syzbot

 sign-in | mailing list | source | docs
🐞 Open [980] ≡ Subsystems 🐞 Fixed [5235] 🐞 Invalid [12496] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len

Status: fixed on 2022/03/08 16:11
Subsystems: net
[Documentation on labels]
Fix commit: b193e15ac69d net: prevent user from passing illegal stab size
First crash: 1233d, last: 936d
Cause bisection: introduced by (bisect log) [release commit]:
commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sun Sep 15 21:19:32 2019 +0000

  Linux 5.3

Crash: UBSAN: undefined-behaviour in __qdisc_calculate_pkt_len (log)
Repro: C syz .config
  

Sample crash report:
================================================================================
UBSAN: shift-out-of-bounds in net/sched/sch_api.c:572:7
shift exponent 144 is too large for 32-bit type 'int'
CPU: 1 PID: 8646 Comm: kworker/1:4 Tainted: G        W         5.14.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: mld mld_ifc_work
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
 __qdisc_calculate_pkt_len.cold+0x62/0xcf net/sched/sch_api.c:572
 qdisc_calculate_pkt_len include/net/sch_generic.h:837 [inline]
 __dev_xmit_skb net/core/dev.c:3856 [inline]
 __dev_queue_xmit+0x1166/0x36c0 net/core/dev.c:4241
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip_finish_output2+0xef0/0x2220 net/ipv4/ip_output.c:230
 __ip_finish_output net/ipv4/ip_output.c:308 [inline]
 __ip_finish_output+0x396/0x640 net/ipv4/ip_output.c:290
 ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0x196/0x310 net/ipv4/ip_output.c:432
 dst_output include/net/dst.h:448 [inline]
 ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:126
 iptunnel_xmit+0x5a3/0x9c0 net/ipv4/ip_tunnel_core.c:82
 geneve_xmit_skb drivers/net/geneve.c:971 [inline]
 geneve_xmit+0x1186/0x3440 drivers/net/geneve.c:1082
 __netdev_start_xmit include/linux/netdevice.h:4944 [inline]
 netdev_start_xmit include/linux/netdevice.h:4958 [inline]
 xmit_one net/core/dev.c:3658 [inline]
 dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3674
 __dev_queue_xmit+0x29ee/0x36c0 net/core/dev.c:4273
 neigh_resolve_output net/core/neighbour.c:1496 [inline]
 neigh_resolve_output+0x50e/0x820 net/core/neighbour.c:1476
 neigh_output include/net/neighbour.h:510 [inline]
 ip6_finish_output2+0x686/0x1700 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline]
 __ip6_finish_output+0x4c1/0x1050 net/ipv6/ip6_output.c:161
 ip6_finish_output+0x32/0x200 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215
 dst_output include/net/dst.h:448 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 mld_sendpack+0x8d4/0xdc0 net/ipv6/mcast.c:1823
 mld_send_cr net/ipv6/mcast.c:2124 [inline]
 mld_ifc_work+0x71c/0xdc0 net/ipv6/mcast.c:2655
 process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
================================================================================

