* WARNING: refcount bug in sctp_transport_put
@ 2018-08-14 0:55 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2018-08-14 0:55 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev,
nhorman, syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: 112cbae26d18 Merge branch 'linus' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12401622400000
kernel config: https://syzkaller.appspot.com/x/.config?x=152cb8ccd35b1f70
dashboard link: https://syzkaller.appspot.com/bug?extid=6a15c8ad0f0632ccd7f3
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6a15c8ad0f0632ccd7f3@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 7203 at lib/refcount.c:187
refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 7203 Comm: udevd Not tainted 4.18.0-rc8+ #182
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
panic+0x238/0x4e7 kernel/panic.c:184
__warn.cold.8+0x163/0x1ba kernel/panic.c:536
report_bug+0x252/0x2d0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Code: 89 de e8 fc b4 1c fe 84 db 74 07 31 db e9 46 ff ff ff e8 1c b4 1c fe
48 c7 c7 80 48 3a 87 c6 05 82 f2 25 05 01 e8 f9 cc e7 fd <0f> 0b 31 db e9
25 ff ff ff 48 8b bd 28 ff ff ff 89 85 34 ff ff ff
RSP: 0018:ffff8801db107598 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff81632481 RDI: ffff8801db107270
RBP: ffff8801db107680 R08: ffff8801b9a22780 R09: 0000000000000002
R10: ffff8801b9a22780 R11: 0000000000000000 R12: 00000000ffffffff
R13: ffff8801db107658 R14: 0000000000000001 R15: ffff8801aefee088
refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
sctp_transport_put+0x76/0x200 net/sctp/transport.c:331
sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7a6/0xc70 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2e8/0xb17 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x1d4/0x210 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:527 [inline]
smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1055
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:update_stack_state+0xcc/0x690 arch/x86/kernel/unwind_frame.c:215
Code: 06 49 8d 7e 50 48 89 fa 89 85 24 ff ff ff 48 c1 ea 03 48 b8 00 00 00
00 00 fc ff df 80 3c 02 00 0f 85 04 05 00 00 49 8b 46 50 <48> 85 c0 0f 84
66 03 00 00 48 05 a8 00 00 00 48 89 85 10 ff ff ff
RSP: 0018:ffff88018d816a60 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffff88018d816cc8 RCX: ffff88018d816c40
RDX: 1ffff10031b02da3 RSI: ffff88018d816d48 RDI: ffff88018d816d18
RBP: ffff88018d816b68 R08: ffff88018d816d00 R09: ffff8801b9a22780
R10: ffffed0031b02da3 R11: ffff88018d816d1f R12: 1ffff10031b02d54
R13: ffff88018d816d48 R14: ffff88018d816cc8 R15: ffff88018d816d18
unwind_next_frame.part.7+0x1ae/0x9e0 arch/x86/kernel/unwind_frame.c:329
unwind_next_frame arch/x86/include/asm/unwind.h:40 [inline]
__unwind_start+0x166/0x330 arch/x86/kernel/unwind_frame.c:414
unwind_start arch/x86/include/asm/unwind.h:54 [inline]
__save_stack_trace+0x59/0xf0 arch/x86/kernel/stacktrace.c:43
save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
slab_post_alloc_hook mm/slab.h:444 [inline]
slab_alloc mm/slab.c:3392 [inline]
kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
anon_vma_chain_alloc mm/rmap.c:129 [inline]
anon_vma_clone+0x140/0x740 mm/rmap.c:269
anon_vma_fork+0xf0/0x960 mm/rmap.c:332
dup_mmap kernel/fork.c:498 [inline]
dup_mm kernel/fork.c:1266 [inline]
copy_mm kernel/fork.c:1320 [inline]
copy_process.part.39+0x4e53/0x70b0 kernel/fork.c:1826
copy_process kernel/fork.c:1639 [inline]
_do_fork+0x291/0x12a0 kernel/fork.c:2122
__do_sys_clone kernel/fork.c:2229 [inline]
__se_sys_clone kernel/fork.c:2223 [inline]
__x64_sys_clone+0xbf/0x150 kernel/fork.c:2223
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1b0bf66f46
Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81
c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff
ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00
RSP: 002b:00007ffc9eb9ddb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc9eb9ddb0 RCX: 00007f1b0bf66f46
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc9eb9de10 R08: 0000000000001c23 R09: 0000000000001c23
R10: 00007f1b0c883a70 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc9eb9ddd0 R14: 0000000000000005 R15: 0000000000000005
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
^ permalink raw reply [flat|nested] 6+ messages in thread
* WARNING: refcount bug in sctp_transport_put
@ 2018-08-14 0:55 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2018-08-14 0:55 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev,
