syzbot

 sign-in | mailing list | source | docs
🐞 Open [990] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

UBSAN: shift-out-of-bounds in est_timer

Status: fixed on 2021/03/11 07:37
Subsystems: net
[Documentation on labels]
Fix commit: dd5e073381f2 net_sched: gen_estimator: support large ewma log
First crash: 1225d, last: 1151d
Cause bisection: introduced by (bisect log) [release commit]:
commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sun Sep 15 21:19:32 2019 +0000

  Linux 5.3

Crash: UBSAN: undefined-behaviour in est_timer (log)
Repro: C syz .config
  
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2021/03/01 19:48 1h02m bisect fix upstream job log (0) log

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in net/core/gen_estimator.c:83:38
shift exponent -1 is negative
CPU: 0 PID: 4876 Comm: systemd-journal Not tainted 5.10.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 est_timer.cold+0xbb/0x12d net/core/gen_estimator.c:83
 call_timer_fn+0x1a5/0x710 kernel/time/timer.c:1417
 expire_timers kernel/time/timer.c:1462 [inline]
 __run_timers.part.0+0x692/0xa80 kernel/time/timer.c:1731
 __run_timers kernel/time/timer.c:1712 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1744
 __do_softirq+0x2bc/0xa77 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0x17f/0x200 kernel/softirq.c:420
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
RIP: 0010:lock_acquire kernel/locking/lockdep.c:5440 [inline]
RIP: 0010:lock_acquire+0x2c7/0x750 kernel/locking/lockdep.c:5402
Code: 48 c7 c7 40 9a 6b 89 48 83 c4 20 e8 83 82 c1 07 b8 ff ff ff ff 65 0f c1 05 76 3a aa 7e 83 f8 01 0f 85 40 03 00 00 ff 34 24 9d <e9> 3a fe ff ff 65 ff 05 dd 28 aa 7e 48 8b 05 b6 36 12 0c e8 a1 77
RSP: 0018:ffffc90000f47888 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 1ffff920001e8f13 RCX: 0000000000000001
RDX: 1ffff110027f6148 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8f5177a7
R10: fffffbfff1ea2ef4 R11: 0000000000000000 R12: 0000000000000002
R13: ffffffff8b78e0e0 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:253 [inline]
 rcu_read_lock include/linux/rcupdate.h:642 [inline]
 __d_lookup+0xa8/0x760 fs/dcache.c:2386
 lookup_fast+0x2d0/0x6c0 fs/namei.c:1502
 walk_component+0xc6/0x6a0 fs/namei.c:1857
 link_path_walk.part.0+0x6b8/0xc20 fs/namei.c:2184
 link_path_walk fs/namei.c:2112 [inline]
 path_lookupat+0xb7/0x830 fs/namei.c:2333
 filename_lookup+0x19f/0x560 fs/namei.c:2367
 do_readlinkat+0xcd/0x2f0 fs/stat.c:407
 __do_sys_readlinkat fs/stat.c:434 [inline]
 __se_sys_readlinkat fs/stat.c:431 [inline]
 __x64_sys_readlinkat+0x93/0xf0 fs/stat.c:431
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fb53d8bc0ba
Code: 48 8b 0d e1 bd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 0b 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ae bd 2b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffc6551c828 EFLAGS: 00000202 ORIG_RAX: 000000000000010b
RAX: ffffffffffffffda RBX: 000055fee9307a80 RCX: 00007fb53d8bc0ba
RDX: 000055fee9307a80 RSI: 00007ffc6551c8b0 RDI: 00000000ffffff9c
RBP: 0000000000000064 R08: 00007fb53db78c58 R09: 0000000000000070
R10: 0000000000000063 R11: 0000000000000202 R12: 00007ffc6551c8b0
R13: 00000000ffffff9c R14: 00007ffc6551c880 R15: 0000000000000063
================================================================================

