syzbot


general protection fault in depot_save_stack

Status: auto-closed as invalid on 2019/05/11 10:33
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+c09e40e4b2e677cc5e25@syzkaller.appspotmail.com
First crash: 2062d, last: 1998d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 general protection fault in depot_save_stack 1 1460d 1460d 0/1 auto-closed as invalid on 2020/08/31 11:55

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3770 Comm: syz-executor4 Not tainted 4.20.0-rc1+ #111
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:find_stack lib/stackdepot.c:188 [inline]
RIP: 0010:depot_save_stack+0x121/0x470 lib/stackdepot.c:238
Code: 0f 00 4e 8b 24 f5 e0 79 2c 8b 4d 85 e4 0f 84 d4 00 00 00 44 8d 47 ff 49 c1 e0 03 eb 0d 4d 8b 24 24 4d 85 e4 0f 84 bd 00 00 00 <41> 39 5c 24 08 75 ec 41 3b 7c 24 0c 75 e5 48 8b 01 49 39 44 24 18
RSP: 0018:ffff8881b73670b0 EFLAGS: 00010002
RAX: 00000000251e50dc RBX: 00000000669fe72c RCX: ffff8881b7367110
RDX: 000000005eee42d9 RSI: 0000000000400000 RDI: 0000000000000014
RBP: ffff8881b73670e8 R08: 0000000000000098 R09: 000000002ccfbf5c
R10: 00000000a9b0a952 R11: ffff8881dae2db3b R12: 00ffff8881185664
R13: ffff8881b73670f8 R14: 00000000000fe72c R15: ffff8881cb596050
FS:  000000000268c940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdf89f9030 CR3: 0000000181b60000 CR4: 00000000001426f0
Call Trace:
 save_stack+0xa9/0xd0 mm/kasan/kasan.c:454
cgroup: fork rejected by pids controller in /syz5
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kobject: 'loop1' (00000000421766ec): kobject_uevent_env
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3817
 kobject_uevent_env+0xf76/0x101e lib/kobject_uevent.c:620
 kobject_uevent+0x1f/0x24 lib/kobject_uevent.c:636
kobject: 'loop1' (00000000421766ec): fill_kobj_path: path = '/devices/virtual/block/loop1'
 rx_queue_add_kobject net/core/net-sysfs.c:945 [inline]
 net_rx_queue_update_kobjects+0x4a0/0x620 net/core/net-sysfs.c:964
 register_queue_kobjects net/core/net-sysfs.c:1535 [inline]
 netdev_register_kobject+0x27f/0x3f0 net/core/net-sysfs.c:1755
 register_netdevice+0x99a/0x11d0 net/core/dev.c:8529
 register_netdev+0x30/0x50 net/core/dev.c:8644
 ip6gre_init_net+0x482/0x770 net/ipv6/ip6_gre.c:1572
 ops_init+0x101/0x560 net/core/net_namespace.c:129
 setup_net+0x362/0x8d0 net/core/net_namespace.c:314
 copy_net_ns+0x2b1/0x4a0 net/core/net_namespace.c:437
 create_new_namespaces+0x6ad/0x900 kernel/nsproxy.c:107
 unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:206
 ksys_unshare+0x79c/0x10b0 kernel/fork.c:2539
 __do_sys_unshare kernel/fork.c:2607 [inline]
 __se_sys_unshare kernel/fork.c:2605 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:2605
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a057
Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 dd 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffffb1093a8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007fd25592e000 RCX: 000000000045a057
RDX: 0000000000000000 RSI: 00007ffffb109380 RDI: 0000000040000000
RBP: 000000000072c988 R08: 0000000000000000 R09: 0000000000000018
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000010
R13: 0000000000412e50 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 8325bab3308a3b12 ]---
RIP: 0010:find_stack lib/stackdepot.c:188 [inline]
RIP: 0010:depot_save_stack+0x121/0x470 lib/stackdepot.c:238
Code: 0f 00 4e 8b 24 f5 e0 79 2c 8b 4d 85 e4 0f 84 d4 00 00 00 44 8d 47 ff 49 c1 e0 03 eb 0d 4d 8b 24 24 4d 85 e4 0f 84 bd 00 00 00 <41> 39 5c 24 08 75 ec 41 3b 7c 24 0c 75 e5 48 8b 01 49 39 44 24 18
RSP: 0018:ffff8881b73670b0 EFLAGS: 00010002
RAX: 00000000251e50dc RBX: 00000000669fe72c RCX: ffff8881b7367110
RDX: 000000005eee42d9 RSI: 0000000000400000 RDI: 0000000000000014
RBP: ffff8881b73670e8 R08: 0000000000000098 R09: 000000002ccfbf5c
R10: 00000000a9b0a952 R11: ffff8881dae2db3b R12: 00ffff8881185664
R13: ffff8881b73670f8 R14: 00000000000fe72c R15: ffff8881cb596050
FS:  000000000268c940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdf89f9030 CR3: 0000000181b60000 CR4: 00000000001426f0

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/12 10:32 upstream e12e00e388de 7b5f8621 .config console log report ci-upstream-kasan-gce-selinux-root
2018/11/11 01:13 upstream ab6e1f378f54 f3c4e618 .config console log report ci-upstream-kasan-gce-root
2018/11/10 23:18 upstream ab6e1f378f54 f3c4e618 .config console log report ci-upstream-kasan-gce-386
2018/09/09 12:36 linux-next f2b6e66e9885 6b5120a4 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.