syzbot


general protection fault in do_raw_spin_lock

Status: fixed on 2017/11/28 03:36
Subsystems: tipc
[Documentation on labels]
Fix commit: 87b1af8dcc08 net-backports: ipv6: add ip6_null_entry check in rt6_select()
First crash: 2571d, last: 2563d

Sample crash report:
R10: 0000000020265000 R11: 0000000000000212 R12: 00000000004b7550
R13: 00007f8f68700b58 R14: 00000000004b7560 R15: 0000000000000000
Subscriber rejected, no memory
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 10638 Comm: syz-executor4 Not tainted 4.14.0-rc5+ #95
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801c8fdc1c0 task.stack: ffff8801cb5f8000
RIP: 0010:debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]
RIP: 0010:do_raw_spin_lock+0x23/0x1e0 kernel/locking/spinlock_debug.c:112
RSP: 0018:ffff8801cb5ff938 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000c
RBP: ffff8801cb5ff958 R08: ffffffff84beb3ff R09: 0000000000000000
R10: ffff8801cb5ff840 R11: 0000000000000020 R12: dffffc0000000000
R13: 0000000000000001 R14: ffff8801d604d488 R15: 0000000000000040
FS:  00007f8f68701700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020a37fc0 CR3: 00000001c9a54000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
 _raw_spin_lock_bh+0x39/0x40 kernel/locking/spinlock.c:175
 spin_lock_bh include/linux/spinlock.h:321 [inline]
 tipc_subscrb_subscrp_delete+0x8f/0x470 net/tipc/subscr.c:201
 tipc_subscrb_delete net/tipc/subscr.c:238 [inline]
 tipc_subscrb_release_cb+0x17/0x30 net/tipc/subscr.c:316
 tipc_close_conn+0x171/0x270 net/tipc/server.c:204
 tipc_topsrv_kern_subscr+0x724/0x810 net/tipc/server.c:514
 tipc_group_create+0x702/0x9c0 net/tipc/group.c:184
 tipc_sk_join net/tipc/socket.c:2747 [inline]
 tipc_setsockopt+0x249/0xc10 net/tipc/socket.c:2861
 SYSC_setsockopt net/socket.c:1852 [inline]
 SyS_setsockopt+0x189/0x360 net/socket.c:1831
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x452869
RSP: 002b:00007f8f68700be8 EFLAGS: 00000212 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452869
RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000013
RBP: 00007f8f68700a20 R08: 000000000000001c R09: 0000000000000000
R10: 0000000020265000 R11: 0000000000000212 R12: 00000000004b7550
R13: 00007f8f68700b58 R14: 00000000004b7560 R15: 0000000000000000
Code: 0f 1f 84 00 00 00 00 00 55 48 b8 00 00 00 00 00 fc ff df 48 89 e5 41 56 41 55 41 54 53 48 89 fb 48 83 c7 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 
RIP: debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline] RSP: ffff8801cb5ff938
RIP: do_raw_spin_lock+0x23/0x1e0 kernel/locking/spinlock_debug.c:112 RSP: ffff8801cb5ff938
---[ end trace f0232e906a5d0f7f ]---
Kernel panic - not syncing: Fatal exception in interrupt
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/10/26 22:13 net-next-old 3fc27b71b894 0a4d6e56 .config console log report ci-upstream-net-kasan-gce
2017/10/24 03:24 net-next-old 058c8d591241 92f543f0 .config console log report ci-upstream-net-kasan-gce
2017/10/23 22:05 net-next-old 058c8d591241 92f543f0 .config console log report ci-upstream-net-kasan-gce
2017/10/23 21:46 net-next-old 058c8d591241 92f543f0 .config console log report ci-upstream-net-kasan-gce
2017/10/22 18:40 net-next-old f8ddadc4db6c ab829b1b .config console log report ci-upstream-net-kasan-gce
2017/10/21 09:05 net-next-old 7f9ad2ace17a 4d9c0713 .config console log report ci-upstream-net-kasan-gce
2017/10/20 14:04 net-next-old d18b4b35e310 4d9c0713 .config console log report ci-upstream-net-kasan-gce
2017/10/18 21:09 net-next-old b9f1f1ce866c fe864987 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.