syzbot


Fatal trap 9: general protection fault in sctp_copy_skeylist

Status: fixed on 2019/07/15 03:35
Reported-by: syzbot+08a486f7e6966f1c3cfb@syzkaller.appspotmail.com
Fix commit: 8a956abe12c6 When calling sctp_initialize_auth_params(), the inp must have at least a read lock. To avoid more complex locking dances, just call it in sctp_aloc_assoc() when the write lock is still held.
First crash: 1340d, last: 1340d

Sample crash report:
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer	= 0x20:0xffffffff812c1d3c
stack pointer	        = 0x28:0xfffffe0020ec7780
frame pointer	        = 0x28:0xfffffe0020ec77c0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 869 (syz-executor.0)
trap number		= 9
panic: general protection fault
cpuid = 0
time = 1559851433
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0020ec7450
vpanic() at vpanic+0x1e0/frame 0xfffffe0020ec74b0
panic() at panic+0x43/frame 0xfffffe0020ec7510
trap_fatal() at trap_fatal+0x4c6/frame 0xfffffe0020ec7590
trap() at trap+0xba/frame 0xfffffe0020ec76b0
calltrap() at calltrap+0x8/frame 0xfffffe0020ec76b0
--- trap 0x9, rip = 0xffffffff812c1d3c, rsp = 0xfffffe0020ec7780, rbp = 0xfffffe0020ec77c0 ---
sctp_copy_skeylist() at sctp_copy_skeylist+0x8c/frame 0xfffffe0020ec77c0
sctp_initialize_auth_params() at sctp_initialize_auth_params+0x319/frame 0xfffffe0020ec7820
sctp_connect() at sctp_connect+0x4a6/frame 0xfffffe0020ec7880
soconnectat() at soconnectat+0x183/frame 0xfffffe0020ec78e0
kern_connectat() at kern_connectat+0x1ff/frame 0xfffffe0020ec7940
sys_connect() at sys_connect+0xd9/frame 0xfffffe0020ec7980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe0020ec7ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0020ec7ab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x4131ba, rsp = 0x7fffdfffdf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 869 tid 100176 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-freebsd-main 2019/06/06 20:09 freebsd f6eb4393c0bd 698773cb console log report syz
ci-freebsd-i386 2019/06/06 20:30 freebsd f6eb4393c0bd 698773cb console log report syz
ci-freebsd-main 2019/06/06 19:43 freebsd f6eb4393c0bd 698773cb console log report
* Struck through repros no longer work on HEAD.