/0xc70 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2e8/0xb17 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x1d4/0x210 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:527 [inline]
smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1055
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:update_stack_state+0xcc/0x690 arch/x86/kernel/unwind_frame.c:215
Code: 06 49 8d 7e 50 48 89 fa 89 85 24 ff ff ff 48 c1 ea 03 48 b8 00 00 00
00 00 fc ff df 80 3c 02 00 0f 85 04 05 00 00 49 8b 46 50 <48> 85 c0 0f 84
66 03 00 00 48 05 a8 00 00 00 48 89 85 10 ff ff ff
RSP: 0018:ffff88018d816a60 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffff88018d816cc8 RCX: ffff88018d816c40
RDX: 1ffff10031b02da3 RSI: ffff88018d816d48 RDI: ffff88018d816d18
RBP: ffff88018d816b68 R08: ffff88018d816d00 R09: ffff8801b9a22780
R10: ffffed0031b02da3 R11: ffff88018d816d1f R12: 1ffff10031b02d54
R13: ffff88018d816d48 R14: ffff88018d816cc8 R15: ffff88018d816d18
unwind_next_frame.part.7+0x1ae/0x9e0 arch/x86/kernel/unwind_frame.c:329
unwind_next_frame arch/x86/include/asm/unwind.h:40 [inline]
__unwind_start+0x166/0x330 arch/x86/kernel/unwind_frame.c:414
unwind_start arch/x86/include/asm/unwind.h:54 [inline]
__save_stack_trace+0x59/0xf0 arch/x86/kernel/stacktrace.c:43
save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
slab_post_alloc_hook mm/slab.h:444 [inline]
slab_alloc mm/slab.c:3392 [inline]
kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
anon_vma_chain_alloc mm/rmap.c:129 [inline]
anon_vma_clone+0x140/0x740 mm/rmap.c:269
anon_vma_fork+0xf0/0x960 mm/rmap.c:332
dup_mmap kernel/fork.c:498 [inline]
dup_mm kernel/fork.c:1266 [inline]
copy_mm kernel/fork.c:1320 [inline]
copy_process.part.39+0x4e53/0x70b0 kernel/fork.c:1826
copy_process kernel/fork.c:1639 [inline]
_do_fork+0x291/0x12a0 kernel/fork.c:2122
__do_sys_clone kernel/fork.c:2229 [inline]
__se_sys_clone kernel/fork.c:2223 [inline]
__x64_sys_clone+0xbf/0x150 kernel/fork.c:2223
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1b0bf66f46
Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81
c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff
ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00
RSP: 002b:00007ffc9eb9ddb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc9eb9ddb0 RCX: 00007f1b0bf66f46
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc9eb9de10 R08: 0000000000001c23 R09: 0000000000001c23
R10: 00007f1b0c883a70 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc9eb9ddd0 R14: 0000000000000005 R15: 0000000000000005
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: WARNING: refcount bug in sctp_transport_put
2018-08-14 0:55 ` syzbot
@ 2018-08-14 1:24 ` Marcelo Ricardo Leitner
-1 siblings, 0 replies; 7+ messages in thread
From: Marcelo Ricardo Leitner @ 2018-08-14 1:24 UTC (permalink / raw)
To: syzbot
Cc: davem, linux-kernel, linux-sctp, netdev, nhorman, syzkaller-bugs,
vyasevich
On Mon, Aug 13, 2018 at 05:55:02PM -0700, syzbot wrote:
> ------------[ cut here ]------------
> refcount_t: underflow; use-after-free.
> WARNING: CPU: 1 PID: 7203 at lib/refcount.c:187
> refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
> Kernel panic - not syncing: panic_on_warn set ...
>
...
> refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
> sctp_transport_put+0x76/0x200 net/sctp/transport.c:331
> sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
> call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
> expire_timers kernel/time/timer.c:1363 [inline]
> __run_timers+0x7a6/0xc70 kernel/time/timer.c:1666
> run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
> __do_softirq+0x2e8/0xb17 kernel/softirq.c:292
> invoke_softirq kernel/softirq.c:372 [inline]
> irq_exit+0x1d4/0x210 kernel/softirq.c:412
> exiting_irq arch/x86/include/asm/apic.h:527 [inline]
> smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1055
> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
> </IRQ>
Interesting, again on heartbeat timer handler.
Marcelo
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: WARNING: refcount bug in sctp_transport_put
@ 2018-08-14 1:24 ` Marcelo Ricardo Leitner
0 siblings, 0 replies; 7+ messages in thread
From: Marcelo Ricardo Leitner @ 2018-08-14 1:24 UTC (permalink / raw)
To: syzbot
Cc: davem, linux-kernel, linux-sctp, netdev, nhorman, syzkaller-bugs,
vyasevich
On Mon, Aug 13, 2018 at 05:55:02PM -0700, syzbot wrote:
> ------------[ cut here ]------------
> refcount_t: underflow; use-after-free.
> WARNING: CPU: 1 PID: 7203 at lib/refcount.c:187
> refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
> Kernel panic - not syncing: panic_on_warn set ...
