syzbot


general protection fault in icmp6_send

Status: fixed on 2019/03/06 07:43
Subsystems: net
[Documentation on labels]
Fix commit: 8d9336704521 ipv6: make icmp6_send() robust against null skb->dev
First crash: 1910d, last: 1910d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in icmp6_send (2) net 1 1839d 1839d 0/26 closed as invalid on 2019/04/24 17:55

Sample crash report:
8021q: adding VLAN 0 to HW filter on device batadv0
kauditd_printk_skb: 3 callbacks suppressed
audit: type=1400 audit(1546592293.799:31): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="_" object="keyring" requested=w pid=8624 comm="syz-executor4" saddr=::1 src=20000 daddr=::1 dest=54218 netif=lo
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8625 Comm: syz-executor4 Not tainted 4.20.0+ #8
kobject: 'loop2' (0000000074315c28): kobject_uevent_env
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dev_net include/linux/netdevice.h:2169 [inline]
RIP: 0010:icmp6_send+0x116/0x2d30 net/ipv6/icmp.c:426
Code: e8 03 42 80 3c 20 00 0f 85 95 26 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 10 49 8d bc 24 80 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 26 00 00 48 8d 8b b4 00 00 00 4d 8b bc 24 80
kobject: 'loop2' (0000000074315c28): fill_kobj_path: path = '/devices/virtual/block/loop2'
RSP: 0018:ffff8880905ef340 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888090850500 RCX: 0000000000000000
RDX: 00000000000000b0 RSI: ffffffff86d564cf RDI: 0000000000000580
RBP: ffff8880905ef5e0 R08: 0000000000000000 R09: ffffed1015cc5b90
R10: ffff8880905ef5f8 R11: ffff8880ae62dc7b R12: 0000000000000000
R13: ffff888090850500 R14: 0000000000000000 R15: 0000000000000001
FS:  00007f335502b700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000606ed8 CR3: 000000009db2a000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
kobject: 'loop5' (0000000081efd7ba): kobject_uevent_env
Call Trace:
kobject: 'loop5' (0000000081efd7ba): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop2' (0000000074315c28): kobject_uevent_env
kobject: 'loop2' (0000000074315c28): fill_kobj_path: path = '/devices/virtual/block/loop2'
------------[ cut here ]------------
downgrading a read lock
WARNING: CPU: 1 PID: 8651 at kernel/locking/lockdep.c:3553 __lock_downgrade kernel/locking/lockdep.c:3553 [inline]
WARNING: CPU: 1 PID: 8651 at kernel/locking/lockdep.c:3553 lock_downgrade+0x4d2/0x910 kernel/locking/lockdep.c:3816

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/04 09:07 upstream 645ff1e8e704 7da23925 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/01/04 08:29 upstream 645ff1e8e704 7da23925 .config console log report ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.