syzbot

 sign-in | mailing list | source | docs
🐞 Open [994] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12516] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

WARNING in bpf_prog_kallsyms_find

Status: fixed on 2019/09/06 20:45
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+89d1ce6e80218a6192d8@syzkaller.appspotmail.com
Fix commit: c751798aa224 bpf: fix use after free in prog symbol exposure
First crash: 1816d, last: 1694d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
Reminder: 8 active syzbot reports in "net/bpf" subsystem 1 (1) 2019/08/16 04:17
Reminder: 36 open syzbot bugs in "net/bpf" subsystem 1 (1) 2019/07/03 06:01
Reminder: 30 open syzbot bugs in "net/bpf" subsystem 1 (1) 2019/06/24 05:01
WARNING in bpf_prog_kallsyms_find 0 (2) 2019/06/17 20:00
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2019/08/26 08:06 18m daniel@iogearbox.net bpf OK

Sample crash report:
WARNING: CPU: 0 PID: 5 at kernel/bpf/core.c:851 bpf_jit_free+0x157/0x1b0
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.2.0+ #41
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 panic+0x2dc/0x755 kernel/panic.c:219
BUG: unable to handle page fault for address: fffffbfff4001000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 21ffee067 P4D 21ffee067 PUD 21ffed067 PMD 9fb75067 PTE 800000008e3b6163
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.2.0+ #41
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:537 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:600 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:674 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:667
Code: 75 07 e8 f3 d3 f4 ff 0f 0b e8 ec d3 f4 ff 48 89 de 4c 89 f7 e8 01 d5 f4 ff 49 39 de 72 71 e8 d7 d3 f4 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff8880a988f850 EFLAGS: 00010806
RAX: 1ffffffff4001000 RBX: ffffffffa0008000 RCX: ffffffff817d778f
RDX: 0000000000000000 RSI: ffffffff817d7799 RDI: 0000000000000006
RBP: ffff8880a988f890 R08: ffff8880a9876140 R09: ffffed1015d06c84
R10: ffffed1015d06c83 R11: ffff8880ae83641b R12: ffff8880909be538
R13: dffffc0000000000 R14: ffffffffffffffff R15: ffff8880909be538
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4001000 CR3: 00000000a8f2b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 is_bpf_text_address+0x78/0x170 kernel/bpf/core.c:709
 kernel_text_address+0x73/0xf0 kernel/extable.c:140
 __kernel_text_address+0xd/0x40 kernel/extable.c:95
 show_trace_log_lvl+0x1cd/0x28c arch/x86/kernel/dumpstack.c:232
 show_stack+0x39/0x3b arch/x86/kernel/dumpstack.c:293
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 panic+0x2dc/0x755 kernel/panic.c:219
 __warn.cold+0x20/0x4c kernel/panic.c:576
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:179 [inline]
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1008
RIP: 0010:bpf_jit_free+0x157/0x1b0
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5d 48 b8 00 02 00 00 00 00 ad de 48 39 43 70 0f 84 05 ff ff ff e8 69 77 f4 ff <0f> 0b e9 f9 fe ff ff e8 ed 5c 2e 00 e9 d9 fe ff ff 48 89 7d e0 e8
RSP: 0018:ffff8880a988fcb0 EFLAGS: 00010293
RAX: ffff8880a9876140 RBX: ffff8880909be500 RCX: ffffffff817c9a1d
RDX: 0000000000000000 RSI: ffffffff817dd407 RDI: ffff8880909be570
RBP: ffff8880a988fcd0 R08: 1ffffffff1511720 R09: fffffbfff1511721
R10: fffffbfff1511720 R11: ffffffff8a88b907 R12: ffffc90001933000
R13: ffff8880909be568 R14: ffff8880a9807200 R15: ffff8880ae834d80
 bpf_prog_free_deferred+0x27a/0x350 kernel/bpf/core.c:1982
 process_one_work+0x9af/0x1740 kernel/workqueue.c:2269
 worker_thread+0x98/0xe40 kernel/workqueue.c:2415
 kthread+0x361/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: fffffbfff4001000
---[ end trace 2ae9d5883da3bc8c ]---
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:537 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:600 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:674 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:667
Code: 75 07 e8 f3 d3 f4 ff 0f 0b e8 ec d3 f4 ff 48 89 de 4c 89 f7 e8 01 d5 f4 ff 49 39 de 72 71 e8 d7 d3 f4 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff8880a988f850 EFLAGS: 00010806
RAX: 1ffffffff4001000 RBX: ffffffffa0008000 RCX: ffffffff817d778f
RDX: 0000000000000000 RSI: ffffffff817d7799 RDI: 0000000000000006
RBP: ffff8880a988f890 R08: ffff8880a9876140 R09: ffffed1015d06c84
R10: ffffed1015d06c83 R11: ffff8880ae83641b R12: ffff8880909be538
R13: dffffc0000000000 R14: ffffffffffffffff R15: ffff8880909be538
