syzbot


BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy

Status: upstream: reported C repro on 2020/10/21 05:32
Reported-by: syzbot+f3bd705c8213cd31abf6@syzkaller.appspotmail.com
First crash: 1479d, last: 890d
Fix bisection: failed (error log, bisect log)
  
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy C 4 628d 1478d 0/1 upstream: reported C repro on 2020/10/22 08:03
upstream KASAN: null-ptr-deref Write in rhashtable_free_and_destroy (2) wireless C unreliable 38 1040d 1305d 20/28 fixed on 2022/03/08 16:11
upstream KASAN: null-ptr-deref Write in rhashtable_free_and_destroy wireless 11 1359d 1436d 19/28 fixed on 2021/03/10 01:49
Fix bisection attempts (6)
Created Duration User Patch Repo Result
2021/11/07 02:39 17m bisect fix linux-4.19.y error job log
2021/07/25 21:21 23m bisect fix linux-4.19.y OK (0) job log log
2021/06/25 20:40 23m bisect fix linux-4.19.y OK (0) job log log
2021/05/26 20:09 30m bisect fix linux-4.19.y OK (0) job log log
2021/04/26 19:40 25m bisect fix linux-4.19.y OK (0) job log log
2021/03/01 09:02 25m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
RAX: ffffffffffffffda RBX: 00007fb2d7b294c0 RCX: 00007fb2d7aa0789
RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000003
RBP: 00007fb2d7b294cc R08: 0000000000000002 R09: 0000000000003131
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb2d7a512f0
R13: 00007fb2d7b294c8 R14: 0000000700050008 R15: 0000000000000002
BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
PGD 0 P4D 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events cfg80211_destroy_iface_wk
RIP: 0010:test_and_set_bit arch/x86/include/asm/bitops.h:209 [inline]
RIP: 0010:try_to_grab_pending+0xcd/0x6f0 kernel/workqueue.c:1229
Code: 3c 02 00 0f 85 26 05 00 00 4c 89 6d 00 e8 4b 53 29 00 31 ff 44 89 e6 e8 81 2c 24 00 45 84 e4 0f 85 da 01 00 00 e8 43 2b 24 00 <f0> 48 0f ba 2b 00 41 0f 92 c4 31 ff 44 89 e6 e8 5f 2c 24 00 45 84
RSP: 0018:ffff8880b5a97870 EFLAGS: 00010093
RAX: ffff8880b5a82380 RBX: 0000000000000080 RCX: ffffffff813e5a1f
RDX: 0000000000000000 RSI: ffffffff813e5a2d RDI: 0000000000000001
RBP: ffff8880b5a978e8 R08: 0000000000400000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000293 R14: dffffc0000000010 R15: ffff8880b5a82380
FS:  0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000080 CR3: 00000000a8b63000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __cancel_work_timer+0xa6/0x590 kernel/workqueue.c:2972
 rhashtable_free_and_destroy+0x2b/0x970 lib/rhashtable.c:1145
 mesh_table_free net/mac80211/mesh_pathtbl.c:73 [inline]
 mesh_pathtbl_unregister+0x42/0xa0 net/mac80211/mesh_pathtbl.c:825
 ieee80211_teardown_sdata net/mac80211/iface.c:1122 [inline]
 ieee80211_uninit+0x7e/0x90 net/mac80211/iface.c:1127
 rollback_registered_many+0x927/0xe70 net/core/dev.c:8210
 rollback_registered+0xe9/0x1b0 net/core/dev.c:8238
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 8203 Comm: syz-executor410 Not tainted 4.19.211-syzkaller #0
 unregister_netdevice_queue+0x1de/0x3e0 net/core/dev.c:9305
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 unregister_netdevice include/linux/netdevice.h:2615 [inline]
 ieee80211_if_remove+0x213/0x390 net/mac80211/iface.c:1920
Call Trace:
 ieee80211_del_iface+0x12/0x20 net/mac80211/cfg.c:144
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 rdev_del_virtual_intf net/wireless/rdev-ops.h:57 [inline]
 cfg80211_destroy_ifaces+0x1d0/0x750 net/wireless/core.c:317
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 cfg80211_destroy_iface_wk+0x1a/0x20 net/wireless/core.c:329
 process_one_work+0x864/0x1570 kernel/workqueue.c:2153
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc+0x3f/0x370 mm/slab.c:3557
 kthread+0x33f/0x460 kernel/kthread.c:259
 kmem_cache_zalloc include/linux/slab.h:699 [inline]
 fill_pool lib/debugobjects.c:134 [inline]
 __debug_object_init+0x6d9/0x9b0 lib/debugobjects.c:379
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
CR2: 0000000000000080
 debug_object_init lib/debugobjects.c:431 [inline]
 debug_object_activate+0x382/0x450 lib/debugobjects.c:512
---[ end trace 35f022831dcf777c ]---
RIP: 0010:test_and_set_bit arch/x86/include/asm/bitops.h:209 [inline]
RIP: 0010:try_to_grab_pending+0xcd/0x6f0 kernel/workqueue.c:1229
Code: 3c 02 00 0f 85 26 05 00 00 4c 89 6d 00 e8 4b 53 29 00 31 ff 44 89 e6 e8 81 2c 24 00 45 84 e4 0f 85 da 01 00 00 e8 43 2b 24 00 <f0> 48 0f ba 2b 00 41 0f 92 c4 31 ff 44 89 e6 e8 5f 2c 24 00 45 84
RSP: 0018:ffff8880b5a97870 EFLAGS: 00010093
RAX: ffff8880b5a82380 RBX: 0000000000000080 RCX: ffffffff813e5a1f
RDX: 0000000000000000 RSI: ffffffff813e5a2d RDI: 0000000000000001
RBP: ffff8880b5a978e8 R08: 0000000000400000 R09: 0000000000000000
 debug_rcu_head_queue kernel/rcu/rcu.h:193 [inline]
 __call_rcu.constprop.0+0x31/0x7f0 kernel/rcu/tree.c:2977
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000293 R14: dffffc0000000010 R15: ffff8880b5a82380
 exit_notify kernel/exit.c:745 [inline]
 do_exit+0x15be/0x2be0 kernel/exit.c:890
FS:  0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000080 CR3: 00000000a8b63000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 do_group_exit+0x125/0x310 kernel/exit.c:967
----------------
Code disassembly (best guess):
   0:	3c 02                	cmp    $0x2,%al
   2:	00 0f                	add    %cl,(%rdi)
   4:	85 26                	test   %esp,(%rsi)
   6:	05 00 00 4c 89       	add    $0x894c0000,%eax
   b:	6d                   	insl   (%dx),%es:(%rdi)
   c:	00 e8                	add    %ch,%al
   e:	4b 53                	rex.WXB push %r11
  10:	29 00                	sub    %eax,(%rax)
  12:	31 ff                	xor    %edi,%edi
  14:	44 89 e6             	mov    %r12d,%esi
  17:	e8 81 2c 24 00       	callq  0x242c9d
  1c:	45 84 e4             	test   %r12b,%r12b
  1f:	0f 85 da 01 00 00    	jne    0x1ff
  25:	e8 43 2b 24 00       	callq  0x242b6d
* 2a:	f0 48 0f ba 2b 00    	lock btsq $0x0,(%rbx) <-- trapping instruction
  30:	41 0f 92 c4          	setb   %r12b
  34:	31 ff                	xor    %edi,%edi
  36:	44 89 e6             	mov    %r12d,%esi
  39:	e8 5f 2c 24 00       	callq  0x242c9d
  3e:	45                   	rex.RB
  3f:	84                   	.byte 0x84

