syzbot


WARNING in adjust_ptr_min_max_vals

Status: fixed on 2018/01/22 13:19
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+6d362cadd45dc0a12ba4@syzkaller.appspotmail.com
Fix commit: 6f16101e6a8b bpf: mark dst unknown on inconsistent {s, u}bounds adjustments
First crash: 2501d, last: 2480d
Discussions (4)
Title Replies (including bot) Last reply
[PATCH 4.14 000/159] 4.14.22-stable review 164 (164) 2018/02/24 17:57
[PATCH bpf v2] bpf: mark dst unknown on inconsistent {s,u}bounds adjustments 2 (2) 2018/01/18 00:33
[PATCH bpf] bpf: do not modify min/max bounds on scalars with constant values 6 (6) 2018/01/15 17:33
WARNING in adjust_ptr_min_max_vals 1 (2) 2018/01/03 06:40

Sample crash report:
audit: type=1400 audit(1514681419.859:7): avc:  denied  { map } for  pid=3194 comm="syzkaller544834" path="/root/syzkaller544834855" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
WARNING: CPU: 1 PID: 3194 at kernel/bpf/verifier.c:1878 adjust_ptr_min_max_vals+0x58c/0x1820 kernel/bpf/verifier.c:1878
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 3194 Comm: syzkaller544834 Not tainted 4.15.0-rc5+ #242
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1dc/0x200 kernel/panic.c:547
 report_bug+0x211/0x2d0 lib/bug.c:184
 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
 invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1079
RIP: 0010:adjust_ptr_min_max_vals+0x58c/0x1820 kernel/bpf/verifier.c:1878
RSP: 0018:ffff8801c7b0f118 EFLAGS: 00010293
RAX: ffff8801c7a40580 RBX: ffff8801c7819200 RCX: ffffffff817e5fdc
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90000002049
RBP: ffff8801c7b0f1b0 R08: 0000000000000000 R09: ffffffff858f9ae0
R10: 000000000000006f R11: 0000000000000000 R12: ffff8801c7819250
R13: ffff8801c7819200 R14: ffffc90000002048 R15: ffff8801c7819200
 adjust_reg_min_max_vals kernel/bpf/verifier.c:2326 [inline]
 check_alu_op kernel/bpf/verifier.c:2504 [inline]
 do_check+0x6f09/0xa4a0 kernel/bpf/verifier.c:3881
 bpf_check+0x1f62/0x2770 kernel/bpf/verifier.c:4623
 bpf_prog_load+0xa15/0x1ab0 kernel/bpf/syscall.c:1192
 SYSC_bpf kernel/bpf/syscall.c:1723 [inline]
 SyS_bpf+0x1044/0x4420 kernel/bpf/syscall.c:1685
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x43fe29
RSP: 002b:00007fff644a3168 EFLAGS: 00000286 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fe29
RDX: 0000000000000048 RSI: 0000000020000000 RDI: 0000000000000005
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000401790
R13: 0000000000401820 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (252):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/31 00:52 upstream 5aa90a845892 bb6384b8 .config console log report syz C ci-upstream-kasan-gce
2017/12/30 04:31 upstream 61233580f1f3 bb6384b8 .config console log report syz C ci-upstream-kasan-gce
2017/12/30 18:31 net-next-old 6bb8824732f6 bb6384b8 .config console log report syz C ci-upstream-net-kasan-gce
2017/12/30 08:34 net-next-old 6bb8824732f6 bb6384b8 .config console log report syz C ci-upstream-net-kasan-gce
2017/12/31 01:55 linux-next 0e08c463db38 bb6384b8 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/30 18:43 mmots 37759fa6d0fa bb6384b8 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/30 16:57 linux-next 0e08c463db38 bb6384b8 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/30 05:46 mmots 37759fa6d0fa bb6384b8 .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/19 08:18 upstream dda3e15231b3 161c1d64 .config console log report ci-upstream-kasan-gce
2018/01/18 22:40 upstream dda3e15231b3 161c1d64 .config console log report ci-upstream-kasan-gce
2018/01/18 21:07 upstream dda3e15231b3 161c1d64 .config console log report ci-upstream-kasan-gce
2018/01/17 14:48 upstream 8cbab92dff77 a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/15 14:38 upstream a8750ddca918 66d492a6 .config console log report ci-upstream-kasan-gce
2018/01/20 08:06 net-next-old 43dd7512b51c fbbdcd92 .config console log report ci-upstream-net-kasan-gce
2018/01/20 05:29 net-next-old 43dd7512b51c fbbdcd92 .config console log report ci-upstream-net-kasan-gce
2018/01/20 01:31 net-next-old 43dd7512b51c fbbdcd92 .config console log report ci-upstream-net-kasan-gce
2018/01/19 18:38 net-next-old ef58ca38dbda 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 18:23 net-next-old ef58ca38dbda 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 15:25 net-next-old ef58ca38dbda 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 12:12 net-next-old ef58ca38dbda 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 11:43 net-next-old ef58ca38dbda 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 08:57 net-next-old d680b3524cd2 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 08:17 net-next-old d680b3524cd2 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 08:17 net-next-old d680b3524cd2 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 05:14 net-next-old d680b3524cd2 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 04:05 net-next-old d680b3524cd2 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/19 03:17 net-next-old d680b3524cd2 161c1d64 .config console log report ci-upstream-net-kasan-gce
2018/01/18 18:55 net-next-old 4f7d58517f46 56cc113a .config console log report ci-upstream-net-kasan-gce
2018/01/18 14:10 net-next-old 4f7d58517f46 56cc113a .config console log report ci-upstream-net-kasan-gce
2018/01/18 06:56 net-next-old 2d83619de8a6 b8970f31 .config console log report ci-upstream-net-kasan-gce
2018/01/18 05:31 net-next-old 2d83619de8a6 b8970f31 .config console log report ci-upstream-net-kasan-gce
2018/01/18 05:16 net-next-old 2d83619de8a6 b8970f31 .config console log report ci-upstream-net-kasan-gce
2018/01/18 03:06 net-next-old 2d83619de8a6 b8970f31 .config console log report ci-upstream-net-kasan-gce
2018/01/18 02:02 net-next-old 2d83619de8a6 b8970f31 .config console log report ci-upstream-net-kasan-gce
2018/01/18 01:59 net-next-old 2d83619de8a6 b8970f31 .config console log report ci-upstream-net-kasan-gce
2018/01/17 19:54 net-next-old 2d83619de8a6 d7bc5820 .config console log report ci-upstream-net-kasan-gce
2018/01/17 19:51 net-next-old 2d83619de8a6 d7bc5820 .config console log report ci-upstream-net-kasan-gce
2018/01/17 16:54 net-next-old c02b3741eb99 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 16:26 net-next-old c02b3741eb99 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 16:11 net-next-old c02b3741eb99 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 07:44 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 02:21 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 22:27 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 04:27 net-next-old 594831a8aba3 e17f4a5d .config console log report ci-upstream-net-kasan-gce
2018/01/15 16:30 net-next-old 564737f981fb 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/15 15:20 net-next-old 564737f981fb 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/15 13:44 net-next-old 564737f981fb 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/15 11:14 net-next-old 564737f981fb 66d492a6 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.