syzbot


UBSAN: shift-out-of-bounds in cbq_dequeue

Status: fixed on 2021/03/10 01:48
Subsystems: net
[Documentation on labels]
Fix commit: e4bedf48aaa5 net_sched: reject silly cell_log in qdisc_get_rtab()
First crash: 1197d, last: 1153d
Cause bisection: introduced by (bisect log) [merge commit]:
commit 1c4c5e2528af0c803fb1171632074f4070229a75
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat Sep 14 19:08:19 2019 +0000

  Merge tag 'mmc-v5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Crash: general protection fault in batadv_iv_ogm_queue_add (log)
Repro: C syz .config
  

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in ./include/net/sch_generic.h:1193:7
shift exponent 129 is too large for 32-bit type 'int'
CPU: 1 PID: 34 Comm: kworker/1:1 Not tainted 5.11.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 qdisc_l2t include/net/sch_generic.h:1193 [inline]
 cbq_update net/sched/sch_cbq.c:562 [inline]
 cbq_dequeue.cold+0x186/0x18b net/sched/sch_cbq.c:809
 dequeue_skb net/sched/sch_generic.c:263 [inline]
 qdisc_restart net/sched/sch_generic.c:366 [inline]
 __qdisc_run+0x1ae/0x15f0 net/sched/sch_generic.c:384
 __dev_xmit_skb net/core/dev.c:3813 [inline]
 __dev_queue_xmit+0x1a30/0x2dd0 net/core/dev.c:4119
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip_finish_output2+0xeb6/0x21b0 net/ipv4/ip_output.c:230
 __ip_finish_output net/ipv4/ip_output.c:308 [inline]
 __ip_finish_output+0x396/0x640 net/ipv4/ip_output.c:290
 ip_finish_output+0x35/0x200 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip_output+0x196/0x310 net/ipv4/ip_output.c:432
 dst_output include/net/dst.h:441 [inline]
 ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:126
 iptunnel_xmit+0x5a3/0x9c0 net/ipv4/ip_tunnel_core.c:82
 geneve_xmit_skb drivers/net/geneve.c:959 [inline]
 geneve_xmit+0xde1/0x2f60 drivers/net/geneve.c:1059
 __netdev_start_xmit include/linux/netdevice.h:4776 [inline]
 netdev_start_xmit include/linux/netdevice.h:4790 [inline]
 xmit_one net/core/dev.c:3574 [inline]
 dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3590
 __dev_queue_xmit+0x21db/0x2dd0 net/core/dev.c:4151
 neigh_resolve_output net/core/neighbour.c:1491 [inline]
 neigh_resolve_output+0x4d8/0x7e0 net/core/neighbour.c:1471
 neigh_output include/net/neighbour.h:510 [inline]
 ip6_finish_output2+0x6b8/0x16c0 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline]
 __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161
 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x1db/0x520 net/ipv6/ip6_output.c:215
 dst_output include/net/dst.h:441 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ndisc_send_skb+0xa90/0x1750 net/ipv6/ndisc.c:508
 ndisc_send_ns+0x3a9/0x850 net/ipv6/ndisc.c:650
 addrconf_dad_work+0xc1c/0x1280 net/ipv6/addrconf.c:4116
 process_one_work+0x98d/0x15f0 kernel/workqueue.c:2275
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
================================================================================

Crashes (27):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/01/20 13:03 upstream 45dfb8a5659a d4f4eca5 .config console log report syz C ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in cbq_dequeue
2020/12/10 09:12 linux-next a9e26cb5f261 c090b4da .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/12/24 17:45 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 17:41 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce
2020/12/24 17:37 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 17:32 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce
2020/12/24 17:32 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce
2020/12/24 17:31 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 17:31 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/20 07:26 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/20 07:25 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 18:18 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-386
2020/12/24 18:13 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-386
2020/12/24 18:13 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-386
2020/12/24 17:45 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce-386
2020/12/20 07:38 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce-386
2020/12/24 17:32 net-old 1f45dc220667 c2c1d1dd .config console log report info ci-upstream-net-this-kasan-gce
2020/12/20 07:33 net-old fec6079b2eea 04201c06 .config console log report info ci-upstream-net-this-kasan-gce
2020/12/29 07:35 net-next-old 3db1a3fa9880 8259d56c .config console log report info ci-upstream-net-kasan-gce
2020/12/20 07:25 linux-next 0d52778b8710 04201c06 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/14 05:40 linux-next 14240d4c5b25 b22a7ec3 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/12 18:15 linux-next 14240d4c5b25 bca53db9 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/12 18:15 linux-next 14240d4c5b25 bca53db9 .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/11 07:57 linux-next 14240d4c5b25 f900b48c .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/10 08:34 linux-next a9e26cb5f261 c090b4da .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/07 15:39 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
2020/12/07 13:21 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.