Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine



syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
Warning: Permanently added '[localhost]:61150' (ED25519) to the list of known hosts.
2026/03/09 08:11:07 parsed 1 programs
[  100.778155][ T5308] cgroup: Unknown subsys name 'net'
[  100.824718][ T5308] cgroup: Unknown subsys name 'cpuset'
[  100.835966][ T5308] cgroup: Unknown subsys name 'rlimit'
[  102.495043][    T9] cfg80211: failed to load regulatory.db
[  143.453170][ T1316] ieee802154 phy0 wpan0: encryption failed: -22
[  143.456980][ T1316] ieee802154 phy1 wpan1: encryption failed: -22
[  151.790041][ T1009] ata1.00: exception Emask 0x0 SAct 0x200000 SErr 0x0 action 0x6 frozen
[  151.795444][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  151.798620][ T1009] ata1.00: cmd 61/00:a8:36:c1:04/20:00:00:00:00/40 tag 21 ncq dma 4194304 ou
[  151.798620][ T1009]          res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[  151.807230][ T1009] ata1.00: status: { DRDY }
[  151.810358][ T1009] ata1: hard resetting link
[  152.133478][ T1009] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[  152.138661][ T1009] ata1.00: configured for UDMA/100
[  152.142424][ T1009] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[  152.180979][ T1009] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[  152.184589][ T1009] ata1: failed to read log page 10h (errno=-5)
[  152.187583][ T1009] ata1.00: exception Emask 0x1 SAct 0x76 SErr 0x0 action 0x0
[  152.200268][ T1009] ata1.00: irq_stat 0x41000000
[  152.202658][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  152.205600][ T1009] ata1.00: cmd 61/00:08:36:c1:04/20:00:00:00:00/40 tag 1 ncq dma 4194304 ou
[  152.205600][ T1009]          res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  152.233239][ T1009] ata1.00: status: { DRDY }
[  152.240616][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  152.243710][ T1009] ata1.00: cmd 61/08:10:4e:04:10/00:00:00:00:00/40 tag 2 ncq dma 4096 out
[  152.243710][ T1009]          res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  152.257043][ T1009] ata1.00: status: { DRDY }
[  152.260632][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  152.263657][ T1009] ata1.00: cmd 61/00:20:36:01:05/20:00:00:00:00/40 tag 4 ncq dma 4194304 ou
[  152.263657][ T1009]          res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  152.272096][ T1009] ata1.00: status: { DRDY }
[  152.274461][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  152.277407][ T1009] ata1.00: cmd 61/00:28:36:21:05/20:00:00:00:00/40 tag 5 ncq dma 4194304 ou
[  152.277407][ T1009]          res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  152.286072][ T1009] ata1.00: status: { DRDY }
[  152.288291][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  152.291815][ T1009] ata1.00: cmd 61/f8:30:36:41:05/0b:00:00:00:00/40 tag 6 ncq dma 1568768 ou
[  152.291815][ T1009]          res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  152.300643][ T1009] ata1.00: status: { DRDY }
[  152.304040][ T1009] ata1.00: configured for UDMA/100
[  152.307255][ T1009] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[  152.331089][ T1009] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[  152.334242][ T1009] ata1: failed to read log page 10h (errno=-5)
[  152.337932][ T1009] ata1.00: NCQ disabled due to excessive errors
[  152.341762][ T1009] ata1.00: exception Emask 0x1 SAct 0x800 SErr 0x0 action 0x0
[  152.345331][ T1009] ata1.00: irq_stat 0x41000008
[  152.347892][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  152.351796][ T1009] ata1.00: cmd 61/00:58:36:c1:04/20:00:00:00:00/40 tag 11 ncq dma 4194304 ou
[  152.351796][ T1009]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  152.361851][ T1009] ata1.00: status: { DRDY }
[  152.364344][ T1009] ata1.00: error: { ABRT }
[  152.367708][ T1009] ata1.00: configured for UDMA/100
[  152.372040][ T1009] ata1: EH complete
Setting up swapspace version 1, size = 127995904 bytes
[  154.342839][ T5308] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
qemu-system-x86_64: hw/ide/core.c:934: ide_dma_cb: Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
Connection to localhost closed by remote host.


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build997279610=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/ccdnCVXi.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         1f318b96 Linux 7.0-rc3
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=108a4806580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine



Tested on:

commit:         1f318b96 Linux 7.0-rc3
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=125e6016580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13fc375a580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine



Tested on:

commit:         1f318b96 Linux 7.0-rc3
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17aa894a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16fbaa02580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine



qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
Warning: Permanently added '[localhost]:8651' (ED25519) to the list of known hosts.
2026/03/09 07:34:15 parsed 1 programs
[   61.038498][ T5297] cgroup: Unknown subsys name 'net'
[   61.082207][ T5297] cgroup: Unknown subsys name 'cpuset'
[   61.085713][ T5297] cgroup: Unknown subsys name 'rlimit'
[   76.021725][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[   76.024057][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[   86.265587][ T1360] cfg80211: failed to load regulatory.db
[  118.279844][ T1009] ata1.00: exception Emask 0x0 SAct 0x4000 SErr 0x0 action 0x6 frozen
[  118.282758][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  118.284895][ T1009] ata1.00: cmd 61/00:70:36:81:04/20:00:00:00:00/40 tag 14 ncq dma 4194304 ou
[  118.284895][ T1009]          res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[  118.290867][ T1009] ata1.00: status: { DRDY }
[  118.292518][ T1009] ata1: hard resetting link
[  118.613228][ T1009] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[  118.617551][ T1009] ata1.00: configured for UDMA/100
[  118.619916][ T1009] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[  118.640373][ T1009] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[  118.642754][ T1009] ata1: failed to read log page 10h (errno=-5)
[  118.645021][ T1009] ata1.00: exception Emask 0x1 SAct 0x7c SErr 0x0 action 0x0
[  118.647590][ T1009] ata1.00: irq_stat 0x41000000
[  118.649279][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  118.651718][ T1009] ata1.00: cmd 61/00:10:5e:12:05/20:00:00:00:00/40 tag 2 ncq dma 4194304 ou
[  118.651718][ T1009]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  118.657603][ T1009] ata1.00: status: { DRDY }
[  118.659224][ T1009] ata1.00: error: { ABRT }
[  118.661112][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  118.663256][ T1009] ata1.00: cmd 61/d8:18:5e:32:05/0e:00:00:00:00/40 tag 3 ncq dma 1945600 ou
[  118.663256][ T1009]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  118.669137][ T1009] ata1.00: status: { DRDY }
[  118.670973][ T1009] ata1.00: error: { ABRT }
[  118.672562][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  118.674666][ T1009] ata1.00: cmd 61/60:20:36:41:05/05:00:00:00:00/40 tag 4 ncq dma 704512 out
[  118.674666][ T1009]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  118.680766][ T1009] ata1.00: status: { DRDY }
[  118.682372][ T1009] ata1.00: error: { ABRT }
[  118.683945][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  118.686052][ T1009] ata1.00: cmd 61/00:28:96:46:05/20:00:00:00:00/40 tag 5 ncq dma 4194304 ou
[  118.686052][ T1009]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  118.692196][ T1009] ata1.00: status: { DRDY }
[  118.693803][ T1009] ata1.00: error: { ABRT }
[  118.695419][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  118.697514][ T1009] ata1.00: cmd 61/a0:30:96:66:05/1a:00:00:00:00/40 tag 6 ncq dma 3489792 ou
[  118.697514][ T1009]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  118.703662][ T1009] ata1.00: status: { DRDY }
[  118.705269][ T1009] ata1.00: error: { ABRT }
[  118.707646][ T1009] ata1.00: configured for UDMA/100
[  118.710038][ T1009] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[  118.753868][ T1009] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[  118.756214][ T1009] ata1: failed to read log page 10h (errno=-5)
[  118.758355][ T1009] ata1.00: NCQ disabled due to excessive errors
[  118.770980][ T1009] ata1.00: exception Emask 0x1 SAct 0x1800 SErr 0x0 action 0x0
[  118.773616][ T1009] ata1.00: irq_stat 0x41000008
[  118.775342][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  118.777442][ T1009] ata1.00: cmd 61/00:58:36:81:04/20:00:00:00:00/40 tag 11 ncq dma 4194304 ou
[  118.777442][ T1009]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  118.800358][ T1009] ata1.00: status: { DRDY }
[  118.802026][ T1009] ata1.00: error: { ABRT }
[  118.803601][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  118.805715][ T1009] ata1.00: cmd 61/00:60:5e:12:05/20:00:00:00:00/40 tag 12 ncq dma 4194304 ou
[  118.805715][ T1009]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  118.815619][ T1009] ata1.00: status: { DRDY }
[  118.817308][ T1009] ata1.00: error: { ABRT }
[  118.819854][ T1009] ata1.00: configured for UDMA/100
[  118.821947][ T1009] ata1: EH complete
qemu-system-x86_64: hw/ide/core.c:934: ide_dma_cb: Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
Connection to localhost closed by remote host.


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2930426070=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/cckeeX7G.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         1f318b96 Linux 7.0-rc3
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15a98016580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine



Tested on:

commit:         1f318b96 Linux 7.0-rc3
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14ea28ba580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=122d03aa580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in sock_def_readable

==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline]
BUG: KASAN: slab-use-after-free in wq_has_sleeper include/linux/wait.h:161 [inline]
BUG: KASAN: slab-use-after-free in skwq_has_sleeper include/net/sock.h:2404 [inline]
BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
Read of size 8 at addr ffff888011ead1c0 by task dhcpcd/5015

CPU: 0 UID: 0 PID: 5015 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xba/0x230 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 list_empty include/linux/list.h:381 [inline]
 waitqueue_active include/linux/wait.h:127 [inline]
 wq_has_sleeper include/linux/wait.h:161 [inline]
 skwq_has_sleeper include/net/sock.h:2404 [inline]
 sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
 send_to_lecd+0x353/0x690 net/atm/lec.c:539
 lec_arp_resolve net/atm/lec.c:1792 [inline]
 lec_start_xmit+0xec0/0x2660 net/atm/lec.c:285
 __netdev_start_xmit include/linux/netdevice.h:5292 [inline]
 netdev_start_xmit include/linux/netdevice.h:5301 [inline]
 xmit_one net/core/dev.c:3871 [inline]
 dev_hard_start_xmit+0x2d8/0x870 net/core/dev.c:3887
 sch_direct_xmit+0x251/0x4c0 net/sched/sch_generic.c:347
 __dev_xmit_skb net/core/dev.c:4186 [inline]
 __dev_queue_xmit+0x1550/0x3890 net/core/dev.c:4802
 lapb_data_transmit+0x90/0xb0 net/lapb/lapb_iface.c:447
 lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
 lapb_establish_data_link+0x89/0xe0 net/lapb/lapb_out.c:-1
 lapb_device_event+0x4e1/0x670 net/lapb/lapb_iface.c:-1
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
 call_netdevice_notifiers net/core/dev.c:2301 [inline]
 __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9803
 netif_change_flags+0xe8/0x1a0 net/core/dev.c:9832
 dev_change_flags+0x130/0x260 net/core/dev_api.c:68
 devinet_ioctl+0x9f2/0x1b30 net/ipv4/devinet.c:1199
 inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1009
 sock_do_ioctl+0x101/0x320 net/socket.c:1254
 sock_ioctl+0x5c6/0x7f0 net/socket.c:1375
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0bc372b378
Code: 00 00 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 07 89 d0 c3 0f 1f 40 00 48 8b 15 49 3a 0d
RSP: 002b:00007fff9b806dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000018 RCX: 00007f0bc372b378
RDX: 00007fff9b816fc0 RSI: 0000000000008914 RDI: 0000000000000018
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9b827160
R13: 00007f0bc362b708 R14: 0000000000000028 R15: 0000000000008914
 </TASK>

