syzbot


panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM

Status: fixed on 2024/12/09 08:20
Fix commit: ddaa99e5d4d2 Ignore the length field when processing the experiment extension header.
First crash: 78d, last: 76d

Sample crash report:
panic: bytes only has space for 6 bytes but need space for 1366 bytes (length = 170) for extension header with id = 253

goroutine 379 gp=0xc000a8d6c0 m=15 mp=0xc000728e08 [running]:
panic({0x1bdf400?, 0xc00061c450?})
	bazel-out/k8-fastbuild/bin/external/io_bazel_rules_go/stdlib_/src/runtime/panic.go:804 +0x168 fp=0xc000a444c0 sp=0xc000a44410 pc=0x478628
gvisor.dev/gvisor/pkg/tcpip/header.(*IPv6PayloadIterator).nextHeaderData(0xc000309290, 0x0, {0xc00058c1ba, 0x6, 0x6})
	pkg/tcpip/header/ipv6_extension_headers.go:720 +0xd25 fp=0xc000a44640 sp=0xc000a444c0 pc=0xe5bca5
gvisor.dev/gvisor/pkg/tcpip/header.(*IPv6PayloadIterator).Next(0xc000309290)
	pkg/tcpip/header/ipv6_extension_headers.go:645 +0x5b5 fp=0xc000a44770 sp=0xc000a44640 pc=0xe5acb5
gvisor.dev/gvisor/pkg/tcpip/header/parse.IPv6(0xc0002b2dc0)
	pkg/tcpip/header/parse/parse.go:97 +0x3d2 fp=0xc000a44950 sp=0xc000a44770 pc=0x10b3392
gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*protocol).Parse(0xc000a449a0?, 0xc0002b2dc0)
	pkg/tcpip/network/ipv6/ipv6.go:2661 +0x45 fp=0xc000a44978 sp=0xc000a44950 pc=0x119c525
gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*protocol).parseAndValidate(0xc000676480, 0xc0002b2dc0)
	pkg/tcpip/network/ipv6/ipv6.go:2623 +0x46 fp=0xc000a449d8 sp=0xc000a44978 pc=0x119c1a6
gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).HandlePacket(0xc000afb508, 0xc0002b2dc0)
	pkg/tcpip/network/ipv6/ipv6.go:1101 +0x105 fp=0xc000a44f50 sp=0xc000a449d8 pc=0x118d965
gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverNetworkPacket(0xc00094cb48, 0x86dd, 0xc0002b2dc0)
	pkg/tcpip/stack/nic.go:774 +0x1eb fp=0xc000a44fa8 sp=0xc000a44f50 pc=0xebd52b
gvisor.dev/gvisor/pkg/tcpip/link/nested.(*Endpoint).DeliverNetworkPacket(0xc0006e26e0, 0x86dd, 0xc0002b2dc0)
	pkg/tcpip/link/nested/nested.go:61 +0xc2 fp=0xc000a44ff0 sp=0xc000a44fa8 pc=0x11caec2
gvisor.dev/gvisor/pkg/tcpip/link/packetsocket.(*endpoint).DeliverNetworkPacket(0xc0006e26e0, 0x86dd, 0xc0002b2dc0)
	pkg/tcpip/link/packetsocket/packetsocket.go:47 +0x5f fp=0xc000a45018 sp=0xc000a44ff0 pc=0x11cdd7f
gvisor.dev/gvisor/pkg/tcpip/link/channel.(*Endpoint).InjectInbound(0xc000cdd560, 0x86dd, 0xc0002b2dc0)
	pkg/tcpip/link/channel/channel.go:207 +0xc2 fp=0xc000a45058 sp=0xc000a45018 pc=0x11d3642
gvisor.dev/gvisor/pkg/tcpip/link/tun.(*Device).Write(0xc000522d28, 0xc000308300)
	pkg/tcpip/link/tun/device.go:250 +0x806 fp=0xc000a45240 sp=0xc000a45058 pc=0x11d7b06
gvisor.dev/gvisor/pkg/sentry/devices/tundev.(*tunFD).Write(0xc000522cc0, {0x2064f60, 0xc000d94588}, {{0x205bbd8, 0xc0008e2008}, {0x0, 0x1, 0x20000dc0, 0x46}, {0x0, ...}}, ...)
	pkg/sentry/devices/tundev/tundev.go:163 +0x592 fp=0xc000a45378 sp=0xc000a45240 pc=0x1707ad2
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write(0xc000522cc0, {0x2064f60, 0xc000d94588}, {{0x205bbd8, 0xc0008e2008}, {0x0, 0x1, 0x20000dc0, 0x46}, {0x0, ...}}, ...)
	pkg/sentry/vfs/file_description.go:682 +0x145 fp=0xc000a45448 sp=0xc000a45378 pc=0xb0e965
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.write(0xc000d94588, 0xc000522cc0, {{0x205bbd8, 0xc0008e2008}, {0x0, 0x1, 0x20000dc0, 0x46}, {0x0, 0x1}}, ...)
	pkg/sentry/syscalls/linux/sys_read_write.go:347 +0xa5 fp=0xc000a45560 sp=0xc000a45448 pc=0x129f085
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Write(0xc000d94588, 0x0?, {{0xc8}, {0x20000dc0}, {0x46}, {0x0}, {0x0}, {0x0}})
	pkg/sentry/syscalls/linux/sys_read_write.go:316 +0x38f fp=0xc000a456e8 sp=0xc000a45560 pc=0x129e58f
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc000d94588, 0x1, {{0xc8}, {0x20000dc0}, {0x46}, {0x0}, {0x0}, {0x0}})
	pkg/sentry/kernel/task_syscall.go:143 +0xb9f fp=0xc000a45998 sp=0xc000a456e8 pc=0xfed83f
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc000d94588, 0x1, {{0xc8}, {0x20000dc0}, {0x46}, {0x0}, {0x0}, {0x0}})
	pkg/sentry/kernel/task_syscall.go:323 +0x85 fp=0xc000a45a40 sp=0xc000a45998 pc=0xfef965
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc000d94588, 0x1, {{0xc8}, {0x20000dc0}, {0x46}, {0x0}, {0x0}, {0x0}})
	pkg/sentry/kernel/task_syscall.go:283 +0xc7 fp=0xc000a45ab0 sp=0xc000a45a40 pc=0xfef287
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc000d94588)
	pkg/sentry/kernel/task_syscall.go:258 +0x54a fp=0xc000a45bd0 sp=0xc000a45ab0 pc=0xfeedea
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc000d94588?, 0xc000d94588)
	pkg/sentry/kernel/task_run.go:269 +0x2295 fp=0xc000a45e78 sp=0xc000a45bd0 pc=0xfd96b5
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc000d94588, 0x9)
	pkg/sentry/kernel/task_run.go:97 +0x41b fp=0xc000a45fb0 sp=0xc000a45e78 pc=0xfd69db
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
	pkg/sentry/kernel/task_start.go:411 +0x45 fp=0xc000a45fe0 sp=0xc000a45fb0 pc=0xfeb145
runtime.goexit({})
	src/runtime/asm_amd64.s:1700 +0x1 fp=0xc000a45fe8 sp=0xc000a45fe0 pc=0x4819a1
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 263
	pkg/sentry/kernel/task_start.go:411 +0x185

