syzbot


WARNING in rds_cmsg_rdma_args

Status: fixed on 2018/01/19 01:24
Subsystems: rds
[Documentation on labels]
Reported-by: syzbot+ef175b5825285531eabf@syzkaller.appspotmail.com
Fix commit: c095508770ae RDS: Heap OOB write in rds_message_alloc_sgs()
First crash: 2306d, last: 2306d
Discussions (2)
Title Replies (including bot) Last reply
Re: WARNING in rds_cmsg_rdma_args 2 (2) 2018/01/04 12:12
WARNING in rds_cmsg_rdma_args 0 (1) 2018/01/03 08:58

Sample crash report:
audit: type=1400 audit(1514947809.406:7): avc:  denied  { map } for  pid=3498 comm="syzkaller564985" path="/root/syzkaller564985288" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
WARNING: CPU: 1 PID: 3498 at net/rds/rdma.c:617 rds_cmsg_rdma_args+0xf8a/0x1380 net/rds/rdma.c:617
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 3498 Comm: syzkaller564985 Not tainted 4.15.0-rc6+ #245
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1dc/0x200 kernel/panic.c:547
 report_bug+0x211/0x2d0 lib/bug.c:184
 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
 invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1079
RIP: 0010:rds_cmsg_rdma_args+0xf8a/0x1380 net/rds/rdma.c:617
RSP: 0018:ffff8801c0ac75b0 EFLAGS: 00010293
RAX: ffff8801c09f8300 RBX: ffff8801daddf238 RCX: ffffffff85115f4a
RDX: 0000000000000000 RSI: 00000000014080c0 RDI: ffff8801c06f9ef0
RBP: ffff8801c0ac7740 R08: 0000000000000000 R09: 1ffff10038158e8b
R10: ffff8801c0ac7420 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8801c044b200 R14: ffff8801daddf200 R15: 1ffff10038158eca
 rds_cmsg_send net/rds/send.c:943 [inline]
 rds_sendmsg+0x144d/0x1f90 net/rds/send.c:1127
 sock_sendmsg_nosec net/socket.c:636 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:646
 ___sys_sendmsg+0x320/0x8b0 net/socket.c:2026
 __sys_sendmmsg+0x1ee/0x620 net/socket.c:2116
 SYSC_sendmmsg net/socket.c:2147 [inline]
 SyS_sendmmsg+0x35/0x60 net/socket.c:2142
 entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x43fe49
RSP: 002b:00007ffd144533b8 EFLAGS: 00000217 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fe49
RDX: 0000000000000001 RSI: 000000002099ffc4 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004017b0
R13: 0000000000401840 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/03 02:52 upstream 30a7acd57389 00193447 .config console log report syz C ci-upstream-kasan-gce
2018/01/03 02:39 net-next-old bcecb4bbf88a 00193447 .config console log report syz C ci-upstream-net-kasan-gce
2018/01/03 02:55 mmots ad036b63ee57 00193447 .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/03 02:51 linux-next e0e99813fb1d 00193447 .config console log report syz C ci-upstream-next-kasan-gce
2018/01/03 02:50 upstream 30a7acd57389 00193447 .config console log report syz ci-upstream-kasan-gce-386
2018/01/03 02:23 net-next-old bcecb4bbf88a 00193447 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.