>
...
> refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
> sctp_transport_put+0x76/0x200 net/sctp/transport.c:331
> sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
> call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
> expire_timers kernel/time/timer.c:1363 [inline]
> __run_timers+0x7a6/0xc70 kernel/time/timer.c:1666
> run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
> __do_softirq+0x2e8/0xb17 kernel/softirq.c:292
> invoke_softirq kernel/softirq.c:372 [inline]
> irq_exit+0x1d4/0x210 kernel/softirq.c:412
> exiting_irq arch/x86/include/asm/apic.h:527 [inline]
> smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1055
> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
> </IRQ>
Interesting, again on heartbeat timer handler.
Marcelo
^ permalink raw reply [flat|nested] 7+ messages in thread
* WARNING: refcount bug in sctp_transport_put (2)
@ 2019-10-05 7:16 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2019-10-05 7:16 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev, nhorman,
syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: 311ef88a Add linux-next specific files for 20191004
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x\x1688f6fb600000
kernel config: https://syzkaller.appspot.com/x/.config?xÛ2e4361e48662f4
dashboard link: https://syzkaller.appspot.com/bug?extidlad8d7f75ebce50a44d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6cad8d7f75ebce50a44d@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 23726 at lib/refcount.c:190
refcount_sub_and_test_checked lib/refcount.c:190 [inline]
WARNING: CPU: 0 PID: 23726 at lib/refcount.c:190
refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 23726 Comm: syz-executor.4 Not tainted 5.4.0-rc1-next-20191004
#0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x2dc/0x755 kernel/panic.c:220
__warn.cold+0x2f/0x3c kernel/panic.c:581
report_bug+0x289/0x300 lib/bug.c:195
fixup_bug arch/x86/kernel/traps.c:174 [inline]
fixup_bug arch/x86/kernel/traps.c:169 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:refcount_sub_and_test_checked lib/refcount.c:190 [inline]
RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Code: 1d 9d a9 7f 06 31 ff 89 de e8 6c 0d 31 fe 84 db 75 94 e8 23 0c 31 fe
48 c7 c7 a0 6e e6 87 c6 05 7d a9 7f 06 01 e8 28 51 02 fe <0f> 0b e9 75 ff
ff ff e8 04 0c 31 fe e9 6e ff ff ff 48 89 df e8 47
RSP: 0018:ffff8880ae809bc8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff815cb526 RDI: ffffed1015d0136b
RBP: ffff8880ae809c60 R08: ffff888097c901c0 R09: fffffbfff14edb4a
R10: fffffbfff14edb49 R11: ffffffff8a76da4f R12: 00000000ffffffff
R13: 0000000000000001 R14: ffff8880ae809c38 R15: 0000000000000000
refcount_dec_and_test_checked+0x1b/0x20 lib/refcount.c:220
sctp_transport_put+0x1e/0x130 net/sctp/transport.c:325
sctp_generate_heartbeat_event+0x2cf/0x450 net/sctp/sm_sideeffect.c:401
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
__do_softirq+0x262/0x98c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x19b/0x1e0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x44/0x50 kernel/kcov.c:109
Code: 48 8b 75 08 75 2b 8b 90 00 13 00 00 83 fa 02 75 20 48 8b 88 08 13 00
00 8b 80 04 13 00 00 48 8b 11 48 83 c2 01 48 39 d0 76 07 <48> 89 34 d1 48
89 11 5d c3 0f 1f 00 65 4c 8b 04 25 40 fe 01 00 65
RSP: 0018:ffff88805f30f4e0 EFLAGS: 00000216 ORIG_RAX: ffffffffffffff13
RAX: 0000000000040000 RBX: 0000000000000008 RCX: ffffc9000e9aa000
RDX: 0000000000021364 RSI: ffffffff830d569e RDI: 0000000000000001
RBP: ffff88805f30f4e0 R08: ffff888097c901c0 R09: ffffed100be61eb3
R10: ffffed100be61eb2 R11: 0000000000000000 R12: ffff8880a858e780
R13: 0000000000000010 R14: 00000000000002d0 R15: 0000000000000000
tomoyo_domain_quota_is_ok+0x2fe/0x540 security/tomoyo/util.c:1069
tomoyo_supervisor+0x2e8/0xef0 security/tomoyo/common.c:2087
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x263/0x360 security/tomoyo/file.c:573
tomoyo_check_open_permission+0x372/0x3f0 security/tomoyo/file.c:780
tomoyo_file_open security/tomoyo/tomoyo.c:325 [inline]
tomoyo_file_open+0x106/0x150 security/tomoyo/tomoyo.c:317
security_file_open+0x71/0x300 security/security.c:1497
do_dentry_open+0x373/0x1250 fs/open.c:784
vfs_open+0xa0/0xd0 fs/open.c:914
do_last fs/namei.c:3412 [inline]
path_openat+0x10e9/0x4720 fs/namei.c:3529
do_filp_open+0x1a1/0x280 fs/namei.c:3559
do_sys_open+0x3fe/0x5d0 fs/open.c:1097
ksys_open include/linux/syscalls.h:1386 [inline]
__do_sys_creat fs/open.c:1155 [inline]
__se_sys_creat fs/open.c:1153 [inline]
__x64_sys_creat+0x61/0x80 fs/open.c:1153
do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a59
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007faa895c7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000459a59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007faa895c86d4
