syzbot


KASAN: null-ptr-deref Write in rcuref_put (4)

Status: upstream: reported on 2025/04/09 12:48
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+27d7cfbc93457e472e00@syzkaller.appspotmail.com
First crash: 41d, last: 16d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] KASAN: null-ptr-deref Write in rcuref_put (4) 0 (1) 2025/04/09 12:48
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in rcuref_put net 1 353d 353d 0/28 closed as invalid on 2024/06/25 17:44
upstream KASAN: null-ptr-deref Write in rcuref_put (3) net 1 104d 104d 0/28 closed as invalid on 2025/03/17 11:18
upstream KASAN: null-ptr-deref Write in rcuref_put (2) net 1 218d 218d 0/28 closed as invalid on 2024/11/27 19:42

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 [inline]
BUG: KASAN: null-ptr-deref in __rcuref_put include/linux/rcuref.h:89 [inline]
BUG: KASAN: null-ptr-deref in rcuref_put+0x16c/0x210 include/linux/rcuref.h:153
Write of size 4 at addr 0000000000000048 by task kworker/u8:12/9803

CPU: 1 UID: 0 PID: 9803 Comm: kworker/u8:12 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 kasan_report+0x118/0x150 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x29a/0x2b0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 [inline]
 __rcuref_put include/linux/rcuref.h:89 [inline]
 rcuref_put+0x16c/0x210 include/linux/rcuref.h:153
 dst_release+0x24/0x1b0 net/core/dst.c:167
 dst_cache_reset_now+0x18e/0x1f0 net/core/dst_cache.c:183
 wg_socket_clear_peer_endpoint_src+0x40/0x50 drivers/net/wireguard/socket.c:312
 wg_netns_pre_exit+0x110/0x1d0 drivers/net/wireguard/device.c:425
 ops_pre_exit_list net/core/net_namespace.c:162 [inline]
 cleanup_net+0x594/0xbd0 net/core/net_namespace.c:634
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/30 07:21 upstream 8bac8898fe39 85a5a23f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rcuref_put
2025/04/05 12:09 upstream a52a3c18cdf3 c53ea9c9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: null-ptr-deref Write in rcuref_put
* Struck through repros no longer work on HEAD.