syzbot

 sign-in | mailing list | source | docs
🐞 Open [993] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12515] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in __smc_diag_dump

Status: fixed on 2019/07/10 21:40
Reported-by: syzbot+5dd1f9327a9ee760048c@syzkaller.appspotmail.com
Fix commit: b03faa1fafc8 net/smc: postpone release of clcsock
First crash: 1945d, last: 1928d
Cause bisection: introduced by (bisect log) :
commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sun Jul 2 23:07:02 2017 +0000

  Linux 4.12

  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
Reminder: 6 open syzbot bugs in "net/smc" subsystem 1 (1) 2019/07/02 06:24
general protection fault in __smc_diag_dump 2 (4) 2019/03/24 07:20
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in __smc_diag_dump syz error 39 545d 1767d 0/1 upstream: reported syz repro on 2019/06/25 06:51

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9582 Comm: syz-executor0 Not tainted 5.0.0-rc1+ #21
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
kobject: 'gretap0' (00000000d7aceeb7): auto cleanup 'remove' event
RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:43 [inline]
RIP: 0010:__smc_diag_dump.isra.0+0x32a/0x2ba0 net/smc/smc_diag.c:93
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 26 25 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7f 20 49 8d 7f 0e 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 d2
RSP: 0018:ffff88806ab27120 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: ffff88808bf25280 RCX: 0000000000000000
kobject: 'gretap0' (00000000d7aceeb7): kobject_uevent_env
RDX: 0000000000000001 RSI: ffffffff87b6cca2 RDI: 000000000000000e
RBP: ffff88806ab273e8 R08: ffff888072a8e080 R09: ffff888066262434
R10: ffffed100cc4c47c R11: ffff8880662623e3 R12: ffff8880658d9620
R13: ffff8880662623e4 R14: ffff88808bf256e0 R15: 0000000000000000
FS:  00007f74ec931700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
kobject: 'gretap0' (00000000d7aceeb7): kobject_uevent_env: uevent_suppress caused the event to drop!
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000094577000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
kobject: 'gretap0' (00000000d7aceeb7): calling ktype release
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kobject: 'gretap0': free name
kobject: 'gretap0' (0000000052720a38): kobject_cleanup, parent           (null)
kobject: 'gretap0' (0000000052720a38): auto cleanup 'remove' event
kobject: 'gretap0' (0000000052720a38): kobject_uevent_env
kobject: 'gretap0' (0000000052720a38): kobject_uevent_env: uevent_suppress caused the event to drop!
kobject: 'gretap0' (0000000052720a38): calling ktype release
kobject: 'gretap0': free name
kobject: 'gretap0' (0000000091bb405b): kobject_cleanup, parent           (null)
 smc_diag_dump_proto.isra.0+0x2e7/0x3c0 net/smc/smc_diag.c:211
 smc_diag_dump+0x27/0x80 net/smc/smc_diag.c:225
kobject: 'gretap0' (0000000091bb405b): auto cleanup 'remove' event
 netlink_dump+0x5f2/0x1070 net/netlink/af_netlink.c:2244
 __netlink_dump_start+0x5b4/0x7e0 net/netlink/af_netlink.c:2352
kobject: 'gretap0' (0000000091bb405b): kobject_uevent_env
 netlink_dump_start include/linux/netlink.h:225 [inline]
 smc_diag_handler_dump+0x2a7/0x350 net/smc/smc_diag.c:242
kobject: 'gretap0' (0000000091bb405b): kobject_uevent_env: uevent_suppress caused the event to drop!
