WARNING: locking bug in __icmp_send

Status: closed as dup on 2019/05/09 13:03
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+173d67242daa7ce45f85@syzkaller.appspotmail.com
First crash: 2697d, last: 2680d
Cause bisection: introduced by (bisect log) :
commit 8bafb83eeee2efb8b9b4e9dfd9fb90debe4a2417
Author: David S. Miller <davem@davemloft.net>
Date: Fri Mar 30 16:32:00 2018 +0000

  Merge branch 'stmmac-DWMAC5'

Crash: KASAN: slab-out-of-bounds Read in icmp_send (log)
Repro: syz .config
  
▶ ▼ Duplicate of
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported
WARNING: locking bug in icmp_send net 4 syz done 1 2711d 2711d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
WARNING: locking bug in __icmp_send 1 (3) 2019/05/09 13:02
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: locking bug in __icmp_send (2) net 4 2 2605d 2613d 0/29 closed as invalid on 2019/07/01 17:56

Sample crash report:
Enabling of bearer <udp:syz1> rejected, already enabled
Enabling of bearer <udp:syz1> rejected, already enabled
Enabling of bearer <udp:syz1> rejected, already enabled
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(class_idx > MAX_LOCKDEP_KEYS)
WARNING: CPU: 0 PID: 9 at kernel/locking/lockdep.c:3315 __lock_acquire+0x13bf/0x4700 kernel/locking/lockdep.c:3315
Enabling of bearer <udp:syz1> rejected, already enabled
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.0.0+ #109
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
Enabling of bearer <udp:syz1> rejected, already enabled
 panic+0x2cb/0x65c kernel/panic.c:214
kobject: 'loop0' (00000000f02900e9): kobject_uevent_env
kobject: 'loop0' (00000000f02900e9): fill_kobj_path: path = '/devices/virtual/block/loop0'
 __warn.cold+0x20/0x45 kernel/panic.c:571
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:290
kobject: 'loop2' (00000000763050ef): kobject_uevent_env
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973
RIP: 0010:__lock_acquire+0x13bf/0x4700 kernel/locking/lockdep.c:3315
kobject: 'loop2' (00000000763050ef): fill_kobj_path: path = '/devices/virtual/block/loop2'
Code: 8b 1d 69 20 06 08 45 85 db 0f 85 d6 f4 ff ff 48 c7 c6 80 a4 6b 87 48 c7 c7 e0 78 6b 87 44 89 9c 24 98 00 00 00 e8 0f 26 ec ff <0f> 0b 44 8b 9c 24 98 00 00 00 e9 af f4 ff ff 8b 3d bc e4 fe 08 85
RSP: 0018:ffff8880aa26f300 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000066c4c53a RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff815a65c6 RDI: ffffed101544de52
RBP: ffff8880aa26f4d0 R08: ffff8880aa25c240 R09: fffffbfff1133335
R10: fffffbfff1133334 R11: ffffffff889999a3 R12: ffff8880aa25cb28
R13: ffff8880aa25cb32 R14: 0000000066c4c53a R15: ffff8880aa25c240
Enabling of bearer <udp:syz1> rejected, already enabled
 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3841
kobject: 'loop5' (0000000002a93434): kobject_uevent_env
kobject: 'loop5' (0000000002a93434): fill_kobj_path: path = '/devices/virtual/block/loop5'
 __raw_spin_trylock include/linux/spinlock_api_smp.h:90 [inline]
 _raw_spin_trylock+0x62/0x80 kernel/locking/spinlock.c:128
 spin_trylock include/linux/spinlock.h:339 [inline]
 icmp_xmit_lock net/ipv4/icmp.c:219 [inline]
 __icmp_send+0x553/0x1400 net/ipv4/icmp.c:666
Enabling of bearer <udp:syz1> rejected, already enabled
kobject: 'loop0' (00000000f02900e9): kobject_uevent_env
kobject: 'loop0' (00000000f02900e9): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop1' (000000004f39548c): kobject_uevent_env
 icmp_send include/net/icmp.h:47 [inline]
 __udp4_lib_rcv+0x1fb6/0x2c50 net/ipv4/udp.c:2323
kobject: 'loop1' (000000004f39548c): fill_kobj_path: path = '/devices/virtual/block/loop1'
 udp_rcv+0x22/0x30 net/ipv4/udp.c:2482
 ip_protocol_deliver_rcu+0x60/0x8f0 net/ipv4/ip_input.c:208
 ip_local_deliver_finish+0x23b/0x390 net/ipv4/ip_input.c:234
kobject: 'loop2' (00000000763050ef): kobject_uevent_env
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 ip_local_deliver+0x1e9/0x520 net/ipv4/ip_input.c:255
kobject: 'loop2' (00000000763050ef): fill_kobj_path: path = '/devices/virtual/block/loop2'
 dst_input include/net/dst.h:450 [inline]
 ip_rcv_finish+0x1e1/0x300 net/ipv4/ip_input.c:414
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 ip_rcv+0xe8/0x3f0 net/ipv4/ip_input.c:524
 __netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4973
 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083
 process_backlog+0x206/0x750 net/core/dev.c:5923
 napi_poll net/core/dev.c:6346 [inline]
 net_rx_action+0x4fa/0x1070 net/core/dev.c:6412
 __do_softirq+0x266/0x95a kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:654 [inline]
 run_ksoftirqd+0x8e/0x110 kernel/softirq.c:646
 smpboot_thread_fn+0x6ab/0xa10 kernel/smpboot.c:164
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/06 02:02 net-old d9862cfbe209 16559f86 .config console log report syz ci-upstream-net-this-kasan-gce
2019/03/23 02:39 linux-next e382d91f5f80 3361bde5 .config console log report syz ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.