syzbot


BUG: unable to handle kernel paging request in netdev_queue_update_kobjects

Status: fixed on 2018/04/06 16:37
Subsystems: net
[Documentation on labels]
Fix commit: c769accdf3d8 vlan: Fix vlan insertion for packets without ethernet header
First crash: 2221d, last: 2221d

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
BUG: unable to handle kernel paging request at 00006801db30e000
kasan: CONFIG_KASAN_INLINE enabled
IP: netdev_queue_update_kobjects+0x35e/0x480 net/core/net-sysfs.c:1359
kasan: GPF could be caused by NULL-ptr deref or user memory access
PGD 0 P4D 0 
Oops: 0002 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4421 Comm: syz-executor5 Not tainted 4.16.0-rc7+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:netdev_queue_update_kobjects+0x35e/0x480 net/core/net-sysfs.c:1359
RSP: 0018:ffff8801b0df73f8 EFLAGS: 00010202
RAX: 0000e0000000e000 RBX: 0000000000000001 RCX: ffffffff8667fafc
RDX: 0000000000000000 RSI: 1ffff100361d3178 RDI: ffff8801b20306b8
RBP: ffff8801b0df74c8 R08: 1ffff100361bee2f R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801b2030180
R13: dffffc0000000000 R14: ffff8801b2030180 R15: ffff8801b22e3800
FS:  000000000107d940(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00006801db30e000 CR3: 00000001b58e5002 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 register_queue_kobjects net/core/net-sysfs.c:1402 [inline]
 netdev_register_kobject+0x2bd/0x360 net/core/net-sysfs.c:1608
 register_netdevice+0xb41/0x1020 net/core/dev.c:7900
 register_netdev+0x1a/0x30 net/core/dev.c:8014
 sit_init_net+0x384/0xa70 net/ipv6/sit.c:1852
 ops_init+0x10a/0x570 net/core/net_namespace.c:118
 setup_net+0x351/0x760 net/core/net_namespace.c:302
 copy_net_ns+0x238/0x580 net/core/net_namespace.c:426
 create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107
 unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
 SYSC_unshare kernel/fork.c:2407 [inline]
 SyS_unshare+0x653/0xfa0 kernel/fork.c:2357
 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457327
RSP: 002b:00007fffb889eb38 EFLAGS: 00000206 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000457327
RDX: 0000000000000000 RSI: 00007fffb889eb10 RDI: 0000000040000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000410710
R13: 00000000004107a0 R14: 0000000000000000 R15: 0000000000000000
Code: 38 05 00 00 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 8f 00 00 00 49 8b 86 38 05 00 00 83 c3 01 48 81 85 70 ff ff ff 80 01 00 00 <65> ff 00 39 9d 48 ff ff ff 0f 85 66 fd ff ff 41 89 d7 89 9d 64 
RIP: netdev_queue_update_kobjects+0x35e/0x480 net/core/net-sysfs.c:1359 RSP: ffff8801b0df73f8
CR2: 00006801db30e000
general protection fault: 0000 [#2] SMP KASAN
kasan: CONFIG_KASAN_INLINE enabled
Dumping ftrace buffer:
kasan: GPF could be caused by NULL-ptr deref or user memory access
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 57344 Comm:  Tainted: G      D          4.16.0-rc7+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:188 [inline]
RIP: 0010:get_running_cputimer include/linux/sched/cputime.h:85 [inline]
RIP: 0010:account_group_system_time include/linux/sched/cputime.h:149 [inline]
RIP: 0010:account_system_index_time+0xdd/0x5e0 kernel/sched/cputime.c:172
RSP: 0018:ffff8801db206770 EFLAGS: 00010006
RAX: 0000e0000000e000 RBX: ffff8801b1f7a640 RCX: 00001c0000001c27
RDX: dffffc0000000000 RSI: 00000000000f4240 RDI: 0000e0000000e138
RBP: ffff8801db206850 R08: ffff88021fff801c R09: ffff88021fff8008
R10: ffff8801db206828 R11: ffff88021fff801d R12: 1ffff1003b640cf1
R13: 000000000002c5c0 R14: 00000000000f4240 R15: 0000000000000003
FS:  00007f7a80d0e700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 00000001b0f68002 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 account_system_time+0x7f/0xb0 kernel/sched/cputime.c:203
 account_process_tick+0xd4/0x3e0 kernel/sched/cputime.c:502
 update_process_times+0x23/0x60 kernel/time/timer.c:1634
 tick_sched_handle+0x85/0x160 kernel/time/tick-sched.c:162
 tick_sched_timer+0x42/0x120 kernel/time/tick-sched.c:1194
 __run_hrtimer kernel/time/hrtimer.c:1349 [inline]
 __hrtimer_run_queues+0x39c/0xec0 kernel/time/hrtimer.c:1411
 hrtimer_interrupt+0x2a5/0x6f0 kernel/time/hrtimer.c:1469
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
 smp_apic_timer_interrupt+0x14a/0x700 arch/x86/kernel/apic/apic.c:1050
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
RIP: 0010:__memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43
RSP: 0018:ffff8801db206ef8 EFLAGS: 00010287 ORIG_RAX: ffffffffffffff12
RAX: ffff8801b1e9d044 RBX: fffffffffffffffe RCX: ffffffffffded3b7
RDX: fffffffffffffffe RSI: ffff8801b20afc87 RDI: ffff8801b20afc8b
RBP: ffff8801db206f18 R08: ffff8801b1e9d03e R09: ffffed00363d3a09
R10: 0000000000000001 R11: ffffed00363d3a08 R12: ffff8801b1e9d044
R13: ffff8801b1e9d040 R14: ffff8801b1e9eb06 R15: ffff8801b1e9ea40
 memmove include/linux/string.h:360 [inline]
 skb_reorder_vlan_header net/core/skbuff.c:5031 [inline]
 skb_vlan_untag+0x470/0xc40 net/core/skbuff.c:5061
 __netif_receive_skb_core+0x119c/0x3460 net/core/dev.c:4460
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4627
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4701
 napi_skb_finish net/core/dev.c:5063 [inline]
 napi_gro_receive+0x3d0/0x500 net/core/dev.c:5094
 tun_napi_receive drivers/net/tun.c:283 [inline]
 tun_napi_poll+0x41c/0x980 drivers/net/tun.c:300
 napi_poll net/core/dev.c:5705 [inline]
 net_rx_action+0x792/0x1910 net/core/dev.c:5771
 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1040
 </IRQ>
Code: ea 03 80 3c 02 00 0f 85 8b 04 00 00 48 8b 83 f8 06 00 00 48 ba 00 00 00 00 00 fc ff df 48 8d b8 38 01 00 00 48 89 f9 48 c1 e9 03 <0f> b6 14 11 48 89 f9 83 e1 07 38 ca 7f 08 84 d2 0f 85 90 03 00 
RIP: __read_once_size include/linux/compiler.h:188 [inline] RSP: ffff8801db206770
RIP: get_running_cputimer include/linux/sched/cputime.h:85 [inline] RSP: ffff8801db206770
RIP: account_group_system_time include/linux/sched/cputime.h:149 [inline] RSP: ffff8801db206770
RIP: account_system_index_time+0xdd/0x5e0 kernel/sched/cputime.c:172 RSP: ffff8801db206770
---[ end trace 37202dec1c30dfaa ]---
general protection fault: 0000 [#3] SMP KASAN

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/03/27 03:02 upstream 3eb2ce825ea1 0ca7878b .config console log report syz ci-upstream-kasan-gce-root
* Struck through repros no longer work on HEAD.