syzbot


general protection fault in fq_codel_enqueue (3)

Status: fixed on 2023/02/24 13:50
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+7a12909485b94426aceb@syzkaller.appspotmail.com
Fix commit: fd1894224407 bpf: Don't redirect packets with invalid pkt_len
First crash: 896d, last: 650d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: general protection fault in fq_codel_enqueue (log)
Repro: C syz .config
  
Discussions (17)
Title Replies (including bot) Last reply
[PATCH v4,bpf-next] bpf: Don't redirect packets with invalid pkt_len 19 (19) 2022/11/09 21:43
[PATCH 5.10 00/37] 5.10.141-rc1 review 45 (45) 2022/09/05 07:44
[PATCH 5.19 00/72] 5.19.7-rc1 review 83 (83) 2022/09/03 14:20
[PATCH 5.4 00/77] 5.4.212-rc1 review 83 (83) 2022/09/03 13:11
[PATCH 5.15 00/73] 5.15.65-rc1 review 81 (81) 2022/09/03 10:47
[PATCH AUTOSEL 5.10 01/46] drm/r128: Fix undefined behavior due to shift overflowing the constant 44 (44) 2022/08/13 13:44
[PATCH AUTOSEL 5.4 01/25] drm/r128: Fix undefined behavior due to shift overflowing the constant 26 (26) 2022/08/12 08:39
[PATCH AUTOSEL 5.19 001/105] fbdev: Restart conflicting fb removal loop when unregistering devices 101 (101) 2022/08/11 15:56
[PATCH AUTOSEL 5.15 01/69] fbdev: Restart conflicting fb removal loop when unregistering devices 63 (63) 2022/08/11 15:56
[PATCH AUTOSEL 5.18 01/93] fbdev: Restart conflicting fb removal loop when unregistering devices 86 (86) 2022/08/11 15:42
[PATCH v3,bpf-next] bpf: Don't redirect packets with invalid pkt_len 3 (3) 2022/07/15 09:17
[PATCH v2,bpf-next] bpf: Don't redirect packets with invalid pkt_len 4 (4) 2022/07/14 21:26
[PATCH bpf-next] bpf: Don't redirect packets with invalid pkt_len 5 (5) 2022/07/13 16:02
Re: [PATCH] bpf: Don't redirect packets with pkt_len 0 1 (1) 2022/06/18 10:16
[PATCH] bpf: Don't redirect packets with pkt_len 0 2 (2) 2022/06/17 08:10
[PATCH] fq_codel: Discard problematic packets with pkt_len 0 4 (4) 2022/06/10 07:37
[syzbot] general protection fault in fq_codel_enqueue (3) 1 (2) 2021/10/29 15:59
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 general protection fault in fq_codel_enqueue C done 5 1420d 1449d 1/1 fixed on 2020/06/21 14:03
linux-4.19 general protection fault in fq_codel_enqueue (2) C error 14 591d 1322d 0/1 upstream: reported C repro on 2020/08/28 22:42
android-5-15 general protection fault in fq_codel_enqueue 1 20d 20d 0/2 premoderation: reported on 2024/03/23 01:26
linux-4.14 general protection fault in fq_codel_enqueue C inconclusive 6 853d 1445d 0/1 upstream: reported C repro on 2020/04/27 21:56
upstream general protection fault in fq_codel_enqueue (2) C done 34 922d 1322d 0/26 closed as invalid on 2021/10/07 21:22
upstream general protection fault in fq_codel_enqueue net C done 25 1369d 1454d 15/26 fixed on 2020/07/17 17:58
android-5-10 general protection fault in fq_codel_enqueue 1 624d 624d 0/2 auto-obsoleted due to no activity on 2022/10/25 22:19
Last patch testing requests (2)
Created Duration User Patch Repo Result
2022/07/16 10:56 16m mail@karthek.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2021/12/03 15:33 10m phind.uet@gmail.com linux-next error OK
Fix bisection attempts (6)
Created Duration User Patch Repo Result
2022/07/02 03:10 20m bisect fix upstream job log (0) log
2022/06/02 01:45 21m bisect fix upstream job log (0) log
2022/04/05 07:46 18m bisect fix upstream job log (0) log
2022/03/06 04:31 20m bisect fix upstream job log (0) log
2022/02/04 04:10 21m bisect fix upstream job log (0) log
2022/01/05 02:40 19m bisect fix upstream job log (0) log