R13: 00000000004c00fd R14: 00000000004d2430 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 7+ messages in thread
* WARNING: refcount bug in sctp_transport_put (2)
@ 2019-10-05 7:16 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2019-10-05 7:16 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev, nhorman,
syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: 311ef88a Add linux-next specific files for 20191004
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1688f6fb600000
kernel config: https://syzkaller.appspot.com/x/.config?x=db2e4361e48662f4
dashboard link: https://syzkaller.appspot.com/bug?extid=6cad8d7f75ebce50a44d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6cad8d7f75ebce50a44d@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 23726 at lib/refcount.c:190
refcount_sub_and_test_checked lib/refcount.c:190 [inline]
WARNING: CPU: 0 PID: 23726 at lib/refcount.c:190
refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 23726 Comm: syz-executor.4 Not tainted 5.4.0-rc1-next-20191004
#0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x2dc/0x755 kernel/panic.c:220
__warn.cold+0x2f/0x3c kernel/panic.c:581
report_bug+0x289/0x300 lib/bug.c:195
fixup_bug arch/x86/kernel/traps.c:174 [inline]
fixup_bug arch/x86/kernel/traps.c:169 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:refcount_sub_and_test_checked lib/refcount.c:190 [inline]
RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Code: 1d 9d a9 7f 06 31 ff 89 de e8 6c 0d 31 fe 84 db 75 94 e8 23 0c 31 fe
48 c7 c7 a0 6e e6 87 c6 05 7d a9 7f 06 01 e8 28 51 02 fe <0f> 0b e9 75 ff
ff ff e8 04 0c 31 fe e9 6e ff ff ff 48 89 df e8 47
RSP: 0018:ffff8880ae809bc8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff815cb526 RDI: ffffed1015d0136b
RBP: ffff8880ae809c60 R08: ffff888097c901c0 R09: fffffbfff14edb4a
R10: fffffbfff14edb49 R11: ffffffff8a76da4f R12: 00000000ffffffff
R13: 0000000000000001 R14: ffff8880ae809c38 R15: 0000000000000000
refcount_dec_and_test_checked+0x1b/0x20 lib/refcount.c:220
sctp_transport_put+0x1e/0x130 net/sctp/transport.c:325
sctp_generate_heartbeat_event+0x2cf/0x450 net/sctp/sm_sideeffect.c:401
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
__do_softirq+0x262/0x98c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x19b/0x1e0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x44/0x50 kernel/kcov.c:109
Code: 48 8b 75 08 75 2b 8b 90 00 13 00 00 83 fa 02 75 20 48 8b 88 08 13 00
00 8b 80 04 13 00 00 48 8b 11 48 83 c2 01 48 39 d0 76 07 <48> 89 34 d1 48
89 11 5d c3 0f 1f 00 65 4c 8b 04 25 40 fe 01 00 65
RSP: 0018:ffff88805f30f4e0 EFLAGS: 00000216 ORIG_RAX: ffffffffffffff13
RAX: 0000000000040000 RBX: 0000000000000008 RCX: ffffc9000e9aa000
RDX: 0000000000021364 RSI: ffffffff830d569e RDI: 0000000000000001
RBP: ffff88805f30f4e0 R08: ffff888097c901c0 R09: ffffed100be61eb3
R10: ffffed100be61eb2 R11: 0000000000000000 R12: ffff8880a858e780
R13: 0000000000000010 R14: 00000000000002d0 R15: 0000000000000000
tomoyo_domain_quota_is_ok+0x2fe/0x540 security/tomoyo/util.c:1069
tomoyo_supervisor+0x2e8/0xef0 security/tomoyo/common.c:2087
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x263/0x360 security/tomoyo/file.c:573
tomoyo_check_open_permission+0x372/0x3f0 security/tomoyo/file.c:780
tomoyo_file_open security/tomoyo/tomoyo.c:325 [inline]
tomoyo_file_open+0x106/0x150 security/tomoyo/tomoyo.c:317
security_file_open+0x71/0x300 security/security.c:1497
do_dentry_open+0x373/0x1250 fs/open.c:784
vfs_open+0xa0/0xd0 fs/open.c:914
do_last fs/namei.c:3412 [inline]
path_openat+0x10e9/0x4720 fs/namei.c:3529
do_filp_open+0x1a1/0x280 fs/namei.c:3559
do_sys_open+0x3fe/0x5d0 fs/open.c:1097
ksys_open include/linux/syscalls.h:1386 [inline]
__do_sys_creat fs/open.c:1155 [inline]
__se_sys_creat fs/open.c:1153 [inline]
__x64_sys_creat+0x61/0x80 fs/open.c:1153
do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a59
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007faa895c7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000459a59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007faa895c86d4
R13: 00000000004c00fd R14: 00000000004d2430 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 7+ messages in thread
* WARNING: refcount bug in sctp_transport_put
@ 2025-02-01 4:35 YAN KANG
0 siblings, 0 replies; 7+ messages in thread
From: YAN KANG @ 2025-02-01 4:35 UTC (permalink / raw)
To: Marcelo Ricardo Leitner, Xin Long, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman,
linux-sctp@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com
Dear developers and maintainers,
I found a new possible kernel bug titiled "WARNING: refcount bug in sctp_transport_put " while using modified syzkaller fuzzing tool. I Itested it on the latest Linux upstream version (6.13.0-rc7)related to sctp protocol, and it was able to be triggered.
