On Thu, Jul 18, 2019 at 5:18 AM syzbot <syzbot+9399c158fcc09b21d...@syzkaller.appspotmail.com> wrote: > > Hello, > > syzbot found the following crash on: > > HEAD commit: a5b64700 fix: taprio: Change type of txtime-delay paramete.. > git tree: net > console output: https://syzkaller.appspot.com/x/log.txt?x=1588b458600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=87305c3ca9c25c70 > dashboard link: https://syzkaller.appspot.com/bug?extid=9399c158fcc09b21d0d2 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=105a61a4600000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=153ef948600000 > > The bug was bisected to: > > commit c8c8218ec5af5d2598381883acbefbf604e56b5e > Author: Cong Wang <xiyou.wangc...@gmail.com> > Date: Thu Jun 27 21:30:58 2019 +0000 > > netrom: fix a memory leak in nr_rx_frame() > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=159ef948600000 > final crash: https://syzkaller.appspot.com/x/report.txt?x=179ef948600000 > console output: https://syzkaller.appspot.com/x/log.txt?x=139ef948600000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+9399c158fcc09b21d...@syzkaller.appspotmail.com > Fixes: c8c8218ec5af ("netrom: fix a memory leak in nr_rx_frame()") > > ================================================================== > BUG: KASAN: use-after-free in atomic_read > /./include/asm-generic/atomic-instrumented.h:26 [inline] > BUG: KASAN: use-after-free in refcount_inc_not_zero_checked+0x81/0x200 > /lib/refcount.c:123 > Read of size 4 at addr ffff8880a5d3f380 by task swapper/1/0 > > CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.2.0+ #89 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > <IRQ> > __dump_stack /lib/dump_stack.c:77 [inline] > dump_stack+0x172/0x1f0 /lib/dump_stack.c:113 > print_address_description.cold+0xd4/0x306 /mm/kasan/report.c:351 > __kasan_report.cold+0x1b/0x36 /mm/kasan/report.c:482 > kasan_report+0x12/0x20 /mm/kasan/common.c:612 > check_memory_region_inline /mm/kasan/generic.c:185 [inline] > check_memory_region+0x134/0x1a0 /mm/kasan/generic.c:192 > __kasan_check_read+0x11/0x20 /mm/kasan/common.c:92 > atomic_read /./include/asm-generic/atomic-instrumented.h:26 [inline] > refcount_inc_not_zero_checked+0x81/0x200 /lib/refcount.c:123 > refcount_inc_checked+0x17/0x70 /lib/refcount.c:156 > sock_hold /./include/net/sock.h:649 [inline] > sk_add_node /./include/net/sock.h:701 [inline] > nr_insert_socket+0x2d/0xe0 /net/netrom/af_netrom.c:137
Looks like nr_insert_socket() doesn't hold a refcnt before inserting it into a global list. Let me think about how to fix this. Thanks.