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4001000 CR3: 00000000a8f2b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (5632):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/28 23:23 bpf-next 192f0f8e9db7 c85e1c5b .config console log report syz C ci-upstream-bpf-next-kasan-gce
2019/06/17 19:59 linux-next a125097c8410 442206d7 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/07/31 06:36 upstream 629f8205a6cc 7c7ded69 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/07/29 04:48 upstream a9815a4fa2fd c85e1c5b .config console log report syz ci-upstream-kasan-gce-root
2019/07/29 03:54 upstream a9815a4fa2fd c85e1c5b .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/07/19 08:25 upstream 3bfe1fc46794 7bb222f7 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/07/16 20:57 upstream 9637d517347e db842eb6 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/07/04 16:55 upstream 550d1f5bda33 55565fa0 .config console log report syz ci-upstream-kasan-gce-root
2019/06/28 23:50 upstream 556e2f6020bf 7509bf36 .config console log report syz ci-upstream-kasan-gce-root
2019/06/28 10:16 upstream c84afab02c31 7509bf36 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/06/28 08:01 upstream c84afab02c31 7509bf36 .config console log report syz ci-upstream-kasan-gce-root
2019/06/28 07:14 upstream c84afab02c31 7509bf36 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/06/24 02:05 upstream 241e39004581 472f0082 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/06/23 17:57 upstream 241e39004581 472f0082 .config console log report syz ci-upstream-kasan-gce-root
2019/06/18 06:35 upstream 9e0babf2c06c 442206d7 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/05/08 02:52 upstream 8ff468c29e9a a7383bfa .config console log report syz ci-upstream-kasan-gce-root
2019/08/11 10:37 net-old 57c722e932cf acb51638 .config console log report syz ci-upstream-net-this-kasan-gce
2019/08/08 00:36 net-old 33920f1ec5bf e6ebef88 .config console log report syz ci-upstream-net-this-kasan-gce
2019/08/04 05:46 net-old 107e47cc80ec 6affd8e8 .config console log report syz ci-upstream-net-this-kasan-gce
2019/07/28 23:45 bpf cb8ffde5694a c85e1c5b .config console log report syz ci-upstream-bpf-kasan-gce
2019/07/05 06:03 net-old 9d1bc24b52fb 429efa16 .config console log report syz ci-upstream-net-this-kasan-gce
2019/07/04 16:53 bpf 9d1bc24b52fb 55565fa0 .config console log report syz ci-upstream-bpf-kasan-gce
2019/06/29 13:35 bpf 0472301a28f6 7509bf36 .config console log report syz ci-upstream-bpf-kasan-gce
2019/05/07 22:50 net-old 982e826d31b1 a7383bfa .config console log report syz ci-upstream-net-this-kasan-gce
2019/09/02 10:31 bpf-next bdb15a29cc28 db7c31ca .config console log report syz ci-upstream-bpf-next-kasan-gce
2019/08/14 00:36 bpf-next 192f0f8e9db7 ef801a3e .config console log report syz ci-upstream-bpf-next-kasan-gce
2019/08/06 21:30 bpf-next 192f0f8e9db7 c6f01e54 .config console log report syz ci-upstream-bpf-next-kasan-gce
2019/08/06 19:59 net-next-old 31cc088a4f5d c6f01e54 .config console log report syz ci-upstream-net-kasan-gce
2019/08/04 04:34 net-next-old 31cc088a4f5d 6affd8e8 .config console log report syz ci-upstream-net-kasan-gce
2019/07/19 04:43 net-next-old 192f0f8e9db7 7bb222f7 .config console log report syz ci-upstream-net-kasan-gce
2019/07/01 01:14 bpf-next 8daed7677a1d 699d6448 .config console log report syz ci-upstream-bpf-next-kasan-gce
2019/06/23 11:53 bpf-next dca73a65a683 34bf9440 .config console log report syz ci-upstream-bpf-next-kasan-gce
2019/08/24 20:25 linux-next 9733a7c62c66 78ded196 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/08/06 21:35 linux-next 958eb4327c17 c6f01e54 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/08/03 19:19 linux-next 7b4980e0bcf4 6affd8e8 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/07/30 09:49 linux-next 70f4b4ac1655 f28bf2a5 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/07/19 06:43 linux-next 6d21a41b7b1f 7bb222f7 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/07/04 07:14 linux-next f9ca7f5a1eb9 55565fa0 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/07/01 06:32 linux-next 48568d8c7f47 699d6448 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/06/29 21:19 linux-next 48568d8c7f47 7509bf36 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/06/29 16:37 linux-next 48568d8c7f47 7509bf36 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/06/28 12:54 linux-next 8087b004bd09 7509bf36 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/06/26 15:19 linux-next 902031767aec 4d342240 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/06/24 19:18 linux-next e2d28c40292b 472f0082 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/06/24 13:00 linux-next e2d28c40292b 472f0082 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/08/27 18:56 upstream a55aa89aab90 d21c5d9d .config console log report ci-upstream-kasan-gce-selinux-root