The bug info is:
kernel revision: v6.13-rc7
OOPS message: KASAN: WARNING: refcount bug in sctp_transport_put
reproducer:NO
After preliminary analysis, I found this refcount-UAF bug is about struct sctp_transport and maybe a concurrent bug:
thread0: thread1: (IRQ)
sysvec_apic_timer_interrupt
…… run_timer_softirq
sctp_association_free expire_timers
sctp_transport_free call_timer_fn refcnt=1
sctp_transport_put sctp_generate_heartbeat_event
kfree sctp_transport_put
refcount_dec_and_test refcnt=0 [Error]
I hope this info will help you .
If you fix this issue, please add the following tag to the commit:
Reported-by: yan kang <kangyan91@outlook.com>
Reported-by: yue sun <samsun1006219@gmail.com
I hope it helps.
Best regards
yan kang
Kernel crash log is below.
==================================================================
[ 392.221643][ C1] ------------[ cut here ]------------
[ 392.222326][ C1] refcount_t: underflow; use-after-free.
[ 392.222925][ C1] WARNING: CPU: 1 PID: 32801 at lib/refcount.c:32 refcount_warn_saturate+0x2e6/0x330
[ 392.223665][ C1] Modules linked in:
[ 392.224011][ C1] CPU: 1 UID: 0 PID: 32801 Comm: syz.4.1477 Not tainted 6.13.0-rc1-00003-gd4774759e15b-dirty #87
[ 392.225039][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 392.225815][ C1] RIP: 0010:refcount_warn_saturate+0x2e6/0x330
[ 392.226297][ C1] Code: ff 89 de e8 ac a6 00 fd 84 db 0f 85 97 fe ff ff e8 cf a3 00 fd c6 05 d1 32 8f 0b 01 90 48 c7 c7 60 4c b1 8b e8 5b 80 c1 fc 90 <0f> 0b 90 90 e9 74 fe ff ff e8 ac a3 00 fd c6 05 ad 32 8f 0b 01 90
[ 392.228110][T32797] kcov: [INFO_KY_KERNEL] krefcnt ioctl KCOV_ENABLE Begin
[ 392.240314][ C1] RSP: 0018:ffffc900001e8c38 EFLAGS: 00010286
[ 392.240355][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81599efa
[ 392.240360][ C1] RDX: ffff888107c22500 RSI: ffffffff81599f07 RDI: 0000000000000001
[ 392.240364][ C1] RBP: 1ffff9200003d187 R08: 0000000000000001 R09: ffffed1026bc5181
[ 392.240368][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
[ 392.240372][ C1] R13: ffffffff81856376 R14: 1ffff9200003d1a8 R15: 000000000003d98c
[ 392.240376][ C1] FS: 00007f848d8d6640(0000) GS:ffff888135e00000(0000) knlGS:0000000000000000
[ 392.240400][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 392.240413][ C1] CR2: 00007f848220f000 CR3: 0000000050830000 CR4: 0000000000752ef0
[ 392.240445][ C1] DR0: 0000000000000006 DR1: 000000000000000d DR2: 0000000000000003
[ 392.240459][ C1] DR3: 0000000000000001 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 392.240474][ C1] PKRU: 80000000
[ 392.240488][ C1] Call Trace:
[ 392.240496][ C1] <IRQ>
[ 392.240560][ C1] ? __warn+0xea/0x3d0
[ 392.240620][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.240660][ C1] ? report_bug+0x2e1/0x500
[ 392.240832][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.240908][ C1] ? refcount_warn_saturate+0x2e7/0x330
[ 392.240934][ C1] ? handle_bug+0xe5/0x180
[ 392.240990][ C1] ? exc_invalid_op+0x35/0x80
[ 392.241015][ C1] ? asm_exc_invalid_op+0x1a/0x20
[ 392.241058][ C1] ? call_timer_fn+0x1a6/0x620
[ 392.241154][ C1] ? __warn_printk+0x17a/0x310
[ 392.241240][ C1] ? __warn_printk+0x187/0x310
[ 392.241249][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.241258][ C1] ? refcount_warn_saturate+0x2e5/0x330
[ 392.241265][ C1] ? __pfx_refcount_warn_saturate+0x10/0x10
[ 392.241317][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 392.241347][ C1] ? call_timer_fn+0x1a6/0x620
[ 392.241380][ C1] ? __run_timers+0x668/0x900
[ 392.241387][ C1] ? run_timer_base+0xc5/0x120
[ 392.241414][ C1] ? run_timer_softirq+0x1a/0x40
[ 392.241436][ C1] ? handle_softirqs+0x1bf/0x850
[ 392.241477][ C1] ? do_raw_spin_unlock+0x174/0x230
[ 392.241498][ C1] ? _raw_spin_unlock+0x28/0x50
[ 392.241538][ C1] ? sctp_generate_heartbeat_event+0x171/0x490
[ 392.241555][ C1] ? sctp_assoc_add_peer+0x2d9/0x1520