Crashes (31):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/06/02 04:32 linux-4.19.y 3f8a27f9e27b b4bc6a3d .config console log report syz C ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2020/11/07 05:13 linux-4.19.y b94de4d19498 cba33199 .config console log report syz C ci2-linux-4-19
2022/06/02 04:16 linux-4.19.y 3f8a27f9e27b b4bc6a3d .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2022/04/13 15:32 linux-4.19.y 3f8a27f9e27b b17b2923 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2022/04/11 20:44 linux-4.19.y 3f8a27f9e27b af01ee7d .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2022/04/04 16:17 linux-4.19.y 3f8a27f9e27b 5915c2cb .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2022/04/03 04:41 linux-4.19.y 3f8a27f9e27b 79a2a8fc .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2022/04/01 19:04 linux-4.19.y 3f8a27f9e27b 79a2a8fc .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2022/02/02 14:32 linux-4.19.y 3f8a27f9e27b 4ebb2798 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2022/01/31 11:12 linux-4.19.y 3f8a27f9e27b a491ad2d .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/12/15 22:29 linux-4.19.y 3f8a27f9e27b 572bcb40 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/12/07 09:39 linux-4.19.y 3f8a27f9e27b 0230ba3e .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/12/07 03:47 linux-4.19.y 3f8a27f9e27b 0230ba3e .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/12/03 23:01 linux-4.19.y 3f8a27f9e27b c7c20675 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/11/27 19:33 linux-4.19.y 3f8a27f9e27b 63eeac02 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/10/08 02:38 linux-4.19.y 6db10b4d5efd efe0f24d .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/09/29 01:41 linux-4.19.y c2276d585654 d82cb927 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/09/14 02:57 linux-4.19.y b172b44fcb17 58d09404 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/08/21 19:39 linux-4.19.y 59456c9cc40c b599f2fc .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/03/27 17:50 linux-4.19.y 78fec1611cbf a8529b82 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/01/30 09:02 linux-4.19.y c4ff839de17f fc9fd31e .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2021/01/18 09:43 linux-4.19.y c110fed0e606 fd103621 .config console log report info ci2-linux-4-19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy
2020/12/31 05:35 linux-4.19.y 3207316b3bee 5cc121d6 .config console log report info ci2-linux-4-19
2020/12/25 13:08 linux-4.19.y 13d2ce42de8c b982b3ea .config console log report info ci2-linux-4-19
2020/12/24 02:17 linux-4.19.y 13d2ce42de8c c2c1d1dd .config console log report info ci2-linux-4-19
2020/12/06 23:47 linux-4.19.y daefdc9eb24b c521566d .config console log report info ci2-linux-4-19
2020/11/27 15:58 linux-4.19.y 0c88e405c97e 486f93ef .config console log report info ci2-linux-4-19
2020/11/18 06:29 linux-4.19.y 31acccdc8774 09323409 .config console log report info ci2-linux-4-19
2020/11/13 08:20 linux-4.19.y 31acccdc8774 16fca0c8 .config console log report info ci2-linux-4-19
2020/10/25 17:32 linux-4.19.y ad326970d25c a1839e81 .config console log report info ci2-linux-4-19
2020/10/21 05:32 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
* Struck through repros no longer work on HEAD.