syzbot

 sign-in | mailing list | source | docs
🐞 Open [984] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12475] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in xsk_poll

Status: fixed on 2019/11/04 14:50
Subsystems: bpf net
[Documentation on labels]
Reported-by: syzbot+a5765ed8cdb1cca4d249@syzkaller.appspotmail.com
Fix commit: df551058f7a3 xsk: Fix crash in poll when device does not support ndo_xsk_wakeup
First crash: 1678d, last: 1645d
Cause bisection: introduced by (bisect log) :
commit 77cd0d7b3f257fd0e3096b4fdcff1a7d38e99e10
Author: Magnus Karlsson <magnus.karlsson@intel.com>
Date: Wed Aug 14 07:27:17 2019 +0000

  xsk: add support for need_wakeup flag in AF_XDP rings

Crash: BUG: unable to handle kernel NULL pointer dereference in xsk_poll (log)
Repro: C syz .config
  
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH bpf v2] xsk: fix crash in poll when device does not support ndo_xsk_wakeup 2 (2) 2019/10/03 15:00
[PATCH bpf] xsk: fix crash in poll when device does not support ndo_xsk_wakeup 4 (4) 2019/10/02 06:06
BUG: unable to handle kernel NULL pointer dereference in xsk_poll 1 (3) 2019/09/30 10:53

Sample crash report:
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
8021q: adding VLAN 0 to HW filter on device batadv0
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 98332067 P4D 98332067 PUD 9640e067 PMD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9423 Comm: syz-executor485 Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8880a91cf848 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880a7efa000 RCX: 1ffff11014fdf494
RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff888082d40000
RBP: ffff8880a91cf880 R08: ffff8880a942e300 R09: ffffed1014fdf449
R10: ffffed1014fdf448 R11: ffff8880a7efa247 R12: 0000000000000002
R13: 0000000000000304 R14: ffff888082d40000 R15: 0000000000000000
FS:  00000000019b8880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000085089000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 xsk_poll+0x1e7/0x5a0 net/xdp/xsk.c:430
 sock_poll+0x15e/0x480 net/socket.c:1256
 vfs_poll include/linux/poll.h:90 [inline]
 do_pollfd fs/select.c:859 [inline]
 do_poll fs/select.c:907 [inline]
 do_sys_poll+0x63c/0xdd0 fs/select.c:1001
 __do_sys_ppoll fs/select.c:1101 [inline]
 __se_sys_ppoll fs/select.c:1081 [inline]
 __x64_sys_ppoll+0x259/0x310 fs/select.c:1081
 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441bd9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff9a25d1c8 EFLAGS: 00000246 ORIG_RAX: 000000000000010f
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441bd9
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000020000040
RBP: 00007fff9a25d1e0 R08: 0000000000000000 R09: 0000000001bbbbbb
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000403170 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000000
---[ end trace a0644bdb1151a8d9 ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8880a91cf848 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880a7efa000 RCX: 1ffff11014fdf494
RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff888082d40000
RBP: ffff8880a91cf880 R08: ffff8880a942e300 R09: ffffed1014fdf449
R10: ffffed1014fdf448 R11: ffff8880a7efa247 R12: 0000000000000002
R13: 0000000000000304 R14: ffff888082d40000 R15: 0000000000000000
FS:  00000000019b8880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000085089000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/18 02:38 upstream 283ea345934d 8c88c9c1 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/10/13 04:19 upstream 48acba989ed5 426631dd .config console log report syz C ci-upstream-kasan-gce-root
2019/10/13 02:56 upstream 48acba989ed5 426631dd .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/10/05 20:34 upstream b145b0eb2031 f3f7d9c8 .config console log report syz C ci-upstream-kasan-gce
2019/09/30 07:10 upstream a3c0e7b1fe1f c1ad5441 .config console log report syz C ci-upstream-kasan-gce
2019/10/06 05:54 upstream 4ea655343ce4 f3f7d9c8 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/30 07:47 net-old 02dc96ef6c25 c1ad5441 .config console log report syz C ci-upstream-net-this-kasan-gce
2019/10/02 06:06 net-next-old 5be5515a8ea1 b7a87a83 .config console log report syz C ci-upstream-net-kasan-gce
2019/09/30 06:13 upstream a3c0e7b1fe1f c1ad5441 .config console log report ci-upstream-kasan-gce
2019/09/15 04:53 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.