nhorman, syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: 112cbae26d18 Merge branch 'linus' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x\x12401622400000
kernel config: https://syzkaller.appspot.com/x/.config?x\x152cb8ccd35b1f70
dashboard link: https://syzkaller.appspot.com/bug?extidj15c8ad0f0632ccd7f3
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6a15c8ad0f0632ccd7f3@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 7203 at lib/refcount.c:187
refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 7203 Comm: udevd Not tainted 4.18.0-rc8+ #182
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
panic+0x238/0x4e7 kernel/panic.c:184
__warn.cold.8+0x163/0x1ba kernel/panic.c:536
report_bug+0x252/0x2d0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Code: 89 de e8 fc b4 1c fe 84 db 74 07 31 db e9 46 ff ff ff e8 1c b4 1c fe
48 c7 c7 80 48 3a 87 c6 05 82 f2 25 05 01 e8 f9 cc e7 fd <0f> 0b 31 db e9
25 ff ff ff 48 8b bd 28 ff ff ff 89 85 34 ff ff ff
RSP: 0018:ffff8801db107598 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff81632481 RDI: ffff8801db107270
RBP: ffff8801db107680 R08: ffff8801b9a22780 R09: 0000000000000002
R10: ffff8801b9a22780 R11: 0000000000000000 R12: 00000000ffffffff
R13: ffff8801db107658 R14: 0000000000000001 R15: ffff8801aefee088
refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
sctp_transport_put+0x76/0x200 net/sctp/transport.c:331
sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7a6/0xc70 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2e8/0xb17 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x1d4/0x210 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:527 [inline]
smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1055
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:update_stack_state+0xcc/0x690 arch/x86/kernel/unwind_frame.c:215
Code: 06 49 8d 7e 50 48 89 fa 89 85 24 ff ff ff 48 c1 ea 03 48 b8 00 00 00
00 00 fc ff df 80 3c 02 00 0f 85 04 05 00 00 49 8b 46 50 <48> 85 c0 0f 84
66 03 00 00 48 05 a8 00 00 00 48 89 85 10 ff ff ff
RSP: 0018:ffff88018d816a60 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffff88018d816cc8 RCX: ffff88018d816c40
RDX: 1ffff10031b02da3 RSI: ffff88018d816d48 RDI: ffff88018d816d18
RBP: ffff88018d816b68 R08: ffff88018d816d00 R09: ffff8801b9a22780
R10: ffffed0031b02da3 R11: ffff88018d816d1f R12: 1ffff10031b02d54
R13: ffff88018d816d48 R14: ffff88018d816cc8 R15: ffff88018d816d18
unwind_next_frame.part.7+0x1ae/0x9e0 arch/x86/kernel/unwind_frame.c:329
unwind_next_frame arch/x86/include/asm/unwind.h:40 [inline]
__unwind_start+0x166/0x330 arch/x86/kernel/unwind_frame.c:414
unwind_start arch/x86/include/asm/unwind.h:54 [inline]
__save_stack_trace+0x59/0xf0 arch/x86/kernel/stacktrace.c:43
save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
slab_post_alloc_hook mm/slab.h:444 [inline]
slab_alloc mm/slab.c:3392 [inline]
kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
anon_vma_chain_alloc mm/rmap.c:129 [inline]
anon_vma_clone+0x140/0x740 mm/rmap.c:269
anon_vma_fork+0xf0/0x960 mm/rmap.c:332
dup_mmap kernel/fork.c:498 [inline]
dup_mm kernel/fork.c:1266 [inline]
copy_mm kernel/fork.c:1320 [inline]
copy_process.part.39+0x4e53/0x70b0 kernel/fork.c:1826
copy_process kernel/fork.c:1639 [inline]
_do_fork+0x291/0x12a0 kernel/fork.c:2122
__do_sys_clone kernel/fork.c:2229 [inline]
__se_sys_clone kernel/fork.c:2223 [inline]
__x64_sys_clone+0xbf/0x150 kernel/fork.c:2223
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1b0bf66f46
Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81
c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff
ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00
RSP: 002b:00007ffc9eb9ddb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc9eb9ddb0 RCX: 00007f1b0bf66f46
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc9eb9de10 R08: 0000000000001c23 R09: 0000000000001c23
R10: 00007f1b0c883a70 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc9eb9ddd0 R14: 0000000000000005 R15: 0000000000000005
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING: refcount bug in sctp_transport_put
2018-08-14 0:55 ` syzbot
@ 2018-08-14 1:24 ` Marcelo Ricardo Leitner
-1 siblings, 0 replies; 6+ messages in thread
From: Marcelo Ricardo Leitner @ 2018-08-14 1:24 UTC (permalink / raw)
To: syzbot
Cc: davem, linux-kernel, linux-sctp, netdev, nhorman, syzkaller-bugs,
vyasevich
On Mon, Aug 13, 2018 at 05:55:02PM -0700, syzbot wrote:
> ------------[ cut here ]------------
> refcount_t: underflow; use-after-free.
