general protection fault in debug_check_no_obj_freed (4)

Status: auto-closed as invalid on 2021/06/24 04:15
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+41816dcc638851bc0550@syzkaller.appspotmail.com
First crash: 1936d, last: 1936d
▶ ▼ Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in debug_check_no_obj_freed (2) mm 2 1 2846d 2845d 0/29 auto-closed as invalid on 2019/04/26 09:49
linux-4.19 general protection fault in debug_check_no_obj_freed (2) 2 2 1675d 1779d 0/1 auto-closed as invalid on 2022/05/11 17:22
upstream general protection fault in debug_check_no_obj_freed (7) fs batman 2 3 1144d 1192d 0/29 auto-obsoleted due to no activity on 2023/09/24 06:05
linux-4.19 general protection fault in debug_check_no_obj_freed 2 1 2165d 2165d 0/1 auto-closed as invalid on 2021/01/06 22:10
upstream general protection fault in debug_check_no_obj_freed (8) mm 2 1 585d 581d 0/29 auto-obsoleted due to no activity on 2025/03/06 15:47
upstream general protection fault in debug_check_no_obj_freed (5) kvm-x86 2 4 1832d 1853d 0/29 auto-closed as invalid on 2021/11/05 02:52
upstream general protection fault in debug_check_no_obj_freed (6) tomoyo 2 2 1739d 1737d 0/29 auto-closed as invalid on 2022/02/06 02:57
upstream general protection fault in debug_check_no_obj_freed (3) mm 2 7 2141d 2152d 0/29 auto-closed as invalid on 2021/01/30 14:32
upstream general protection fault in debug_check_no_obj_freed mm 2 2 3061d 3059d 0/29 closed as invalid on 2018/07/17 14:23
upstream KASAN: slab-use-after-free Read in debug_check_no_obj_freed prio:high mm 19 1 116d 112d 0/29 auto-obsoleted due to no activity on 2026/07/18 21:14
linux-4.19 BUG: unable to handle kernel paging request in debug_check_no_obj_freed 8 1 1999d 1999d 0/1 auto-closed as invalid on 2021/06/21 12:27
upstream BUG: unable to handle kernel paging request in debug_check_no_obj_freed (3) ntfs3 8 1 1478d 1474d 0/29 auto-obsoleted due to no activity on 2022/10/25 02:48

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc781ffffd40: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x000003c0ffffea00-0x000003c0ffffea07]
CPU: 1 PID: 8474 Comm: syz-fuzzer Not tainted 5.12.0-rc8-next-20210423-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:976 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1d3/0x420 lib/debugobjects.c:1018
Code: 39 00 0f 85 0f 02 00 00 48 89 45 08 4d 89 30 4c 89 c7 4d 89 68 08 e8 7c d0 ff ff 48 85 ed 74 2c 49 89 e8 4c 89 c0 48 c1 e8 03 <42> 80 3c 38 00 0f 84 2e ff ff ff 4c 89 c7 4c 89 44 24 38 e8 e5 85
RSP: 0018:ffffc900016eee70 EFLAGS: 00010002
RAX: 000000781ffffd40 RBX: ffff88801d6de000 RCX: ffffffff815afd30
RDX: 1ffffffff2131dfa RSI: 0000000000000004 RDI: ffff888014648018
RBP: 000003c0ffffea00 R08: 000003c0ffffea00 R09: ffffe8ffffd1dc90
R10: fffff520002dddbc R11: 000000000000003f R12: 0000000000000004
R13: dead000000000122 R14: dead000000000100 R15: dffffc0000000000
FS:  000000c0004a0490(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c001058010 CR3: 0000000028bb7000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 slab_free_hook mm/slub.c:1568 [inline]
 slab_free_freelist_hook+0x174/0x240 mm/slub.c:1618
 slab_free mm/slub.c:3178 [inline]
 kmem_cache_free+0x97/0x750 mm/slub.c:3194
 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:684
 __kfree_skb net/core/skbuff.c:741 [inline]
 consume_skb net/core/skbuff.c:896 [inline]
 consume_skb+0xcf/0x160 net/core/skbuff.c:890
 packet_rcv+0xea/0x13e0 net/packet/af_packet.c:2176
