syzbot


general protection fault in tcf_ife_cleanup

Status: fixed on 2020/02/18 14:31
Subsystems: net
[Documentation on labels]
Fix commit: 44c23d71599f net/sched: act_ife: initalize ife->metalist earlier
First crash: 1614d, last: 1591d
Cause bisection: introduced by (bisect log) :
commit 11a94d7fd80f92325e7b8653290ad3d2cd67f119
Author: Davide Caratti <dcaratti@redhat.com>
Date: Wed Mar 20 14:00:03 2019 +0000

  net/sched: act_ife: validate the control action inside init()

Crash: general protection fault in tcf_ife_cleanup (log)
Repro: C syz .config
  

Sample crash report:
netlink: 4 bytes leftover after parsing attributes in process `syz-executor562'.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9471 Comm: syz-executor562 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:_tcf_ife_cleanup net/sched/act_ife.c:412 [inline]
RIP: 0010:tcf_ife_cleanup+0x6e/0x400 net/sched/act_ife.c:431
Code: 48 c1 ea 03 80 3c 02 00 0f 85 94 03 00 00 49 8b bd f8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 67 e8 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5c 03 00 00 48 bb 00 00 00 00 00 fc ff df 48 8b
RSP: 0018:ffffc90001d96d00 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffffff864619c0 RCX: ffffffff815bfa09
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000
RBP: ffffc90001d96d50 R08: 0000000000000004 R09: fffff520003b2d8e
R10: fffff520003b2d8d R11: 0000000000000003 R12: ffffffffffffffe8
R13: ffff8880a02b3000 R14: ffff888215750e00 R15: 0000000000000000
FS:  0000000001959880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007300 CR3: 0000000091b4e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 tcf_action_cleanup+0x62/0x1b0 net/sched/act_api.c:119
 __tcf_action_put+0xfa/0x130 net/sched/act_api.c:135
 __tcf_idr_release net/sched/act_api.c:165 [inline]
 __tcf_idr_release+0x59/0xf0 net/sched/act_api.c:145
 tcf_idr_release include/net/act_api.h:171 [inline]
 tcf_ife_init+0x97c/0x1870 net/sched/act_ife.c:616
 tcf_action_init_1+0x6b6/0xa40 net/sched/act_api.c:944
 tcf_action_init+0x21a/0x330 net/sched/act_api.c:1000
 tcf_action_add+0xf5/0x3b0 net/sched/act_api.c:1410
 tc_ctl_action+0x390/0x488 net/sched/act_api.c:1465
 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5424
 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x58c/0x7d0 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:639 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:659
 ____sys_sendmsg+0x753/0x880 net/socket.c:2330
 ___sys_sendmsg+0x100/0x170 net/socket.c:2384
 __sys_sendmsg+0x105/0x1d0 net/socket.c:2417
 __do_sys_sendmsg net/socket.c:2426 [inline]
 __se_sys_sendmsg net/socket.c:2424 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2424
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440269
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcfbb19958 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269
RDX: 0000000000000000 RSI: 0000000020007300 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401af0
R13: 0000000000401b80 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace bfbcb87e693573ca ]---
RIP: 0010:_tcf_ife_cleanup net/sched/act_ife.c:412 [inline]
RIP: 0010:tcf_ife_cleanup+0x6e/0x400 net/sched/act_ife.c:431
Code: 48 c1 ea 03 80 3c 02 00 0f 85 94 03 00 00 49 8b bd f8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 67 e8 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5c 03 00 00 48 bb 00 00 00 00 00 fc ff df 48 8b
RSP: 0018:ffffc90001d96d00 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffffff864619c0 RCX: ffffffff815bfa09
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000
RBP: ffffc90001d96d50 R08: 0000000000000004 R09: fffff520003b2d8e
R10: fffff520003b2d8d R11: 0000000000000003 R12: ffffffffffffffe8
R13: ffff8880a02b3000 R14: ffff888215750e00 R15: 0000000000000000
FS:  0000000001959880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007300 CR3: 0000000091b4e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (111):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/11 10:28 upstream e69ec487b2c7 4de4e9f0 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/11 07:36 upstream e69ec487b2c7 4de4e9f0 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/11 08:04 net-old e267371dd376 4de4e9f0 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/01/11 08:00 net-next-old 9f120e7659b0 4de4e9f0 .config console log report syz C ci-upstream-net-kasan-gce
2020/01/19 18:39 upstream 8f8972a3127f 0342f8c7 .config console log report ci-upstream-kasan-gce-root
