syzbot


kernel BUG in rxrpc_new_incoming_call

Status: upstream: reported syz repro on 2023/02/20 00:12
Reported-by: syzbot+a9af0843a79dcc8069cd@syzkaller.appspotmail.com
First crash: 431d, last: 431d

Sample crash report:
XFS (loop1): Mounting V4 Filesystem
XFS (loop5): Mounting V4 Filesystem
XFS (loop3): Ending clean mount
XFS (loop1): Ending clean mount
------------[ cut here ]------------
kernel BUG at net/rxrpc/call_accept.c:432!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9674 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RSP: 0018:ffff88809bc17270 EFLAGS: 00010293
RAX: ffff88809cb68480 RBX: ffff8880958a46c0 RCX: ffffffff8756f7eb
RDX: 0000000000000000 RSI: ffffffff87570fb0 RDI: 0000000000000005
RBP: ffff8880abd72000 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888094df8dc0
R13: ffff8880abd72900 R14: ffff8880abd72288 R15: 0000000000000004
FS:  00007f1b021b2700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b021b0ff8 CR3: 000000009edfa000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 rxrpc_input_packet+0x2241/0x5350 net/rxrpc/input.c:1411
 udp_queue_rcv_skb+0x8d2/0x1a70 net/ipv4/udp.c:1977
 __udp4_lib_mcast_deliver net/ipv4/udp.c:2121 [inline]
 __udp4_lib_rcv+0x262a/0x3180 net/ipv4/udp.c:2252
 ip_local_deliver_finish+0x495/0xc00 net/ipv4/ip_input.c:215
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip_local_deliver+0x188/0x500 net/ipv4/ip_input.c:256
 dst_input include/net/dst.h:461 [inline]
 ip_rcv_finish+0x1ca/0x2e0 net/ipv4/ip_input.c:414
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip_rcv+0xca/0x3c0 net/ipv4/ip_input.c:524
 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954
 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066
 netif_receive_skb_internal+0xf0/0x3f0 net/core/dev.c:5156
 tun_rx_batched.isra.0+0x472/0x740 drivers/net/tun.c:1543
 tun_get_user+0x2ee5/0x5100 drivers/net/tun.c:1974
 tun_chr_write_iter+0xdb/0x1d0 drivers/net/tun.c:2007
 call_write_iter include/linux/fs.h:1821 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x51b/0x770 fs/read_write.c:487
 vfs_write+0x1f3/0x540 fs/read_write.c:549
 ksys_write+0x12b/0x2a0 fs/read_write.c:599
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1b02e12e7f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f1b021b2130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1b02f81050 RCX: 00007f1b02e12e7f
RDX: 0000000000000086 RSI: 00000000200000c0 RDI: 00000000000000c8
RBP: 00007f1b02ebcae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000086 R11: 0000000000000293 R12: 0000000000000000
R13: 00007ffc3011aaef R14: 00007f1b021b2300 R15: 0000000000022000
Modules linked in:
---[ end trace f0597b44549ea042 ]---
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RSP: 0018:ffff88809bc17270 EFLAGS: 00010293
RAX: ffff88809cb68480 RBX: ffff8880958a46c0 RCX: ffffffff8756f7eb
RDX: 0000000000000000 RSI: ffffffff87570fb0 RDI: 0000000000000005
RBP: ffff8880abd72000 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888094df8dc0
R13: ffff8880abd72900 R14: ffff8880abd72288 R15: 0000000000000004
FS:  00007f1b021b2700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b021b0ff8 CR3: 000000009edfa000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/02/20 01:55 linux-4.19.y 3f8a27f9e27b bcdf85f8 .config console log report syz [disk image] [vmlinux] [mounted in repro] ci2-linux-4-19 kernel BUG in rxrpc_new_incoming_call
2023/02/20 00:11 linux-4.19.y 3f8a27f9e27b bcdf85f8 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 kernel BUG in rxrpc_new_incoming_call
* Struck through repros no longer work on HEAD.