syzbot

 sign-in | mailing list | source | docs
🐞 Open [977] ≡ Subsystems 🐞 Fixed [5235] 🐞 Invalid [12490] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in xsk_poll

Status: fixed on 2019/10/15 23:40
Subsystems: bpf net
[Documentation on labels]
Reported-by: syzbot+c82697e3043781e08802@syzkaller.appspotmail.com
Fix commit: 42fddcc7c64b xsk: use state member for socket synchronization
First crash: 1708d, last: 1681d
Cause bisection: introduced by (bisect log) :
commit 77cd0d7b3f257fd0e3096b4fdcff1a7d38e99e10
Author: Magnus Karlsson <magnus.karlsson@intel.com>
Date: Wed Aug 14 07:27:17 2019 +0000

  xsk: add support for need_wakeup flag in AF_XDP rings

Crash: general protection fault in xsk_poll (log)
Repro: C syz .config
  
▶ ▼ Discussions (7)
Title Replies (including bot) Last reply
[PATCH bpf-next v3 0/4] xsk: various CPU barrier and {READ, WRITE}_ONCE 7 (7) 2019/09/05 13:14
[PATCH bpf-next v2 0/4] xsk: various CPU barrier and {READ, WRITE}_ONCE fixes 11 (11) 2019/09/03 15:26
[PATCH bpf-next 0/4] xsk: various CPU barrier and {READ, WRITE}_ONCE fixes 10 (10) 2019/08/25 17:06
Re: [PATCH bpf-next 1/4] xsk: avoid store-tearing when assigning queues 1 (1) 2019/08/22 13:51
[PATCH bpf-next] xsk: proper socket state check in xsk_poll 4 (4) 2019/08/20 21:24
Re: general protection fault in xsk_poll 1 (1) 2019/08/20 09:17
general protection fault in xsk_poll 0 (1) 2019/08/20 01:18

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8680 Comm: syz-executor614 Not tainted 5.3.0-rc6-next-20190830 #75
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:xsk_poll+0x95/0x540 net/xdp/xsk.c:386
Code: 80 3c 02 00 0f 85 70 04 00 00 4c 8b a3 88 04 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 96 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 bf 03 00 00
RSP: 0018:ffff8880a05cf690 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff8880a0126000 RCX: ffffffff859b666a
RDX: 0000000000000012 RSI: ffffffff859b6684 RDI: 0000000000000096
RBP: ffff8880a05cf6c0 R08: ffff888098456000 R09: ffffed1014024c49
R10: ffffed1014024c48 R11: ffff8880a0126247 R12: 0000000000000000
R13: 0000000000000304 R14: ffff88809525d000 R15: ffff8880939f8a60
FS:  00005555562d4880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000096708000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 sock_poll+0x15e/0x480 net/socket.c:1256
 vfs_poll include/linux/poll.h:90 [inline]
 do_select+0x927/0x16f0 fs/select.c:534
 core_sys_select+0x564/0x890 fs/select.c:677
 do_pselect fs/select.c:759 [inline]
 __do_sys_pselect6 fs/select.c:784 [inline]
 __se_sys_pselect6 fs/select.c:769 [inline]
 __x64_sys_pselect6+0x3df/0x490 fs/select.c:769
 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4402c9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcaa491348 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402c9
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000040
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000140 R11: 0000000000000246 R12: 0000000000401b50
R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace f6632f03d3406035 ]---
RIP: 0010:xsk_poll+0x95/0x540 net/xdp/xsk.c:386
Code: 80 3c 02 00 0f 85 70 04 00 00 4c 8b a3 88 04 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 96 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 bf 03 00 00
RSP: 0018:ffff8880a05cf690 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff8880a0126000 RCX: ffffffff859b666a
RDX: 0000000000000012 RSI: ffffffff859b6684 RDI: 0000000000000096
RBP: ffff8880a05cf6c0 R08: ffff888098456000 R09: ffffed1014024c49
R10: ffffed1014024c48 R11: ffff8880a0126247 R12: 0000000000000000
R13: 0000000000000304 R14: ffff88809525d000 R15: ffff8880939f8a60
FS:  00005555562d4880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000096708000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (430):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/15 05:50 linux-next 6d028043b55e 32d59357 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/08/19 11:55 linux-next da6570438d9b b8ceabfc .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/09/16 03:33 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/16 01:31 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/15 18:58 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/15 16:35 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/15 12:27 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/15 08:51 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/15 07:03 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/15 05:39 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/15 01:46 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/15 00:45 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/14 20:49 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/14 18:39 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/14 18:28 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/14 16:34 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/14 14:50 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/14 06:01 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/14 00:28 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/13 22:14 linux-next 6d028043b55e 32d59357 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/13 17:30 linux-next 6d028043b55e 40fa42bc .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/13 15:02 linux-next 6d028043b55e 40fa42bc .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/13 10:27 linux-next 6d028043b55e 40fa42bc .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/12 17:39 linux-next 6d028043b55e 0b7672ee .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/12 16:36 linux-next 6d028043b55e 0b7672ee .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/12 06:26 linux-next 6d028043b55e f4e53c10 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/12 05:24 linux-next 6d028043b55e f4e53c10 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/12 01:48 linux-next 6d028043b55e f4e53c10 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/12 01:45 linux-next 6d028043b55e f4e53c10 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/11 19:51 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/11 18:33 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/11 15:20 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/11 08:28 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/11 06:31 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/11 04:57 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/11 02:42 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/11 00:20 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 22:33 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 21:49 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 19:01 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 16:50 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 15:35 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 14:14 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 12:43 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 10:27 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/10 03:11 linux-next 6d028043b55e a60cb4cd .config console log report ci-upstream-linux-next-kasan-gce-root
2019/08/19 10:35 linux-next da6570438d9b b8ceabfc .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.