syzbot


general protection fault in ip6erspan_set_version

Status: fixed on 2019/11/29 10:34
Reported-by: syzbot+3dac29a4da072067f33a@syzkaller.appspotmail.com
Fix commit: ab69a2304210 Revert "tipc: fix modprobe tipc failed after switch order of device registration"
First crash: 2053d, last: 2044d
Fix bisection: fixed by (bisect log) :
commit ab69a230421065b48ef93d3e6daf332e71c931dc
Author: David S. Miller <davem@davemloft.net>
Date: Fri May 17 19:15:05 2019 +0000

  Revert "tipc: fix modprobe tipc failed after switch order of device registration"

  
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in ip6erspan_set_version net C 39 2098d 2103d 11/28 fixed on 2019/03/06 07:43

Sample crash report:
audit: type=1400 audit(1554945900.414:36): avc:  denied  { map } for  pid=7915 comm="syz-executor820" path="/root/syz-executor820951771" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7915 Comm: syz-executor820 Not tainted 4.19.34 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ip6erspan_set_version+0x5c/0x350 net/ipv6/ip6_gre.c:1742
Code: 07 38 d0 7f 08 84 c0 0f 85 9f 02 00 00 49 8d bc 24 b0 00 00 00 c6 43 54 01 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 02 00 00 4d 8b ac 24 b0 00 00 00 4d 85 ed 0f
RSP: 0018:ffff888098f86fc8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888098a8ab98 RCX: 0000000000000000
RDX: 0000000000000016 RSI: ffffffff8610a4e4 RDI: 00000000000000b0
RBP: ffff888098f86fe0 R08: 1ffff11013151573 R09: ffff888098a8ab98
R10: ffffed101315157d R11: ffff888098a8abef R12: 0000000000000000
R13: ffffffff890fa140 R14: ffffffff893ce800 R15: ffff888098a8ab98
FS:  0000000001030880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000184 CR3: 000000008d273000 CR4: 00000000001406f0
Call Trace:
 ip6erspan_newlink+0x66/0x7b0 net/ipv6/ip6_gre.c:2232
 rtnl_newlink+0x1062/0x1620 net/core/rtnetlink.c:3107
 rtnetlink_rcv_msg+0x465/0xb00 net/core/rtnetlink.c:4743
 netlink_rcv_skb+0x180/0x460 net/netlink/af_netlink.c:2454
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4761
 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
 netlink_unicast+0x53c/0x720 net/netlink/af_netlink.c:1343
 netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xdd/0x130 net/socket.c:632
 ___sys_sendmsg+0x806/0x930 net/socket.c:2115
 __sys_sendmsg+0x105/0x1d0 net/socket.c:2153
 __do_sys_sendmsg net/socket.c:2162 [inline]
 __se_sys_sendmsg net/socket.c:2160 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2160
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440279
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffce24f8de8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440279
RDX: 0000000000000000 RSI: 0000000020001340 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000001 R09: 00000000004002c8
R10: 0000000000000010 R11: 0000000000000246 R12: 0000000000401b00
R13: 0000000000401b90 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace c771724f9588ffda ]---
RIP: 0010:ip6erspan_set_version+0x5c/0x350 net/ipv6/ip6_gre.c:1742
Code: 07 38 d0 7f 08 84 c0 0f 85 9f 02 00 00 49 8d bc 24 b0 00 00 00 c6 43 54 01 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 02 00 00 4d 8b ac 24 b0 00 00 00 4d 85 ed 0f
RSP: 0018:ffff888098f86fc8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888098a8ab98 RCX: 0000000000000000
RDX: 0000000000000016 RSI: ffffffff8610a4e4 RDI: 00000000000000b0
RBP: ffff888098f86fe0 R08: 1ffff11013151573 R09: ffff888098a8ab98
R10: ffffed101315157d R11: ffff888098a8abef R12: 0000000000000000
R13: ffffffff890fa140 R14: ffffffff893ce800 R15: ffff888098a8ab98
FS:  0000000001030880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000184 CR3: 000000008d273000 CR4: 00000000001406f0

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/11 01:30 linux-4.19.y 4d552acf3370 65b612b7 .config console log report syz C ci2-linux-4-19
2019/04/20 06:43 linux-4.19.y 4b0e041c9dad b0e8efcb .config console log report ci2-linux-4-19
2019/04/19 23:02 linux-4.19.y 4b0e041c9dad b0e8efcb .config console log report ci2-linux-4-19
2019/04/17 22:29 linux-4.19.y 4b0e041c9dad b0e8efcb .config console log report ci2-linux-4-19
2019/04/17 21:45 linux-4.19.y 4b0e041c9dad b0e8efcb .config console log report ci2-linux-4-19
2019/04/16 17:50 linux-4.19.y 4d552acf3370 505ab413 .config console log report ci2-linux-4-19
2019/04/11 01:04 linux-4.19.y 4d552acf3370 65b612b7 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.