 __sock_diag_cmd net/core/sock_diag.c:232 [inline]
 sock_diag_rcv_msg+0x322/0x410 net/core/sock_diag.c:263
kobject: 'gretap0' (0000000091bb405b): calling ktype release
 netlink_rcv_skb+0x17d/0x410 net/netlink/af_netlink.c:2477
kobject: 'gretap0': free name
 sock_diag_rcv+0x2b/0x40 net/core/sock_diag.c:274
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0x574/0x770 net/netlink/af_netlink.c:1336
kobject: 'gretap0' (00000000c818af24): kobject_cleanup, parent           (null)
kobject: 'gretap0' (00000000c818af24): auto cleanup 'remove' event
 netlink_sendmsg+0xa05/0xf90 net/netlink/af_netlink.c:1917
kobject: 'gretap0' (00000000c818af24): kobject_uevent_env
kobject: 'gretap0' (00000000c818af24): kobject_uevent_env: uevent_suppress caused the event to drop!
kobject: 'gretap0' (00000000c818af24): calling ktype release
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xdd/0x130 net/socket.c:631
 ___sys_sendmsg+0x7ec/0x910 net/socket.c:2116
kobject: 'gretap0': free name
kobject: 'gretap0' (000000004faf8020): kobject_cleanup, parent           (null)
kobject: 'gretap0' (000000004faf8020): auto cleanup 'remove' event
kobject: 'gretap0' (000000004faf8020): kobject_uevent_env
kobject: 'gretap0' (000000004faf8020): kobject_uevent_env: uevent_suppress caused the event to drop!
 __sys_sendmsg+0x112/0x270 net/socket.c:2154
kobject: 'gretap0' (000000004faf8020): calling ktype release
kobject: 'gretap0': free name
 __do_sys_sendmsg net/socket.c:2163 [inline]
 __se_sys_sendmsg net/socket.c:2161 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2161
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
kobject: 'gretap0' (00000000ed13ba1d): kobject_cleanup, parent           (null)
kobject: 'gretap0' (00000000ed13ba1d): auto cleanup 'remove' event
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
kobject: 'gretap0' (00000000ed13ba1d): kobject_uevent_env
RIP: 0033:0x457ec9
Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f74ec930c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
kobject: 'gretap0' (00000000ed13ba1d): kobject_uevent_env: uevent_suppress caused the event to drop!
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 000000000000000d
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f74ec9316d4
R13: 00000000004c52f9 R14: 00000000004d8d58 R15: 00000000ffffffff
kobject: 'gretap0' (00000000ed13ba1d): calling ktype release
Modules linked in:
---[ end trace f9e877d89202b442 ]---
kobject: 'gretap0': free name
RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:43 [inline]
RIP: 0010:__smc_diag_dump.isra.0+0x32a/0x2ba0 net/smc/smc_diag.c:93
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 26 25 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7f 20 49 8d 7f 0e 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 d2
RSP: 0018:ffff88806ab27120 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: ffff88808bf25280 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff87b6cca2 RDI: 000000000000000e
RBP: ffff88806ab273e8 R08: ffff888072a8e080 R09: ffff888066262434
R10: ffffed100cc4c47c R11: ffff8880662623e3 R12: ffff8880658d9620
R13: ffff8880662623e4 R14: ffff88808bf256e0 R15: 0000000000000000
FS:  00007f74ec931700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000094577000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (309):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/12 16:47 upstream 4b3c31c8d4dd c3f3344c .config console log report syz ci-upstream-kasan-gce-root
2019/01/12 16:12 upstream 4b3c31c8d4dd c3f3344c .config console log report syz ci-upstream-kasan-gce
2019/01/12 16:12 upstream 4b3c31c8d4dd c3f3344c .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/01/12 16:11 upstream 4b3c31c8d4dd c3f3344c .config console log report syz ci-upstream-kasan-gce-smack-root
2019/01/12 15:56 upstream 4b3c31c8d4dd c3f3344c .config console log report syz ci-upstream-kasan-gce-root
2019/01/12 13:34 upstream 4b3c31c8d4dd c3f3344c .config console log report syz ci-upstream-kasan-gce-smack-root
2019/01/07 05:41 upstream 574823bfab82 ee332608 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/01/07 02:56 upstream 574823bfab82 ee332608 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/01/07 02:05 upstream 574823bfab82 ee332608 .config console log report syz ci-upstream-kasan-gce-root
