syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1320]
≡ Subsystems
🐞 Fixed [7197]
🐞 Invalid [19024]
⬇ Missing Backports [221]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

KASAN: null-ptr-deref Write in rcuref_put (2)

Status: closed as invalid on 2024/11/27 19:42
Subsystems: net
[Documentation on labels]
First crash: 628d, last: 628d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in rcuref_put (4) net 12 C done 7 330d 448d 29/29 fixed on 2025/09/04 16:56
upstream KASAN: null-ptr-deref Write in rcuref_put net 12 1 764d 764d 0/29 closed as invalid on 2024/06/25 17:44
upstream KASAN: null-ptr-deref Write in rcuref_put (3) net 12 1 514d 514d 0/29 closed as invalid on 2025/03/17 11:18
upstream KASAN: null-ptr-deref Write in rcuref_put (5) net prio:high 12 1 72d 72d 0/29 closed as invalid on 2026/05/30 06:16

Sample crash report:
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_add_negative_release include/linux/atomic/atomic-instrumented.h:1457 [inline]
BUG: KASAN: null-ptr-deref in __rcuref_put include/linux/rcuref.h:87 [inline]
BUG: KASAN: null-ptr-deref in rcuref_put+0x190/0x240 include/linux/rcuref.h:150
Write of size 4 at addr 0000000000000060 by task kworker/u8:3/52

CPU: 0 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.12.0-rc2-syzkaller-00100-geb952c47d154 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_report+0xe8/0x550 mm/kasan/report.c:491
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_add_negative_release include/linux/atomic/atomic-instrumented.h:1457 [inline]
 __rcuref_put include/linux/rcuref.h:87 [inline]
 rcuref_put+0x190/0x240 include/linux/rcuref.h:150
 dst_release+0x1b/0x50 net/core/dst.c:164
 dst_cache_destroy+0x115/0x190 net/core/dst_cache.c:163
 netdev_run_todo+0xe1c/0x1000 net/core/dev.c:10809
 cleanup_net+0x762/0xcc0 net/core/net_namespace.c:622
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f2/0x390 kernel/kthread.c:389
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/11 05:01 upstream eb952c47d154 8fbfc0c8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: null-ptr-deref Write in rcuref_put
* Struck through repros no longer work on HEAD.