Allocated by task 5796:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4542 [inline]
 slab_alloc_node mm/slub.c:4869 [inline]
 kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4888
 sock_alloc_inode+0x28/0xc0 net/socket.c:322
 alloc_inode+0x6a/0x1b0 fs/inode.c:347
 new_inode_pseudo include/linux/fs.h:3003 [inline]
 sock_alloc net/socket.c:637 [inline]
 __sock_create+0x12d/0x9d0 net/socket.c:1569
 sock_create net/socket.c:1663 [inline]
 __sys_socket_create net/socket.c:1700 [inline]
 __sys_socket+0xd6/0x1b0 net/socket.c:1747
 __do_sys_socket net/socket.c:1761 [inline]
 __se_sys_socket net/socket.c:1759 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1759
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 15:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2692 [inline]
 slab_free mm/slub.c:6168 [inline]
 kmem_cache_free+0x187/0x630 mm/slub.c:6298
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
 handle_softirqs+0x22a/0x870 kernel/softirq.c:622
 run_ksoftirqd+0x36/0x60 kernel/softirq.c:1063
 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
 __call_rcu_common kernel/rcu/tree.c:3131 [inline]
 call_rcu+0xee/0x890 kernel/rcu/tree.c:3251
 destroy_inode fs/inode.c:402 [inline]
 evict+0x95b/0xb10 fs/inode.c:870
 __dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
 finish_dput+0xc9/0x480 fs/dcache.c:879
 __fput+0x691/0xa70 fs/file_table.c:477
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888011ead140
 which belongs to the cache sock_inode_cache of size 1344
The buggy address is located 128 bytes inside of
 freed 1344-byte region [ffff888011ead140, ffff888011ead680)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eac
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888043587181
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b7b0140 dead000000000100 dead000000000122
raw: 0000000000000000 00000008000b000b 00000000f5000000 ffff888043587181
head: 00fff00000000040 ffff88801b7b0140 dead000000000100 dead000000000122
head: 0000000000000000 00000008000b000b 00000000f5000000 ffff888043587181
head: 00fff00000000002 ffffea000047ab01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5302, tgid 5302 (sshd-session), ts 94001934717, free_ts 93590589059
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
 alloc_slab_page mm/slub.c:3296 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3485
 new_slab mm/slub.c:3543 [inline]
 refill_objects+0x331/0x3c0 mm/slub.c:7178
 __pcs_replace_empty_main+0x2f9/0x5e0 mm/slub.c:-1
 alloc_from_pcs mm/slub.c:4720 [inline]
 slab_alloc_node mm/slub.c:4854 [inline]
 kmem_cache_alloc_lru_noprof+0x37c/0x640 mm/slub.c:4888
 sock_alloc_inode+0x28/0xc0 net/socket.c:322
 alloc_inode+0x6a/0x1b0 fs/inode.c:347
 new_inode_pseudo include/linux/fs.h:3003 [inline]
 sock_alloc net/socket.c:637 [inline]
 __sock_create+0x12d/0x9d0 net/socket.c:1569
 sock_create net/socket.c:1663 [inline]
 __sys_socket_create net/socket.c:1700 [inline]
 __sys_socket+0xd6/0x1b0 net/socket.c:1747
 __do_sys_socket net/socket.c:1761 [inline]
 __se_sys_socket net/socket.c:1759 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1759
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5297 tgid 5297 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 free_unref_folios+0xed5/0x16d0 mm/page_alloc.c:3040
 folios_put_refs+0x789/0x8d0 mm/swap.c:1002
 free_pages_and_swap_cache+0x2e7/0x5b0 mm/swap_state.c:423
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:398 [inline]
 tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:405
 tlb_finish_mmu+0xf9/0x230 mm/mmu_gather.c:530
 unmap_region+0x2a5/0x330 mm/vma.c:488
 vms_clear_ptes mm/vma.c:1284 [inline]
 vms_complete_munmap_vmas+0x493/0xc60 mm/vma.c:1326
 do_vmi_align_munmap+0x3b7/0x4b0 mm/vma.c:1585
 do_vmi_munmap+0x252/0x2d0 mm/vma.c:1633
 __vm_munmap+0x22c/0x3d0 mm/vma.c:3254
 __do_sys_munmap mm/mmap.c:1078 [inline]
 __se_sys_munmap mm/mmap.c:1075 [inline]
 __x64_sys_munmap+0x60/0x70 mm/mmap.c:1075
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888011ead080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff888011ead100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888011ead180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff888011ead200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888011ead280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         1f318b96 Linux 7.0-rc3
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=123f0d52580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12d228ba580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine



syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x15e000)
[   97.361247][ T1361] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:63864' (ED25519) to the list of known hosts.
2026/03/09 05:12:51 parsed 1 programs
[  105.505495][ T5312] cgroup: Unknown subsys name 'net'
[  105.556579][ T5312] cgroup: Unknown subsys name 'cpuset'
[  105.564965][ T5312] cgroup: Unknown subsys name 'rlimit'
[  143.435346][ T1314] ieee802154 phy0 wpan0: encryption failed: -22
[  143.438624][ T1314] ieee802154 phy1 wpan1: encryption failed: -22
[  156.251964][ T1010] ata1.00: NCQ disabled due to excessive errors
[  156.255266][ T1010] ata1.00: exception Emask 0x0 SAct 0x4000 SErr 0x0 action 0x6 frozen
[  156.259683][ T1010] ata1.00: failed command: WRITE FPDMA QUEUED
[  156.263482][ T1010] ata1.00: cmd 61/f0:70:0e:cb:04/0a:00:00:00:00/40 tag 14 ncq dma 1433600 ou
[  156.263482][ T1010]          res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[  156.272729][ T1010] ata1.00: status: { DRDY }
[  156.274976][ T1010] ata1: hard resetting link
[  156.595684][ T1010] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[  156.600550][ T1010] ata1.00: configured for UDMA/100
[  156.603826][ T1010] ata1: EH complete
qemu-system-x86_64: hw/ide/core.c:934: ide_dma_cb: Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
Connection to localhost closed by remote host.


