syzbot


general protection fault in __bpf_map_put

Status: fixed on 2018/01/22 13:19
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+d2f5524fb46fd3b312ee@syzkaller.appspotmail.com
Fix commit: bbeb6e4323da bpf, array: fix overflow in max_entries and undefined behavior in index_mask
First crash: 2326d, last: 2319d
Discussions (6)
Title Replies (including bot) Last reply
[PATCH 4.4 00/87] 4.4.112-stable review 103 (103) 2018/02/14 16:43
[PATCH 4.9 00/96] 4.9.77-stable review 111 (111) 2018/01/21 16:03
[PATCH 4.14 000/118] 4.14.14-stable review 139 (139) 2018/01/16 20:50
general protection fault in __bpf_map_put 2 (3) 2018/01/14 00:21
[PATCH 4.4-stable 0/6] bpf: prevent out-of-bounds speculation 11 (11) 2018/01/13 19:49
[PATCH bpf] bpf, array: fix overflow in max_entries and undefined behavior in index_mask 2 (2) 2018/01/10 22:58

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 4.15.0-rc8+ #263
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events bpf_map_free_deferred
RIP: 0010:__bpf_map_put+0x64/0x2e0 kernel/bpf/syscall.c:233
RSP: 0018:ffff8801d9fbf458 EFLAGS: 00010293
RAX: ffff8801d9fb0480 RBX: e66001ca00000ec6 RCX: ffffffff817db0d4
RDX: 0000000000000000 RSI: 0000000000000001 RDI: e66001ca00000ec6
RBP: ffff8801d9fbf4e8 R08: 1ffff1003b3f7e6a R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1003b3f7e8c
R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000204f9fe4 CR3: 0000000006822004 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 bpf_map_put+0x1a/0x20 kernel/bpf/syscall.c:243
 bpf_map_fd_put_ptr+0x15/0x20 kernel/bpf/map_in_map.c:96
 fd_array_map_delete_elem kernel/bpf/arraymap.c:420 [inline]
 bpf_fd_array_map_clear kernel/bpf/arraymap.c:461 [inline]
 array_of_map_free+0x100/0x180 kernel/bpf/arraymap.c:618
 bpf_map_free_deferred+0xb0/0xe0 kernel/bpf/syscall.c:217
 process_one_work+0xbbf/0x1b10 kernel/workqueue.c:2112
 worker_thread+0x223/0x1990 kernel/workqueue.c:2246
 kthread+0x33c/0x400 kernel/kthread.c:238
 ret_from_fork+0x37/0x50 arch/x86/entry/entry_64.S:530
Code: b5 41 48 c7 45 80 95 d4 58 86 48 c7 45 88 70 b0 7d 81 c7 00 f1 f1 f1 f1 c7 40 04 00 f2 f2 f2 c7 40 08 f3 f3 f3 f3 e8 ec 66 f2 ff <f0> ff 4b 48 74 2f e8 e1 66 f2 ff 48 b8 00 00 00 00 00 fc ff df 
RIP: __bpf_map_put+0x64/0x2e0 kernel/bpf/syscall.c:233 RSP: ffff8801d9fbf458
---[ end trace 6c10653fdfd94c8b ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (331):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/16 05:16 upstream a8750ddca918 e17f4a5d .config console log report syz C ci-upstream-kasan-gce
2018/01/15 19:05 upstream a8750ddca918 66d492a6 .config console log report syz C ci-upstream-kasan-gce
2018/01/14 07:23 upstream 2c1cfa499018 c9e7aeae .config console log report syz C ci-upstream-kasan-gce
2018/01/13 06:44 upstream c92a9a461dff 9dc808a6 .config console log report syz C ci-upstream-kasan-gce
2018/01/12 22:47 upstream c92a9a461dff 9dc808a6 .config console log report syz C ci-upstream-kasan-gce
2018/01/16 06:52 upstream a8750ddca918 e17f4a5d .config console log report syz C ci-upstream-kasan-gce-386
2018/01/15 19:05 upstream a8750ddca918 66d492a6 .config console log report syz C ci-upstream-kasan-gce-386
2018/01/14 07:07 upstream 2c1cfa499018 c9e7aeae .config console log report syz C ci-upstream-kasan-gce-386
2018/01/13 06:56 upstream c92a9a461dff 9dc808a6 .config console log report syz C ci-upstream-kasan-gce-386
2018/01/12 22:45 upstream c92a9a461dff 9dc808a6 .config console log report syz C ci-upstream-kasan-gce-386
2018/01/16 03:27 net-next-old 594831a8aba3 e17f4a5d .config console log report syz C ci-upstream-net-kasan-gce
2018/01/15 18:54 net-next-old 564737f981fb 66d492a6 .config console log report syz C ci-upstream-net-kasan-gce
2018/01/14 06:15 net-next-old 6bd39bc3da0f c9e7aeae .config console log report syz C ci-upstream-net-kasan-gce
2018/01/13 07:02 net-next-old 6bd39bc3da0f 9dc808a6 .config console log report syz C ci-upstream-net-kasan-gce
2018/01/12 22:34 net-next-old 19d28fbd306e 9dc808a6 .config console log report syz C ci-upstream-net-kasan-gce
2018/01/12 22:47 mmots 2c405fa05106 9dc808a6 .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/11 08:49 linux-next 8418f8876404 02a19b64 .config console log report syz C ci-upstream-next-kasan-gce
2018/01/11 08:48 mmots 4147d50978df 02a19b64 .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/10 08:09 linux-next b4464bcab38d 1f60c828 .config console log report syz C ci-upstream-next-kasan-gce
2018/01/10 06:00 linux-next b4464bcab38d 1f60c828 .config console log report syz C ci-upstream-next-kasan-gce
2018/01/17 09:39 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/17 07:41 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/17 05:59 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/17 05:56 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/17 05:00 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/17 03:48 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/17 01:23 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/16 22:34 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/16 21:16 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/17 09:43 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce-386
2018/01/17 09:05 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce-386
2018/01/16 20:09 upstream a8750ddca918 a46e5318 .config console log report ci-upstream-kasan-gce-386
2018/01/17 08:40 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 08:01 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 07:09 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 05:58 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 05:54 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 05:46 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 05:43 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 05:36 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 04:47 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 04:34 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 04:30 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 03:53 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 03:38 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 03:20 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 03:20 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 02:44 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 01:56 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 01:51 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 01:23 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/17 00:16 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 23:39 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 23:25 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 23:22 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 22:56 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 21:11 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 21:05 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 20:25 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 20:25 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.