2019/01/04 23:15 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce-smack-root
2019/01/04 22:59 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce-smack-root
2019/01/04 21:48 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/01/04 21:32 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/01/04 18:45 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce-root
2019/01/04 18:29 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce-root
2019/01/04 17:31 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce
2019/01/04 17:15 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce
2019/01/04 07:37 upstream 645ff1e8e704 7da23925 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/01/03 15:57 upstream 645ff1e8e704 66fcd29b .config console log report syz ci-upstream-kasan-gce-root
2019/01/03 15:24 upstream 645ff1e8e704 66fcd29b .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/01/03 14:03 upstream 645ff1e8e704 66fcd29b .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/01/03 09:45 upstream 85f78456f286 06a2b89f .config console log report syz ci-upstream-kasan-gce
2019/01/02 08:29 upstream 28e8c4bc8eb4 3d85f48c .config console log report syz ci-upstream-kasan-gce-smack-root
2019/01/12 16:12 upstream 4b3c31c8d4dd c3f3344c .config console log report syz ci-upstream-kasan-gce-386
2019/01/12 11:12 upstream 4b3c31c8d4dd c3f3344c .config console log report syz ci-upstream-kasan-gce-386
2019/01/07 04:43 upstream 574823bfab82 ee332608 .config console log report syz ci-upstream-kasan-gce-386
2019/01/04 18:29 upstream 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-kasan-gce-386
2019/01/04 14:10 upstream 645ff1e8e704 7da23925 .config console log report syz ci-upstream-kasan-gce-386
2019/01/03 21:30 upstream 645ff1e8e704 66fcd29b .config console log report syz ci-upstream-kasan-gce-386
2019/01/03 09:48 upstream 85f78456f286 06a2b89f .config console log report syz ci-upstream-kasan-gce-386
2019/01/07 02:54 net-old d4a7e9bb74b5 ee332608 .config console log report syz ci-upstream-net-this-kasan-gce
2019/01/04 16:23 net-old 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-net-this-kasan-gce
2019/01/04 16:08 net-old 96d4f267e40f 0127e3ba .config console log report syz ci-upstream-net-this-kasan-gce
2019/01/03 22:40 net-old c5ee066333eb 66fcd29b .config console log report syz ci-upstream-net-this-kasan-gce
2019/01/03 09:43 net-old d63967e475ae 06a2b89f .config console log report syz ci-upstream-net-this-kasan-gce
2019/01/14 10:33 net-next-old b71acb0e3721 95485883 .config console log report syz ci-upstream-net-kasan-gce
2019/01/12 07:43 net-next-old b71acb0e3721 c3f3344c .config console log report syz ci-upstream-net-kasan-gce
2019/01/07 02:35 net-next-old b71acb0e3721 ee332608 .config console log report syz ci-upstream-net-kasan-gce
2019/01/04 16:04 net-next-old b71acb0e3721 0127e3ba .config console log report syz ci-upstream-net-kasan-gce
2019/01/04 13:52 net-next-old b71acb0e3721 7da23925 .config console log report syz ci-upstream-net-kasan-gce
2019/01/03 09:10 net-next-old b71acb0e3721 06a2b89f .config console log report syz ci-upstream-net-kasan-gce
2018/12/29 14:45 net-next-old b71acb0e3721 a40793d7 .config console log report syz ci-upstream-net-kasan-gce
2019/01/07 02:20 linux-next a4983672f9ca ee332608 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/01/04 22:43 linux-next a4983672f9ca 0127e3ba .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/01/04 22:27 linux-next a4983672f9ca 0127e3ba .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/01/03 09:42 linux-next 4cd1b60def51 06a2b89f .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/01/15 12:30 upstream fe76fc6aaf53 ebacf5cb .config console log report ci-upstream-kasan-gce-root
2019/01/15 11:19 upstream fe76fc6aaf53 ebacf5cb .config console log report ci-upstream-kasan-gce-smack-root
2019/01/14 22:19 upstream 3719876809e7 ebacf5cb .config console log report ci-upstream-kasan-gce-selinux-root
2019/01/14 13:21 upstream 1c7fc5cbc339 95485883 .config console log report ci-upstream-kasan-gce
2019/01/13 03:05 upstream 66c56cfa64d9 c3f3344c .config console log report ci-upstream-kasan-gce
