KASAN: null-ptr-deref Write in kcm_tx_work

Status: auto-closed as invalid on 2020/07/14 11:16
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+867331f5ea7690d840b4@syzkaller.appspotmail.com
First crash: 2369d, last: 2340d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KASAN: null-ptr-deref Write in kcm_tx_work 0 (1) 2020/02/20 06:31
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in kcm_tx_work (3) net 12 syz, C inconclusive inconclusive 7 1411d 1512d 22/29 fixed on 2023/02/24 13:50
upstream KASAN: null-ptr-deref Write in kcm_tx_work (2) net 12 1 1675d 1671d 0/29 auto-closed as invalid on 2022/05/10 04:14

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
BUG: KASAN: null-ptr-deref in kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:743
Write of size 8 at addr 0000000000000008 by task kworker/u4:8/16987

CPU: 1 PID: 16987 Comm: kworker/u4:8 Not tainted 5.6.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: kkcmd kcm_tx_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 __kasan_report.cold+0x5/0x32 mm/kasan/report.c:510
 kasan_report+0xe/0x20 mm/kasan/common.c:641
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x128/0x190 mm/kasan/generic.c:192
 clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
 kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:743
 process_one_work+0x94b/0x1690 kernel/workqueue.c:2266
 worker_thread+0x96/0xe20 kernel/workqueue.c:2412
 kthread+0x357/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 16987 Comm: kworker/u4:8 Tainted: G    B             5.6.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: kkcmd kcm_tx_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:221
 end_report+0x43/0x49 mm/kasan/report.c:96
 __kasan_report.cold+0xd/0x32 mm/kasan/report.c:513
 kasan_report+0xe/0x20 mm/kasan/common.c:641
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x128/0x190 mm/kasan/generic.c:192
 clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
 kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:743
 process_one_work+0x94b/0x1690 kernel/workqueue.c:2266
 worker_thread+0x96/0xe20 kernel/workqueue.c:2412
 kthread+0x357/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/16 11:15 net-old 0fda7600c2e1 749688d2 .config console log report ci-upstream-net-this-kasan-gce
2020/02/16 05:24 net-next-old 2019fc96af22 5d7b90f1 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.