syzbot
kernel BUG in add_grec
Status:
fixed on 2022/03/29 10:01
Reported-by: syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com
Fix commit:
ae8ec5eabb1a
net: ipv6: fix skb_over_panic in __ip6_append_data
First crash: 1668d, last: 1594d
▶
▼
Similar bugs (23)
| Kernel |
Title |
Rank
🛈
|
Repro |
Cause bisect |
Fix bisect |
Count |
Last |
Reported |
Patched |
Status |
| android-54 |
kernel BUG at net/core/skbuff.c:LINE!
|
-1 |
syz, C |
|
|
267 |
1180d |
2400d
|
0/2 |
auto-obsoleted due to no activity on 2023/08/22 15:17
|
| android-5-10 |
kernel BUG in add_grec (2)
|
-1 |
syz, C |
error |
inconclusive |
1039 |
1354d |
1354d
|
2/2 |
fixed on 2023/02/24 12:10
|
| android-5-10 |
kernel BUG in cdc_ncm_fill_tx_frame
|
-1 |
syz, C |
error |
|
40 |
1686d |
1752d
|
1/2 |
fixed on 2021/12/29 12:20
|
| android-5-15 |
kernel BUG in add_grec
|
-1 |
syz, C |
|
|
38 |
1341d |
1355d
|
2/2 |
fixed on 2022/12/13 18:12
|
| android-44 |
kernel BUG at net/core/skbuff.c:LINE!
|
-1 |
syz, C |
|
|
79 |
2451d |
2676d
|
0/2 |
public: reported C repro on 2019/04/11 08:44
|
| linux-4.19 |
kernel BUG at net/core/skbuff.c:LINE!
|
-1 |
syz, C |
|
unreliable |
494 |
1440d |
2660d
|
0/1 |
upstream: reported C repro on 2019/04/27 20:12
|
| android-54 |
kernel BUG in pfkey_send_acquire
|
-1 |
syz, C |
|
|
278 |
1364d |
2029d
|
0/2 |
auto-obsoleted due to no activity on 2023/04/19 14:24
|
| upstream |
kernel BUG at net/core/skbuff.c:LINE! (2)
net
|
-1 |
syz, C |
|
|
562 |
3115d |
3204d
|
4/29 |
fixed on 2018/01/29 03:39
|
| android-414 |
kernel BUG at net/core/skbuff.c:LINE!
|
-1 |
syz, C |
|
|
2743 |
2439d |
2676d
|
0/1 |
public: reported C repro on 2019/04/11 00:00
|
| upstream |
kernel BUG in netem_enqueue
net
|
-1 |
|
|
|
9 |
1332d |
1557d
|
22/29 |
fixed on 2023/02/24 13:50
|
| upstream |
kernel BUG at net/core/skbuff.c:LINE! (3)
|
-1 |
syz, C |
done |
|
4399 |
1993d |
3110d
|
19/29 |
fixed on 2021/03/10 01:48
|
| upstream |
kernel BUG at net/core/skbuff.c:LINE!
sctp
|
-1 |
|
|
|
5 |
3210d |
3280d
|
3/29 |
fixed on 2017/10/27 10:10
|
| linux-4.19 |
kernel BUG in pfkey_send_acquire
|
-1 |
syz, C |
|
done |
56 |
2000d |
2029d
|
1/1 |
fixed on 2021/03/18 08:30
|
| linux-4.14 |
kernel BUG at net/core/skbuff.c:LINE!
|
-1 |
syz, C |
|
|
3066 |
1256d |
2675d
|
0/1 |
upstream: reported C repro on 2019/04/12 15:43
|
| upstream |
kernel BUG in llc_sap_action_send_xid_c
net
|
-1 |
syz, C |
error |
|
61 |
1733d |
1947d
|
20/29 |
fixed on 2021/11/10 00:50
|
| upstream |
kernel BUG in pskb_expand_head
net
|
-1 |
syz, C |
done |
|
1600 |
1276d |
1727d
|
22/29 |
fixed on 2023/02/25 08:02
|
| android-49 |
kernel BUG at net/core/skbuff.c:LINE!
