syzbot


WARNING in ipv6_addr_prefix

Status: upstream: reported C repro on 2025/05/01 11:15
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+9596c1b9df18e0ae7261@syzkaller.appspotmail.com
Fix commit: ipv6: Restore fib6_config validation for SIOCADDRT.
Patched on: [], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 7d06h, last: now
Cause bisection: failed (error log, bisect log)
  
Duplicate bugs (2)
duplicates (2):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
UBSAN: array-index-out-of-bounds in ipv6_addr_prefix net C error 109 6h17m 17h06m 0/28 closed as dup on 2025/05/02 00:26
UBSAN: array-index-out-of-bounds in ip6_rt_copy_init net C done 51 20m 17h08m 0/28 closed as dup on 2025/05/02 01:16
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] WARNING in ipv6_addr_prefix 1 (2) 2025/05/01 23:43

Sample crash report:
UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
------------[ cut here ]------------
memcpy: detected field-spanning write (size 898) of single field "pfx->in6_u.u6_addr8" at ./include/net/ipv6.h:614 (size 16)
WARNING: CPU: 0 PID: 5838 at ./include/net/ipv6.h:614 ipv6_addr_prefix+0x124/0x1d0 include/net/ipv6.h:614
Modules linked in:
CPU: 0 UID: 0 PID: 5838 Comm: syz-executor414 Not tainted 6.15.0-rc3-syzkaller-00557-g5565acd1e6c4 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:ipv6_addr_prefix+0x124/0x1d0 include/net/ipv6.h:614
Code: cc e8 70 eb af f7 c6 05 b8 a8 59 05 01 90 b9 10 00 00 00 48 c7 c7 a0 86 7d 8c 4c 89 fe 48 c7 c2 c0 8d 7d 8c e8 4d 4a 74 f7 90 <0f> 0b 90 90 e9 33 ff ff ff e8 3e eb af f7 44 89 e6 48 c7 c7 c0 53
RSP: 0018:ffffc90003eb7920 EFLAGS: 00010246
RAX: 8f8f704687b6a900 RBX: ffff8880337f5c50 RCX: ffff88803326da00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 0000000000000000 R08: ffffc90003eb7607 R09: 1ffff920007d6ec0
R10: dffffc0000000000 R11: fffff520007d6ec1 R12: 0000000000000382
R13: 1ffff920007d6f4e R14: ffffc90003eb7a84 R15: 0000000000000382
FS:  0000555594768380(0000) GS:ffff8881260b2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d1681c9000 CR3: 0000000078e3e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ip6_route_info_create+0x5cc/0xa70 net/ipv6/route.c:3810
 ip6_route_add+0x29/0x2f0 net/ipv6/route.c:3902
 ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4539
 inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577
 sock_do_ioctl+0xd9/0x300 net/socket.c:1190
 sock_ioctl+0x576/0x790 net/socket.c:1311
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa5ecea7369
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff70ec1b18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fff70ec1ce8 RCX: 00007fa5ecea7369
RDX: 0000200000000340 RSI: 000000000000890b RDI: 0000000000000003
RBP: 00007fa5ecf1a610 R08: 0000000000000000 R09: 00007fff70ec1ce8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff70ec1cd8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Crashes (2509):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/25 01:28 net-next 5565acd1e6c4 9c80ffa0 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/04/25 00:22 net-next 5565acd1e6c4 9c80ffa0 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/02 03:50 net-next 337079d31fb1 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/02 03:24 net-next 337079d31fb1 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/02 02:21 net-next 337079d31fb1 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/02 01:44 net-next 337079d31fb1 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 23:10 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 23:10 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 22:09 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 21:28 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 20:34 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 19:36 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 18:42 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 17:47 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 16:59 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 16:42 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 15:38 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 14:36 net-next deeed351e982 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 13:11 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 12:33 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 11:36 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 10:51 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 10:11 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 09:19 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 09:12 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 08:06 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 07:13 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 06:23 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 06:15 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 05:15 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 04:59 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 03:59 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 03:00 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 02:30 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 01:26 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 00:47 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/05/01 00:08 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/04/30 23:55 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/04/30 22:55 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/04/30 22:47 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/04/30 21:38 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/04/30 20:51 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/04/30 19:39 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
2025/04/30 19:38 net-next deeed351e982 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ipv6_addr_prefix
* Struck through repros no longer work on HEAD.