2019/01/11 15:20 upstream 1bdbe2274920 c3f3344c .config console log report ci-upstream-kasan-gce-smack-root
2019/01/10 13:30 upstream ba422731316d db9b6579 .config console log report ci-upstream-kasan-gce-smack-root
2019/01/10 04:02 upstream 4064e47c8281 45c0c1b1 .config console log report ci-upstream-kasan-gce
2019/01/09 21:50 upstream 4064e47c8281 45c0c1b1 .config console log report ci-upstream-kasan-gce-selinux-root
2019/01/09 14:36 upstream a88cc8da0279 45c0c1b1 .config console log report ci-upstream-kasan-gce
2019/01/11 01:32 upstream 1bdbe2274920 80dde172 .config console log report ci-upstream-kasan-gce-386
2019/01/10 23:37 upstream ba422731316d db9b6579 .config console log report ci-upstream-kasan-gce-386
2019/01/08 14:30 bpf 2dc0f02da14e 37dd2683 .config console log report ci-upstream-bpf-kasan-gce
2019/01/08 01:26 net-old 0aaa81377c5a 69d69aa9 .config console log report ci-upstream-net-this-kasan-gce
2019/01/15 20:18 bpf-next b71acb0e3721 79cb1a7c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/15 15:34 bpf-next b71acb0e3721 79cb1a7c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/15 06:56 bpf-next b71acb0e3721 ebacf5cb .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/15 05:57 net-next-old b71acb0e3721 ebacf5cb .config console log report ci-upstream-net-kasan-gce
2019/01/15 03:49 net-next-old b71acb0e3721 ebacf5cb .config console log report ci-upstream-net-kasan-gce
2019/01/15 00:22 bpf-next b71acb0e3721 ebacf5cb .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/14 20:51 net-next-old b71acb0e3721 95485883 .config console log report ci-upstream-net-kasan-gce
2019/01/14 18:47 net-next-old b71acb0e3721 95485883 .config console log report ci-upstream-net-kasan-gce
2019/01/14 16:37 bpf-next b71acb0e3721 95485883 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/14 14:22 bpf-next b71acb0e3721 95485883 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/14 09:10 net-next-old b71acb0e3721 95485883 .config console log report ci-upstream-net-kasan-gce
2019/01/13 17:52 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/13 08:51 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/13 07:16 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/13 05:25 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/13 00:20 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/12 19:04 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/12 15:14 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/12 09:18 net-next-old b71acb0e3721 c3f3344c .config console log report ci-upstream-net-kasan-gce
2019/01/12 04:31 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/11 22:20 bpf-next b71acb0e3721 c3f3344c .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/11 18:54 net-next-old b71acb0e3721 c3f3344c .config console log report ci-upstream-net-kasan-gce
2019/01/11 10:42 net-next-old b71acb0e3721 80dde172 .config console log report ci-upstream-net-kasan-gce
2019/01/11 06:39 bpf-next b71acb0e3721 80dde172 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/11 05:28 net-next-old b71acb0e3721 80dde172 .config console log report ci-upstream-net-kasan-gce
2019/01/10 21:47 net-next-old b71acb0e3721 db9b6579 .config console log report ci-upstream-net-kasan-gce
2019/01/10 20:46 bpf-next b71acb0e3721 db9b6579 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/10 19:43 bpf-next b71acb0e3721 db9b6579 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/10 17:41 net-next-old b71acb0e3721 db9b6579 .config console log report ci-upstream-net-kasan-gce
2019/01/10 15:43 bpf-next b71acb0e3721 db9b6579 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/10 08:43 bpf-next b71acb0e3721 45c0c1b1 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/10 07:37 bpf-next b71acb0e3721 45c0c1b1 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/10 06:25 bpf-next b71acb0e3721 45c0c1b1 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/10 00:15 bpf-next b71acb0e3721 45c0c1b1 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/09 12:55 bpf-next b71acb0e3721 45c0c1b1 .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/09 11:23 bpf-next b71acb0e3721 45c0c1b1 .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.