syzbot


BUG: unable to handle kernel NULL pointer dereference in unix_stream_sendmsg

Status: fixed on 2024/04/02 10:57
Subsystems: bpf net
[Documentation on labels]
Fix commit: 4cd12c6065df bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()
First crash: 60d, last: 60d

Sample crash report:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000086000006
  EC = 0x21: IABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010ad64000
[0000000000000000] pgd=080000011ac19003, p4d=080000011ac19003, pud=0800000112fd8003, pmd=0000000000000000
Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 6497 Comm: syz-executor693 Tainted: G    B              6.8.0-rc5-syzkaller-g9abbc24128bc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : sk_psock_verdict_data_ready+0x298/0x598 net/core/skmsg.c:1230
sp : ffff8000979d7760
x29: ffff8000979d7760 x28: 0000000000000001 x27: 0000000000000000
x26: ffff8000979d7c64 x25: ffff700012f3af08 x24: 0000000000000000
x23: ffff0000de488600 x22: dfff800000000000 x21: ffff0000db4cb005
x20: ffff0000db4cb2e0 x19: ffff0000db376800 x18: 1fffe0001b66ed7e
x17: 0000000000000000 x16: ffff800080528d4c x15: 0000000000000001
x14: 00000000ffff8000 x13: 00000000cd6b674e x12: ffff8000979d7640
x11: ffff800080324180 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff80008906de5c
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000000 x1 : ffff0000db4cb000 x0 : ffff0000db376800
Call trace:
 0x0
 unix_stream_sendmsg+0x564/0xb60 net/unix/af_unix.c:2291
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x56c/0x840 net/socket.c:2584
 ___sys_sendmsg net/socket.c:2638 [inline]
 __sys_sendmsg+0x26c/0x33c net/socket.c:2667
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2674
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Code: ???????? ???????? ???????? ???????? (????????) 
---[ end trace 0000000000000000 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/02/27 02:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9abbc24128bc edd6a5e9 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in unix_stream_sendmsg
* Struck through repros no longer work on HEAD.