syzbot


general protection fault in btf_struct_resolve

Status: fixed on 2019/08/05 13:45
Subsystems: bpf
[Documentation on labels]
Fix commit: e4f07120210a bpf: fix NULL deref in btf_type_is_resolve_source_only
First crash: 1624d, last: 1601d
Cause bisection: failed (error log, bisect log)
  

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8062 Comm: syz-executor120 Not tainted 5.2.0-rc5+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:btf_type_is_var kernel/bpf/btf.c:392 [inline]
RIP: 0010:btf_type_is_resolve_source_only kernel/bpf/btf.c:405 [inline]
RIP: 0010:btf_struct_resolve+0x42d/0xfc0 kernel/bpf/btf.c:2173
Code: e8 03 42 80 3c 28 00 4d 89 e7 74 08 48 89 df e8 a9 5b 25 00 4c 8b 23 49 8d 5c 24 04 48 89 d8 48 c1 e8 03 48 89 85 68 ff ff ff <42> 0f b6 04 28 84 c0 48 8b 55 c8 0f 85 19 04 00 00 4c 8d 6a fc 48
RSP: 0018:ffff88809b8675f0 EFLAGS: 00010247
RAX: 0000000000000000 RBX: 0000000000000004 RCX: ffff88809d5b25c0
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000001
RBP: ffff88809b867690 R08: ffffffff81897f28 R09: fffffbfff1178ed9
R10: fffffbfff1178ed9 R11: 1ffffffff1178ed8 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8880a8e180c0 R15: ffff88809aa84ac0
FS:  00005555566b8880(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000100 CR3: 00000000a8495000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 btf_resolve+0x3ed/0xda0 kernel/bpf/btf.c:3037
 btf_check_all_types kernel/bpf/btf.c:3076 [inline]
 btf_parse_type_sec kernel/bpf/btf.c:3117 [inline]
 btf_parse kernel/bpf/btf.c:3346 [inline]
 btf_new_fd+0x216a/0x37b0 kernel/bpf/btf.c:3394
 bpf_btf_load kernel/bpf/syscall.c:2630 [inline]
 __do_sys_bpf+0x1212/0xc5d0 kernel/bpf/syscall.c:2854
 __se_sys_bpf kernel/bpf/syscall.c:2772 [inline]
 __x64_sys_bpf+0x7a/0x90 kernel/bpf/syscall.c:2772
 do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4401f9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffe267d07b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004401f9
RDX: 0000000000000020 RSI: 0000000020000100 RDI: 0000000000000012
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000401a80
R13: 0000000000401b10 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace b2ff400ac9e08111 ]---
RIP: 0010:btf_type_is_var kernel/bpf/btf.c:392 [inline]
RIP: 0010:btf_type_is_resolve_source_only kernel/bpf/btf.c:405 [inline]
RIP: 0010:btf_struct_resolve+0x42d/0xfc0 kernel/bpf/btf.c:2173
Code: e8 03 42 80 3c 28 00 4d 89 e7 74 08 48 89 df e8 a9 5b 25 00 4c 8b 23 49 8d 5c 24 04 48 89 d8 48 c1 e8 03 48 89 85 68 ff ff ff <42> 0f b6 04 28 84 c0 48 8b 55 c8 0f 85 19 04 00 00 4c 8d 6a fc 48
RSP: 0018:ffff88809b8675f0 EFLAGS: 00010247
RAX: 0000000000000000 RBX: 0000000000000004 RCX: ffff88809d5b25c0
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000001
RBP: ffff88809b867690 R08: ffffffff81897f28 R09: fffffbfff1178ed9
R10: fffffbfff1178ed9 R11: 1ffffffff1178ed8 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8880a8e180c0 R15: ffff88809aa84ac0
FS:  00005555566b8880(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000100 CR3: 00000000a8495000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (49):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/19 08:25 upstream bed3c0d84e7e 34bf9440 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/07/12 00:56 upstream 5450e8a316a6 186a30b9 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/06 22:25 upstream 69bf4b6b54fb f62e1e85 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/04 10:48 upstream 550d1f5bda33 55565fa0 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/03 03:13 upstream 6fbc7275c7a9 55565fa0 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 22:14 upstream 6fbc7275c7a9 907bf746 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 17:46 upstream 6fbc7275c7a9 907bf746 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 17:44 upstream 6fbc7275c7a9 907bf746 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 09:32 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 09:30 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 09:30 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 01:16 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 16:35 upstream 6fbc7275c7a9 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 04:45 upstream 728254541ebc 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 03:04 upstream 728254541ebc 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 01:57 upstream 728254541ebc 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 20:27 upstream 01305db842e1 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 12:02 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 12:00 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 07:32 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/26 14:57 upstream 249155c20f9b 4d342240 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/26 00:56 upstream 249155c20f9b 0a8d1a96 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/25 21:51 upstream 249155c20f9b 0a8d1a96 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/25 21:49 upstream 249155c20f9b 0a8d1a96 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/25 20:22 upstream 249155c20f9b 0a8d1a96 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/25 07:50 upstream 4b972a01a7da 82c13b6b .config console log report ci-upstream-kasan-gce-smack-root
2019/06/25 07:13 upstream 4b972a01a7da 82c13b6b .config console log report ci-upstream-kasan-gce-smack-root
2019/06/25 00:36 upstream 4b972a01a7da 82c13b6b .config console log report ci-upstream-kasan-gce-smack-root
2019/06/24 17:46 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/24 02:39 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/24 02:33 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/24 02:30 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/23 19:07 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/23 17:56 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/23 17:52 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/22 19:38 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/22 19:34 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/22 19:32 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/22 02:11 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/22 01:40 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/21 21:41 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/21 21:39 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/19 07:35 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/19 07:24 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/19 07:20 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/19 07:17 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.