Crashes (34):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/05 04:58 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-ptrace-2-race-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:52 gvisor f2abd313672c 29f61fce console log report syz / log C ci-gvisor-ptrace-1 panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:52 gvisor f2abd313672c 29f61fce console log report syz / log C ci-gvisor-systrap-1 panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:52 gvisor f2abd313672c 29f61fce console log report syz / log C ci-gvisor-ptrace-2 panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:52 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-ptrace-2-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:52 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-systrap-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:50 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-ptrace-1-race-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:48 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-systrap-1-race-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:48 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-ptrace-1-race panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:45 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-ptrace-2-race panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:44 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-systrap-1-race panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:44 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-kvm-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:42 gvisor f2abd313672c 29f61fce console log report syz / log C ci-gvisor-kvm panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:32 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-ptrace-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:48 gvisor f2abd313672c 29f61fce console log report syz / log C ci-gvisor-arm64-systrap-1 panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:43 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-arm64-ptrace-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:42 gvisor f2abd313672c 29f61fce console log report syz / log C ci-gvisor-arm64-ptrace-1 panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:42 gvisor f2abd313672c 29f61fce .config console log report syz / log C ci-gvisor-arm64-systrap-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/07 01:36 gvisor 188a756ff387 9ac0fdc6 .config console log report info ci-gvisor-kvm-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/06 13:45 gvisor 188a756ff387 9ac0fdc6 .config console log report info ci-gvisor-systrap-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/06 10:58 gvisor b92307b4e648 946d28f0 .config console log report info ci-gvisor-ptrace-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/06 10:57 gvisor b92307b4e648 946d28f0 .config console log report info ci-gvisor-kvm-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/06 07:10 gvisor b92307b4e648 946d28f0 .config console log report info ci-gvisor-kvm-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/06 05:27 gvisor b92307b4e648 946d28f0 .config console log report info ci-gvisor-systrap-1-race-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/06 04:07 gvisor b92307b4e648 946d28f0 console log report info ci-gvisor-systrap-1 panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 20:13 gvisor a8e963b09573 1c533826 .config console log report info ci-gvisor-systrap-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 08:50 gvisor f2abd313672c 29f61fce .config console log report info ci-gvisor-kvm-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 06:42 gvisor f2abd313672c 29f61fce .config console log report info ci-gvisor-kvm-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 06:36 gvisor f2abd313672c 29f61fce console log report info ci-gvisor-ptrace-2 panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 06:22 gvisor f2abd313672c 29f61fce .config console log report info ci-gvisor-kvm-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 04:26 gvisor f2abd313672c 29f61fce .config console log report info ci-gvisor-ptrace-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/06 17:13 gvisor 188a756ff387 9ac0fdc6 .config console log report info ci-gvisor-arm64-ptrace-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 16:48 gvisor a8e963b09573 1c533826 .config console log report info ci-gvisor-arm64-systrap-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
2024/12/05 13:15 gvisor a8e963b09573 1c533826 .config console log report info ci-gvisor-arm64-ptrace-1-cover panic: bytes only has space for NUM bytes but need space for NUM bytes (length = NUM) for extension header with id = NUM
* Struck through repros no longer work on HEAD.