syzbot


kernel BUG at ./include/linux/skbuff.h:LINE! (2)

Status: fixed on 2018/04/06 16:37
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+91e6f9932ff122fa4410@syzkaller.appspotmail.com
Fix commit: 10b8a3de603d ipv6: the entire IPv6 header chain must fit the first fragment
First crash: 2246d, last: 2242d
Discussions (9)
Title Replies (including bot) Last reply
[PATCH 3.16 000/410] 3.16.57-rc1 review 426 (426) 2018/11/12 17:42
[PATCH 4.9 000/310] 4.9.94-stable review 325 (325) 2018/07/12 06:27
[PATCH 4.4 000/190] 4.4.128-stable review 216 (216) 2018/05/17 21:08
[PATCH 3.18 000/121] 3.18.105-stable review 128 (128) 2018/04/12 16:54
[PATCH 4.15 000/168] 4.15.17-stable review 174 (174) 2018/04/11 19:33
[PATCH 4.14 000/138] 4.14.34-stable review 148 (148) 2018/04/11 19:19
[PATCH net v2] ipv6: the entire IPv6 header chain must fit the first fragment 3 (3) 2018/03/26 01:18
[PATCH net] ipv6: the entire IPv6 header chain must fit the first fragment 2 (2) 2018/03/23 13:24
kernel BUG at ./include/linux/skbuff.h:LINE! (2) 0 (1) 2018/03/22 23:00
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 kernel BUG at ./include/linux/skbuff.h:LINE! syz 27 1689d 1714d 0/1 public: reported syz repro on 2019/08/10 08:48
linux-4.14 kernel BUG at ./include/linux/skbuff.h:LINE! C done 16 1689d 1714d 1/1 fixed on 2019/12/05 10:31
android-49 kernel BUG at ./include/linux/skbuff.h:LINE! C 3 2246d 2400d 0/3 closed as invalid on 2019/03/06 00:11
upstream kernel BUG at ./include/linux/skbuff.h:LINE! net C 4502 2284d 2297d 4/26 fixed on 2018/01/22 13:19
android-49 kernel BUG at ./include/linux/skbuff.h:LINE! (2) syz 16 1689d 1708d 0/3 public: reported syz repro on 2019/08/16 10:13

Sample crash report:
audit: type=1400 audit(1519836182.953:6): avc:  denied  { map } for  pid=4237 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
audit: type=1400 audit(1519836189.261:7): avc:  denied  { map } for  pid=4251 comm="syzkaller092998" path="/root/syzkaller092998485" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
------------[ cut here ]------------
kernel BUG at ./include/linux/skbuff.h:2073!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4251 Comm: syzkaller092998 Not tainted 4.16.0-rc3+ #332
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__skb_pull include/linux/skbuff.h:2073 [inline]
RIP: 0010:__ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636
RSP: 0018:ffff8801c381f1f0 EFLAGS: 00010293
RAX: ffff8801ae58a180 RBX: 00000000000006e0 RCX: ffffffff84efbde8
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801b1243d18
RBP: ffff8801c381f460 R08: ffff8801b0c19b04 R09: 0000000000000000
R10: ffff8801c381f480 R11: fd676b049aac0ae7 R12: 00000000000005a1
R13: ffff8801b1243840 R14: dffffc0000000000 R15: ffff8801b0c19a80
FS:  00000000006d1880(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000280 CR3: 00000001ca0ff005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ip6_finish_skb include/net/ipv6.h:969 [inline]
 udp_v6_push_pending_frames+0x269/0x3b0 net/ipv6/udp.c:1073
 udpv6_sendmsg+0x2a96/0x3400 net/ipv6/udp.c:1343
 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764
 sock_sendmsg_nosec net/socket.c:630 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:640
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2046
 __sys_sendmsg+0xe5/0x210 net/socket.c:2080
 SYSC_sendmsg net/socket.c:2091 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2087
 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4402a9
RSP: 002b:00007ffcbb6929c8 EFLAGS: 00000217 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0100000000000000 RCX: 00000000004402a9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000217 R12: 0000000000401bd0
R13: 0000000000401c60 R14: 0000000000000000 R15: 0000000000000000
Code: ff e8 6d 74 b9 fc e9 15 e9 ff ff e8 63 74 b9 fc e9 44 e8 ff ff e8 79 74 b9 fc e9 c0 e6 ff ff e8 5f 36 81 fc 0f 0b e8 58 36 81 fc <0f> 0b 49 8d 87 80 00 00 00 4d 8d 87 84 00 00 00 48 89 85 20 fe 
RIP: __skb_pull include/linux/skbuff.h:2073 [inline] RSP: ffff8801c381f1f0
RIP: __ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636 RSP: ffff8801c381f1f0
---[ end trace 07ff165e0714390f ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/02/28 16:45 upstream f3afe530d644 05b5a32c .config console log report syz C ci-upstream-kasan-gce
2018/02/24 09:01 upstream 938e1426e262 5c1e0207 .config console log report syz C ci-upstream-kasan-gce
2018/02/28 15:46 net-next-old fb66cb077560 05b5a32c .config console log report syz C ci-upstream-net-kasan-gce
2018/02/24 09:01 net-next-old 1b71af6053af 5c1e0207 .config console log report syz C ci-upstream-net-kasan-gce
2018/02/24 08:58 upstream 938e1426e262 5c1e0207 .config console log report syz ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.