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build951511429=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/ccKv8fCF.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         1f318b96 Linux 7.0-rc3
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17ad875a580000

[syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    6de23f81a5e0 Linux 7.0-rc1
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=148d655a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=3b4642149033fe7c
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1085e55a580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12e6d9e6580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-6de23f81.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5258f38d5768/vmlinux-6de23f81.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a7730b97aa5a/bzImage-6de23f81.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline]
BUG: KASAN: slab-use-after-free in wq_has_sleeper include/linux/wait.h:161 [inline]
BUG: KASAN: slab-use-after-free in skwq_has_sleeper include/net/sock.h:2404 [inline]
BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
Read of size 8 at addr ffff888047cb0c00 by task kworker/0:4/5308

CPU: 0 UID: 0 PID: 5308 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: mld mld_ifc_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xba/0x230 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 list_empty include/linux/list.h:381 [inline]
 waitqueue_active include/linux/wait.h:127 [inline]
 wq_has_sleeper include/linux/wait.h:161 [inline]
 skwq_has_sleeper include/net/sock.h:2404 [inline]
 sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
 send_to_lecd+0x322/0x600 net/atm/lec.c:538
 lec_arp_resolve net/atm/lec.c:1787 [inline]
 lec_start_xmit+0xec0/0x2660 net/atm/lec.c:285
 __netdev_start_xmit include/linux/netdevice.h:5275 [inline]
 netdev_start_xmit include/linux/netdevice.h:5284 [inline]
 xmit_one net/core/dev.c:3871 [inline]
 dev_hard_start_xmit+0x2d8/0x870 net/core/dev.c:3887
 sch_direct_xmit+0x251/0x4c0 net/sched/sch_generic.c:347
 __dev_xmit_skb net/core/dev.c:4186 [inline]
 __dev_queue_xmit+0x1538/0x38a0 net/core/dev.c:4802
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x25c/0x610 net/ipv6/ip6_output.c:219
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246
 NF_HOOK+0xa2/0x3a0 include/linux/netfilter.h:318
 mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
 mld_send_cr net/ipv6/mcast.c:2154 [inline]
 mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 6850:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4501 [inline]
 slab_alloc_node mm/slub.c:4830 [inline]
 kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4849
 sock_alloc_inode+0x28/0xc0 net/socket.c:322
 alloc_inode+0x6a/0x1b0 fs/inode.c:347
 new_inode_pseudo include/linux/fs.h:3003 [inline]
 sock_alloc net/socket.c:637 [inline]
 __sock_create+0x12d/0x9d0 net/socket.c:1569
 sock_create net/socket.c:1663 [inline]
 __sys_socket_create net/socket.c:1700 [inline]
 __sys_socket+0xd6/0x1b0 net/socket.c:1747
 __do_sys_socket net/socket.c:1761 [inline]
 __se_sys_socket net/socket.c:1759 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1759
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6859:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2687 [inline]
 slab_free mm/slub.c:6124 [inline]
 kmem_cache_free+0x187/0x630 mm/slub.c:6254
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
 handle_softirqs+0x22a/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
 __call_rcu_common kernel/rcu/tree.c:3131 [inline]
 call_rcu+0xee/0x890 kernel/rcu/tree.c:3251
 destroy_inode fs/inode.c:402 [inline]
 evict+0x95b/0xb10 fs/inode.c:870
 __dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
 finish_dput+0xc9/0x480 fs/dcache.c:879
 __fput+0x691/0xa70 fs/file_table.c:477
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888047cb0b80
 which belongs to the cache sock_inode_cache of size 1344
The buggy address is located 128 bytes inside of
 freed 1344-byte region [ffff888047cb0b80, ffff888047cb10c0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x47cb0
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888038584a01
flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000040 ffff888030419c80 dead000000000100 dead000000000122
raw: 0000000000000000 00000008000b000b 00000000f5000000 ffff888038584a01
head: 04fff00000000040 ffff888030419c80 dead000000000100 dead000000000122
head: 0000000000000000 00000008000b000b 00000000f5000000 ffff888038584a01
head: 04fff00000000002 ffffea00011f2c01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5295, tgid 5295 (syz-execprog), ts 87351971632, free_ts 76295178870
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
 alloc_slab_page mm/slub.c:3255 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3444
 new_slab mm/slub.c:3502 [inline]
 refill_objects+0x331/0x3c0 mm/slub.c:7134
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x2b9/0x620 mm/slub.c:4578
 alloc_from_pcs mm/slub.c:4681 [inline]
 slab_alloc_node mm/slub.c:4815 [inline]
 kmem_cache_alloc_lru_noprof+0x37c/0x640 mm/slub.c:4849
 sock_alloc_inode+0x28/0xc0 net/socket.c:322
 alloc_inode+0x6a/0x1b0 fs/inode.c:347
 new_inode_pseudo include/linux/fs.h:3003 [inline]
 sock_alloc net/socket.c:637 [inline]
 __sock_create+0x12d/0x9d0 net/socket.c:1569
 mptcp_subflow_create_socket+0xfb/0x800 net/mptcp/subflow.c:1788
 __mptcp_socket_create net/mptcp/protocol.c:110 [inline]
 __mptcp_nmpc_sk+0x155/0x790 net/mptcp/protocol.c:142
 mptcp_setsockopt_v6 net/mptcp/sockopt.c:399 [inline]
 mptcp_setsockopt+0xe4a/0x36a0 net/mptcp/sockopt.c:922
 do_sock_setsockopt+0x270/0x400 net/socket.c:2322
 __sys_setsockopt net/socket.c:2347 [inline]
 __do_sys_setsockopt net/socket.c:2353 [inline]
 __se_sys_setsockopt net/socket.c:2350 [inline]
 __x64_sys_setsockopt+0x18a/0x210 net/socket.c:2350
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
page last free pid 5281 tgid 5281 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
 __slab_free+0x263/0x2b0 mm/slub.c:5532
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4501 [inline]
 slab_alloc_node mm/slub.c:4830 [inline]
 __kmalloc_cache_noprof+0x2ba/0x660 mm/slub.c:5334
 kmalloc_noprof include/linux/slab.h:962 [inline]
 tomoyo_print_header security/tomoyo/audit.c:156 [inline]
 tomoyo_init_log+0x195/0x1fb0 security/tomoyo/audit.c:255
 tomoyo_supervisor+0x353/0x1570 security/tomoyo/common.c:2232
 tomoyo_audit_env_log security/tomoyo/environ.c:37 [inline]
 tomoyo_env_perm+0x151/0x1f0 security/tomoyo/environ.c:64
 tomoyo_environ security/tomoyo/domain.c:673 [inline]
 tomoyo_find_next_domain+0x15cb/0x1aa0 security/tomoyo/domain.c:889
 tomoyo_bprm_check_security+0x11b/0x180 security/tomoyo/tomoyo.c:102
 security_bprm_check+0x85/0x240 security/security.c:794
 search_binary_handler fs/exec.c:1654 [inline]
 exec_binprm fs/exec.c:1696 [inline]
 bprm_execve+0x896/0x1460 fs/exec.c:1748
 do_execveat_common+0x50d/0x690 fs/exec.c:1846
 __do_sys_execve fs/exec.c:1930 [inline]
 __se_sys_execve fs/exec.c:1924 [inline]
 __x64_sys_execve+0x97/0xc0 fs/exec.c:1924
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94