2019/08/26 03:30 upstream e67095fd2f72 d21c5d9d .config console log report ci-upstream-kasan-gce-root
2019/05/07 21:18 upstream 8ff468c29e9a a7383bfa .config console log report ci-upstream-kasan-gce-selinux-root
2019/08/23 17:54 bpf 3035bb72ee47 78ded196 .config console log report ci-upstream-bpf-kasan-gce
2019/08/20 21:22 net-old 1edfb8ed6cc1 cfc9868f .config console log report ci-upstream-net-this-kasan-gce
2019/09/06 17:17 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 16:12 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 14:56 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 13:26 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 10:23 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 08:57 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 07:16 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 06:26 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 04:13 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 02:29 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/06 00:30 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 22:27 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 21:03 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 16:10 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 15:02 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 13:36 bpf-next 310f4204eeb6 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 10:27 bpf-next 110509df4540 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 07:58 bpf-next 110509df4540 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 07:42 bpf-next 110509df4540 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 04:42 bpf-next 110509df4540 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 03:13 bpf-next 110509df4540 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/05 01:35 bpf-next 110509df4540 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 23:16 bpf-next 110509df4540 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 18:57 bpf-next 110509df4540 040fda58 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 16:24 bpf-next 110509df4540 12381952 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 15:13 bpf-next 110509df4540 12381952 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 13:44 bpf-next 110509df4540 12381952 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 09:13 bpf-next 110509df4540 12381952 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 07:03 bpf-next 110509df4540 12381952 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 06:43 bpf-next 110509df4540 12381952 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 03:48 bpf-next 110509df4540 526709ff .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 02:25 bpf-next 110509df4540 526709ff .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/04 01:16 bpf-next 110509df4540 526709ff .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 21:54 bpf-next ac915762ea39 48448e71 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 20:45 bpf-next ac915762ea39 48448e71 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 17:15 bpf-next ac915762ea39 48448e71 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 15:24 bpf-next ac915762ea39 48448e71 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 13:06 bpf-next bdb15a29cc28 48448e71 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 12:39 bpf-next bdb15a29cc28 48448e71 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 10:09 bpf-next bdb15a29cc28 14544a56 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 06:52 bpf-next bdb15a29cc28 14544a56 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 04:46 bpf-next bdb15a29cc28 14544a56 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 03:40 bpf-next bdb15a29cc28 14544a56 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/03 00:41 bpf-next bdb15a29cc28 14544a56 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/02 22:01 bpf-next bdb15a29cc28 14544a56 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/02 19:18 bpf-next bdb15a29cc28 14544a56 .config console log report ci-upstream-bpf-next-kasan-gce
2019/09/02 18:15 bpf-next bdb15a29cc28 14544a56 .config console log report ci-upstream-bpf-next-kasan-gce
2019/08/31 18:34 net-next-old d00ee466a07e fd37b39e .config console log report ci-upstream-net-kasan-gce
2019/08/26 09:46 linux-next 9733a7c62c66 d21c5d9d .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.