syzbot


general protection fault in tcp_v6_send_reset

Status: fixed on 2019/08/05 13:45
Subsystems: net
[Documentation on labels]
Fix commit: 392096736a06 ipv6: tcp: fix potential NULL deref in tcp_v6_send_reset()
First crash: 1833d, last: 1828d
Cause bisection: introduced by (bisect log) :
commit 323a53c41292a0d7efc8748856c623324c8d7c21
Author: Eric Dumazet <edumazet@google.com>
Date: Wed Jun 5 14:55:09 2019 +0000

  ipv6: tcp: enable flowlabel reflection in some RST packets

Crash: general protection fault in tcp_v6_send_reset (log)
Repro: C syz .config
  

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8945 Comm: syz-executor900 Not tainted 5.2.0-rc2+ #18
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:tcp_v6_send_reset+0x1e2/0x10c0 net/ipv6/tcp_ipv6.c:941
Code: 46 fb 4d 85 ff 0f 85 00 04 00 00 e8 68 4e 46 fb 49 83 e5 fe e8 5f 4e 46 fb 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 92 0d 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffff8880867dfa00 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88809780ca50 RCX: ffffffff862a574a
RDX: 0000000000000000 RSI: ffffffff862a5761 RDI: 0000000000000007
RBP: ffff8880867dfab8 R08: ffff888098500500 R09: ffffed1010cfbf05
R10: ffff8880867dfac8 R11: 0000000000000003 R12: ffff888095a7ae20
R13: 0000000000000000 R14: ffff88809780c940 R15: 0000000000000000
FS:  0000555555d82880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000208 CR3: 0000000008a6d000 CR4: 00000000001406e0
Call Trace:
 tcp_v6_do_rcv+0xe7b/0x12c0 net/ipv6/tcp_ipv6.c:1379
 sk_backlog_rcv include/net/sock.h:950 [inline]
 __release_sock+0x129/0x390 net/core/sock.c:2418
 tcp_close+0x6b3/0x10c0 net/ipv4/tcp.c:2420
 inet_release+0xe0/0x1f0 net/ipv4/af_inet.c:431
 inet6_release+0x53/0x80 net/ipv6/af_inet6.c:474
 __sock_release+0xce/0x2a0 net/socket.c:607
 sock_close+0x1b/0x30 net/socket.c:1279
 __fput+0x2ff/0x890 fs/file_table.c:280
 ____fput+0x16/0x20 fs/file_table.c:313
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x90a/0x2fa0 kernel/exit.c:877
 do_group_exit+0x135/0x370 kernel/exit.c:981
 __do_sys_exit_group kernel/exit.c:992 [inline]
 __se_sys_exit_group kernel/exit.c:990 [inline]
 __x64_sys_exit_group+0x44/0x50 kernel/exit.c:990
 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x43ef58
Code: Bad RIP value.
RSP: 002b:00007ffe1a7c37a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ef58
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004be768 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d0180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 6a4ec77957a7cdf4 ]---
RIP: 0010:tcp_v6_send_reset+0x1e2/0x10c0 net/ipv6/tcp_ipv6.c:941
Code: 46 fb 4d 85 ff 0f 85 00 04 00 00 e8 68 4e 46 fb 49 83 e5 fe e8 5f 4e 46 fb 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 92 0d 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffff8880867dfa00 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88809780ca50 RCX: ffffffff862a574a
RDX: 0000000000000000 RSI: ffffffff862a5761 RDI: 0000000000000007
RBP: ffff8880867dfab8 R08: ffff888098500500 R09: ffffed1010cfbf05
R10: ffff8880867dfac8 R11: 0000000000000003 R12: ffff888095a7ae20
R13: 0000000000000000 R14: ffff88809780c940 R15: 0000000000000000
FS:  0000555555d82880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043ef2e CR3: 0000000008a6d000 CR4: 00000000001406e0

Crashes (353):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/06 23:40 net-next-old 4daa95af7f1c 698773cb .config console log report syz C ci-upstream-net-kasan-gce
2019/06/09 20:00 net-next-old 8d94a8733c94 0159583c .config console log report syz ci-upstream-net-kasan-gce
2019/06/10 09:18 net-next-old 900d96e418dc 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/10 08:14 net-next-old 900d96e418dc 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/10 06:55 net-next-old 900d96e418dc 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/10 03:26 net-next-old 900d96e418dc 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/10 02:38 net-next-old 900d96e418dc 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 23:55 net-next-old 900d96e418dc 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 19:04 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 17:16 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 16:06 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 14:26 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 11:04 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 08:48 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 08:20 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 07:05 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 06:02 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 03:27 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 02:04 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 01:24 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/09 00:22 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/08 23:18 net-next-old 8d94a8733c94 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/08 21:40 net-next-old a6cdeeb16bff 0159583c .config console log report ci-upstream-net-kasan-gce
2019/06/06 22:32 net-next-old 4daa95af7f1c 698773cb .config console log report ci-upstream-net-kasan-gce
2019/06/11 08:42 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/11 07:35 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/11 06:23 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/11 05:38 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/11 04:27 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/11 02:31 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/11 01:03 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 23:50 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 22:37 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 19:33 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 18:07 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 17:28 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 15:56 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 13:20 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 11:31 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/10 04:47 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/09 21:18 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/09 15:55 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/09 13:23 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/09 12:07 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/09 10:03 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/09 04:27 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/08 22:15 linux-next 3f310e51ceb1 0159583c .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.