Memory state around the buggy address:
 ffff888047cb0b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888047cb0b80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888047cb0c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888047cb0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888047cb0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[Jiayuan Chen]

#syz test

diff --git a/net/atm/lec.c b/net/atm/lec.c
index 7e6fc2bd40ac..7d99ba8ba3b4 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -139,6 +139,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
 	 */
 	buff = skb->data + skb->dev->hard_header_len;
 	if (*buff++ == 0x42 && *buff++ == 0x42 && *buff++ == 0x03) {
+		struct atm_vcc *vcc;
 		struct sock *sk;
 		struct sk_buff *skb2;
 		struct atmlec_msg *mesg;
@@ -154,10 +155,18 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
 					/* 0x01 is topology change */

 		priv = netdev_priv(dev);
-		atm_force_charge(priv->lecd, skb2->truesize);
-		sk = sk_atm(priv->lecd);
-		skb_queue_tail(&sk->sk_receive_queue, skb2);
-		sk->sk_data_ready(sk);
+
+		rcu_read_lock();
+		vcc = rcu_dereference(priv->lecd);
+		if (vcc) {
+			atm_force_charge(vcc, skb2->truesize);
+			sk = sk_atm(vcc);
+			skb_queue_tail(&sk->sk_receive_queue, skb2);
+			sk->sk_data_ready(sk);
+		} else {
+			dev_kfree_skb(skb2);
+		}
+		rcu_read_unlock();
 	}
 }
 #endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
 	int is_rdesc;

 	pr_debug("called\n");
-	if (!priv->lecd) {
+	if (!rcu_access_pointer(priv->lecd)) {
 		pr_info("%s:No lecd attached\n", dev->name);
 		dev->stats.tx_errors++;
 		netif_stop_queue(dev);
@@ -440,6 +449,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
 		if (br_fdb_test_addr_hook(dev, mesg->content.proxy.mac_addr)) {
 			/* hit from bridge table, send LE_ARP_RESPONSE */
 			struct sk_buff *skb2;
+			struct atm_vcc *lecd;
 			struct sock *sk;

 			pr_debug("%s: entry found, responding to zeppelin\n",
@@ -449,10 +459,18 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
 				break;
 			skb2->len = sizeof(struct atmlec_msg);
 			skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
-			atm_force_charge(priv->lecd, skb2->truesize);
-			sk = sk_atm(priv->lecd);
-			skb_queue_tail(&sk->sk_receive_queue, skb2);
-			sk->sk_data_ready(sk);
+
+			rcu_read_lock();
+			lecd = rcu_dereference(priv->lecd);
+			if (lecd) {
+				atm_force_charge(lecd, skb2->truesize);
+				sk = sk_atm(lecd);
+				skb_queue_tail(&sk->sk_receive_queue, skb2);
+				sk->sk_data_ready(sk);
+			} else {
+				dev_kfree_skb(skb2);
+			}
+			rcu_read_unlock();
 		}
 	}
 #endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -472,7 +490,8 @@ static void lec_atm_close(struct atm_vcc *vcc)
 	struct net_device *dev = (struct net_device *)vcc->proto_data;
 	struct lec_priv *priv = netdev_priv(dev);

