KASAN: slab-out-of-bounds Write in __run_timers

Status: auto-closed as invalid on 2021/10/26 12:53
Reported-by: syzbot+b9125f9f83b03d388605@syzkaller.appspotmail.com
First crash: 2043d, last: 1852d
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: use-after-free Write in __run_timers (2) 22 C 752 425d 514d 0/2 upstream: reported C repro on 2025/02/25 14:17
upstream KASAN: slab-out-of-bounds Write in __run_timers 21 19 3231d 3248d 0/29 closed as invalid on 2017/10/22 12:45
android-54 KASAN: use-after-free Write in __run_timers 22 syz 449 752d 2204d 0/2 auto-obsoleted due to no activity on 2024/09/11 00:16
upstream KASAN: invalid-access Write in __run_timers kernel -1 8 1981d 1988d 0/29 auto-closed as invalid on 2021/05/20 13:15
android-6-1 KASAN: use-after-free Write in __run_timers origin:lts 22 C 1025 4h53m 601d 0/2 upstream: reported C repro on 2024/12/01 07:19
upstream KMSAN: uninit-value in __run_timers (3) net 7 C error 4 1053d 1090d 0/29 auto-obsoleted due to no activity on 2024/01/10 00:11
upstream KASAN: slab-use-after-free Write in __run_timers net 22 1 511d 511d 0/29 closed as invalid on 2025/03/30 10:14
upstream BUG: unable to handle kernel paging request in __run_timers (2) sound virt net 21 4 175d 271d 0/29 auto-obsoleted due to no activity on 2026/05/01 08:57
linux-5.15 KASAN: use-after-free Write in __run_timers origin:lts-only 22 C error 1 191d 225d 0/3 auto-obsoleted due to no activity on 2026/06/03 21:03
upstream BUG: unable to handle kernel NULL pointer dereference in __run_timers arm 10 1 787d 783d 0/29 auto-obsoleted due to no activity on 2024/08/27 10:03

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in hlist_move_list include/linux/list.h:843 [inline]
BUG: KASAN: slab-out-of-bounds in __collect_expired_timers kernel/time/timer.c:1482 [inline]
BUG: KASAN: slab-out-of-bounds in collect_expired_timers kernel/time/timer.c:1717 [inline]
BUG: KASAN: slab-out-of-bounds in __run_timers+0x507/0x740 kernel/time/timer.c:1781
Write of size 8 at addr ffff8881e40b71c8 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.125-syzkaller-00234-g47fe7966921f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x24e lib/dump_stack.c:118
 print_address_description+0x9b/0x650 mm/kasan/report.c:384
 __kasan_report+0x182/0x260 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 hlist_move_list include/linux/list.h:843 [inline]
 __collect_expired_timers kernel/time/timer.c:1482 [inline]
 collect_expired_timers kernel/time/timer.c:1717 [inline]
 __run_timers+0x507/0x740 kernel/time/timer.c:1781
 run_timer_softirq+0x46/0x80 kernel/time/timer.c:1798
 __do_softirq+0x23e/0x615 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x113/0x420 arch/x86/kernel/apic/apic.c:1150
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:831
 </IRQ>
RIP: 0010:default_idle+0x1f/0x30 arch/x86/kernel/process.c:573
Code: 90 90 90 90 90 90 90 90 90 90 90 e8 ab a1 e5 fd bf 01 00 00 00 89 c6 e8 3f 34 e2 fc e9 07 00 00 00 0f 00 2d e3 39 5f 00 fb f4 <e8> 8c a1 e5 fd bf ff ff ff ff 89 c6 e9 20 34 e2 fc 41 57 41 56 53
RSP: 0018:ffffffff85e07d18 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffffffff85e18a40 RCX: ffffffff85e18a40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffffff85e07e20 R08: ffffffff822cd380 R09: fffffbfff0bc3149
R10: fffffbfff0bc3149 R11: 0000000000000000 R12: ffffffff86473120
R13: 1ffffffff0bc3148 R14: dffffc0000000000 R15: 0000000000000000
 default_idle_call kernel/sched/idle.c:94 [inline]
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x229/0x600 kernel/sched/idle.c:264
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:356
 start_kernel+0x710/0x85c init/main.c:1049
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241

