KASAN: null-ptr-deref Write in kcm_tx_work (3)

Status: fixed on 2023/02/24 13:50
Subsystems: net
[Documentation on labels]
Fix commit: ec7eede369fe kcm: avoid potential race in kcm_tx_work
First crash: 1494d, last: 1393d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: null-ptr-deref Write in kcm_tx_work (log)
Repro: C syz .config
  
Fix bisection the fix commit could be any of (bisect log):
  ca1fdab7fd27 Merge tag 'efi-urgent-for-v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi
  568035b01cfb Linux 6.0-rc1
   
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in kcm_tx_work (2) net 12 1 1657d 1653d 0/29 auto-closed as invalid on 2022/05/10 04:14
upstream KASAN: null-ptr-deref Write in kcm_tx_work net 12 2 2322d 2347d 0/29 auto-closed as invalid on 2020/07/14 11:16

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline]
BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
BUG: KASAN: null-ptr-deref in kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742
Write of size 8 at addr 0000000000000008 by task kworker/u4:1/11

CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted 5.19.0-rc3-syzkaller-00038-gca1fdab7fd27 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: kkcmd kcm_tx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_report mm/kasan/report.c:432 [inline]
 kasan_report.cold+0x61/0x1c6 mm/kasan/report.c:491
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 instrument_atomic_write include/linux/instrumented.h:86 [inline]
 clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
 kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted 5.19.0-rc3-syzkaller-00038-gca1fdab7fd27 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: kkcmd kcm_tx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 panic+0x2d7/0x64a kernel/panic.c:274
 end_report.part.0+0x3f/0x7c mm/kasan/report.c:168
 end_report include/trace/events/error_report.h:69 [inline]
 kasan_report.cold+0x93/0x1c6 mm/kasan/report.c:493
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 instrument_atomic_write include/linux/instrumented.h:86 [inline]
 clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
 kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/06/22 19:04 upstream ca1fdab7fd27 0fc5c330 .config console log report syz C ci-upstream-kasan-gce KASAN: null-ptr-deref Write in kcm_tx_work
2022/09/30 23:58 net-next-old 0f5ef005310d feb56351 .config console log report syz C ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in kcm_tx_work
2022/06/22 01:35 linux-next 34d1d36073ea 0fc5c330 .config console log report syz C ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Write in kcm_tx_work
2022/07/07 18:42 net-old 07266d066301 bff65f44 .config console log report info ci-upstream-net-this-kasan-gce KASAN: null-ptr-deref Write in kcm_tx_work
2022/09/30 22:14 net-next-old 0f5ef005310d feb56351 .config console log report info ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in kcm_tx_work
2022/07/12 03:57 net-next-old edb2c3476db9 da3d6955 .config console log report info ci-upstream-net-kasan-gce KASAN: null-ptr-deref Write in kcm_tx_work
2022/06/21 23:29 linux-next 34d1d36073ea 0fc5c330 .config console log report info ci-upstream-linux-next-kasan-gce-root KASAN: null-ptr-deref Write in kcm_tx_work
* Struck through repros no longer work on HEAD.