-	priv->lecd = NULL;
+	rcu_assign_pointer(priv->lecd, NULL);
+	synchronize_rcu();
 	/* Do something needful? */

 	netif_stop_queue(dev);
@@ -510,15 +529,25 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
 	     const unsigned char *mac_addr, const unsigned char *atm_addr,
 	     struct sk_buff *data)
 {
+	struct atm_vcc *vcc;
 	struct sock *sk;
 	struct sk_buff *skb;
 	struct atmlec_msg *mesg;

-	if (!priv || !priv->lecd)
+	if (!priv)
+		return -1;
+
+	rcu_read_lock();
+	vcc = rcu_dereference(priv->lecd);
+	if (!vcc) {
+		rcu_read_unlock();
 		return -1;
+	}
 	skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
-	if (!skb)
+	if (!skb) {
+		rcu_read_unlock();
 		return -1;
+	}
 	skb->len = sizeof(struct atmlec_msg);
 	mesg = (struct atmlec_msg *)skb->data;
 	memset(mesg, 0, sizeof(struct atmlec_msg));
@@ -532,18 +561,19 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
 	if (atm_addr)
 		memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);

-	atm_force_charge(priv->lecd, skb->truesize);
-	sk = sk_atm(priv->lecd);
+	atm_force_charge(vcc, skb->truesize);
+	sk = sk_atm(vcc);
 	skb_queue_tail(&sk->sk_receive_queue, skb);
 	sk->sk_data_ready(sk);

 	if (data != NULL) {
 		pr_debug("about to send %d bytes of data\n", data->len);
-		atm_force_charge(priv->lecd, data->truesize);
+		atm_force_charge(vcc, data->truesize);
 		skb_queue_tail(&sk->sk_receive_queue, data);
 		sk->sk_data_ready(sk);
 	}

+	rcu_read_unlock();
 	return 0;
 }

@@ -618,7 +648,8 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)

 		atm_return(vcc, skb->truesize);
 		if (*(__be16 *) skb->data == htons(priv->lecid) ||
-		    !priv->lecd || !(dev->flags & IFF_UP)) {
+		    !rcu_access_pointer(priv->lecd) ||
+		    !(dev->flags & IFF_UP)) {
 			/*
 			 * Probably looping back, or if lecd is missing,
 			 * lecd has gone down
@@ -753,12 +784,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
 		priv = netdev_priv(dev_lec[i]);
 	} else {
 		priv = netdev_priv(dev_lec[i]);
-		if (priv->lecd)
+		if (rcu_access_pointer(priv->lecd))
 			return -EADDRINUSE;
 	}
 	lec_arp_init(priv);
 	priv->itfnum = i;	/* LANE2 addition */
-	priv->lecd = vcc;
+	rcu_assign_pointer(priv->lecd, vcc);
 	vcc->dev = &lecatm_dev;
 	vcc_insert_socket(sk_atm(vcc));

diff --git a/net/atm/lec.h b/net/atm/lec.h
index be0e2667bd8c..ec85709bf818 100644
--- a/net/atm/lec.h
+++ b/net/atm/lec.h
@@ -91,7 +91,7 @@ struct lec_priv {
 						 */
 	spinlock_t lec_arp_lock;
 	struct atm_vcc *mcast_vcc;		/* Default Multicast Send VCC */
-	struct atm_vcc *lecd;
+	struct atm_vcc __rcu *lecd;
 	struct delayed_work lec_arp_work;	/* C10 */
 	unsigned int maximum_unknown_frame_count;
 						/*

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to copy syz-execprog to VM: failed to run ["scp" "-P" "48817" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-execprog" "root@localhost:/syz-execprog"]: exit status 255



syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3224921581=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/cc2JgryH.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         1f318b96 Linux 7.0-rc3
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1528375a580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[Hillf Danton]

#syz test

--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -471,12 +471,14 @@ static void lec_atm_close(struct atm_vcc
 	struct sk_buff *skb;
 	struct net_device *dev = (struct net_device *)vcc->proto_data;
 	struct lec_priv *priv = netdev_priv(dev);
+	struct sock *sk = sk_atm(priv->lecd);
 
 	priv->lecd = NULL;
 	/* Do something needful? */
 
 	netif_stop_queue(dev);
 	lec_arp_destroy(priv);
+	sock_put(sk);
 
 	if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
 		pr_info("%s closing with messages pending\n", dev->name);
@@ -761,6 +763,7 @@ static int lecd_attach(struct atm_vcc *v
 	priv->lecd = vcc;
 	vcc->dev = &lecatm_dev;
 	vcc_insert_socket(sk_atm(vcc));
+	sock_hold(sk_atm(vcc));
 
 	vcc->proto_data = dev_lec[i];
 	set_bit(ATM_VF_META, &vcc->flags);
--

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in sock_def_readable

==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline]
BUG: KASAN: slab-use-after-free in wq_has_sleeper include/linux/wait.h:161 [inline]
BUG: KASAN: slab-use-after-free in skwq_has_sleeper include/net/sock.h:2404 [inline]
BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
Read of size 8 at addr ffff88804a44dd40 by task kworker/0:3/1105

