syzbot


general protection fault in ipt_do_table

Status: closed as dup on 2018/02/12 16:31
Subsystems: netfilter
[Documentation on labels]
Reported-by: syzbot+c914fd8c6a751c4fddbd@syzkaller.appspotmail.com
First crash: 2488d, last: 2475d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
general protection fault in ip6t_do_table netfilter C 8077 2476d 2502d
Discussions (1)
Title Replies (including bot) Last reply
general protection fault in ipt_do_table 2 (3) 2018/02/12 16:31
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 general protection fault in ipt_do_table 1 1341d 1341d 0/1 auto-closed as invalid on 2021/08/01 14:21

Sample crash report:
audit: type=1400 audit(1519158542.272:7): avc:  denied  { map } for  pid=4176 comm="syzkaller546481" path="/root/syzkaller546481045" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 4.16.0-rc2+ #322
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ipt_do_table+0x12ee/0x1950 net/ipv4/netfilter/ip_tables.c:334
RSP: 0018:ffff8801d9f56200 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8801b0082288 RCX: ffffffff84b795fd
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8801b008209a
RBP: ffff8801d9f56408 R08: ffff8801d9f56500 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8801b0082040 R15: ffff8801d9f56380
FS:  0000000000000000(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c2a9f900b8 CR3: 0000000006a22006 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 iptable_filter_hook+0x65/0x80 net/ipv4/netfilter/iptable_filter.c:41
 nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
 nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
 nf_hook include/linux/netfilter.h:243 [inline]
 NF_HOOK include/linux/netfilter.h:286 [inline]
 ip_local_deliver+0x445/0x6e0 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:449 [inline]
 ip_rcv_finish+0xa36/0x2040 net/ipv4/ip_input.c:397
 NF_HOOK include/linux/netfilter.h:288 [inline]
 ip_rcv+0xc5a/0x1840 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1a41/0x3460 net/core/dev.c:4554
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4619
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4693
 napi_skb_finish net/core/dev.c:5055 [inline]
 napi_gro_receive+0x3d0/0x500 net/core/dev.c:5086
 receive_buf+0xb6e/0x2530 drivers/net/virtio_net.c:916
 virtnet_receive drivers/net/virtio_net.c:1160 [inline]
 virtnet_poll+0x320/0xb70 drivers/net/virtio_net.c:1240
 napi_poll net/core/dev.c:5697 [inline]
 net_rx_action+0x792/0x1910 net/core/dev.c:5763
 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
 run_ksoftirqd+0x86/0x100 kernel/softirq.c:666
 smpboot_thread_fn+0x450/0x7c0 kernel/smpboot.c:164
 kthread+0x33c/0x400 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:407
Code: 46 52 02 75 41 e8 d3 75 b9 fc 8b 85 80 fe ff ff 8d 70 01 89 b5 00 ff ff ff 48 8b b5 88 fe ff ff 4c 8d 24 c6 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 0f 85 e8 01 00 00 8b 85 00 ff ff ff 4d 89 34 24 
RIP: ipt_do_table+0x12ee/0x1950 net/ipv4/netfilter/ip_tables.c:334 RSP: ffff8801d9f56200
---[ end trace 1ae60b7145f258ee ]---
Kernel panic - not syncing: Fatal exception in interrupt
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (21):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/02/20 20:31 upstream 79c0ef3e85c0 5abac192 .config console log report syz C ci-upstream-kasan-gce
2018/02/11 17:23 upstream d48fcbd864a0 4e9b726d .config console log report syz C ci-upstream-kasan-gce
2018/02/18 04:02 upstream ee78ad7848a7 833f78c7 .config console log report syz C ci-upstream-kasan-gce-386
2018/02/20 20:32 net-next-old f5c0c6f4299f 5abac192 .config console log report syz C ci-upstream-net-kasan-gce
2018/02/11 20:30 net-next-old 9a61df9e5f74 4e9b726d .config console log report syz C ci-upstream-net-kasan-gce
2018/02/24 07:31 upstream 938e1426e262 5c1e0207 .config console log report ci-upstream-kasan-gce
2018/02/23 13:47 upstream 0f9da844d877 33464158 .config console log report ci-upstream-kasan-gce
2018/02/23 05:05 upstream af3e79d29555 8d8e2494 .config console log report ci-upstream-kasan-gce
2018/02/22 15:25 upstream af3e79d29555 02fb4232 .config console log report ci-upstream-kasan-gce
2018/02/22 01:32 upstream af3e79d29555 04cbdbd1 .config console log report ci-upstream-kasan-gce
2018/02/20 20:10 upstream 79c0ef3e85c0 5abac192 .config console log report ci-upstream-kasan-gce
2018/02/23 04:49 upstream af3e79d29555 8d8e2494 .config console log report ci-upstream-kasan-gce-386
2018/02/24 10:39 net-next-old 1b71af6053af 5c1e0207 .config console log report ci-upstream-net-kasan-gce
2018/02/24 08:41 net-next-old 1b71af6053af 5c1e0207 .config console log report ci-upstream-net-kasan-gce
2018/02/24 03:58 net-next-old 1b71af6053af 5c1e0207 .config console log report ci-upstream-net-kasan-gce
2018/02/22 00:53 net-next-old 022ddbca86ce 04cbdbd1 .config console log report ci-upstream-net-kasan-gce
2018/02/21 11:50 net-next-old 5eeba397392a 04cbdbd1 .config console log report ci-upstream-net-kasan-gce
2018/02/21 11:01 net-next-old 5eeba397392a 04cbdbd1 .config console log report ci-upstream-net-kasan-gce
2018/02/21 08:16 net-next-old 5eeba397392a 04cbdbd1 .config console log report ci-upstream-net-kasan-gce
2018/02/20 20:03 net-next-old f5c0c6f4299f 5abac192 .config console log report ci-upstream-net-kasan-gce
2018/02/17 08:28 net-next-old 65bd449c32c2 c8b3f7c1 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.