| TITLE: BUG: unable to handle kernel paging request in corrupted |
| CORRUPTED: Y |
| |
| [ 85.149573] BUG: unable to handle kernel paging request at ffffffff0001eea6 |
| [ 85.153038] ================================================================== |
| [ 85.153056] BUG: KASAN: use-after-free in rb_first_postorder+0x7c/0xa0 |
| [ 85.153063] Read of size 8 at addr ffff8801d92ca840 by task syz-executor3/13991 |
| [ 85.153065] |
| [ 85.153074] CPU: 0 PID: 13991 Comm: syz-executor3 Not tainted 4.15.0-rc7-next-20180115+ #97 |
| [ 85.153080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 85.153082] Call Trace: |
| [ 85.153098] dump_stack+0x194/0x257 |
| [ 85.153111] ? arch_local_irq_restore+0x53/0x53 |
| [ 85.153121] ? show_regs_print_info+0x18/0x18 |
| [ 85.153134] ? rb_first_postorder+0x7c/0xa0 |
| [ 85.153144] print_address_description+0x73/0x250 |
| [ 85.153151] ? rb_first_postorder+0x7c/0xa0 |
| [ 85.153158] kasan_report+0x23b/0x360 |
| [ 85.153168] __asan_report_load8_noabort+0x14/0x20 |
| [ 85.153175] rb_first_postorder+0x7c/0xa0 |
| [ 85.153185] tipc_group_join+0x120/0x2d0 |
| [ 85.153195] ? tipc_group_update_member+0x740/0x740 |
| [ 85.153201] ? tipc_sk_publish+0x388/0x4b0 |
| [ 85.153215] ? tipc_nametbl_build_group+0x2a0/0x3a0 |
| [ 85.153227] tipc_setsockopt+0x67e/0xcc0 |
| [ 85.153238] ? tipc_sk_leave+0x200/0x200 |
| [ 85.153261] ? security_socket_setsockopt+0x89/0xb0 |
| [ 85.153273] SyS_setsockopt+0x189/0x360 |
| [ 85.153285] ? SyS_recv+0x40/0x40 |
| [ 85.153297] ? entry_SYSCALL_64_fastpath+0x5/0xa0 |
| [ 85.153311] ? trace_hardirqs_on_thunk+0x1a/0x1c |
| [ 85.153324] entry_SYSCALL_64_fastpath+0x29/0xa0 |
| [ 85.153330] RIP: 0033:0x452cf9 |
| [ 85.153333] RSP: 002b:00007f88b463ac58 EFLAGS: 00000212 ORIG_RAX: 0000000000000036 |
| [ 85.153340] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452cf9 |
| [ 85.153344] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000015 |
| [ 85.153348] RBP: 000000000000004d R08: 0000000000000010 R09: 0000000000000000 |
| [ 85.153352] R10: 0000000020f38000 R11: 0000000000000212 R12: 00000000006ee7d8 |
| [ 85.153356] R13: 00000000ffffffff R14: 00007f88b463b6d4 R15: 0000000000000000 |
| [ 85.153370] |
| [ 85.153373] Allocated by task 13991: |
| [ 85.153381] save_stack+0x43/0xd0 |
| [ 85.153387] kasan_kmalloc+0xad/0xe0 |
| [ 85.153394] kmem_cache_alloc_trace+0x136/0x750 |
| [ 85.153400] tipc_group_create+0x144/0x900 |
| [ 85.153405] tipc_setsockopt+0x274/0xcc0 |
| [ 85.153411] SyS_setsockopt+0x189/0x360 |
| [ 85.153418] entry_SYSCALL_64_fastpath+0x29/0xa0 |
| [ 85.153419] |
| [ 85.153421] Freed by task 13991: |
| [ 85.153427] save_stack+0x43/0xd0 |
| [ 85.153433] __kasan_slab_free+0x11a/0x170 |
| [ 85.153439] kasan_slab_free+0xe/0x10 |
| [ 85.153445] kfree+0xd9/0x260 |
| [ 85.153451] tipc_group_delete+0x2c8/0x3d0 |
| [ 85.153457] tipc_setsockopt+0xba3/0xcc0 |
| [ 85.153462] SyS_setsockopt+0x189/0x360 |
| [ 85.153469] entry_SYSCALL_64_fastpath+0x29/0xa0 |
| [ 85.153470] |
