syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in fq_codel_enqueue (2)

Status: upstream: reported C repro on 2020/08/28 22:42
Reported-by: syzbot+1e7f7f305992599e9d42@syzkaller.appspotmail.com
First crash: 1336d, last: 604d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in fq_codel_enqueue (3) net C inconclusive 5 663d 909d 22/26 fixed on 2023/02/24 13:50
linux-4.19 general protection fault in fq_codel_enqueue C done 5 1434d 1462d 1/1 fixed on 2020/06/21 14:03
android-5-10 general protection fault in fq_codel_enqueue (2) 2 4d02h 5d21h 0/2 premoderation: reported on 2024/04/20 04:54
android-5-15 general protection fault in fq_codel_enqueue 1 34d 34d 0/2 premoderation: reported on 2024/03/23 01:26
linux-4.14 general protection fault in fq_codel_enqueue C inconclusive 6 866d 1459d 0/1 upstream: reported C repro on 2020/04/27 21:56
upstream general protection fault in fq_codel_enqueue (2) C done 34 936d 1336d 0/26 closed as invalid on 2021/10/07 21:22
upstream general protection fault in fq_codel_enqueue net C done 25 1383d 1467d 15/26 fixed on 2020/07/17 17:58
android-5-10 general protection fault in fq_codel_enqueue 1 638d 638d 0/2 auto-obsoleted due to no activity on 2022/10/25 22:19
▶ ▼ Fix bisection attempts (14)
Created Duration User Patch Repo Result
2021/11/13 00:20 11m bisect fix linux-4.19.y error job log (0)
2021/10/13 23:51 28m bisect fix linux-4.19.y job log (0) log
2021/09/13 23:22 29m bisect fix linux-4.19.y job log (0) log
2021/08/14 22:54 27m bisect fix linux-4.19.y job log (0) log
2021/07/15 22:31 22m bisect fix linux-4.19.y job log (0) log
2021/06/15 22:08 22m bisect fix linux-4.19.y job log (0) log
2021/05/16 20:59 22m bisect fix linux-4.19.y job log (0) log
2021/04/16 18:19 21m bisect fix linux-4.19.y job log (0) log
2021/03/17 14:21 23m bisect fix linux-4.19.y job log (0) log
2021/02/03 20:30 1m bisect fix linux-4.19.y error job log (0)
2020/12/27 04:31 24m bisect fix linux-4.19.y job log (0) log
2020/11/27 04:07 24m bisect fix linux-4.19.y job log (0) log
2020/10/27 23:32 24m bisect fix linux-4.19.y job log (0) log
2020/09/27 22:42 25m bisect fix linux-4.19.y job log (0) log

