From: syzbot <syzbot+aa245f26d42b8305d157@syzkaller.appspotmail.com>
To: davem@davemloft.net, jon.maloy@ericsson.com,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com,
tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
Subject: KASAN: use-after-free Read in tipc_sub_unsubscribe (2)
Date: Wed, 11 Apr 2018 08:02:02 -0700 [thread overview]
Message-ID: <94eb2c049236e1e93b056993eb5e@google.com> (raw)
Hello,
syzbot hit the following crash on upstream commit
b284d4d5a6785f8cd07eda2646a95782373cd01e (Tue Apr 10 19:25:30 2018 +0000)
Merge tag 'ceph-for-4.17-rc1' of git://github.com/ceph/ceph-client
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=aa245f26d42b8305d157
So far this crash happened 2 times on upstream.
C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5881855630901248
syzkaller reproducer:
https://syzkaller.appspot.com/x/repro.syz?id=5979790213382144
Raw console output:
https://syzkaller.appspot.com/x/log.txt?id=5808961445953536
Kernel config:
https://syzkaller.appspot.com/x/.config?id=-1223000601505858474
compiler: gcc (GCC) 8.0.1 20180301 (experimental)
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+aa245f26d42b8305d157@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.
R10: 0000000020b89fe4 R11: 0000000000000246 R12: 0000000000000005
R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000
Service creation failed, no memory
Failed to subscribe for {1906,0,4294967295}
==================================================================
BUG: KASAN: use-after-free in tipc_sub_unsubscribe+0x22d/0x305
net/tipc/subscr.c:167
Read of size 4 at addr ffff8801b78718d8 by task syzkaller446011/4466
CPU: 1 PID: 4466 Comm: syzkaller446011 Not tainted 4.16.0+ #19
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0xac/0x2f5 mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
tipc_sub_unsubscribe+0x22d/0x305 net/tipc/subscr.c:167
tipc_conn_delete_sub+0x32d/0x530 net/tipc/topsrv.c:245
tipc_topsrv_kern_unsubscr+0x280/0x3f0 net/tipc/topsrv.c:598
tipc_group_delete+0x2dd/0x3f0 net/tipc/group.c:231
tipc_sk_leave+0x10e/0x210 net/tipc/socket.c:2800
tipc_release+0x146/0x1290 net/tipc/socket.c:576
sock_release+0x96/0x1b0 net/socket.c:594
sock_close+0x16/0x20 net/socket.c:1149
__fput+0x34d/0x890 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x1e4/0x290 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x1aee/0x2730 kernel/exit.c:865
do_group_exit+0x16f/0x430 kernel/exit.c:968
SYSC_exit_group kernel/exit.c:979 [inline]
SyS_exit_group+0x1d/0x20 kernel/exit.c:977
do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x43f1f8
RSP: 002b:00007fff7867bac8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f1f8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004bf2e8 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000020b89fe4 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 4466:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
kmalloc include/linux/slab.h:512 [inline]
tipc_sub_subscribe+0x25a/0x6b0 net/tipc/subscr.c:143
tipc_conn_rcv_sub.isra.5+0x42c/0x7e0 net/tipc/topsrv.c:381
tipc_topsrv_kern_subscr+0x72b/0xad0 net/tipc/topsrv.c:582
tipc_group_create+0x72e/0xa50 net/tipc/group.c:194
tipc_sk_join net/tipc/socket.c:2766 [inline]
tipc_setsockopt+0x2c9/0xd70 net/tipc/socket.c:2881
__sys_setsockopt+0x1bd/0x390 net/socket.c:1903
SYSC_setsockopt net/socket.c:1914 [inline]
SyS_setsockopt+0x34/0x50 net/socket.c:1911
do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
Freed by task 4466:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kfree+0xd9/0x260 mm/slab.c:3813
tipc_sub_kref_release net/tipc/subscr.c:117 [inline]
kref_put include/linux/kref.h:70 [inline]
tipc_sub_put+0x33/0x40 net/tipc/subscr.c:122
tipc_nametbl_unsubscribe+0x52c/0xaf0 net/tipc/name_table.c:709
tipc_sub_unsubscribe+0x6d/0x305 net/tipc/subscr.c:166
tipc_conn_delete_sub+0x32d/0x530 net/tipc/topsrv.c:245
tipc_topsrv_kern_unsubscr+0x280/0x3f0 net/tipc/topsrv.c:598
tipc_group_delete+0x2dd/0x3f0 net/tipc/group.c:231
tipc_sk_leave+0x10e/0x210 net/tipc/socket.c:2800
tipc_release+0x146/0x1290 net/tipc/socket.c:576
sock_release+0x96/0x1b0 net/socket.c:594
sock_close+0x16/0x20 net/socket.c:1149
__fput+0x34d/0x890 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x1e4/0x290 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x1aee/0x2730 kernel/exit.c:865
do_group_exit+0x16f/0x430 kernel/exit.c:968
SYSC_exit_group kernel/exit.c:979 [inline]
SyS_exit_group+0x1d/0x20 kernel/exit.c:977
do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
The buggy address belongs to the object at ffff8801b7871840
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 152 bytes inside of
256-byte region [ffff8801b7871840, ffff8801b7871940)
The buggy address belongs to the page:
page:ffffea0006de1c40 count:1 mapcount:0 mapping:ffff8801b78710c0 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffff8801b78710c0 0000000000000000 000000010000000c
raw: ffffea00071ce1a0 ffffea0006db8fa0 ffff8801dac007c0 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801b7871780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801b7871800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> ffff8801b7871880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801b7871900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8801b7871980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@googlegroups.com.
syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.
reply other threads:[~2018-04-11 15:02 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=94eb2c049236e1e93b056993eb5e@google.com \
--to=syzbot+aa245f26d42b8305d157@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=jon.maloy@ericsson.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tipc-discussion@lists.sourceforge.net \
--cc=ying.xue@windriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.