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 6542 Comm: syz-executor965 Not tainted 5.15.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dequeue_head net/sched/sch_fq_codel.c:120 [inline]
RIP: 0010:fq_codel_drop net/sched/sch_fq_codel.c:168 [inline]
RIP: 0010:fq_codel_enqueue+0x83e/0x10c0 net/sched/sch_fq_codel.c:230
Code: f8 e2 25 fa 45 39 ec 0f 83 cb 00 00 00 e8 1a dc 25 fa 48 8b 44 24 10 80 38 00 0f 85 9a 06 00 00 49 8b 07 48 89 c2 48 c1 ea 03 <42> 80 3c 32 00 0f 85 6e 06 00 00 48 8b 10 48 8d 78 28 49 89 17 48
RSP: 0018:ffffc90001187310 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87504776 RDI: 0000000000000003
RBP: ffffc900011874e0 R08: 0000000000000400 R09: 0000000000000001
R10: ffffffff875046d6 R11: 0000000000000000 R12: 0000000000000400
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888071660000
FS:  0000555556b21300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9c09885040 CR3: 0000000021c77000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 dev_qdisc_enqueue+0x40/0x300 net/core/dev.c:3771
 __dev_xmit_skb net/core/dev.c:3855 [inline]
 __dev_queue_xmit+0x1f0e/0x36e0 net/core/dev.c:4170
 __bpf_tx_skb net/core/filter.c:2114 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2139 [inline]
 __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162
 ____bpf_clone_redirect net/core/filter.c:2429 [inline]
 bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401
 ___bpf_prog_run+0x3592/0x77d0 kernel/bpf/core.c:1548
 __bpf_prog_run512+0x91/0xd0 kernel/bpf/core.c:1776
 bpf_dispatcher_nop_func include/linux/bpf.h:718 [inline]
 __bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_prog_run include/linux/filter.h:631 [inline]
 bpf_test_run+0x37c/0xa20 net/bpf/test_run.c:119
 bpf_prog_test_run_skb+0xa7c/0x1cb0 net/bpf/test_run.c:662
 bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline]
 __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605
 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4689 [inline]
 __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fef7c1e24d9
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc95c98158 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fef7c1e24d9
RDX: 0000000000000048 RSI: 0000000020000140 RDI: 000000000000000a
RBP: 00007fef7c1a64c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fef7c1a6550
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 0597f54336b28fa4 ]---
RIP: 0010:dequeue_head net/sched/sch_fq_codel.c:120 [inline]
RIP: 0010:fq_codel_drop net/sched/sch_fq_codel.c:168 [inline]
RIP: 0010:fq_codel_enqueue+0x83e/0x10c0 net/sched/sch_fq_codel.c:230
Code: f8 e2 25 fa 45 39 ec 0f 83 cb 00 00 00 e8 1a dc 25 fa 48 8b 44 24 10 80 38 00 0f 85 9a 06 00 00 49 8b 07 48 89 c2 48 c1 ea 03 <42> 80 3c 32 00 0f 85 6e 06 00 00 48 8b 10 48 8d 78 28 49 89 17 48
RSP: 0018:ffffc90001187310 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87504776 RDI: 0000000000000003
RBP: ffffc900011874e0 R08: 0000000000000400 R09: 0000000000000001
R10: ffffffff875046d6 R11: 0000000000000000 R12: 0000000000000400
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888071660000
FS:  0000555556b21300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9c09885040 CR3: 0000000021c77000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	f8                   	clc
   1:	e2 25                	loop   0x28
   3:	fa                   	cli
   4:	45 39 ec             	cmp    %r13d,%r12d
   7:	0f 83 cb 00 00 00    	jae    0xd8
   d:	e8 1a dc 25 fa       	callq  0xfa25dc2c
  12:	48 8b 44 24 10       	mov    0x10(%rsp),%rax
  17:	80 38 00             	cmpb   $0x0,(%rax)
  1a:	0f 85 9a 06 00 00    	jne    0x6ba
  20:	49 8b 07             	mov    (%r15),%rax
  23:	48 89 c2             	mov    %rax,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	42 80 3c 32 00       	cmpb   $0x0,(%rdx,%r14,1) <-- trapping instruction
  2f:	0f 85 6e 06 00 00    	jne    0x6a3
  35:	48 8b 10             	mov    (%rax),%rdx
  38:	48 8d 78 28          	lea    0x28(%rax),%rdi
  3c:	49 89 17             	mov    %rdx,(%r15)
  3f:	48                   	rex.W

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/10/28 20:07 upstream 1fc596a56b33 be531bb4 .config console log report syz C ci-upstream-kasan-gce-selinux-root general protection fault in fq_codel_enqueue
2022/04/06 18:37 upstream 3e732ebf7316 97582466 .config console log report info ci-upstream-kasan-gce-smack-root general protection fault in fq_codel_enqueue
2021/11/22 13:47 upstream 136057256686 545ab074 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in fq_codel_enqueue
2022/05/03 01:45 net-next-old 829b7bdd7044 2df221f6 .config console log report info ci-upstream-net-kasan-gce general protection fault in fq_codel_enqueue
2021/12/06 02:14 linux-next f81e94e91878 a617004c .config console log report info ci-upstream-linux-next-kasan-gce-root general protection fault in fq_codel_enqueue
* Struck through repros no longer work on HEAD.