syzbot


general protection fault in ___bpf_prog_run

Status: fixed on 2018/02/12 17:26
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+1eb094057b338eb1fc00@syzkaller.appspotmail.com
Fix commit: 65073a67331d bpf: fix null pointer deref in bpf_prog_test_run_xdp
First crash: 2305d, last: 2298d
Discussions (3)
Title Replies (including bot) Last reply
[PATCH bpf v2] bpf: fix null pointer deref in bpf_prog_test_run_xdp 3 (3) 2018/02/01 15:49
[PATCH bpf] bpf: fix null pointer deref in bpf_prog_test_run_xdp 4 (4) 2018/01/31 11:26
general protection fault in ___bpf_prog_run 2 (3) 2018/01/31 00:35

Sample crash report:
audit: type=1400 audit(1517334503.713:9): avc:  denied  { prog_run } for  pid=4145 comm="syzkaller844681" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4145 Comm: syzkaller844681 Not tainted 4.15.0-rc9+ #9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:___bpf_prog_run+0xec7/0x6020 kernel/bpf/core.c:1258
RSP: 0018:ffff8801b208f4d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff817d64e5
RDX: 0000000000000000 RSI: ffffc900013dc030 RDI: ffffc900013dc04a
RBP: ffff8801b208f5d8 R08: 1ffff10036411e23 R09: 0000000000000002
R10: ffff8801b208f5d8 R11: 0000000000000000 R12: ffff8801b208f650
R13: ffffc900013dc048 R14: 0000000000000000 R15: ffff8801b208f678
FS:  0000000001cfe880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002072b000 CR3: 00000001b6a9d002 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __bpf_prog_run32+0xce/0x130 kernel/bpf/core.c:1379
 bpf_test_run_one net/bpf/test_run.c:20 [inline]
 bpf_test_run+0xb0/0x330 net/bpf/test_run.c:36
 bpf_prog_test_run_xdp+0x270/0x470 net/bpf/test_run.c:168
 bpf_prog_test_run kernel/bpf/syscall.c:1514 [inline]
 SYSC_bpf kernel/bpf/syscall.c:1901 [inline]
 SyS_bpf+0x13bc/0x4860 kernel/bpf/syscall.c:1843
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x43ff99
RSP: 002b:00007ffc75aba9f8 EFLAGS: 00000203 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 000000000043ff99
RDX: 0000000000000028 RSI: 0000000020f7cfd8 RDI: 000000000000000a
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000203 R12: 00000000004018c0
R13: 0000000000401950 R14: 0000000000000000 R15: 0000000000000000
Code: 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 7c 4f 00 00 4d 0f bf 75 02 41 0f b6 45 01 4d 01 fe 83 e0 0f 4d 8d 3c c4 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 0f 85 77 49 00 00 4c 89 f8 4d 8b 36 48 c1 e8 03 80 
RIP: ___bpf_prog_run+0xec7/0x6020 kernel/bpf/core.c:1258 RSP: ffff8801b208f4d0
---[ end trace 3891966c6c38a115 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/30 17:50 bpf-next 868c36dcc949 a899be78 .config console log report syz C ci-upstream-bpf-next-kasan-gce
2018/02/06 23:16 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/05 17:55 bpf-next 617aebe6a97e a1bc9d40 .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/04 10:45 bpf-next b2fe5fa68642 632a8c2c .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/02 06:15 bpf-next b2fe5fa68642 826b35d6 .config console log report ci-upstream-bpf-next-kasan-gce
2018/01/31 20:53 bpf-next 868c36dcc949 02553e22 .config console log report ci-upstream-bpf-next-kasan-gce
2018/01/31 10:31 bpf-next 868c36dcc949 02553e22 .config console log report ci-upstream-bpf-next-kasan-gce
2018/01/30 17:32 bpf-next 868c36dcc949 a899be78 .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.