[ 392.241597][ C1] sctp_transport_put+0x172/0x1d0
[ 392.241639][ C1] call_timer_fn+0x1a6/0x620
[ 392.241668][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10
[ 392.241678][ C1] ? __pfx_call_timer_fn+0x10/0x10
[ 392.241693][ C1] ? __pfx_lock_release+0x10/0x10
[ 392.241725][ C1] ? mark_held_locks+0x9f/0xe0
[ 392.241741][ C1] ? _raw_spin_unlock_irq+0x23/0x50
[ 392.241759][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10
[ 392.241858][ C1] __run_timers+0x668/0x900
[ 392.241889][ C1] ? __pfx___run_timers+0x10/0x10
[ 392.241905][ C1] ? rcu_is_watching+0x12/0xc0
[ 392.241955][ C1] ? do_raw_spin_lock+0x12c/0x2b0
[ 392.241971][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 392.242013][ C1] ? lock_acquire+0x32/0xc0
[ 392.242029][ C1] ? run_timer_base+0xbd/0x120
[ 392.242083][ C1] run_timer_base+0xc5/0x120
[ 392.242104][ C1] run_timer_softirq+0x1a/0x40
[ 392.242110][ C1] handle_softirqs+0x1bf/0x850
[ 392.242129][ C1] __irq_exit_rcu+0x109/0x170
[ 392.242151][ C1] irq_exit_rcu+0x9/0x30
[ 392.242157][ C1] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 392.242186][ C1] </IRQ>
[ 392.242198][ C1] <TASK>
[ 392.242212][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 392.242277][ C1] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50
[ 392.242310][ C1] Code: 90 f3 0f 1e fa 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 5a 3c 59 f6 48 89 ef e8 b2 b1 59 f6 e8 4d f8 83 f6 fb bf 01 00 00 00 <e8> 42 dc 4a f6 65 8b 05 f3 6a e7 74 85 c0 74 06 5d c3 cc cc cc cc
[ 392.242330][ C1] RSP: 0018:ffffc90006ff7800 EFLAGS: 00000202
[ 392.242385][ C1] RAX: 000000000000048f RBX: 0000000000000cc0 RCX: 1ffffffff2d93fdf
[ 392.242389][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
[ 392.242425][ C1] RBP: ffff888106c79dc8 R08: 0000000000000001 R09: fffffbfff2d8a1b1
[ 392.242449][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006ff7870
[ 392.242489][ C1] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[ 392.242547][ C1] shmem_add_to_page_cache+0x5ef/0xaf0
[ 392.242618][ C1] ? __pfx_shmem_add_to_page_cache+0x10/0x10
[ 392.242650][ C1] shmem_alloc_and_add_folio+0x56b/0xb90
[ 392.242712][ C1] ? __lock_acquire+0x157d/0x3c80
[ 392.242775][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10
[ 392.242837][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 392.242897][ C1] ? shmem_allowable_huge_orders+0x1c2/0x6c0
[ 392.242938][ C1] shmem_get_folio_gfp+0x593/0x14e0
[ 392.243062][ C1] ? __pfx_shmem_get_folio_gfp+0x10/0x10
[ 392.243090][ C1] shmem_write_begin+0x14e/0x310
[ 392.243146][ C1] ? __pfx_fault_in_readable+0x10/0x10
[ 392.243202][ C1] ? __pfx_shmem_write_begin+0x10/0x10
[ 392.243236][ C1] generic_perform_write+0x2bd/0x900
[ 392.243313][ C1] ? __pfx_generic_perform_write+0x10/0x10
[ 392.243352][ C1] ? inode_needs_update_time.part.0+0x191/0x270
[ 392.243382][ C1] shmem_file_write_iter+0x111/0x140
[ 392.243411][ C1] vfs_write+0xc02/0x10d0
[ 392.243460][ C1] ? __pfx_shmem_file_write_iter+0x10/0x10
[ 392.243501][ C1] ? __pfx_vfs_write+0x10/0x10
[ 392.243527][ C1] ? __fget_files+0x40/0x3a0
[ 392.243563][ C1] ksys_write+0x122/0x240
[ 392.243591][ C1] ? __pfx_ksys_write+0x10/0x10
[ 392.243686][ C1] do_syscall_64+0xcb/0x250
[ 392.243771][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 392.243791][ C1] RIP: 0033:0x7f848cb9ea3f
[ 392.243800][ C1] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 79 0d 03 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 bc 0d 03 00 48
[ 392.243816][ C1] RSP: 002b:00007f848d8d5d40 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 392.243842][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f848cb9ea3f
[ 392.243855][ C1] RDX: 0000000000010000 RSI: 00007f8482200000 RDI: 0000000000000003
[ 392.243899][ C1] RBP: 000000000000023b R08: 0000000000000000 R09: 0000000000000237
[ 392.243931][ C1] R10: 00000000000003b2 R11: 0000000000000293 R12: 0000000000000003