The buggy address belongs to the page:
page:ffffea0007902d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0
flags: 0x8000000000010000(head)
raw: 8000000000010000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x140dc0(GFP_USER|__GFP_COMP|__GFP_ZERO)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x19a/0x380 mm/page_alloc.c:2171
 get_page_from_freelist+0x550/0x8b0 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x3a2/0x880 mm/page_alloc.c:4855
 __alloc_pages include/linux/gfp.h:503 [inline]
 __alloc_pages_node include/linux/gfp.h:516 [inline]
 alloc_pages_node include/linux/gfp.h:530 [inline]
 kmalloc_order mm/slab_common.c:1341 [inline]
 kmalloc_order_trace+0x2a/0xf0 mm/slab_common.c:1357
 kmalloc_large include/linux/slab.h:485 [inline]
 kmalloc include/linux/slab.h:549 [inline]
 kzalloc include/linux/slab.h:690 [inline]
 tipc_nametbl_init+0x93/0x260 net/tipc/name_table.c:738
 tipc_init_net+0x229/0x360 net/tipc/core.c:74
 ops_init+0x26e/0x340 net/core/net_namespace.c:137
 setup_net+0x21b/0xa70 net/core/net_namespace.c:335
 copy_net_ns+0x2cf/0x470 net/core/net_namespace.c:476
 create_new_namespaces+0x442/0x610 kernel/nsproxy.c:103
 copy_namespaces+0x169/0x1b0 kernel/nsproxy.c:161
 copy_process+0x1fd7/0x5630 kernel/fork.c:2043
 _do_fork+0x18f/0x900 kernel/fork.c:2391
 __do_sys_clone kernel/fork.c:2549 [inline]
 __se_sys_clone kernel/fork.c:2530 [inline]
 __x64_sys_clone+0x25b/0x2c0 kernel/fork.c:2530
 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 __free_pages_ok+0xc60/0xd80 mm/page_alloc.c:1438
 free_the_page mm/page_alloc.c:4917 [inline]
 __free_pages+0x8f/0x250 mm/page_alloc.c:4923
 kfree+0x1ee/0x660 mm/slub.c:4058
 device_release+0x70/0x1a0 drivers/base/core.c:1767
 kobject_cleanup+0x1de/0x3c0 lib/kobject.c:708
 tun_set_iff drivers/net/tun.c:2900 [inline]
 __tun_chr_ioctl+0x2b91/0x4d20 drivers/net/tun.c:3143
 do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
 ksys_ioctl fs/ioctl.c:742 [inline]
 __do_sys_ioctl fs/ioctl.c:749 [inline]
 __se_sys_ioctl fs/ioctl.c:747 [inline]
 __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Memory state around the buggy address:
 ffff8881e40b7080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 ffff8881e40b7100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>ffff8881e40b7180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
                                              ^
 ffff8881e40b7200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 ffff8881e40b7280: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B             5.4.125-syzkaller-00234-g47fe7966921f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09cd0 EFLAGS: 00010202
RAX: ffffffff815624b8 RBX: 0000000000000101 RCX: ffffffff85e18a40
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881e40b71c0
RBP: ffff8881e40b71e0 R08: ffffffff8156227d R09: fffffbfff0dc45d1
R10: fffffbfff0dc45d1 R11: 0000000000000000 R12: 00000000ffffc128
R13: 1ffff1103edc46f1 R14: 0000000000000000 R15: ffff8881e40b71c0
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001ec78a000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x30/0x330 kernel/time/timer.c:1416
 expire_timers+0x214/0x410 kernel/time/timer.c:1461
 __run_timers+0x603/0x740 kernel/time/timer.c:1785
 run_timer_softirq+0x46/0x80 kernel/time/timer.c:1798
 __do_softirq+0x23e/0x615 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x113/0x420 arch/x86/kernel/apic/apic.c:1150
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:831
 </IRQ>
RIP: 0010:default_idle+0x1f/0x30 arch/x86/kernel/process.c:573
Code: 90 90 90 90 90 90 90 90 90 90 90 e8 ab a1 e5 fd bf 01 00 00 00 89 c6 e8 3f 34 e2 fc e9 07 00 00 00 0f 00 2d e3 39 5f 00 fb f4 <e8> 8c a1 e5 fd bf ff ff ff ff 89 c6 e9 20 34 e2 fc 41 57 41 56 53
RSP: 0018:ffffffff85e07d18 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: ffffffff85e18a40 RCX: ffffffff85e18a40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffffff85e07e20 R08: ffffffff822cd380 R09: fffffbfff0bc3149
R10: fffffbfff0bc3149 R11: 0000000000000000 R12: ffffffff86473120
R13: 1ffffffff0bc3148 R14: dffffc0000000000 R15: 0000000000000000
 default_idle_call kernel/sched/idle.c:94 [inline]
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x229/0x600 kernel/sched/idle.c:264
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:356
 start_kernel+0x710/0x85c init/main.c:1049
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
Modules linked in:
CR2: 0000000000000000
---[ end trace 8842771ff00bdcc3 ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09cd0 EFLAGS: 00010202
RAX: ffffffff815624b8 RBX: 0000000000000101 RCX: ffffffff85e18a40
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881e40b71c0
RBP: ffff8881e40b71e0 R08: ffffffff8156227d R09: fffffbfff0dc45d1
R10: fffffbfff0dc45d1 R11: 0000000000000000 R12: 00000000ffffc128
R13: 1ffff1103edc46f1 R14: 0000000000000000 R15: ffff8881e40b71c0
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001ec78a000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/06/28 12:53 android12-5.4 47fe7966921f 9d2ab5df .config console log report info ci2-android-5-4-kasan KASAN: slab-out-of-bounds Write in __run_timers
2021/05/31 08:34 android12-5.4 3e256ddba1ff 325a8dab .config console log report info ci2-android-5-4-kasan KASAN: slab-out-of-bounds Write in __run_timers
2021/01/31 20:22 android12-5.4 1e5f5a14faba fc9fd31e .config console log report info ci2-android-5-4-kasan KASAN: slab-out-of-bounds Write in __run_timers
2020/12/20 05:28 android12-5.4 cd5f5cb9fe67 04201c06 .config console log report info ci2-android-5-4-kasan
* Struck through repros no longer work on HEAD.