Sample crash report:
netlink: 28 bytes leftover after parsing attributes in process `syz-executor112'.
netlink: 28 bytes leftover after parsing attributes in process `syz-executor112'.
netlink: 28 bytes leftover after parsing attributes in process `syz-executor112'.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8342 Comm: syz-executor112 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dequeue_head net/sched/sch_fq_codel.c:126 [inline]
RIP: 0010:fq_codel_drop net/sched/sch_fq_codel.c:174 [inline]
RIP: 0010:fq_codel_enqueue+0x8ad/0x1100 net/sched/sch_fq_codel.c:236
Code: 59 8e ca fa 45 39 ec 0f 83 cb 00 00 00 e8 5b 8d ca fa 48 8b 44 24 10 80 38 00 0f 85 69 06 00 00 49 8b 07 48 89 c2 48 c1 ea 03 <42> 80 3c 32 00 0f 85 3d 06 00 00 48 8b 10 48 8d 78 28 49 89 17 48
RSP: 0018:ffff888094b476d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8697f775
RDX: 0000000000000000 RSI: ffffffff8697f815 RDI: 0000000000000004
RBP: ffff888094b47890 R08: ffffffff8c665018 R09: 0000000000000400
R10: 0000000000000004 R11: ffffffff8c66501b R12: 0000000000000400
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88808b1c0600
FS:  0000555556171300(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000340 CR3: 0000000092640000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __dev_xmit_skb net/core/dev.c:3494 [inline]
 __dev_queue_xmit+0x140a/0x2e00 net/core/dev.c:3807
 __netlink_deliver_tap_skb net/netlink/af_netlink.c:303 [inline]
 __netlink_deliver_tap net/netlink/af_netlink.c:321 [inline]
 netlink_deliver_tap+0x8fb/0xb00 net/netlink/af_netlink.c:334
 netlink_deliver_tap_kernel net/netlink/af_netlink.c:343 [inline]
 netlink_unicast_kernel net/netlink/af_netlink.c:1324 [inline]
 netlink_unicast+0x545/0x690 net/netlink/af_netlink.c:1351
 netlink_sendmsg+0x6c3/0xc50 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xc3/0x120 net/socket.c:661
 ___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
 __sys_sendmsg net/socket.c:2265 [inline]
 __do_sys_sendmsg net/socket.c:2274 [inline]
 __se_sys_sendmsg net/socket.c:2272 [inline]
 __x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ff5b5c01c19
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd05134578 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffd051345a0 RCX: 00007ff5b5c01c19
RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000006
RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d
R10: 000000000000000d R11: 0000000000000246 R12: 00007ffd05134590
R13: 00000000000f4240 R14: 00000000000088cf R15: 00007ffd05134584
Modules linked in:
---[ end trace 395dedf27835a027 ]---
RIP: 0010:dequeue_head net/sched/sch_fq_codel.c:126 [inline]
RIP: 0010:fq_codel_drop net/sched/sch_fq_codel.c:174 [inline]
RIP: 0010:fq_codel_enqueue+0x8ad/0x1100 net/sched/sch_fq_codel.c:236
Code: 59 8e ca fa 45 39 ec 0f 83 cb 00 00 00 e8 5b 8d ca fa 48 8b 44 24 10 80 38 00 0f 85 69 06 00 00 49 8b 07 48 89 c2 48 c1 ea 03 <42> 80 3c 32 00 0f 85 3d 06 00 00 48 8b 10 48 8d 78 28 49 89 17 48
RSP: 0018:ffff888094b476d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8697f775
RDX: 0000000000000000 RSI: ffffffff8697f815 RDI: 0000000000000004
RBP: ffff888094b47890 R08: ffffffff8c665018 R09: 0000000000000400
R10: 0000000000000004 R11: ffffffff8c66501b R12: 0000000000000400
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88808b1c0600
FS:  0000555556171300(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000340 CR3: 0000000092640000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	59                   	pop    %rcx
   1:	8e ca                	mov    %edx,%cs
   3:	fa                   	cli
   4:	45 39 ec             	cmp    %r13d,%r12d
   7:	0f 83 cb 00 00 00    	jae    0xd8
   d:	e8 5b 8d ca fa       	callq  0xfaca8d6d
  12:	48 8b 44 24 10       	mov    0x10(%rsp),%rax
  17:	80 38 00             	cmpb   $0x0,(%rax)
  1a:	0f 85 69 06 00 00    	jne    0x689
  20:	49 8b 07             	mov    (%r15),%rax
  23:	48 89 c2             	mov    %rax,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	42 80 3c 32 00       	cmpb   $0x0,(%rdx,%r14,1) <-- trapping instruction
  2f:	0f 85 3d 06 00 00    	jne    0x672
  35:	48 8b 10             	mov    (%rax),%rdx
  38:	48 8d 78 28          	lea    0x28(%rax),%rdi
  3c:	49 89 17             	mov    %rdx,(%r15)
  3f:	48                   	rex.W

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/03/31 08:01 linux-4.19.y 3f8a27f9e27b 9d49f3a7 .config console log report syz C ci2-linux-4-19 general protection fault in fq_codel_enqueue
2021/02/15 14:21 linux-4.19.y 811218eceeaa 98682e5e .config console log report syz C ci2-linux-4-19 general protection fault in fq_codel_enqueue
2020/08/28 22:42 linux-4.19.y f6d5cb9e2c06 d5a3ae1f .config console log report syz C ci2-linux-4-19
2022/08/30 05:02 linux-4.19.y 3f8a27f9e27b 4a380809 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in fq_codel_enqueue
2022/05/10 07:23 linux-4.19.y 3f8a27f9e27b 8b277b8e .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2022/05/08 02:01 linux-4.19.y 3f8a27f9e27b e60b1103 .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2022/04/10 12:05 linux-4.19.y 3f8a27f9e27b e22c3da3 .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2022/03/30 21:54 linux-4.19.y 3f8a27f9e27b 42718dd6 .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2022/03/11 21:26 linux-4.19.y 3f8a27f9e27b 9e8eaa75 .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2022/03/11 07:02 linux-4.19.y 3f8a27f9e27b 9e8eaa75 .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2022/02/05 00:47 linux-4.19.y 3f8a27f9e27b e13a05ed .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2022/01/20 17:23 linux-4.19.y 3f8a27f9e27b b838eb76 .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2021/11/27 15:31 linux-4.19.y 3f8a27f9e27b 63eeac02 .config console log report info ci2-linux-4-19 general protection fault in fq_codel_enqueue
2021/01/04 19:24 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
* Struck through repros no longer work on HEAD.