| [ 85.153475] The buggy address belongs to the object at ffff8801d92ca840 |
| [ 85.153475] which belongs to the cache kmalloc-128 of size 128 |
| [ 85.153480] The buggy address is located 0 bytes inside of |
| [ 85.153480] 128-byte region [ffff8801d92ca840, ffff8801d92ca8c0) |
| [ 85.153482] The buggy address belongs to the page: |
| [ 85.153488] page:ffffea000764b280 count:1 mapcount:0 mapping:ffff8801d92ca000 index:0x0 |
| [ 85.153494] flags: 0x2fffc0000000100(slab) |
| [ 85.153504] raw: 02fffc0000000100 ffff8801d92ca000 0000000000000000 0000000100000015 |
| [ 85.153512] raw: ffffea0007639820 ffffea0007639460 ffff8801dac00640 0000000000000000 |
| [ 85.153515] page dumped because: kasan: bad access detected |
| [ 85.153516] |
| [ 85.153518] Memory state around the buggy address: |
| [ 85.153523] ffff8801d92ca700: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc |
| [ 85.153528] ffff8801d92ca780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| [ 85.153533] >ffff8801d92ca800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb |
| [ 85.153536] ^ |
| [ 85.153541] ffff8801d92ca880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc |
| [ 85.153546] ffff8801d92ca900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb |
| [ 85.153548] ================================================================== |
| [ 85.153572] Kernel panic - not syncing: panic_on_warn set ... |
| [ 85.153572] |
| [ 85.536900] IP: dst_release+0x1e/0x90 |
| [ 85.540682] PGD 6825067 P4D 6825067 PUD 0 |
| [ 85.544904] Oops: 0002 [#1] SMP KASAN |
| [ 85.548684] Dumping ftrace buffer: |
| [ 85.552205] (ftrace buffer empty) |
| [ 85.555894] Modules linked in: |
| [ 85.559069] CPU: 1 PID: 13996 Comm: syz-executor5 Tainted: G B 4.15.0-rc7-next-20180115+ #97 |
| [ 85.568839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 85.578183] RIP: 0010:dst_release+0x1e/0x90 |
| [ 85.582480] RSP: 0018:ffff8801c247f598 EFLAGS: 00010246 |
| [ 85.587837] RAX: 0000000000010000 RBX: ffff8801c247f720 RCX: 00000000ffffffff |
| [ 85.595090] RDX: 0000000000010000 RSI: ffffc90001c77000 RDI: ffffffff0001ee66 |
| [ 85.602344] RBP: ffff8801c247f5a8 R08: 0000000000000000 R09: 0000000000000000 |
| [ 85.609596] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff0001ee66 |
| [ 85.616852] R13: ffffffff0001ee66 R14: ffff8801c247f648 R15: ffff8801c247f7c8 |
| [ 85.624123] FS: 00007fd191c53700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 |
| [ 85.632351] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| [ 85.638218] CR2: ffffffff0001eea6 CR3: 00000001bce8d005 CR4: 00000000001606e0 |
| [ 85.645474] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| [ 85.652731] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 |
| [ 85.659985] Call Trace: |
| [ 85.662562] ip6_cork_release.isra.43+0x1bb/0x2c0 |
| [ 85.667389] ip6_make_skb+0x4f1/0x5a0 |
| [ 85.671172] ? ip_reply_glue_bits+0xb0/0xb0 |
| [ 85.675479] ? ip6_push_pending_frames+0xe0/0xe0 |
| [ 85.680217] ? ip6_dst_hoplimit+0x26c/0x420 |