|
-1 |
syz, C |
|
|
391 |
2439d |
2675d
|
0/3 |
public: reported C repro on 2019/04/12 00:00
|
| upstream |
kernel BUG in cdc_ncm_fill_tx_frame
usb
|
-1 |
syz |
error |
error |
5 |
61d |
1163d
|
0/29 |
upstream: reported syz repro on 2023/06/02 18:39
|
| android-5-15 |
kernel BUG in cdc_ncm_fill_tx_frame (2)
origin:downstream
|
-1 |
syz, C |
done |
|
5 |
1173d |
1187d
|
2/2 |
fixed on 2023/06/16 14:10
|
| android-5-15 |
kernel BUG in cdc_ncm_fill_tx_frame
|
-1 |
|
|
|
1 |
1354d |
1354d
|
0/2 |
auto-obsoleted due to no activity on 2023/04/11 17:56
|
| android-5-10 |
kernel BUG in cdc_ncm_fill_tx_frame (2)
|
-1 |
syz, C |
error |
|
3 |
1180d |
1187d
|
2/2 |
fixed on 2023/06/28 00:02
|
| android-5-15 |
kernel BUG in mld_newpack
|
-1 |
|
|
|
1 |
1361d |
1361d
|
0/2 |
auto-obsoleted due to no activity on 2023/03/24 18:30
|
| upstream |
kernel BUG in mld_newpack
net
|
-1 |
|
|
|
1 |
1393d |
1393d
|
22/29 |
fixed on 2023/02/24 13:50
|
▶
▼
Last patch testing requests (3)
Sample crash report:
skbuff: skb_over_panic: text:ffffffff842f46b6 len:65575 put:65575 head:ffff88811d74a000 data:ffff88811d74a088 tail:0x100af end:0x680 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:110!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 366 Comm: syz-executor693 Not tainted 5.10.92-syzkaller-01003-gf45f895af546 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:skb_panic+0x14f/0x160 net/core/skbuff.c:106
Code: 87 85 48 8b 75 c0 48 8b 55 b8 8b 4d d4 44 8b 45 d0 4c 8b 4d c8 b8 00 00 00 00 53 41 56 41 55 41 54 e8 9c 42 89 fd 48 83 c4 20 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 48 89 e5 41
RSP: 0018:ffffc90000ba71b0 EFLAGS: 00010282
RAX: 000000000000008f RBX: ffffffff858750a0 RCX: 24e716add774bb00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffc90000ba71f8 R08: ffffffff815457c8 R09: ffffed103ee2a5d8
R10: ffffed103ee2a5d8 R11: 0000000000000000 R12: ffff88811d74a088
R13: 00000000000100af R14: 0000000000000680 R15: dffffc0000000000
FS: 00005555557e2300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558102e15048 CR3: 000000011ccbd000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
skb_over_panic+0x2c/0x30 net/core/skbuff.c:115
skb_put+0x205/0x210 net/core/skbuff.c:1877
__ip6_append_data+0x2ad6/0x3d80 net/ipv6/ip6_output.c:1680
ip6_append_data+0x1ab/0x2d0 net/ipv6/ip6_output.c:1829
rawv6_sendmsg+0x1e4f/0x2cd0 net/ipv6/raw.c:949
inet_sendmsg+0xa1/0xc0 net/ipv4/af_inet.c:821
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg net/socket.c:672 [inline]
____sys_sendmsg+0x5b9/0x910 net/socket.c:2343
___sys_sendmsg net/socket.c:2397 [inline]
__sys_sendmmsg+0x5ae/0x7f0 net/socket.c:2487
__do_sys_sendmmsg net/socket.c:2516 [inline]
__se_sys_sendmmsg net/socket.c:2513 [inline]
__x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2513
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f1eb12453f9
Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd42c6b928 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007ffd42c6b938 RCX: 00007f1eb12453f9
RDX: 0000000000000001 RSI: 00000000200002c0 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000fe80 R11: 0000000000000246 R12: 00007ffd42c6b940
R13: 00007ffd42c6b960 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace e41daba6b63d41fe ]---
RIP: 0010:skb_panic+0x14f/0x160 net/core/skbuff.c:106
Code: 87 85 48 8b 75 c0 48 8b 55 b8 8b 4d d4 44 8b 45 d0 4c 8b 4d c8 b8 00 00 00 00 53 41 56 41 55 41 54 e8 9c 42 89 fd 48 83 c4 20 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 48 89 e5 41
RSP: 0018:ffffc90000ba71b0 EFLAGS: 00010282
RAX: 000000000000008f RBX: ffffffff858750a0 RCX: 24e716add774bb00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffc90000ba71f8 R08: ffffffff815457c8 R09: ffffed103ee2a5d8
R10: ffffed103ee2a5d8 R11: 0000000000000000 R12: ffff88811d74a088
R13: 00000000000100af R14: 0000000000000680 R15: dffffc0000000000
FS: 00005555557e2300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558102e15048 CR3: 000000011ccbd000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
* Struck through repros no longer work on HEAD.