Crashes (5660):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/13 02:53 upstream 7fef2edf7cc7 f415556d .config console log report syz C ci-upstream-kasan-gce-selinux-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/05/29 14:19 upstream 5ff2756afde0 858ea628 .config console log report syz C ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/01/20 01:18 upstream 1e2a199f6ccd 63631df1 .config console log report syz C ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/03/31 14:20 net-old 61431a5907fc 6a81331a .config console log report syz C ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/03/31 14:18 net-next-old 37f368d8d09d 6a81331a .config console log report syz C ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2020/12/10 02:16 linux-next a9e26cb5f261 c090b4da .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2021/09/30 17:59 upstream 02d5e016800d be530f6c .config console log report info ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 12:42 upstream a4e6f95a891a d82cb927 .config console log report info ci-upstream-kasan-gce-smack-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 09:39 upstream a4e6f95a891a d82cb927 .config console log report info ci-upstream-kasan-gce-selinux-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 07:59 upstream a4e6f95a891a d82cb927 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 03:12 upstream d33bec7b3dfa d82cb927 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/28 11:51 upstream 0513e464f900 78494d16 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/28 06:46 upstream 0513e464f900 78494d16 .config console log report info ci-upstream-kasan-gce-selinux-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/28 03:35 upstream 0513e464f900 78494d16 .config console log report info ci-upstream-kasan-gce-smack-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 18:17 upstream 5816b3e6577e 78494d16 .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 00:05 upstream 996148ee05d0 78494d16 .config console log report info ci-upstream-kasan-gce-smack-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/26 05:21 upstream a5e0aceabef6 8cac236e .config console log report info ci-upstream-kasan-gce-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 19:12 upstream 7d42e9818258 8cac236e .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/24 08:29 upstream f9e36107ec70 8cac236e .config console log report info ci-upstream-kasan-gce-smack-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/24 07:25 upstream f9e36107ec70 8cac236e .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/24 06:10 upstream f9e36107ec70 8cac236e .config console log report info ci-upstream-kasan-gce-selinux-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/23 20:56 upstream 58e2cf5d7946 8cac236e .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/23 18:44 upstream 58e2cf5d7946 8cac236e .config console log report info ci-upstream-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/08/01 20:38 upstream d4affd6b6e81 6c236867 .config console log report info ci-qemu-upstream UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/30 19:09 upstream 02d5e016800d be530f6c .config console log report info ci-upstream-kasan-gce-386 UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/28 05:29 upstream 0513e464f900 78494d16 .config console log report info ci-upstream-kasan-gce-386 UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 02:15 upstream 4c4f0c2bf341 8cac236e .config console log report info ci-upstream-kasan-gce-386 UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/24 14:27 upstream f9e36107ec70 8cac236e .config console log report info ci-upstream-kasan-gce-386 UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/08/04 00:48 upstream d5ad8ec3cfb5 6c236867 .config console log report info ci-qemu-upstream-386 UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/26 08:08 net-old 7fe7f3182a0d 8cac236e .config console log report info ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/26 03:31 net-old 7fe7f3182a0d 8cac236e .config console log report info ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/26 00:25 net-old 7fe7f3182a0d 8cac236e .config console log report info ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 21:13 net-old 7fe7f3182a0d 8cac236e .config console log report info ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 18:03 net-old 7fe7f3182a0d 8cac236e .config console log report info ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 13:07 net-old 7fe7f3182a0d 8cac236e .config console log report info ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 03:31 net-old 4526fe74c3c5 8cac236e .config console log report info ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/23 23:22 net-old 3106a0847525 8cac236e .config console log report info ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/10/01 02:31 net-next-old 69508d43334e 1d849ab4 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/10/01 01:25 net-next-old 69508d43334e 1d849ab4 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/30 11:34 net-next-old ef91abfb20c7 be530f6c .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 18:27 net-next-old b69c99463d41 be530f6c .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 14:40 net-next-old b69c99463d41 be530f6c .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 12:38 net-next-old b69c99463d41 d82cb927 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 06:46 net-next-old b69c99463d41 d82cb927 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/29 03:13 net-next-old b69c99463d41 d82cb927 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/28 15:51 net-next-old b69c99463d41 d82cb927 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/28 02:02 net-next-old b69c99463d41 78494d16 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 20:15 net-next-old b69c99463d41 78494d16 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 15:53 net-next-old b69c99463d41 78494d16 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 13:22 net-next-old b69c99463d41 78494d16 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 13:20 net-next-old b69c99463d41 78494d16 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 09:49 net-next-old d59bdda85eb7 78494d16 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 07:24 net-next-old d59bdda85eb7 78494d16 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/27 01:15 net-next-old d59bdda85eb7 78494d16 .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/26 17:04 net-next-old d59bdda85eb7 8cac236e .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/26 10:36 net-next-old 24aa160d5375 8cac236e .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/26 09:10 net-next-old 24aa160d5375 8cac236e .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 23:16 net-next-old 24aa160d5375 8cac236e .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 10:02 net-next-old acde891c243c 8cac236e .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/24 11:16 net-next-old 2fcd14d0f780 8cac236e .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/24 04:28 net-next-old 2fcd14d0f780 8cac236e .config console log report info ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/25 11:37 linux-next 5a5d008887b4 8cac236e .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/24 04:29 linux-next bc5aa70f2699 8cac236e .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/09/24 02:29 linux-next bc5aa70f2699 8cac236e .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: shift-out-of-bounds in __qdisc_calculate_pkt_len
2021/01/17 13:17 upstream 0da0a8a0a0e1 813be542 .config console log report info ci-upstream-kasan-gce
2020/12/07 13:08 linux-next 15ac8fdb7440 1190297f .config console log report info ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.