[ 392.243957][ C1] R13: 00007f848d8d5e0c R14: 00007f848d8d5e10 R15: 00007f8482200000
[ 392.244000][ C1] </TASK>
[ 392.244010][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 392.244047][ C1] CPU: 1 UID: 0 PID: 32801 Comm: syz.4.1477 Not tainted 6.13.0-rc1-00003-gd4774759e15b-dirty #87
[ 392.244081][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 392.244099][ C1] Call Trace:
[ 392.244108][ C1] <IRQ>
[ 392.244111][ C1] dump_stack_lvl+0x3d/0x1b0
[ 392.244121][ C1] panic+0x6fd/0x7b0
[ 392.244130][ C1] ? __pfx_panic+0x10/0x10
[ 392.244184][ C1] ? show_trace_log_lvl+0x284/0x390
[ 392.244254][ C1] ? check_panic_on_warn+0x1f/0xc0
[ 392.244284][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.244292][ C1] check_panic_on_warn+0xb1/0xc0
[ 392.244314][ C1] __warn+0xf6/0x3d0
[ 392.244333][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.244361][ C1] report_bug+0x2e1/0x500
[ 392.244375][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.244404][ C1] ? refcount_warn_saturate+0x2e7/0x330
[ 392.244421][ C1] handle_bug+0xe5/0x180
[ 392.244455][ C1] exc_invalid_op+0x35/0x80
[ 392.244472][ C1] asm_exc_invalid_op+0x1a/0x20
[ 392.244484][ C1] RIP: 0010:refcount_warn_saturate+0x2e6/0x330
[ 392.244491][ C1] Code: ff 89 de e8 ac a6 00 fd 84 db 0f 85 97 fe ff ff e8 cf a3 00 fd c6 05 d1 32 8f 0b 01 90 48 c7 c7 60 4c b1 8b e8 5b 80 c1 fc 90 <0f> 0b 90 90 e9 74 fe ff ff e8 ac a3 00 fd c6 05 ad 32 8f 0b 01 90
[ 392.244510][ C1] RSP: 0018:ffffc900001e8c38 EFLAGS: 00010286
[ 392.244565][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81599efa
[ 392.244636][ C1] RDX: ffff888107c22500 RSI: ffffffff81599f07 RDI: 0000000000000001
[ 392.244653][ C1] RBP: 1ffff9200003d187 R08: 0000000000000001 R09: ffffed1026bc5181
[ 392.244697][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
[ 392.244716][ C1] R13: ffffffff81856376 R14: 1ffff9200003d1a8 R15: 000000000003d98c
[ 392.244747][ C1] ? call_timer_fn+0x1a6/0x620
[ 392.244799][ C1] ? __warn_printk+0x17a/0x310
[ 392.244836][ C1] ? __warn_printk+0x187/0x310
[ 392.244875][ C1] ? refcount_warn_saturate+0x2e5/0x330
[ 392.244903][ C1] ? __pfx_refcount_warn_saturate+0x10/0x10
[ 392.244957][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 392.244963][ C1] ? call_timer_fn+0x1a6/0x620
[ 392.244971][ C1] ? __run_timers+0x668/0x900
[ 392.245006][ C1] ? run_timer_base+0xc5/0x120
[ 392.245033][ C1] ? run_timer_softirq+0x1a/0x40
[ 392.245056][ C1] ? handle_softirqs+0x1bf/0x850
[ 392.245067][ C1] ? do_raw_spin_unlock+0x174/0x230
[ 392.245114][ C1] ? _raw_spin_unlock+0x28/0x50
[ 392.245123][ C1] ? sctp_generate_heartbeat_event+0x171/0x490
[ 392.245203][ C1] ? sctp_assoc_add_peer+0x2d9/0x1520
[ 392.245246][ C1] sctp_transport_put+0x172/0x1d0
[ 392.245263][ C1] call_timer_fn+0x1a6/0x620
[ 392.245273][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10
[ 392.245295][ C1] ? __pfx_call_timer_fn+0x10/0x10
[ 392.245307][ C1] ? __pfx_lock_release+0x10/0x10
[ 392.245316][ C1] ? mark_held_locks+0x9f/0xe0
[ 392.245337][ C1] ? _raw_spin_unlock_irq+0x23/0x50
[ 392.245380][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10
[ 392.245424][ C1] __run_timers+0x668/0x900
[ 392.245433][ C1] ? __pfx___run_timers+0x10/0x10
[ 392.245437][ C1] ? rcu_is_watching+0x12/0xc0
[ 392.245443][ C1] ? do_raw_spin_lock+0x12c/0x2b0
[ 392.245449][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 392.245454][ C1] ? lock_acquire+0x32/0xc0
[ 392.245458][ C1] ? run_timer_base+0xbd/0x120
[ 392.245466][ C1] run_timer_base+0xc5/0x120
[ 392.245471][ C1] run_timer_softirq+0x1a/0x40
[ 392.245475][ C1] handle_softirqs+0x1bf/0x850
[ 392.245484][ C1] __irq_exit_rcu+0x109/0x170
[ 392.245489][ C1] irq_exit_rcu+0x9/0x30
[ 392.245493][ C1] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 392.245499][ C1] </IRQ>
[ 392.245501][ C1] <TASK>