Crashes (73):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/19 18:00 upstream 3644e2d2dda7 04201c06 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/12/19 18:43 net-old 1e72faedcd58 04201c06 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/12/19 16:35 net-old 1e72faedcd58 04201c06 .config console log report syz C ci-upstream-net-this-kasan-gce
2021/01/20 03:27 upstream 1e2a199f6ccd 63631df1 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/19 03:20 upstream 19c329f68089 63631df1 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/18 17:56 upstream 19c329f68089 63631df1 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/18 08:36 upstream a1339d6355ac fd103621 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/18 04:14 upstream a1339d6355ac fd103621 .config console log report info ci-upstream-kasan-gce-smack-root UBSAN: shift-out-of-bounds in est_timer
2021/01/20 14:16 net-next-old 7b8fc0103bb5 d4f4eca5 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/19 14:14 net-next-old 99d518970c5a 63631df1 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/19 08:55 net-next-old 220723dc3bcf 63631df1 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/19 04:28 net-next-old 220723dc3bcf 63631df1 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/18 11:14 net-next-old 213b97b12580 fd103621 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/18 10:01 net-next-old 213b97b12580 fd103621 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in est_timer
2021/01/16 13:24 upstream 1d94330a437a 65a7a854 .config console log report info ci-upstream-kasan-gce
2021/01/15 10:07 upstream 5ee88057889b 65a7a854 .config console log report info ci-upstream-kasan-gce-smack-root
2021/01/11 07:07 upstream 0653161f0fac 2c1f2513 .config console log report info ci-upstream-kasan-gce-root
2021/01/11 05:09 upstream 0653161f0fac 2c1f2513 .config console log report info ci-upstream-kasan-gce-root
2021/01/11 02:09 upstream 0653161f0fac 2c1f2513 .config console log report info ci-upstream-kasan-gce-selinux-root
2021/01/11 01:00 upstream 0653161f0fac 2c1f2513 .config console log report info ci-upstream-kasan-gce
2021/01/10 23:36 upstream 0653161f0fac 2c1f2513 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/24 15:27 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci-upstream-kasan-gce
2020/12/21 17:59 upstream e37b12e4bb21 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/21 14:27 upstream e37b12e4bb21 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/21 12:00 upstream e37b12e4bb21 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/21 04:50 upstream 6a447b0e3151 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/21 01:48 upstream 6a447b0e3151 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/20 06:09 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/20 06:08 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/19 15:24 upstream 3644e2d2dda7 04201c06 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/12/19 15:20 upstream 3644e2d2dda7 04201c06 .config console log report info ci-upstream-kasan-gce
2020/12/17 07:59 upstream 5e60366d56c6 04201c06 .config console log report info ci-upstream-kasan-gce
2021/01/11 03:28 upstream 0653161f0fac 2c1f2513 .config console log report info ci-upstream-kasan-gce-386
2020/12/20 06:10 upstream 467f8165a2b0 04201c06 .config console log report info ci-upstream-kasan-gce-386
2020/12/19 15:24 upstream 3644e2d2dda7 04201c06 .config console log report info ci-upstream-kasan-gce-386
2021/01/15 22:00 net-old 146620506274 65a7a854 .config console log report info ci-upstream-net-this-kasan-gce
2021/01/11 00:17 net-old f97844f9c518 2c1f2513 .config console log report info ci-upstream-net-this-kasan-gce
2021/01/10 21:48 net-old f97844f9c518 2c1f2513 .config console log report info ci-upstream-net-this-kasan-gce
2020/12/26 10:20 net-old 1f45dc220667 821e0b09 .config console log report info ci-upstream-net-this-kasan-gce
2020/12/23 01:07 net-old 2575bc1aa9d5 04201c06 .config console log report info ci-upstream-net-this-kasan-gce
2020/12/20 06:18 net-old fec6079b2eea 04201c06 .config console log report info ci-upstream-net-this-kasan-gce
2020/12/19 15:19 net-old 1e72faedcd58 04201c06 .config console log report info ci-upstream-net-this-kasan-gce
2021/01/17 09:02 net-next-old c761b2df9df0 65a7a854 .config console log report info ci-upstream-net-kasan-gce
2021/01/16 23:21 net-next-old 9ab7e76aefc9 65a7a854 .config console log report info ci-upstream-net-kasan-gce
2021/01/16 00:48 net-next-old e7fa5c80defe 65a7a854 .config console log report info ci-upstream-net-kasan-gce
2021/01/15 20:41 net-next-old 1d9f03c0a15f 65a7a854 .config console log report info ci-upstream-net-kasan-gce
2021/01/15 00:33 net-next-old 0ae5b43d6dde 65a7a854 .config console log report info ci-upstream-net-kasan-gce
2021/01/14 20:06 net-next-old 0ae5b43d6dde 65a7a854 .config console log report info ci-upstream-net-kasan-gce
2021/01/14 11:44 net-next-old 679500e385fc 269d24e8 .config console log report info ci-upstream-net-kasan-gce
2021/01/14 07:27 net-next-old 679500e385fc 269d24e8 .config console log report info ci-upstream-net-kasan-gce
2021/01/13 21:39 net-next-old f50e2f9f7916 a945f0a3 .config console log report info ci-upstream-net-kasan-gce
2021/01/13 16:33 net-next-old f50e2f9f7916 a945f0a3 .config console log report info ci-upstream-net-kasan-gce
2021/01/05 21:19 net-next-old 3db1a3fa9880 a0234d98 .config console log report info ci-upstream-net-kasan-gce
2021/01/04 08:45 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/03 22:38 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/03 17:16 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/03 14:32 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/03 10:18 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/03 09:17 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/03 00:00 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/02 20:30 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/02 16:24 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/02 05:55 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2021/01/01 22:44 net-next-old 3db1a3fa9880 79264ae3 .config console log report info ci-upstream-net-kasan-gce
2020/12/30 04:01 net-next-old 3db1a3fa9880 0fa352f2 .config console log report info ci-upstream-net-kasan-gce
2020/12/29 06:18 net-next-old 3db1a3fa9880 8259d56c .config console log report info ci-upstream-net-kasan-gce
2020/12/28 09:50 net-next-old 3db1a3fa9880 2242f77f .config console log report info ci-upstream-net-kasan-gce
2020/12/27 21:43 net-next-old 3db1a3fa9880 2242f77f .config console log report info ci-upstream-net-kasan-gce
2020/12/20 06:10 linux-next 0d52778b8710 04201c06 .config console log report info ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.