syzbot


general protection fault in mr_mfc_find_parent

Status: fixed on 2018/06/07 13:52
Subsystems: net
[Documentation on labels]
Fix commit: 66fb33254f45 ipmr: properly check rhltable_init() return value
First crash: 2192d, last: 2187d

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 17956 Comm: syz-executor4 Not tainted 4.17.0-rc6+ #67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:rht_key_hashfn include/linux/rhashtable.h:277 [inline]
RIP: 0010:__rhashtable_lookup include/linux/rhashtable.h:630 [inline]
RIP: 0010:rhltable_lookup include/linux/rhashtable.h:716 [inline]
RIP: 0010:mr_mfc_find_parent+0x2ad/0xbb0 net/ipv4/ipmr_base.c:63
RSP: 0018:ffff88018c286f70 EFLAGS: 00010203
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffc900052d2000
RDX: 0000000000000079 RSI: ffffffff86622e19 RDI: 000000000000000c
RBP: ffff88018c2871c0 R08: ffff8801b0102580 R09: ffffed003b5e46d2
R10: ffffed003b5e46d2 R11: ffff8801daf23693 R12: dffffc0000000000
R13: ffff88018c287198 R14: ffff8801a9802a80 R15: ffff88018c287658
FS:  00007f4340ed1700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004daac4 CR3: 0000000186e6f000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ip6mr_cache_find_parent net/ipv6/ip6mr.c:981 [inline]
 ip6mr_mfc_delete+0x1fe/0x6b0 net/ipv6/ip6mr.c:1221
 ip6_mroute_setsockopt+0x15c6/0x1d70 net/ipv6/ip6mr.c:1698
 do_ipv6_setsockopt.isra.9+0x422/0x4660 net/ipv6/ipv6_sockglue.c:163
 ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:922
 rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1060
 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3039
 __sys_setsockopt+0x1bd/0x390 net/socket.c:1903
 __do_sys_setsockopt net/socket.c:1914 [inline]
 __se_sys_setsockopt net/socket.c:1911 [inline]
 __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455a09
RSP: 002b:00007f4340ed0c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007f4340ed16d4 RCX: 0000000000455a09
RDX: 00000000000000cd RSI: 0000000000000029 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 000000000000005c R09: 0000000000000000
R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000603 R14: 00000000006fd0e8 R15: 0000000000000000
Code: ff ff e8 27 13 17 fb 48 8b 85 18 fe ff ff 31 ff 48 c1 e8 03 66 42 89 3c 20 48 8b 85 20 fe ff ff 48 8d 78 0c 48 89 f8 48 c1 e8 03 <42> 0f b6 14 20 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 
RIP: rht_key_hashfn include/linux/rhashtable.h:277 [inline] RSP: ffff88018c286f70
RIP: __rhashtable_lookup include/linux/rhashtable.h:630 [inline] RSP: ffff88018c286f70
RIP: rhltable_lookup include/linux/rhashtable.h:716 [inline] RSP: ffff88018c286f70
RIP: mr_mfc_find_parent+0x2ad/0xbb0 net/ipv4/ipmr_base.c:63 RSP: ffff88018c286f70
---[ end trace 492377e909fa0310 ]---

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/25 23:52 upstream 62d18ecfa641 f48c20b8 .config console log report ci-upstream-kasan-gce-root
2018/05/20 12:07 upstream 203ec2fed17a f48c20b8 .config console log report ci-upstream-kasan-gce
* Struck through repros no longer work on HEAD.