syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

WARNING: ODEBUG bug in route4_change

Status: fixed on 2020/04/24 02:59
Reported-by: syzbot+c450a124c51abb62615d@syzkaller.appspotmail.com
Fix commit: ea3d6652c240 net_sched: cls_route: remove the right filter from hashtable
First crash: 1510d, last: 1491d
Fix bisection: fixed by (bisect log) :
commit ea3d6652c240978736a91b9e85fde9fee9359be4
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date: Sat Mar 14 05:29:54 2020 +0000

  net_sched: cls_route: remove the right filter from hashtable

  
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: ODEBUG bug in route4_change C done 68 1481d 1504d 15/26 fixed on 2020/05/10 10:41
linux-4.14 WARNING: ODEBUG bug in route4_change C done 23 1482d 1510d 1/1 fixed on 2020/05/02 15:54

Sample crash report:
audit: type=1400 audit(1585064477.348:36): avc:  denied  { map } for  pid=8108 comm="syz-executor515" path="/root/syz-executor515903356" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
IPVS: ftp: loaded support on port[0] = 21
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object type: rcu_head hint:           (null)
WARNING: CPU: 1 PID: 8110 at lib/debugobjects.c:325 debug_print_object+0x160/0x250 lib/debugobjects.c:325
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 8110 Comm: syz-executor515 Not tainted 4.19.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 panic+0x26a/0x50e kernel/panic.c:186
 __warn.cold+0x20/0x46 kernel/panic.c:541
 report_bug+0x262/0x2a0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037
RIP: 0010:debug_print_object+0x160/0x250 lib/debugobjects.c:325
Code: dd 60 0f ab 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 bf 00 00 00 48 8b 14 dd 60 0f ab 87 48 c7 c7 a0 04 ab 87 e8 9b f6 e6 fd <0f> 0b 83 05 23 a5 37 06 01 48 83 c4 20 5b 5d 41 5c 41 5d c3 48 89
RSP: 0018:ffff8880974a7268 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8152d3a1 RDI: ffffed1012e94e3f
RBP: 0000000000000001 R08: ffff8880972c0680 R09: ffffed1015ce3ee3
R10: ffffed1015ce3ee2 R11: ffff8880ae71f717 R12: ffffffff88b928c0
R13: 0000000000000000 R14: ffff888091fe5cf8 R15: 1ffff11012e94e5a
 debug_object_activate+0x357/0x4e0 lib/debugobjects.c:484
 debug_rcu_head_queue kernel/rcu/rcu.h:193 [inline]
 __call_rcu.constprop.0+0x31/0x7e0 kernel/rcu/tree.c:2977
 queue_rcu_work+0x75/0x90 kernel/workqueue.c:1633
 route4_change+0xe6a/0x2210 net/sched/cls_route.c:552
 tc_new_tfilter+0xa6b/0x1450 net/sched/cls_api.c:1320
 rtnetlink_rcv_msg+0x453/0xaf0 net/core/rtnetlink.c:4777
 netlink_rcv_skb+0x160/0x410 net/netlink/af_netlink.c:2455
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x4d7/0x6a0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x80b/0xcd0 net/netlink/af_netlink.c:1909
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:632
 ___sys_sendmsg+0x803/0x920 net/socket.c:2115
 __sys_sendmsg+0xec/0x1b0 net/socket.c:2153
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4466c9
Code: e8 1c ba 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab 0e fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f18e8e8ad98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006dbc68 RCX: 00000000004466c9
RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
RBP: 00000000006dbc60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc6c
R13: 0000000000000005 R14: 00a3a20740000000 R15: 0507002400000038

======================================================

Crashes (28):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/24 15:43 linux-4.19.y 14cfdbd39e31 33e14df3 .config console log report syz C ci2-linux-4-19
2020/03/23 11:45 linux-4.19.y 14cfdbd39e31 78267cec .config console log report syz C ci2-linux-4-19
2020/03/23 01:11 linux-4.19.y 14cfdbd39e31 78267cec .config console log report syz C ci2-linux-4-19
2020/03/22 18:15 linux-4.19.y 14cfdbd39e31 78267cec .config console log report syz C ci2-linux-4-19
2020/03/22 14:35 linux-4.19.y 14cfdbd39e31 78267cec .config console log report syz C ci2-linux-4-19
2020/03/21 21:19 linux-4.19.y 14cfdbd39e31 78267cec .config console log report syz C ci2-linux-4-19
2020/03/21 09:17 linux-4.19.y 14cfdbd39e31 aa6c6a55 .config console log report syz C ci2-linux-4-19
2020/03/20 21:39 linux-4.19.y 14cfdbd39e31 2c31c529 .config console log report syz C ci2-linux-4-19
2020/03/19 06:28 linux-4.19.y 93556fb211fa 2c31c529 .config console log report syz C ci2-linux-4-19
2020/03/19 02:18 linux-4.19.y 93556fb211fa 2c31c529 .config console log report syz C ci2-linux-4-19
2020/03/18 18:36 linux-4.19.y 93556fb211fa 0a96a13c .config console log report syz C ci2-linux-4-19
2020/03/18 12:07 linux-4.19.y 93556fb211fa 0a96a13c .config console log report syz C ci2-linux-4-19
2020/03/18 04:47 linux-4.19.y 339485c9a80f 97bc55ce .config console log report syz C ci2-linux-4-19
2020/03/17 16:12 linux-4.19.y 339485c9a80f 749688d2 .config console log report syz C ci2-linux-4-19
2020/03/17 06:08 linux-4.19.y 339485c9a80f 749688d2 .config console log report syz C ci2-linux-4-19
2020/03/16 22:45 linux-4.19.y 339485c9a80f 749688d2 .config console log report syz C ci2-linux-4-19
2020/03/16 21:45 linux-4.19.y 339485c9a80f 749688d2 .config console log report syz C ci2-linux-4-19
2020/03/05 13:38 linux-4.19.y a083db76118d b655d91b .config console log report syz C ci2-linux-4-19
2020/03/05 09:36 linux-4.19.y a083db76118d 576fb9bc .config console log report syz C ci2-linux-4-19
2020/03/05 08:56 linux-4.19.y a083db76118d 576fb9bc .config console log report syz C ci2-linux-4-19
2020/03/05 08:16 linux-4.19.y a083db76118d 576fb9bc .config console log report syz C ci2-linux-4-19
2020/03/24 06:11 linux-4.19.y 14cfdbd39e31 33e14df3 .config console log report syz ci2-linux-4-19
2020/03/24 03:19 linux-4.19.y 14cfdbd39e31 84f999d6 .config console log report syz ci2-linux-4-19
2020/03/23 13:36 linux-4.19.y 14cfdbd39e31 78267cec .config console log report syz ci2-linux-4-19
2020/03/05 14:15 linux-4.19.y a083db76118d b655d91b .config console log report syz ci2-linux-4-19
2020/03/23 08:30 linux-4.19.y 14cfdbd39e31 78267cec .config console log report ci2-linux-4-19
2020/03/20 21:29 linux-4.19.y 14cfdbd39e31 2c31c529 .config console log report ci2-linux-4-19
2020/03/17 21:50 linux-4.19.y 339485c9a80f 97bc55ce .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.