 dev_queue_xmit_nit+0x7a9/0xa90 net/core/dev.c:2445
 xmit_one net/core/dev.c:3649 [inline]
 dev_hard_start_xmit+0xad/0x920 net/core/dev.c:3670
 sch_direct_xmit+0x2e1/0xbd0 net/sched/sch_generic.c:313
 qdisc_restart net/sched/sch_generic.c:376 [inline]
 __qdisc_run+0x4ba/0x15f0 net/sched/sch_generic.c:384
 qdisc_run include/net/pkt_sched.h:136 [inline]
 qdisc_run include/net/pkt_sched.h:128 [inline]
 __dev_xmit_skb net/core/dev.c:3856 [inline]
 __dev_queue_xmit+0x1390/0x2e50 net/core/dev.c:4213
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip_finish_output2+0xef0/0x2220 net/ipv4/ip_output.c:230
 __ip_finish_output net/ipv4/ip_output.c:308 [inline]
 __ip_finish_output+0x396/0x640 net/ipv4/ip_output.c:290
 ip_finish_output+0x35/0x200 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip_output+0x196/0x310 net/ipv4/ip_output.c:432
 dst_output include/net/dst.h:448 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0x8d3/0x1a30 net/ipv4/ip_output.c:533
 __tcp_transmit_skb+0x1889/0x38f0 net/ipv4/tcp_output.c:1405
 __tcp_send_ack.part.0+0x3d6/0x7a0 net/ipv4/tcp_output.c:3970
 __tcp_send_ack net/ipv4/tcp_output.c:3976 [inline]
 tcp_send_ack+0x7d/0xa0 net/ipv4/tcp_output.c:3976
 tcp_cleanup_rbuf+0x46c/0x5b0 net/ipv4/tcp.c:1598
 tcp_recvmsg_locked+0x7aa/0x22f0 net/ipv4/tcp.c:2520
 tcp_recvmsg+0x134/0x550 net/ipv4/tcp.c:2550
 inet_recvmsg+0x11b/0x5e0 net/ipv4/af_inet.c:852
 sock_recvmsg_nosec net/socket.c:888 [inline]
 sock_recvmsg net/socket.c:906 [inline]
 sock_recvmsg net/socket.c:902 [inline]
 sock_read_iter+0x33c/0x470 net/socket.c:979
 call_read_iter include/linux/fs.h:2108 [inline]
 new_sync_read+0x5b7/0x6e0 fs/read_write.c:415
 vfs_read+0x35c/0x570 fs/read_write.c:496
 ksys_read+0x1ee/0x250 fs/read_write.c:634
 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4af19b
Code: fb ff eb bd e8 a6 b6 fb ff e9 61 ff ff ff cc e8 9b 82 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
RSP: 002b:000000c0000a1850 EFLAGS: 00000206 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004af19b
RDX: 0000000000001000 RSI: 000000c000208000 RDI: 0000000000000006
RBP: 000000c0000a18a0 R08: 0000000000000001 R09: 0000000000000002
R10: 0000000000000607 R11: 0000000000000206 R12: ffffffffffffffff
R13: 0000000000000400 R14: 0000000000000004 R15: 0000000000000004
Modules linked in:
---[ end trace 6851efde4685fc76 ]---
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:976 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1d3/0x420 lib/debugobjects.c:1018
Code: 39 00 0f 85 0f 02 00 00 48 89 45 08 4d 89 30 4c 89 c7 4d 89 68 08 e8 7c d0 ff ff 48 85 ed 74 2c 49 89 e8 4c 89 c0 48 c1 e8 03 <42> 80 3c 38 00 0f 84 2e ff ff ff 4c 89 c7 4c 89 44 24 38 e8 e5 85
RSP: 0018:ffffc900016eee70 EFLAGS: 00010002
RAX: 000000781ffffd40 RBX: ffff88801d6de000 RCX: ffffffff815afd30
RDX: 1ffffffff2131dfa RSI: 0000000000000004 RDI: ffff888014648018
RBP: 000003c0ffffea00 R08: 000003c0ffffea00 R09: ffffe8ffffd1dc90
R10: fffff520002dddbc R11: 000000000000003f R12: 0000000000000004
R13: dead000000000122 R14: dead000000000100 R15: dffffc0000000000
FS:  000000c0004a0490(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c001058010 CR3: 0000000028bb7000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/04/25 04:15 linux-next e3d35712f85a 17f0b706 .config console log report info ci-upstream-linux-next-kasan-gce-root general protection fault in debug_check_no_obj_freed
* Struck through repros no longer work on HEAD.