CPU: 0 UID: 0 PID: 1105 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: mld mld_ifc_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xba/0x230 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 list_empty include/linux/list.h:381 [inline]
 waitqueue_active include/linux/wait.h:127 [inline]
 wq_has_sleeper include/linux/wait.h:161 [inline]
 skwq_has_sleeper include/net/sock.h:2404 [inline]
 sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
 send_to_lecd+0x322/0x600 net/atm/lec.c:540
 lec_arp_resolve net/atm/lec.c:1794 [inline]
 lec_start_xmit+0xec0/0x2660 net/atm/lec.c:285
 __netdev_start_xmit include/linux/netdevice.h:5292 [inline]
 netdev_start_xmit include/linux/netdevice.h:5301 [inline]
 xmit_one net/core/dev.c:3871 [inline]
 dev_hard_start_xmit+0x2d8/0x870 net/core/dev.c:3887
 sch_direct_xmit+0x251/0x4c0 net/sched/sch_generic.c:347
 __dev_xmit_skb net/core/dev.c:4186 [inline]
 __dev_queue_xmit+0x1550/0x3890 net/core/dev.c:4802
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x2e5/0x740 net/ipv6/ip6_output.c:219
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246
 dst_output include/net/dst.h:470 [inline]
 NF_HOOK+0x177/0x4f0 include/linux/netfilter.h:318
 mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
 mld_send_cr net/ipv6/mcast.c:2154 [inline]
 mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5809:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4542 [inline]
 slab_alloc_node mm/slub.c:4869 [inline]
 kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4888
 sock_alloc_inode+0x28/0xc0 net/socket.c:322
 alloc_inode+0x6a/0x1b0 fs/inode.c:347
 new_inode_pseudo include/linux/fs.h:3003 [inline]
 sock_alloc net/socket.c:637 [inline]
 __sock_create+0x12d/0x9d0 net/socket.c:1569
 sock_create net/socket.c:1663 [inline]
 __sys_socket_create net/socket.c:1700 [inline]
 __sys_socket+0xd6/0x1b0 net/socket.c:1747
 __do_sys_socket net/socket.c:1761 [inline]
 __se_sys_socket net/socket.c:1759 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1759
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5818:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2692 [inline]
 slab_free mm/slub.c:6168 [inline]
 kmem_cache_free+0x187/0x630 mm/slub.c:6298
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
 handle_softirqs+0x22a/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
 __call_rcu_common kernel/rcu/tree.c:3131 [inline]
 call_rcu+0xee/0x890 kernel/rcu/tree.c:3251
 destroy_inode fs/inode.c:402 [inline]
 evict+0x95b/0xb10 fs/inode.c:870
 __dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
 finish_dput+0xc9/0x480 fs/dcache.c:879
 __fput+0x691/0xa70 fs/file_table.c:477
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88804a44dcc0
 which belongs to the cache sock_inode_cache of size 1344
The buggy address is located 128 bytes inside of
 freed 1344-byte region [ffff88804a44dcc0, ffff88804a44e200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4a44c
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88804a44ff41
flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000040 ffff888030465500 dead000000000122 0000000000000000
raw: 0000000000000000 00000008000b000b 00000000f5000000 ffff88804a44ff41
head: 04fff00000000040 ffff888030465500 dead000000000122 0000000000000000
head: 0000000000000000 00000008000b000b 00000000f5000000 ffff88804a44ff41
head: 04fff00000000002 ffffea0001291301 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5752, tgid 5752 (syz-executor), ts 178422438569, free_ts 113142646262
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
 alloc_slab_page mm/slub.c:3296 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3485
 new_slab mm/slub.c:3543 [inline]
 refill_objects+0x331/0x3c0 mm/slub.c:7178
 __pcs_replace_empty_main+0x2f9/0x5e0 mm/slub.c:-1
 alloc_from_pcs mm/slub.c:4720 [inline]
 slab_alloc_node mm/slub.c:4854 [inline]
 kmem_cache_alloc_lru_noprof+0x37c/0x640 mm/slub.c:4888
 sock_alloc_inode+0x28/0xc0 net/socket.c:322
 alloc_inode+0x6a/0x1b0 fs/inode.c:347
 new_inode_pseudo include/linux/fs.h:3003 [inline]
 sock_alloc net/socket.c:637 [inline]
 __sock_create+0x12d/0x9d0 net/socket.c:1569
 sock_create net/socket.c:1663 [inline]
 __sys_socket_create net/socket.c:1700 [inline]
 __sys_socket+0xd6/0x1b0 net/socket.c:1747
 __do_sys_socket net/socket.c:1761 [inline]
 __se_sys_socket net/socket.c:1759 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1759
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 4707 tgid 4707 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
 __slab_free+0x263/0x2b0 mm/slub.c:5576
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4542 [inline]
 slab_alloc_node mm/slub.c:4869 [inline]
 kmem_cache_alloc_node_noprof+0x384/0x690 mm/slub.c:4921
 __alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
 alloc_skb include/linux/skbuff.h:1383 [inline]
 alloc_skb_with_frags+0xca/0x890 net/core/skbuff.c:6763
 sock_alloc_send_pskb+0x878/0x990 net/core/sock.c:2995
 unix_dgram_sendmsg+0x4fb/0x18d0 net/unix/af_unix.c:2125
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 __sys_sendto+0x672/0x710 net/socket.c:2206
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2209
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88804a44dc00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88804a44dc80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88804a44dd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff88804a44dd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88804a44de00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         80234b5a Merge tag 'rproc-v7.0-fixes' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15bcef5a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=107fb75a580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[Hillf Danton]

#syz test

--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -474,6 +474,7 @@ static void lec_atm_close(struct atm_vcc
 
 	priv->lecd = NULL;
 	/* Do something needful? */
+	synchronize_rcu();
 
 	netif_stop_queue(dev);
 	lec_arp_destroy(priv);
--

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to copy prog to VM: failed to run ["scp" "-P" "10667" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syzkaller2428577641" "root@localhost:/syzkaller2428577641"]: exit status 255



syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4120003145=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/cc1EmJT5.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         80234b5a Merge tag 'rproc-v7.0-fixes' of git://git.ker..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1188cd52580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[Hillf Danton]

#syz test  upstream master

--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -474,6 +474,7 @@ static void lec_atm_close(struct atm_vcc
 
 	priv->lecd = NULL;
 	/* Do something needful? */
+	synchronize_rcu();
 
 	netif_stop_queue(dev);
 	lec_arp_destroy(priv);
--

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine



Tested on:

commit:         80234b5a Merge tag 'rproc-v7.0-fixes' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=144168ba580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1498cd52580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[Hillf Danton]