[ 392.245505][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 392.245508][ C1] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50
[ 392.245513][ C1] Code: 90 f3 0f 1e fa 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 5a 3c 59 f6 48 89 ef e8 b2 b1 59 f6 e8 4d f8 83 f6 fb bf 01 00 00 00 <e8> 42 dc 4a f6 65 8b 05 f3 6a e7 74 85 c0 74 06 5d c3 cc cc cc cc
[ 392.245517][ C1] RSP: 0018:ffffc90006ff7800 EFLAGS: 00000202
[ 392.245522][ C1] RAX: 000000000000048f RBX: 0000000000000cc0 RCX: 1ffffffff2d93fdf
[ 392.245525][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
[ 392.245528][ C1] RBP: ffff888106c79dc8 R08: 0000000000000001 R09: fffffbfff2d8a1b1
[ 392.245532][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006ff7870
[ 392.245535][ C1] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[ 392.245545][ C1] shmem_add_to_page_cache+0x5ef/0xaf0
[ 392.245552][ C1] ? __pfx_shmem_add_to_page_cache+0x10/0x10
[ 392.245563][ C1] shmem_alloc_and_add_folio+0x56b/0xb90
[ 392.245571][ C1] ? __lock_acquire+0x157d/0x3c80
[ 392.245575][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10
[ 392.245580][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 392.245586][ C1] ? shmem_allowable_huge_orders+0x1c2/0x6c0
[ 392.245594][ C1] shmem_get_folio_gfp+0x593/0x14e0
[ 392.245602][ C1] ? __pfx_shmem_get_folio_gfp+0x10/0x10
[ 392.245611][ C1] shmem_write_begin+0x14e/0x310
[ 392.245617][ C1] ? __pfx_fault_in_readable+0x10/0x10
[ 392.245622][ C1] ? __pfx_shmem_write_begin+0x10/0x10
[ 392.245631][ C1] generic_perform_write+0x2bd/0x900
[ 392.245640][ C1] ? __pfx_generic_perform_write+0x10/0x10
[ 392.245646][ C1] ? inode_needs_update_time.part.0+0x191/0x270
[ 392.245654][ C1] shmem_file_write_iter+0x111/0x140
[ 392.245661][ C1] vfs_write+0xc02/0x10d0
[ 392.245666][ C1] ? __pfx_shmem_file_write_iter+0x10/0x10
[ 392.245673][ C1] ? __pfx_vfs_write+0x10/0x10
[ 392.245679][ C1] ? __fget_files+0x40/0x3a0
[ 392.245691][ C1] ksys_write+0x122/0x240
[ 392.245696][ C1] ? __pfx_ksys_write+0x10/0x10
[ 392.245705][ C1] do_syscall_64+0xcb/0x250
[ 392.245712][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 392.245717][ C1] RIP: 0033:0x7f848cb9ea3f
[ 392.245721][ C1] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 79 0d 03 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 bc 0d 03 00 48
[ 392.245725][ C1] RSP: 002b:00007f848d8d5d40 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 392.245730][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f848cb9ea3f
[ 392.245733][ C1] RDX: 0000000000010000 RSI: 00007f8482200000 RDI: 0000000000000003
[ 392.245736][ C1] RBP: 000000000000023b R08: 0000000000000000 R09: 0000000000000237
[ 392.245739][ C1] R10: 00000000000003b2 R11: 0000000000000293 R12: 0000000000000003
[ 392.245742][ C1] R13: 00007f848d8d5e0c R14: 00007f848d8d5e10 R15: 00007f8482200000
[ 392.245752][ C1] </TASK>
[ 392.246649][ C1] Kernel Offset: disabled
==================================================================
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 32801 at lib/refcount.c:32 refcount_warn_saturate+0x2e6/0x330 lib/refcount.c:32
Modules linked in:
CPU: 1 UID: 0 PID: 32801 Comm: syz.4.1477 Not tainted 6.13.0-rc1-00003-gd4774759e15b-dirty #87
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x2e6/0x330 lib/refcount.c:32
Code: ff 89 de e8 ac a6 00 fd 84 db 0f 85 97 fe ff ff e8 cf a3 00 fd c6 05 d1 32 8f 0b 01 90 48 c7 c7 60 4c b1 8b e8 5b 80 c1 fc 90 <0f> 0b 90 90 e9 74 fe ff ff e8 ac a3 00 fd c6 05 ad 32 8f 0b 01 90
RSP: 0018:ffffc900001e8c38 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81599efa
RDX: ffff888107c22500 RSI: ffffffff81599f07 RDI: 0000000000000001
RBP: 1ffff9200003d187 R08: 0000000000000001 R09: ffffed1026bc5181
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
R13: ffffffff81856376 R14: 1ffff9200003d1a8 R15: 000000000003d98c
