syzbot

 sign-in | mailing list | source | docs
🐞 Open [1490]
≡ Subsystems
🐞 Fixed [6576]
🐞 Invalid [16811]
⬇ Missing Backports [203]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: null-ptr-deref Write in dst_release (5)

Status: closed as invalid on 2025/01/28 16:15
Subsystems: net
[Documentation on labels]
First crash: 247d, last: 247d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in dst_release (4) net 12 23 340d 527d 28/29 fixed on 2024/11/29 14:58
upstream KASAN: null-ptr-deref Write in dst_release (2) net 23 syz error 148 1372d 1622d 0/29 closed as invalid on 2021/12/14 20:12
upstream KASAN: null-ptr-deref Write in dst_release net 12 27 2279d 2441d 0/29 auto-closed as invalid on 2019/10/25 08:50
upstream KASAN: null-ptr-deref Write in dst_release (3) net 23 2 1367d 1367d 20/29 fixed on 2022/03/08 16:11

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_add_negative_release include/linux/atomic/atomic-instrumented.h:1457 [inline]
BUG: KASAN: null-ptr-deref in __rcuref_put include/linux/rcuref.h:87 [inline]
BUG: KASAN: null-ptr-deref in rcuref_put include/linux/rcuref.h:150 [inline]
BUG: KASAN: null-ptr-deref in dst_release+0x4e/0x270 net/core/dst.c:167
Write of size 4 at addr 0000000000000060 by task kworker/u8:21/6310

CPU: 1 UID: 0 PID: 6310 Comm: kworker/u8:21 Not tainted 6.13.0-rc6-syzkaller-00051-geea6e4b4dfb8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xd9/0x110 mm/kasan/report.c:602
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_add_negative_release include/linux/atomic/atomic-instrumented.h:1457 [inline]
 __rcuref_put include/linux/rcuref.h:87 [inline]
 rcuref_put include/linux/rcuref.h:150 [inline]
 dst_release+0x4e/0x270 net/core/dst.c:167
 dst_cache_destroy net/core/dst_cache.c:163 [inline]
 dst_cache_destroy+0x119/0x270 net/core/dst_cache.c:155
 netdev_run_todo+0x760/0x12d0 net/core/dev.c:10919
 cleanup_net+0x591/0xbd0 net/core/net_namespace.c:644
 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/09 21:17 upstream eea6e4b4dfb8 9220929f .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto KASAN: null-ptr-deref Write in dst_release
* Struck through repros no longer work on HEAD.