syzbot


BUG: unable to handle kernel paging request in fd_array_map_delete_elem

Status: fixed on 2018/01/22 13:19
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+0d363c942452cca68c01@syzkaller.appspotmail.com
Fix commit: bbeb6e4323da bpf, array: fix overflow in max_entries and undefined behavior in index_mask
First crash: 2291d, last: 2284d
Discussions (6)
Title Replies (including bot) Last reply
[PATCH 4.4 00/87] 4.4.112-stable review 103 (103) 2018/02/14 16:43
[PATCH 4.9 00/96] 4.9.77-stable review 111 (111) 2018/01/21 16:03
[PATCH 4.14 000/118] 4.14.14-stable review 139 (139) 2018/01/16 20:50
[PATCH 4.4-stable 0/6] bpf: prevent out-of-bounds speculation 11 (11) 2018/01/13 19:49
[PATCH bpf] bpf, array: fix overflow in max_entries and undefined behavior in index_mask 2 (2) 2018/01/10 22:58
BUG: unable to handle kernel paging request in fd_array_map_delete_elem 0 (1) 2018/01/10 13:17

Sample crash report:
BUG: unable to handle kernel paging request at ffff8804586031b8
IP: fd_array_map_delete_elem+0x7b/0x110 kernel/bpf/arraymap.c:418
PGD 890a067 P4D 890a067 PUD 0 
Oops: 0002 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 21038 Comm: syz-executor2 Not tainted 4.15.0-rc7+ #192
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:fd_array_map_delete_elem+0x7b/0x110 kernel/bpf/arraymap.c:418
RSP: 0018:ffff8801c274f8a0 EFLAGS: 00010246
RAX: 0000000052e18755 RBX: ffff8801c153f640 RCX: ffffffff8181a675
RDX: 00000000000000d9 RSI: ffffc90003d30000 RDI: ffff8801c153f664
RBP: ffff8801c274f8b0 R08: 1ffff100384e9e59 R09: 0000000000000002
R10: ffffffff817e8b21 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8801c636ba41 R14: ffff8801c274ff20 R15: ffff8801d9a14540
FS:  00007fbf30851700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8804586031b8 CR3: 00000001d811c001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 map_delete_elem kernel/bpf/syscall.c:737 [inline]
 SYSC_bpf kernel/bpf/syscall.c:1814 [inline]
 SyS_bpf+0x22ea/0x4400 kernel/bpf/syscall.c:1782
 entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x452df9
RSP: 002b:00007fbf30850c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fbf30851700 RCX: 0000000000452df9
RDX: 0000000000000010 RSI: 000000002007d000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000
R13: 0000000000a2f7ef R14: 00007fbf308519c0 R15: 0000000000000000
Code: fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 6c 44 39 63 24 76 7a e8 8b 77 ee ff 44 89 e0 45 31 e4 <4c> 87 a4 c3 d0 00 00 00 4d 85 e4 74 69 e8 73 77 ee ff 48 89 da 
RIP: fd_array_map_delete_elem+0x7b/0x110 kernel/bpf/arraymap.c:418 RSP: ffff8801c274f8a0
CR2: ffff8804586031b8
---[ end trace 72ae92eb49c8503e ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/16 22:43 net-next-old e02f08a07098 a46e5318 .config console log report ci-upstream-net-kasan-gce
2018/01/16 19:20 net-next-old 79d891c1bbb6 4198e588 .config console log report ci-upstream-net-kasan-gce
2018/01/16 03:10 net-next-old 594831a8aba3 e17f4a5d .config console log report ci-upstream-net-kasan-gce
2018/01/15 18:39 net-next-old 564737f981fb 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/15 13:59 net-next-old 564737f981fb 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/14 19:38 net-next-old 1988c7957881 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/14 11:47 net-next-old 6bd39bc3da0f c9e7aeae .config console log report ci-upstream-net-kasan-gce
2018/01/14 05:57 net-next-old 6bd39bc3da0f c9e7aeae .config console log report ci-upstream-net-kasan-gce
2018/01/12 19:26 net-next-old 19d28fbd306e 9dc808a6 .config console log report ci-upstream-net-kasan-gce
2018/01/11 09:31 linux-next 8418f8876404 02a19b64 .config console log report ci-upstream-next-kasan-gce
2018/01/10 07:50 linux-next b4464bcab38d 1f60c828 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.