syzbot


general protection fault in fq_codel_enqueue (3)
Status: upstream: reported C repro on 2021/10/29 15:55
Reported-by: syzbot+7a12909485b94426aceb@syzkaller.appspotmail.com
First crash: 211d, last: 24d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: general protection fault in fq_codel_enqueue (log)
Repro: C syz .config
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 general protection fault in fq_codel_enqueue C done 5 735d 763d 1/1 fixed on 2020/06/21 14:03
linux-4.19 general protection fault in fq_codel_enqueue (2) C error 13 17d 636d 0/1 upstream: reported C repro on 2020/08/28 22:42
linux-4.14 general protection fault in fq_codel_enqueue C inconclusive 6 167d 759d 0/1 upstream: reported C repro on 2020/04/27 21:56
upstream general protection fault in fq_codel_enqueue (2) C done 34 237d 637d 0/22 closed as invalid on 2021/10/07 21:22
upstream general protection fault in fq_codel_enqueue C done 25 683d 768d 17/22 fixed on 2020/07/17 17:58
Patch testing requests:
Created Duration User Patch Repo Result
2021/12/03 15:33 10m phind.uet@gmail.com linux-next error

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 6542 Comm: syz-executor965 Not tainted 5.15.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dequeue_head net/sched/sch_fq_codel.c:120 [inline]
RIP: 0010:fq_codel_drop net/sched/sch_fq_codel.c:168 [inline]
RIP: 0010:fq_codel_enqueue+0x83e/0x10c0 net/sched/sch_fq_codel.c:230
Code: f8 e2 25 fa 45 39 ec 0f 83 cb 00 00 00 e8 1a dc 25 fa 48 8b 44 24 10 80 38 00 0f 85 9a 06 00 00 49 8b 07 48 89 c2 48 c1 ea 03 <42> 80 3c 32 00 0f 85 6e 06 00 00 48 8b 10 48 8d 78 28 49 89 17 48
RSP: 0018:ffffc90001187310 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87504776 RDI: 0000000000000003
RBP: ffffc900011874e0 R08: 0000000000000400 R09: 0000000000000001
R10: ffffffff875046d6 R11: 0000000000000000 R12: 0000000000000400
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888071660000
FS:  0000555556b21300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9c09885040 CR3: 0000000021c77000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 dev_qdisc_enqueue+0x40/0x300 net/core/dev.c:3771
 __dev_xmit_skb net/core/dev.c:3855 [inline]
 __dev_queue_xmit+0x1f0e/0x36e0 net/core/dev.c:4170
 __bpf_tx_skb net/core/filter.c:2114 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2139 [inline]
 __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162
 ____bpf_clone_redirect net/core/filter.c:2429 [inline]
 bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401
 ___bpf_prog_run+0x3592/0x77d0 kernel/bpf/core.c:1548
 __bpf_prog_run512+0x91/0xd0 kernel/bpf/core.c:1776
 bpf_dispatcher_nop_func include/linux/bpf.h:718 [inline]
 __bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_prog_run include/linux/filter.h:631 [inline]
 bpf_test_run+0x37c/0xa20 net/bpf/test_run.c:119
 bpf_prog_test_run_skb+0xa7c/0x1cb0 net/bpf/test_run.c:662
 bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline]
 __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605
 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4689 [inline]
 __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fef7c1e24d9
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc95c98158 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fef7c1e24d9
RDX: 0000000000000048 RSI: 0000000020000140 RDI: 000000000000000a
RBP: 00007fef7c1a64c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fef7c1a6550
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 0597f54336b28fa4 ]---
RIP: 0010:dequeue_head net/sched/sch_fq_codel.c:120 [inline]
RIP: 0010:fq_codel_drop net/sched/sch_fq_codel.c:168 [inline]
RIP: 0010:fq_codel_enqueue+0x83e/0x10c0 net/sched/sch_fq_codel.c:230
Code: f8 e2 25 fa 45 39 ec 0f 83 cb 00 00 00 e8 1a dc 25 fa 48 8b 44 24 10 80 38 00 0f 85 9a 06 00 00 49 8b 07 48 89 c2 48 c1 ea 03 <42> 80 3c 32 00 0f 85 6e 06 00 00 48 8b 10 48 8d 78 28 49 89 17 48
RSP: 0018:ffffc90001187310 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87504776 RDI: 0000000000000003
RBP: ffffc900011874e0 R08: 0000000000000400 R09: 0000000000000001
R10: ffffffff875046d6 R11: 0000000000000000 R12: 0000000000000400
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888071660000
FS:  0000555556b21300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9c09885040 CR3: 0000000021c77000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	f8                   	clc
   1:	e2 25                	loop   0x28
   3:	fa                   	cli
   4:	45 39 ec             	cmp    %r13d,%r12d
   7:	0f 83 cb 00 00 00    	jae    0xd8
   d:	e8 1a dc 25 fa       	callq  0xfa25dc2c
  12:	48 8b 44 24 10       	mov    0x10(%rsp),%rax
  17:	80 38 00             	cmpb   $0x0,(%rax)
  1a:	0f 85 9a 06 00 00    	jne    0x6ba
  20:	49 8b 07             	mov    (%r15),%rax
  23:	48 89 c2             	mov    %rax,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	42 80 3c 32 00       	cmpb   $0x0,(%rdx,%r14,1) <-- trapping instruction
  2f:	0f 85 6e 06 00 00    	jne    0x6a3
  35:	48 8b 10             	mov    (%rax),%rdx
  38:	48 8d 78 28          	lea    0x28(%rax),%rdi
  3c:	49 89 17             	mov    %rdx,(%r15)
  3f:	48                   	rex.W

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2022/04/05 08:05 upstream 312310928417 be531bb4 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2022/03/06 04:52 upstream dcde98da9970 be531bb4 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2022/02/04 04:31 upstream dcb85f85fa6f be531bb4 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2022/01/05 03:00 upstream c9e6606c7fe9 be531bb4 .config log report syz C
Crashes (5):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2021/10/28 20:07 upstream 1fc596a56b33 be531bb4 .config log report syz C general protection fault in fq_codel_enqueue
ci-upstream-kasan-gce-smack-root 2022/04/06 18:37 upstream 3e732ebf7316 97582466 .config log report info general protection fault in fq_codel_enqueue
ci-upstream-kasan-gce-selinux-root 2021/11/22 13:47 upstream 136057256686 545ab074 .config log report info general protection fault in fq_codel_enqueue
ci-upstream-net-kasan-gce 2022/05/03 01:45 net-next 829b7bdd7044 2df221f6 .config log report info general protection fault in fq_codel_enqueue
ci-upstream-linux-next-kasan-gce-root 2021/12/06 02:14 linux-next f81e94e91878 a617004c .config log report info general protection fault in fq_codel_enqueue