syzbot |
sign-in | mailing list | source | docs |
| Kernel | Title | Rank 🛈 | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
|---|---|---|---|---|---|---|---|---|---|---|
| linux-4.19 | KASAN: stack-out-of-bounds Write in __ip_options_echo | 23 | 1 | 2396d | 2396d | 0/1 | auto-closed as invalid on 2019/10/25 08:39 | |||
| linux-4.14 | KASAN: stack-out-of-bounds Write in __ip_options_echo | 23 | 1 | 2398d | 2398d | 0/1 | auto-closed as invalid on 2019/10/24 16:14 | |||
| upstream | KASAN: stack-out-of-bounds Write in __ip_options_echo net | 23 | syz | done | 8 | 2401d | 2405d | 12/29 | fixed on 2019/05/27 12:48 |
================================================================== BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xafd/0x11a0 net/ipv4/ip_options.c:169 Write of size 4 at addr ffffc900039dfbbf by task syz-fuzzer/10312 CPU: 1 PID: 10312 Comm: syz-fuzzer Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x320 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [inline] __ip_options_echo+0xafd/0x11a0 net/ipv4/ip_options.c:169 __icmp_send+0x830/0x13c0 net/ipv4/icmp.c:720 icmp_send include/net/icmp.h:43 [inline] ip_expire+0x63a/0x840 net/ipv4/ip_fragment.c:189 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x45/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0033:0x5b94da Code: 01 48 8b 8c 24 90 01 00 00 48 89 0c 24 48 8b 9c 24 98 01 00 00 48 89 5c 24 08 48 89 44 24 10 48 8b 94 24 a8 01 00 00 48 8b 32 <ff> d6 48 8b bc 24 a0 01 00 00 80 7f 30 00 0f 85 3c 04 00 00 48 8b RSP: 002b:000000c000391758 EFLAGS: 00000202 RAX: 000000c00a9982c0 RBX: 000000c00a7680d0 RCX: 0000000000c96c00 RDX: 000000c000391c68 RSI: 00000000005ee3e0 RDI: 000000c0003918d0 RBP: 000000c0003918d8 R08: 000000c000391c68 R09: 0000000000203002 R10: 0000000000000002 R11: 0000000000000011 R12: 00000000000000f1 R13: 0000000000000000 R14: 0000000000c55b75 R15: 0000000000000000 </TASK> addr ffffc900039dfbbf is located in stack of task syz-fuzzer/10312 at offset 383 in frame: __icmp_send+0x0/0x13c0 include/linux/skbuff.h:986 this frame has 5 objects: [48, 49) '_inner_type' [64, 72) 'rt' [96, 136) 'ipc' [176, 232) 'fl4' [272, 384) 'icmp_param' Memory state around the buggy address: ffffc900039dfa80: 00 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 ffffc900039dfb00: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 >ffffc900039dfb80: 00 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 ^ ffffc900039dfc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc900039dfc80: 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 f3 f3 f3 f3 ==================================================================
| Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021/11/10 21:27 | upstream | 881007522c8f | 75b04091 | .config | console log | report | info | ci-upstream-kasan-gce-root | KASAN: stack-out-of-bounds Write in __ip_options_echo |