> WARNING: CPU: 1 PID: 7203 at lib/refcount.c:187
> refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
> Kernel panic - not syncing: panic_on_warn set ...
>
...
> refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
> sctp_transport_put+0x76/0x200 net/sctp/transport.c:331
> sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
> call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
> expire_timers kernel/time/timer.c:1363 [inline]
> __run_timers+0x7a6/0xc70 kernel/time/timer.c:1666
> run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
> __do_softirq+0x2e8/0xb17 kernel/softirq.c:292
> invoke_softirq kernel/softirq.c:372 [inline]
> irq_exit+0x1d4/0x210 kernel/softirq.c:412
> exiting_irq arch/x86/include/asm/apic.h:527 [inline]
> smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1055
> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
> </IRQ>
Interesting, again on heartbeat timer handler.
Marcelo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING: refcount bug in sctp_transport_put
@ 2018-08-14 1:24 ` Marcelo Ricardo Leitner
0 siblings, 0 replies; 6+ messages in thread
From: Marcelo Ricardo Leitner @ 2018-08-14 1:24 UTC (permalink / raw)
To: syzbot
Cc: davem, linux-kernel, linux-sctp, netdev, nhorman, syzkaller-bugs,
vyasevich
On Mon, Aug 13, 2018 at 05:55:02PM -0700, syzbot wrote:
> ------------[ cut here ]------------
> refcount_t: underflow; use-after-free.
> WARNING: CPU: 1 PID: 7203 at lib/refcount.c:187
> refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
> Kernel panic - not syncing: panic_on_warn set ...
>
...
> refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
> sctp_transport_put+0x76/0x200 net/sctp/transport.c:331
> sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
> call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
> expire_timers kernel/time/timer.c:1363 [inline]
> __run_timers+0x7a6/0xc70 kernel/time/timer.c:1666
> run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
> __do_softirq+0x2e8/0xb17 kernel/softirq.c:292
> invoke_softirq kernel/softirq.c:372 [inline]
> irq_exit+0x1d4/0x210 kernel/softirq.c:412
> exiting_irq arch/x86/include/asm/apic.h:527 [inline]
> smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1055
> apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
> </IRQ>
Interesting, again on heartbeat timer handler.
Marcelo
^ permalink raw reply [flat|nested] 6+ messages in thread
* WARNING: refcount bug in sctp_transport_put (2)
2018-08-14 0:55 ` syzbot
@ 2019-10-05 7:16 ` syzbot
-1 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2019-10-05 7:16 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev,
nhorman, syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: 311ef88a Add linux-next specific files for 20191004
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1688f6fb600000
kernel config: https://syzkaller.appspot.com/x/.config?x=db2e4361e48662f4
dashboard link: https://syzkaller.appspot.com/bug?extid=6cad8d7f75ebce50a44d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6cad8d7f75ebce50a44d@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 23726 at lib/refcount.c:190
refcount_sub_and_test_checked lib/refcount.c:190 [inline]
WARNING: CPU: 0 PID: 23726 at lib/refcount.c:190
refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 23726 Comm: syz-executor.4 Not tainted 5.4.0-rc1-next-20191004
#0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x2dc/0x755 kernel/panic.c:220
__warn.cold+0x2f/0x3c kernel/panic.c:581
report_bug+0x289/0x300 lib/bug.c:195
fixup_bug arch/x86/kernel/traps.c:174 [inline]
fixup_bug arch/x86/kernel/traps.c:169 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:refcount_sub_and_test_checked lib/refcount.c:190 [inline]
RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Code: 1d 9d a9 7f 06 31 ff 89 de e8 6c 0d 31 fe 84 db 75 94 e8 23 0c 31 fe
48 c7 c7 a0 6e e6 87 c6 05 7d a9 7f 06 01 e8 28 51 02 fe <0f> 0b e9 75 ff
ff ff e8 04 0c 31 fe e9 6e ff ff ff 48 89 df e8 47
RSP: 0018:ffff8880ae809bc8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff815cb526 RDI: ffffed1015d0136b
RBP: ffff8880ae809c60 R08: ffff888097c901c0 R09: fffffbfff14edb4a
R10: fffffbfff14edb49 R11: ffffffff8a76da4f R12: 00000000ffffffff
R13: 0000000000000001 R14: ffff8880ae809c38 R15: 0000000000000000
refcount_dec_and_test_checked+0x1b/0x20 lib/refcount.c:220
sctp_transport_put+0x1e/0x130 net/sctp/transport.c:325
sctp_generate_heartbeat_event+0x2cf/0x450 net/sctp/sm_sideeffect.c:401
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
__do_softirq+0x262/0x98c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x19b/0x1e0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x44/0x50 kernel/kcov.c:109
Code: 48 8b 75 08 75 2b 8b 90 00 13 00 00 83 fa 02 75 20 48 8b 88 08 13 00
00 8b 80 04 13 00 00 48 8b 11 48 83 c2 01 48 39 d0 76 07 <48> 89 34 d1 48
89 11 5d c3 0f 1f 00 65 4c 8b 04 25 40 fe 01 00 65
RSP: 0018:ffff88805f30f4e0 EFLAGS: 00000216 ORIG_RAX: ffffffffffffff13
RAX: 0000000000040000 RBX: 0000000000000008 RCX: ffffc9000e9aa000
RDX: 0000000000021364 RSI: ffffffff830d569e RDI: 0000000000000001
RBP: ffff88805f30f4e0 R08: ffff888097c901c0 R09: ffffed100be61eb3
R10: ffffed100be61eb2 R11: 0000000000000000 R12: ffff8880a858e780
R13: 0000000000000010 R14: 00000000000002d0 R15: 0000000000000000
tomoyo_domain_quota_is_ok+0x2fe/0x540 security/tomoyo/util.c:1069
tomoyo_supervisor+0x2e8/0xef0 security/tomoyo/common.c:2087
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x263/0x360 security/tomoyo/file.c:573
tomoyo_check_open_permission+0x372/0x3f0 security/tomoyo/file.c:780
tomoyo_file_open security/tomoyo/tomoyo.c:325 [inline]
tomoyo_file_open+0x106/0x150 security/tomoyo/tomoyo.c:317
security_file_open+0x71/0x300 security/security.c:1497
do_dentry_open+0x373/0x1250 fs/open.c:784
vfs_open+0xa0/0xd0 fs/open.c:914
do_last fs/namei.c:3412 [inline]
path_openat+0x10e9/0x4720 fs/namei.c:3529
do_filp_open+0x1a1/0x280 fs/namei.c:3559
do_sys_open+0x3fe/0x5d0 fs/open.c:1097
ksys_open include/linux/syscalls.h:1386 [inline]
__do_sys_creat fs/open.c:1155 [inline]
__se_sys_creat fs/open.c:1153 [inline]
__x64_sys_creat+0x61/0x80 fs/open.c:1153
do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a59
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007faa895c7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000459a59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007faa895c86d4
R13: 00000000004c00fd R14: 00000000004d2430 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 6+ messages in thread
* WARNING: refcount bug in sctp_transport_put (2)
@ 2019-10-05 7:16 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2019-10-05 7:16 UTC (permalink / raw)
To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev,
nhorman, syzkaller-bugs, vyasevich
Hello,
syzbot found the following crash on:
HEAD commit: 311ef88a Add linux-next specific files for 20191004
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x\x1688f6fb600000
kernel config: https://syzkaller.appspot.com/x/.config?xÛ2e4361e48662f4
dashboard link: https://syzkaller.appspot.com/bug?extidlad8d7f75ebce50a44d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6cad8d7f75ebce50a44d@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 23726 at lib/refcount.c:190
refcount_sub_and_test_checked lib/refcount.c:190 [inline]
WARNING: CPU: 0 PID: 23726 at lib/refcount.c:190
refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 23726 Comm: syz-executor.4 Not tainted 5.4.0-rc1-next-20191004
#0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x2dc/0x755 kernel/panic.c:220
__warn.cold+0x2f/0x3c kernel/panic.c:581
report_bug+0x289/0x300 lib/bug.c:195
fixup_bug arch/x86/kernel/traps.c:174 [inline]
fixup_bug arch/x86/kernel/traps.c:169 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:refcount_sub_and_test_checked lib/refcount.c:190 [inline]
RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Code: 1d 9d a9 7f 06 31 ff 89 de e8 6c 0d 31 fe 84 db 75 94 e8 23 0c 31 fe
48 c7 c7 a0 6e e6 87 c6 05 7d a9 7f 06 01 e8 28 51 02 fe <0f> 0b e9 75 ff
ff ff e8 04 0c 31 fe e9 6e ff ff ff 48 89 df e8 47
RSP: 0018:ffff8880ae809bc8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff815cb526 RDI: ffffed1015d0136b
RBP: ffff8880ae809c60 R08: ffff888097c901c0 R09: fffffbfff14edb4a
R10: fffffbfff14edb49 R11: ffffffff8a76da4f R12: 00000000ffffffff
R13: 0000000000000001 R14: ffff8880ae809c38 R15: 0000000000000000
refcount_dec_and_test_checked+0x1b/0x20 lib/refcount.c:220
sctp_transport_put+0x1e/0x130 net/sctp/transport.c:325
sctp_generate_heartbeat_event+0x2cf/0x450 net/sctp/sm_sideeffect.c:401
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
__do_softirq+0x262/0x98c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x19b/0x1e0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x44/0x50 kernel/kcov.c:109
Code: 48 8b 75 08 75 2b 8b 90 00 13 00 00 83 fa 02 75 20 48 8b 88 08 13 00
00 8b 80 04 13 00 00 48 8b 11 48 83 c2 01 48 39 d0 76 07 <48> 89 34 d1 48
89 11 5d c3 0f 1f 00 65 4c 8b 04 25 40 fe 01 00 65
RSP: 0018:ffff88805f30f4e0 EFLAGS: 00000216 ORIG_RAX: ffffffffffffff13
RAX: 0000000000040000 RBX: 0000000000000008 RCX: ffffc9000e9aa000
RDX: 0000000000021364 RSI: ffffffff830d569e RDI: 0000000000000001
RBP: ffff88805f30f4e0 R08: ffff888097c901c0 R09: ffffed100be61eb3
R10: ffffed100be61eb2 R11: 0000000000000000 R12: ffff8880a858e780
R13: 0000000000000010 R14: 00000000000002d0 R15: 0000000000000000
tomoyo_domain_quota_is_ok+0x2fe/0x540 security/tomoyo/util.c:1069
tomoyo_supervisor+0x2e8/0xef0 security/tomoyo/common.c:2087
tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
tomoyo_path_permission security/tomoyo/file.c:587 [inline]
tomoyo_path_permission+0x263/0x360 security/tomoyo/file.c:573
tomoyo_check_open_permission+0x372/0x3f0 security/tomoyo/file.c:780
tomoyo_file_open security/tomoyo/tomoyo.c:325 [inline]
tomoyo_file_open+0x106/0x150 security/tomoyo/tomoyo.c:317
security_file_open+0x71/0x300 security/security.c:1497
do_dentry_open+0x373/0x1250 fs/open.c:784
vfs_open+0xa0/0xd0 fs/open.c:914
do_last fs/namei.c:3412 [inline]
path_openat+0x10e9/0x4720 fs/namei.c:3529
do_filp_open+0x1a1/0x280 fs/namei.c:3559
do_sys_open+0x3fe/0x5d0 fs/open.c:1097
ksys_open include/linux/syscalls.h:1386 [inline]
__do_sys_creat fs/open.c:1155 [inline]
__se_sys_creat fs/open.c:1153 [inline]
__x64_sys_creat+0x61/0x80 fs/open.c:1153
do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a59
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007faa895c7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000459a59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007faa895c86d4
R13: 00000000004c00fd R14: 00000000004d2430 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-10-05 7:16 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-14 0:55 WARNING: refcount bug in sctp_transport_put syzbot
2018-08-14 0:55 ` syzbot
2018-08-14 1:24 ` Marcelo Ricardo Leitner
2018-08-14 1:24 ` Marcelo Ricardo Leitner
2019-10-05 7:16 WARNING: refcount bug in sctp_transport_put (2) syzbot
2019-10-05 7:16 ` syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.