FS: 00007f848d8d6640(0000) GS:ffff888135e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f848220f000 CR3: 0000000050830000 CR4: 0000000000752ef0
DR0: 0000000000000006 DR1: 000000000000000d DR2: 0000000000000003
DR3: 0000000000000001 DR6: 00000000fffe07f0 DR7: 0000000000000400
PKRU: 80000000
Call Trace:
<IRQ>
__refcount_sub_and_test include/linux/refcount.h:296 [inline]
__refcount_dec_and_test include/linux/refcount.h:333 [inline]
refcount_dec_and_test include/linux/refcount.h:354 [inline]
sctp_transport_put+0x172/0x1d0 net/sctp/transport.c:483
call_timer_fn+0x1a6/0x620 kernel/time/timer.c:1793
expire_timers kernel/time/timer.c:1844 [inline]
__run_timers+0x668/0x900 kernel/time/timer.c:2418
__run_timer_base kernel/time/timer.c:2430 [inline]
__run_timer_base kernel/time/timer.c:2422 [inline]
run_timer_base+0xc5/0x120 kernel/time/timer.c:2439
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2449
handle_softirqs+0x1bf/0x850 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:655
irq_exit_rcu+0x9/0x30 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa8/0xc0 arch/x86/kernel/apic/apic.c:1049
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 5a 3c 59 f6 48 89 ef e8 b2 b1 59 f6 e8 4d f8 83 f6 fb bf 01 00 00 00 <e8> 42 dc 4a f6 65 8b 05 f3 6a e7 74 85 c0 74 06 5d c3 cc cc cc cc
RSP: 0018:ffffc90006ff7800 EFLAGS: 00000202
RAX: 000000000000048f RBX: 0000000000000cc0 RCX: 1ffffffff2d93fdf
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff888106c79dc8 R08: 0000000000000001 R09: fffffbfff2d8a1b1
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006ff7870
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
spin_unlock_irq include/linux/spinlock.h:401 [inline]
shmem_add_to_page_cache+0x5ef/0xaf0 mm/shmem.c:830
shmem_alloc_and_add_folio+0x56b/0xb90 mm/shmem.c:1859
shmem_get_folio_gfp+0x593/0x14e0 mm/shmem.c:2355
shmem_get_folio mm/shmem.c:2461 [inline]
shmem_write_begin+0x14e/0x310 mm/shmem.c:3117
generic_perform_write+0x2bd/0x900 mm/filemap.c:4055
shmem_file_write_iter+0x111/0x140 mm/shmem.c:3293
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0xc02/0x10d0 fs/read_write.c:679
ksys_write+0x122/0x240 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f848cb9ea3f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 79 0d 03 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 bc 0d 03 00 48
RSP: 002b:00007f848d8d5d40 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f848cb9ea3f
RDX: 0000000000010000 RSI: 00007f8482200000 RDI: 0000000000000003
RBP: 000000000000023b R08: 0000000000000000 R09: 0000000000000237
R10: 00000000000003b2 R11: 0000000000000293 R12: 0000000000000003
R13: 00007f848d8d5e0c R14: 00007f848d8d5e10 R15: 00007f8482200000
</TASK>
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 55 push %rbp
6: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
b: 48 89 fd mov %rdi,%rbp
e: 48 83 c7 18 add $0x18,%rdi
12: e8 5a 3c 59 f6 call 0xf6593c71
17: 48 89 ef mov %rbp,%rdi
1a: e8 b2 b1 59 f6 call 0xf659b1d1
1f: e8 4d f8 83 f6 call 0xf683f871
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 42 dc 4a f6 call 0xf64adc71 <-- trapping instruction
2f: 65 8b 05 f3 6a e7 74 mov %gs:0x74e76af3(%rip),%eax # 0x74e76b29
36: 85 c0 test %eax,%eax
38: 74 06 je 0x40
3a: 5d pop %rbp
3b: c3 ret
3c: cc int3
3d: cc int3
3e: cc int3
3f: cc int3
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-02-01 4:35 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-08-14 0:55 WARNING: refcount bug in sctp_transport_put syzbot
2018-08-14 0:55 ` syzbot
2018-08-14 1:24 ` Marcelo Ricardo Leitner
2018-08-14 1:24 ` Marcelo Ricardo Leitner
2019-10-05 7:16 ` WARNING: refcount bug in sctp_transport_put (2) syzbot
2019-10-05 7:16 ` syzbot
-- strict thread matches above, loose matches on Subject: below --
2025-02-01 4:35 WARNING: refcount bug in sctp_transport_put YAN KANG
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.