syzbot


WARNING in fib6_add

Status: fixed on 2024/01/11 06:28
Reported-by: syzbot+48e882067aaab477fdfe@syzkaller.appspotmail.com
Fix commit: a3f5de10b5cf ipv6: fix potential NULL deref in fib6_add()
First crash: 530d, last: 363d
Fix bisection: fixed by (bisect log) :
commit a3f5de10b5cfd39328d76e73a88dc1daa22ed50f
Author: Eric Dumazet <edumazet@google.com>
Date: Wed Nov 29 16:06:30 2023 +0000

  ipv6: fix potential NULL deref in fib6_add()

  
Bug presence (1)
Date Name Commit Repro Result
2024/01/07 upstream (ToT) 52b1853b080a C Didn't crash
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in fib6_add (5) net C done 6 367d 530d 25/28 fixed on 2024/01/22 01:16
upstream WARNING in fib6_add net C 8225 2585d 2609d 3/28 fixed on 2017/11/28 03:36
upstream WARNING in fib6_add (4) net 2 1681d 1697d 0/28 auto-closed as invalid on 2020/08/31 02:33
linux-5.15 WARNING in fib6_add C error 4 362d 531d 0/3 auto-obsoleted due to no activity on 2024/03/22 05:58
upstream WARNING in fib6_add (2) net 11 2059d 2200d 0/28 auto-closed as invalid on 2019/10/17 17:19
upstream WARNING in fib6_add (3) net 1 1775d 1775d 0/28 closed as invalid on 2020/02/24 20:17
linux-4.19 WARNING in fib6_add 1 1948d 1948d 0/1 auto-closed as invalid on 2019/12/07 20:56
Fix bisection attempts (4)
Created Duration User Patch Repo Result
2024/01/11 01:55 4h29m bisect fix linux-6.1.y OK (1) job log
2023/12/11 23:23 1h56m bisect fix linux-6.1.y OK (0) job log log
2023/11/11 06:08 1h47m bisect fix linux-6.1.y OK (0) job log log
2023/09/09 05:54 1h54m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fb3ac971c39
RDX: 0000000020000000 RSI: 000000000000890b RDI: 0000000000000005
RBP: 00007fb3ac9f1440 R08: 00007fffbb6da927 R09: 00007fffbb6dacb8
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000031
R13: 0000000000000003 R14: 00007fffbb6dac10 R15: 00007fffbb6dabda
 </TASK>
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3547 at net/ipv6/ip6_fib.c:1507 fib6_add+0x318e/0x3c80
Modules linked in:
CPU: 1 PID: 3547 Comm: syz-executor388 Not tainted 6.1.56-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
RIP: 0010:fib6_add+0x318e/0x3c80 net/ipv6/ip6_fib.c:1507
Code: 8b 94 24 80 00 00 00 e8 a0 1e 00 00 48 85 c0 74 14 49 89 c6 e8 53 3c 3e f8 eb 5b e8 4c 3c 3e f8 e9 c9 00 00 00 e8 42 3c 3e f8 <0f> 0b 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 80 3c 01 00 74
RSP: 0018:ffffc90003baf760 EFLAGS: 00010293
RAX: ffffffff894c34ae RBX: ffffc90003bafab0 RCX: ffff888021819dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90003baf980 R08: ffffffff894c55d5 R09: ffffed100ef8fd06
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888077a70420
R13: 1ffff1100ef4e084 R14: ffff888077c7e800 R15: 00000000ffffffff
FS:  00005555557f1380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000340 CR3: 0000000077dce000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __ip6_ins_rt net/ipv6/route.c:1305 [inline]
 ip6_route_add+0x84/0x120 net/ipv6/route.c:3851
 ipv6_route_ioctl+0x521/0x7b0 net/ipv6/route.c:4471
 inet6_ioctl+0x1e1/0x240 net/ipv6/af_inet6.c:585
 sock_do_ioctl+0x152/0x450 net/socket.c:1174
 sock_ioctl+0x47f/0x770 net/socket.c:1291
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb3ac971c39
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbb6dab88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fb3ac971c39
RDX: 0000000020000000 RSI: 000000000000890b RDI: 0000000000000005
RBP: 00007fb3ac9f1440 R08: 00007fffbb6da927 R09: 00007fffbb6dacb8
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000031
R13: 0000000000000003 R14: 00007fffbb6dac10 R15: 00007fffbb6dabda
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/10/09 00:16 linux-6.1.y ecda77b46871 5e837c76 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan WARNING in fib6_add
2023/06/27 15:25 linux-6.1.y e84a4e368abe 4cd5bb25 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in fib6_add
* Struck through repros no longer work on HEAD.