syzbot


general protection fault in inet_diag_bc_sk

Status: fixed on 2020/07/17 17:58
Subsystems: net
[Documentation on labels]
Fix commit: ee1bd483cc06 inet_diag: bc: read cgroup id only for full sockets
First crash: 1456d, last: 1454d

Sample crash report:
general protection fault, probably for non-canonical address 0xe48f382f2000002e: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0x2479e17900000170-0x2479e17900000177]
CPU: 1 PID: 13266 Comm: syz-executor.3 Not tainted 5.7.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:cgroup_id include/linux/cgroup.h:312 [inline]
RIP: 0010:inet_diag_bc_sk+0x2e1/0xc70 net/ipv4/inet_diag.c:749
Code: 85 db 0f 84 79 05 00 00 e8 ac 6f bb fa e8 a7 6f bb fa 48 8d bb 70 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7e 08 00 00 48 8b 9b 70 01 00 00 48 b8 00 00 00
RSP: 0018:ffffc900018871a0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 2479e17900000000 RCX: ffffc9000f7f3000
RDX: 048f3c2f2000002e RSI: ffffffff86b7bce9 RDI: 2479e17900000170
RBP: ffff8880a737d048 R08: ffff8880985240c0 R09: fffff52000310e34
R10: 0000000000000003 R11: fffff52000310e33 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000004001 R15: 0000000000000000
FS:  00007fc340262700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2c223000 CR3: 0000000094f89000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 inet_diag_dump_icsk+0xbe4/0x1306 net/ipv4/inet_diag.c:1061
 __inet_diag_dump+0x8d/0x240 net/ipv4/inet_diag.c:1113
 netlink_dump+0x50b/0xf50 net/netlink/af_netlink.c:2245
 __netlink_dump_start+0x63f/0x910 net/netlink/af_netlink.c:2353
 netlink_dump_start include/linux/netlink.h:246 [inline]
 inet_diag_handler_cmd+0x263/0x2c0 net/ipv4/inet_diag.c:1278
 __sock_diag_cmd net/core/sock_diag.c:233 [inline]
 sock_diag_rcv_msg+0x2fe/0x3e0 net/core/sock_diag.c:264
 netlink_rcv_skb+0x15a/0x410 net/netlink/af_netlink.c:2469
 sock_diag_rcv+0x26/0x40 net/core/sock_diag.c:275
 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
 netlink_unicast+0x537/0x740 net/netlink/af_netlink.c:1329
 netlink_sendmsg+0x882/0xe10 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 sock_write_iter+0x289/0x3c0 net/socket.c:1004
 call_write_iter include/linux/fs.h:1907 [inline]
 do_iter_readv_writev+0x5a8/0x850 fs/read_write.c:694
 do_iter_write fs/read_write.c:999 [inline]
 do_iter_write+0x18b/0x600 fs/read_write.c:980
 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1072
 do_writev+0x27f/0x300 fs/read_write.c:1115
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x45c829
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fc340261c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 000000000050d140 RCX: 000000000045c829
RDX: 0000000000000001 RSI: 0000000020000140 RDI: 0000000000000005
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000d18 R14: 00000000004cb1f4 R15: 00007fc3402626d4
Modules linked in:
---[ end trace 2f1df30557dc2a60 ]---
RIP: 0010:cgroup_id include/linux/cgroup.h:312 [inline]
RIP: 0010:inet_diag_bc_sk+0x2e1/0xc70 net/ipv4/inet_diag.c:749
Code: 85 db 0f 84 79 05 00 00 e8 ac 6f bb fa e8 a7 6f bb fa 48 8d bb 70 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7e 08 00 00 48 8b 9b 70 01 00 00 48 b8 00 00 00
RSP: 0018:ffffc900018871a0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 2479e17900000000 RCX: ffffc9000f7f3000
RDX: 048f3c2f2000002e RSI: ffffffff86b7bce9 RDI: 2479e17900000170
RBP: ffff8880a737d048 R08: ffff8880985240c0 R09: fffff52000310e34
R10: 0000000000000003 R11: fffff52000310e33 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000004001 R15: 0000000000000000
FS:  00007fc340262700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2c223000 CR3: 0000000094f89000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/03 13:25 net-next-old 115506fea499 5457883a .config console log report ci-upstream-net-kasan-gce
2020/05/03 03:02 net-next-old 115506fea499 5457883a .config console log report ci-upstream-net-kasan-gce
2020/05/02 04:38 net-next-old 4b4976a6fec5 bc734e7a .config console log report ci-upstream-net-kasan-gce
2020/05/01 18:30 net-next-old 37ecb5b8b8cd bc734e7a .config console log report ci-upstream-net-kasan-gce
2020/05/01 18:21 net-next-old 37ecb5b8b8cd bc734e7a .config console log report ci-upstream-net-kasan-gce
2020/05/01 18:07 net-next-old 37ecb5b8b8cd bc734e7a .config console log report ci-upstream-net-kasan-gce
2020/05/01 18:01 net-next-old 37ecb5b8b8cd bc734e7a .config console log report ci-upstream-net-kasan-gce
2020/05/01 17:30 net-next-old 37ecb5b8b8cd a4d01b80 .config console log report ci-upstream-net-kasan-gce
2020/05/01 14:35 net-next-old 37ecb5b8b8cd a4d01b80 .config console log report ci-upstream-net-kasan-gce
2020/05/01 11:30 net-next-old 37ecb5b8b8cd a4d01b80 .config console log report ci-upstream-net-kasan-gce
2020/05/01 06:23 net-next-old 37ecb5b8b8cd a4d01b80 .config console log report ci-upstream-net-kasan-gce
2020/05/01 06:18 net-next-old 37ecb5b8b8cd a4d01b80 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.