syzbot

 sign-in | mailing list | source | docs
🐞 Open [987] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: using __this_cpu_read() in preemptible code in ip6_finish_output

Status: fixed on 2019/06/14 18:22
Reported-by: syzbot+51471b4aae195285a4a3@syzkaller.appspotmail.com
Fix commit: 28b05b928868 net: use correct this_cpu primitive in dev_recursion_level
First crash: 1850d, last: 1844d
Cause bisection: introduced by (bisect log) :
commit 97cdcf37b57e3f204be3000b9eab9686f38b4356
Author: Florian Westphal <fw@strlen.de>
Date: Mon Apr 1 14:42:13 2019 +0000

  net: place xmit recursion in softnet data

Crash: BUG: using __this_cpu_read() in preemptible code in ip6_finish_output (log)
Repro: C syz .config
  
▶ ▼ Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: using __this_cpu_read() in preemptible code in sk_mc_loop net C done 1713 1844d 1849d 0/26 closed as dup on 2019/04/03 11:54
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH 4.19 000/131] 4.19.131-rc1 review 148 (148) 2020/07/05 13:30
BUG: using __this_cpu_read() in preemptible code in ip6_finish_output 3 (5) 2019/04/05 12:36
[PATCH net-next] net: use correct this_cpu primitive in dev_recursion_level 3 (3) 2019/04/05 00:35

Sample crash report:
BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor881/7479
caller is dev_recursion_level include/linux/netdevice.h:3052 [inline]
caller is ip6_skb_dst_mtu include/net/ip6_route.h:245 [inline]
caller is ip6_finish_output+0x335/0xdc0 net/ipv6/ip6_output.c:149
CPU: 0 PID: 7479 Comm: syz-executor881 Not tainted 5.1.0-rc2+ #122
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 __this_cpu_preempt_check+0x246/0x270 lib/smp_processor_id.c:47
 dev_recursion_level include/linux/netdevice.h:3052 [inline]
 ip6_skb_dst_mtu include/net/ip6_route.h:245 [inline]
 ip6_finish_output+0x335/0xdc0 net/ipv6/ip6_output.c:149
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x235/0x7f0 net/ipv6/ip6_output.c:171
 dst_output include/net/dst.h:433 [inline]
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 ip6_xmit+0xe41/0x20c0 net/ipv6/ip6_output.c:275
 sctp_v6_xmit+0x313/0x660 net/sctp/ipv6.c:232
 sctp_packet_transmit+0x1bc4/0x36f0 net/sctp/output.c:641
 sctp_packet_singleton net/sctp/outqueue.c:787 [inline]
 sctp_outq_flush_ctrl.constprop.0+0x6d4/0xd50 net/sctp/outqueue.c:918
 sctp_outq_flush+0xe8/0x2780 net/sctp/outqueue.c:1200
 sctp_outq_uncork+0x6c/0x80 net/sctp/outqueue.c:772
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
 sctp_do_sm+0x559/0x53e0 net/sctp/sm_sideeffect.c:1191
 sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88
 __sctp_connect+0x8cd/0xce0 net/sctp/socket.c:1226
 __sctp_setsockopt_connectx+0x133/0x1a0 net/sctp/socket.c:1349
 sctp_setsockopt_connectx_old net/sctp/socket.c:1365 [inline]
 sctp_setsockopt net/sctp/socket.c:4656 [inline]
 sctp_setsockopt+0x22cc/0x6d20 net/sctp/socket.c:4620
 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3120
 __sys_setsockopt+0x180/0x280 net/socket.c:2046
 __do_sys_setsockopt net/socket.c:2057 [inline]
 __se_sys_setsockopt net/socket.c:2054 [inline]
 __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2054
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440189
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffe68aade98 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440189
RDX: 000000000000006b RSI: 0000000000000084 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 000000000000001c R09: 00000000004002c8

Crashes (18807):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/05 03:58 net-next-old 847d44efad07 e5d1b3ac .config console log report syz C ci-upstream-net-kasan-gce
2019/04/04 20:50 net-next-old 4950c2ba49cc 6a475fff .config console log report syz C ci-upstream-net-kasan-gce
2019/04/04 19:20 net-next-old 4950c2ba49cc 6a475fff .config console log report syz C ci-upstream-net-kasan-gce
2019/04/04 16:26 net-next-old 4950c2ba49cc 6a475fff .config console log report syz C ci-upstream-net-kasan-gce
2019/04/03 18:58 net-next-old e142723700ba dfd3394d .config console log report syz C ci-upstream-net-kasan-gce
2019/04/02 20:46 net-next-old e142723700ba dfd3394d .config console log report syz C ci-upstream-net-kasan-gce
2019/04/02 20:09 net-next-old e142723700ba dfd3394d .config console log report syz C ci-upstream-net-kasan-gce
2019/04/02 19:59 net-next-old e142723700ba dfd3394d .config console log report syz C ci-upstream-net-kasan-gce
2019/04/05 10:07 net-next-old 847d44efad07 e5d1b3ac .config console log report ci-upstream-net-kasan-gce
2019/04/02 09:09 net-next-old e142723700ba a9ca43d4 .config console log report ci-upstream-net-kasan-gce
2019/04/08 06:13 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 05:59 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 05:43 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 05:29 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 05:16 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 05:02 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 04:50 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 04:37 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 04:21 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 04:06 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 03:52 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 03:38 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 03:23 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 03:10 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 02:57 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 02:42 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 02:22 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 02:08 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 01:53 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 01:39 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 01:25 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 01:10 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 00:57 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 00:46 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 00:29 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 00:16 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 00:03 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 23:47 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 23:33 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 23:20 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 23:08 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 22:53 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 22:39 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 22:27 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 22:14 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 22:02 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 21:50 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 21:37 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 21:24 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 21:11 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/07 20:58 linux-next 81e0cd6a7f09 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.