| [ 85.684524] ? lock_downgrade+0x980/0x980 |
| [ 85.688658] ? lock_release+0xa40/0xa40 |
| [ 85.692614] ? __lock_is_held+0xb6/0x140 |
| [ 85.696668] ? ip6_dst_hoplimit+0xc1/0x420 |
| [ 85.700898] ? ip6_find_1stfragopt+0x260/0x260 |
| [ 85.705473] udpv6_sendmsg+0x27fc/0x3400 |
| [ 85.709535] ? ip_reply_glue_bits+0xb0/0xb0 |
| [ 85.713849] ? udpv6_setsockopt+0x80/0x80 |
| [ 85.717987] ? reacquire_held_locks+0x1f9/0x3e0 |
| [ 85.722638] ? reacquire_held_locks+0x1f9/0x3e0 |
| [ 85.727295] ? find_held_lock+0x35/0x1d0 |
| [ 85.731351] ? release_sock+0x1d4/0x2a0 |
| [ 85.735308] ? lock_downgrade+0x980/0x980 |
| [ 85.739438] ? lock_downgrade+0x980/0x980 |
| [ 85.743573] ? __local_bh_enable_ip+0x121/0x230 |
| [ 85.748225] ? trace_hardirqs_on_caller+0x421/0x5c0 |
| [ 85.753237] ? release_sock+0x1d4/0x2a0 |
| [ 85.757192] ? trace_hardirqs_on+0xd/0x10 |
| [ 85.761323] ? __local_bh_enable_ip+0x121/0x230 |
| [ 85.765975] ? _raw_spin_unlock_bh+0x30/0x40 |
| [ 85.770366] ? release_sock+0x1d4/0x2a0 |
| [ 85.774338] inet_sendmsg+0x11f/0x5e0 |
| [ 85.778122] ? inet_sendmsg+0x11f/0x5e0 |
| [ 85.782078] ? __might_sleep+0x95/0x190 |
| [ 85.786034] ? inet_create+0xf50/0xf50 |
| [ 85.789904] ? selinux_socket_sendmsg+0x36/0x40 |
| [ 85.794555] ? security_socket_sendmsg+0x89/0xb0 |
| [ 85.799310] ? inet_create+0xf50/0xf50 |
| [ 85.803186] sock_sendmsg+0xca/0x110 |
| [ 85.806900] SYSC_sendto+0x361/0x5c0 |
| [ 85.810597] ? SYSC_connect+0x4a0/0x4a0 |
| [ 85.814554] ? __mutex_unlock_slowpath+0xe9/0xac0 |
| [ 85.819379] ? vfs_write+0x374/0x510 |
| [ 85.823080] ? wait_for_completion+0x770/0x770 |
| [ 85.827650] ? __lock_is_held+0xb6/0x140 |
| [ 85.831714] ? fput+0xd2/0x140 |
| [ 85.834888] ? SyS_write+0x184/0x220 |
| [ 85.838585] ? entry_SYSCALL_64_fastpath+0x5/0xa0 |
| [ 85.843416] SyS_sendto+0x40/0x50 |
| [ 85.846857] entry_SYSCALL_64_fastpath+0x29/0xa0 |
| [ 85.851594] RIP: 0033:0x452cf9 |
| [ 85.854761] RSP: 002b:00007fd191c52c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002c |
| [ 85.862450] RAX: ffffffffffffffda RBX: 00007fd191c52aa0 RCX: 0000000000452cf9 |
| [ 85.869705] RDX: 0000000000000555 RSI: 00000000204ce000 RDI: 0000000000000013 |
| [ 85.876958] RBP: 00007fd191c52a90 R08: 0000000020e26fe4 R09: 000000000000001c |
| [ 85.884210] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b798c |
| [ 85.891463] R13: 00007fd191c52bc8 R14: 00000000004b798c R15: 0000000000000000 |
| [ 85.898731] Code: f7 ff 31 c0 5b 5d c3 66 0f 1f 44 00 00 55 48 89 e5 41 54 53 49 89 fc e8 b1 77 30 fd 4d 85 e4 74 21 e8 a7 77 30 fd b9 ff ff ff ff <f0> 41 0f c1 4c 24 40 89 cb 83 eb 01 78 33 e8 8f 77 30 fd 85 db |
| [ 85.917879] RIP: dst_release+0x1e/0x90 RSP: ffff8801c247f598 |
| [ 85.923673] CR2: ffffffff0001eea6 |
| [ 85.927129] ---[ end trace b421a5a363a9c4fd ]--- |
| [ 86.211221] Shutting down cpus with NMI |
| [ 86.215778] Dumping ftrace buffer: |
| [ 86.219299] (ftrace buffer empty) |
| [ 86.223002] Kernel Offset: disabled |
| [ 86.226619] Rebooting in 86400 seconds.. |