#syz test  upstream master

--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -474,6 +474,7 @@ static void lec_atm_close(struct atm_vcc
 
 	priv->lecd = NULL;
 	/* Do something needful? */
+	synchronize_rcu();
 
 	netif_stop_queue(dev);
 	lec_arp_destroy(priv);
--

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine



syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
Warning: Permanently added '[localhost]:9504' (ED25519) to the list of known hosts.
2026/03/12 22:20:27 parsed 1 programs
[  135.338848][ T5316] cgroup: Unknown subsys name 'net'
[  135.396122][ T5316] cgroup: Unknown subsys name 'cpuset'
[  135.403015][ T5316] cgroup: Unknown subsys name 'rlimit'
[  143.433872][ T1314] ieee802154 phy0 wpan0: encryption failed: -22
[  143.437206][ T1314] ieee802154 phy1 wpan1: encryption failed: -22
[  188.890546][ T1009] ata1.00: NCQ disabled due to excessive errors
[  188.893607][ T1009] ata1.00: exception Emask 0x0 SAct 0x4000 SErr 0x0 action 0x6 frozen
[  188.898202][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[  188.902723][ T1009] ata1.00: cmd 61/00:70:26:5e:04/20:00:00:00:00/40 tag 14 ncq dma 4194304 ou
[  188.902723][ T1009]          res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[  188.911375][ T1009] ata1.00: status: { DRDY }
[  188.913896][ T1009] ata1: hard resetting link
[  189.233766][ T1009] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[  189.239363][ T1009] ata1.00: configured for UDMA/100
[  189.243584][ T1009] ata1: EH complete
qemu-system-x86_64: hw/ide/core.c:934: ide_dma_cb: Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
Connection to localhost closed by remote host.


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2904551795=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/cctV4tEl.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         0257f64b Merge tag 'pm-7.0-rc4' of git://git.kernel.or..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14940b88580000

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[Hillf Danton]

#syz test: upstream 651690480a96

--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -474,6 +474,7 @@ static void lec_atm_close(struct atm_vcc
 
 	priv->lecd = NULL;
 	/* Do something needful? */
+	synchronize_rcu();
 
 	netif_stop_queue(dev);
 	lec_arp_destroy(priv);
--

Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine



syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xfb000)
[   97.299132][   T10] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:10854' (ED25519) to the list of known hosts.
2026/03/13 19:00:35 parsed 1 programs
[  105.586401][ T5314] cgroup: Unknown subsys name 'net'
[  105.643957][ T5314] cgroup: Unknown subsys name 'cpuset'
[  105.650699][ T5314] cgroup: Unknown subsys name 'rlimit'
[  143.372540][ T1314] ieee802154 phy0 wpan0: encryption failed: -22
[  143.376030][ T1314] ieee802154 phy1 wpan1: encryption failed: -22
[  156.189227][ T1011] ata1.00: exception Emask 0x0 SAct 0x4000 SErr 0x0 action 0x6 frozen
[  156.193435][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[  156.196306][ T1011] ata1.00: cmd 61/d8:70:36:61:04/07:00:00:00:00/40 tag 14 ncq dma 1028096 ou
[  156.196306][ T1011]          res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[  156.205965][ T1011] ata1.00: status: { DRDY }
[  156.208393][ T1011] ata1: hard resetting link
[  156.531189][ T1011] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[  156.536384][ T1011] ata1.00: configured for UDMA/100
[  156.539569][ T1011] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x2bb000)
[  156.595084][ T1011] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[  156.598460][ T1011] ata1: failed to read log page 10h (errno=-5)
[  156.619268][ T1011] ata1.00: NCQ disabled due to excessive errors
[  156.622929][ T1011] ata1.00: exception Emask 0x1 SAct 0x1e00 SErr 0x0 action 0x0
[  156.627134][ T1011] ata1.00: irq_stat 0x41000008
[  156.639141][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[  156.642238][ T1011] ata1.00: cmd 61/d8:48:86:a2:04/02:00:00:00:00/40 tag 9 ncq dma 372736 out
[  156.642238][ T1011]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  156.679095][ T1011] ata1.00: status: { DRDY }
[  156.681893][ T1011] ata1.00: error: { ABRT }
[  156.684701][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[  156.699416][ T1011] ata1.00: cmd 61/00:50:5e:a5:04/06:00:00:00:00/40 tag 10 ncq dma 786432 out
[  156.699416][ T1011]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  156.707246][ T1011] ata1.00: status: { DRDY }
[  156.718658][ T1011] ata1.00: error: { ABRT }
[  156.720862][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[  156.723709][ T1011] ata1.00: cmd 61/d8:58:5e:ab:04/15:00:00:00:00/40 tag 11 ncq dma 2863104 ou
[  156.723709][ T1011]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  156.742964][ T1011] ata1.00: status: { DRDY }
[  156.745213][ T1011] ata1.00: error: { ABRT }
[  156.747285][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[  156.750902][ T1011] ata1.00: cmd 61/00:60:36:c1:04/20:00:00:00:00/40 tag 12 ncq dma 4194304 ou
[  156.750902][ T1011]          res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[  156.760311][ T1011] ata1.00: status: { DRDY }
[  156.762534][ T1011] ata1.00: error: { ABRT }
[  156.766637][ T1011] ata1.00: configured for UDMA/100
[  156.770968][ T1011] ata1: EH complete
qemu-system-x86_64: hw/ide/core.c:934: ide_dma_cb: Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
Connection to localhost closed by remote host.


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build649871866=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/ccZ4u7l4.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16822776580000