2020/01/19 10:07 upstream 244dc2689085 bc8bc756 .config console log report ci-upstream-kasan-gce-root
2020/01/19 03:25 upstream 244dc2689085 bc8bc756 .config console log report ci-upstream-kasan-gce-selinux-root
2020/01/18 13:23 upstream 25e73aadf297 3de7aabb .config console log report ci-upstream-kasan-gce-smack-root
2020/01/18 02:58 upstream ab7541c3addd 3de7aabb .config console log report ci-upstream-kasan-gce-smack-root
2020/01/17 02:45 upstream f5ae2ea6347a 3de7aabb .config console log report ci-upstream-kasan-gce-root
2020/01/17 02:44 upstream f5ae2ea6347a 3de7aabb .config console log report ci-upstream-kasan-gce-smack-root
2020/01/17 02:43 upstream f5ae2ea6347a 3de7aabb .config console log report ci-upstream-kasan-gce-smack-root
2020/01/17 02:43 upstream f5ae2ea6347a 3de7aabb .config console log report ci-upstream-kasan-gce-smack-root
2020/01/17 02:43 upstream f5ae2ea6347a 3de7aabb .config console log report ci-upstream-kasan-gce-selinux-root
2020/01/17 02:43 upstream f5ae2ea6347a 3de7aabb .config console log report ci-upstream-kasan-gce-selinux-root
2020/01/11 07:10 upstream e69ec487b2c7 4de4e9f0 .config console log report ci-upstream-kasan-gce-selinux-root
2020/01/17 19:48 net-old 93ad0f969fc7 3de7aabb .config console log report ci-upstream-net-this-kasan-gce
2020/01/17 14:13 net-old 93ad0f969fc7 3de7aabb .config console log report ci-upstream-net-this-kasan-gce
2020/01/17 02:31 net-old 567110f147b3 3de7aabb .config console log report ci-upstream-net-this-kasan-gce
2020/01/20 03:47 net-next-old 7f013edebaa4 0342f8c7 .config console log report ci-upstream-net-kasan-gce
2020/01/20 02:44 net-next-old 7f013edebaa4 0342f8c7 .config console log report ci-upstream-net-kasan-gce
2020/01/20 01:26 net-next-old 7f013edebaa4 0342f8c7 .config console log report ci-upstream-net-kasan-gce
2020/01/19 22:35 net-next-old 7f013edebaa4 0342f8c7 .config console log report ci-upstream-net-kasan-gce
2020/01/19 14:07 net-next-old 9aaa29494030 bc8bc756 .config console log report ci-upstream-net-kasan-gce
2020/01/19 09:47 net-next-old 9aaa29494030 bc8bc756 .config console log report ci-upstream-net-kasan-gce
2020/01/18 22:16 net-next-old 9aaa29494030 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/18 17:20 net-next-old 56f200c78ce4 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/18 14:26 net-next-old 56f200c78ce4 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/18 12:06 net-next-old 56f200c78ce4 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/18 11:01 net-next-old 56f200c78ce4 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/18 08:22 net-next-old 56f200c78ce4 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/18 05:16 net-next-old 56f200c78ce4 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/17 18:30 net-next-old 6bc803803526 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/17 11:14 net-next-old 6bc803803526 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/17 02:42 net-next-old 1ccf6c13d9c7 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/01/17 02:35 net-next-old 1ccf6c13d9c7 3de7aabb .config console log report ci-upstream-net-kasan-gce
2020/02/04 03:08 linux-next 2747d5fdab78 93e5e335 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/02/03 15:44 linux-next 2747d5fdab78 93e5e335 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/02/03 11:40 linux-next 2747d5fdab78 93e5e335 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/02/02 03:52 linux-next 2747d5fdab78 2274ad39 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/02/01 01:59 linux-next 2747d5fdab78 c30117b2 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/31 17:35 linux-next 2747d5fdab78 5ed23f9a .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/31 13:46 linux-next 2747d5fdab78 5ed23f9a .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/31 06:58 linux-next 2747d5fdab78 5ed23f9a .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/31 06:58 linux-next 2747d5fdab78 5ed23f9a .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/30 07:31 linux-next 2747d5fdab78 5ed23f9a .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/28 11:27 linux-next 2747d5fdab78 56cd6c9b .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/28 01:45 linux-next 2747d5fdab78 56cd6c9b .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/27 01:36 linux-next 2747d5fdab78 dd56146d .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/23 12:08 linux-next 2747d5fdab78 3334d684 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/01/20 21:57 linux-next 2747d5fdab78 d2557fb5 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.