syzbot

 sign-in | mailing list | source | docs
🐞 Open [982] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12500] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

WARNING in bpf_raw_tp_link_fill_link_info

Status: fixed on 2020/11/16 12:12
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+976d5ecfab0c7eb43ac3@syzkaller.appspotmail.com
Fix commit: b474959d5afd bpf: Fix a buffer out-of-bound access when filling raw_tp link_info
First crash: 1323d, last: 1308d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
WARNING in bpf_raw_tp_link_fill_link_info 2 (3) 2020/10/30 10:09
[PATCH] Using a pointer and kzalloc in place of a struct directly 6 (6) 2020/09/13 11:49
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2020/09/12 16:54 9m dragonjetli@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master report log
2020/09/11 03:46 16m anant.thazhemadam@gmail.com patch https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master OK
2020/09/10 14:17 10m anant.thazhemadam@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master report log
2020/09/10 14:11 10m anant.thazhemadam@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git 7fb5eefd76394cfefb380724a87ca40b47d44405 report log

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6854 at include/linux/thread_info.h:150 check_copy_size include/linux/thread_info.h:150 [inline]
WARNING: CPU: 0 PID: 6854 at include/linux/thread_info.h:150 copy_to_user include/linux/uaccess.h:167 [inline]
WARNING: CPU: 0 PID: 6854 at include/linux/thread_info.h:150 bpf_raw_tp_link_fill_link_info+0x306/0x350 kernel/bpf/syscall.c:2661
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 6854 Comm: syz-executor574 Not tainted 5.9.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:231
 __warn.cold+0x20/0x4a kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:check_copy_size include/linux/thread_info.h:150 [inline]
RIP: 0010:copy_to_user include/linux/uaccess.h:167 [inline]
RIP: 0010:bpf_raw_tp_link_fill_link_info+0x306/0x350 kernel/bpf/syscall.c:2661
Code: 41 bc ea ff ff ff e9 35 ff ff ff 4c 89 ff e8 41 66 33 00 e9 d0 fd ff ff 4c 89 ff e8 a4 66 33 00 e9 06 ff ff ff e8 ca ed f2 ff <0f> 0b eb 94 48 89 ef e8 2e 66 33 00 e9 65 fd ff ff e8 24 66 33 00
RSP: 0018:ffffc900051c7bd0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffc900051c7c60 RCX: ffffffff818179d6
RDX: ffff88808b490000 RSI: ffffffff81817a96 RDI: 0000000000000006
RBP: 0000000000000019 R08: 0000000000000000 R09: ffffc900051c7c7f
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000019
R13: 0000000000001265 R14: ffffffff8986ecc0 R15: ffffc900051c7c78
 bpf_link_get_info_by_fd kernel/bpf/syscall.c:3626 [inline]
 bpf_obj_get_info_by_fd+0x43a/0xc40 kernel/bpf/syscall.c:3664
 __do_sys_bpf+0x1906/0x4b30 kernel/bpf/syscall.c:4237
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4405f9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff47155808 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004405f9
RDX: 0000000000000010 RSI: 00000000200000c0 RDI: 000000000000000f
RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401e00
R13: 0000000000401e90 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (56):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/09/10 02:43 bpf-next 7fb5eefd7639 409809d8 .config console log report syz C ci-upstream-bpf-next-kasan-gce
2020/09/24 19:12 bpf-next 0789e13bc3f8 54289b08 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/24 17:49 bpf-next 0789e13bc3f8 54289b08 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/24 01:23 bpf-next a8a717963fe5 287cd75a .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/23 18:08 bpf-next a8a717963fe5 287cd75a .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/23 16:05 bpf-next a8a717963fe5 287cd75a .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/23 09:57 bpf-next a8a717963fe5 3e8f6c27 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/23 08:18 bpf-next a8a717963fe5 3e8f6c27 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/22 18:58 bpf-next a8a717963fe5 3e8f6c27 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/22 07:56 bpf-next 31f23a6a181c 9e1fa68e .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/21 10:58 bpf-next 70b971118e07 9e1fa68e .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/21 08:40 bpf-next 70b971118e07 9564d2e9 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/21 08:20 bpf-next 70b971118e07 9564d2e9 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/20 23:10 bpf-next 70b971118e07 9564d2e9 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/20 17:37 bpf-next 70b971118e07 9564d2e9 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/20 14:12 bpf-next 70b971118e07 9564d2e9 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/20 01:30 bpf-next 70b971118e07 53ce8104 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/19 23:54 bpf-next 70b971118e07 53ce8104 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/19 03:39 bpf-next b6ed6cf4a3ac 53ce8104 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/18 17:55 bpf-next 3b0379111197 38962c8b .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/18 16:34 bpf-next 3b0379111197 38962c8b .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/18 12:30 bpf-next 3b0379111197 38962c8b .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/18 10:28 bpf-next 3b0379111197 38962c8b .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/18 00:39 bpf-next c64779e24e88 8247808b .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/16 16:12 bpf-next ffa915f46193 18d7d030 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/15 19:30 bpf-next d317b0a8acfc 6989d6f6 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/15 14:54 bpf-next d317b0a8acfc 6989d6f6 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/15 14:24 bpf-next d317b0a8acfc 6989d6f6 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/09/13 22:01 bpf-next 2bab48c5bef0 2d3cdd63 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/13 02:00 bpf-next 2bab48c5bef0 ce441f06 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/13 01:41 bpf-next 2bab48c5bef0 ce441f06 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/13 01:32 bpf-next 2bab48c5bef0 ce441f06 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/13 01:32 bpf-next 2bab48c5bef0 ce441f06 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/11 14:54 bpf-next 18841da98100 adfb8b4e .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/11 14:33 bpf-next 18841da98100 adfb8b4e .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/11 04:19 bpf-next 8081ede1f731 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/11 04:09 bpf-next 8081ede1f731 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 22:19 bpf-next 8081ede1f731 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 22:15 bpf-next 8081ede1f731 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 16:06 bpf-next 8081ede1f731 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 16:01 bpf-next 8081ede1f731 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 16:01 bpf-next 8081ede1f731 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 12:45 bpf-next 7fb5eefd7639 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 12:43 bpf-next 7fb5eefd7639 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 08:27 bpf-next 7fb5eefd7639 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 08:26 bpf-next 7fb5eefd7639 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 05:10 bpf-next 7fb5eefd7639 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 02:42 bpf-next 7fb5eefd7639 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 02:42 bpf-next 7fb5eefd7639 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
2020/09/10 02:23 bpf-next 7fb5eefd7639 409809d8 .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.