syzbot

 sign-in | mailing list | source | docs
🐞 Open [995] ≡ Subsystems 🐞 Fixed [5242] 🐞 Invalid [12510] ⬇ Missing Backports [84] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in skb_clone (4)

Status: closed as invalid on 2022/10/12 18:15
Subsystems: net
[Documentation on labels]
First crash: 866d, last: 569d
Cause bisection: introduced by (bisect log) [merge commit]:
commit a26a9d8ab4f9edbdfb087a563b6613e9970ef0b0
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon Feb 22 17:00:03 2021 +0000

  Merge tag 'hwmon-for-v5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Crash: WARNING in kvm_wait (log)
Repro: C syz .config
  
▶ ▼ Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in skb_clone C 1 423d 557d 0/1 upstream: reported C repro on 2022/10/17 02:33
upstream general protection fault in skb_clone syz 3 2445d 2444d 3/26 fixed on 2017/10/24 19:00
upstream BUG: unable to handle kernel paging request in skb_clone net 2 987d 1031d 0/26 closed as invalid on 2021/10/04 21:36
upstream general protection fault in skb_clone (3) net 44 1429d 1431d 15/26 fixed on 2020/07/17 17:58
linux-4.19 general protection fault in skb_clone C error 2 557d 866d 0/1 upstream: reported C repro on 2021/12/12 07:38
upstream general protection fault in skb_clone (2) hams 1 1613d 1610d 0/26 auto-closed as invalid on 2020/03/25 12:28
upstream general protection fault in skb_clone (5) net C done 7 542d 560d 22/26 fixed on 2023/02/24 13:50
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2022/08/02 05:06 22m bisect fix upstream job log (0) log
2022/03/24 09:50 19m bisect fix upstream job log (0) log

Sample crash report:
RSP: 002b:00007fff57b81668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007faeeb3afd83
RDX: 000000000000000e RSI: 0000000020000100 RDI: 00000000000000c8
RBP: 00007fff57b81690 R08: 0000000000000000 R09: 0000000000000001
R10: 00007fff57b81407 R11: 0000000000000246 R12: 0000000000000003
R13: 00007fff57b816b0 R14: 00007fff57b816a0 R15: 00007fff57b8167c
 </TASK>
general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
CPU: 1 PID: 3615 Comm: syz-executor119 Not tainted 5.18.0-rc1-syzkaller-00016-g3e732ebf7316 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:skb_clone+0x107/0x3c0 net/core/skbuff.c:1512
Code: 00 00 49 8b 5c 24 28 48 85 db 0f 85 ec 00 00 00 e8 2e 9d 40 fa 4c 8d 7d 7e 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <0f> b6 04 02 4c 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 d3 01 00 00
RSP: 0018:ffffc9000389f488 EFLAGS: 00010217
RAX: dffffc0000000000 RBX: ffffc9000389f598 RCX: 0000000000000000
RDX: 000000000000000f RSI: ffffffff87388592 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000140 R09: ffffffff8bed9373
R10: fffffbfff17db26e R11: 0000000000000000 R12: ffff8880247e6c80
R13: 0000000000000a20 R14: ffff8880247e6d48 R15: 000000000000007e
FS:  00005555569b1300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faeeb423dd0 CR3: 00000000247e4000 CR4: 0000000000350ee0
Call Trace:
 <TASK>
 hsr_get_untagged_frame+0x4e/0x5a0 net/hsr/hsr_forward.c:164
 hsr_forward_do net/hsr/hsr_forward.c:461 [inline]
 hsr_forward_skb+0xc78/0x1c60 net/hsr/hsr_forward.c:623
 hsr_handle_frame+0x565/0x790 net/hsr/hsr_slave.c:69
 __netif_receive_skb_core+0xa8c/0x3a60 net/core/dev.c:5297
 __netif_receive_skb_one_core+0xae/0x180 net/core/dev.c:5403
 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519
 netif_receive_skb_internal net/core/dev.c:5605 [inline]
 netif_receive_skb+0x13e/0x8e0 net/core/dev.c:5664
 tun_rx_batched.isra.0+0x460/0x720 drivers/net/tun.c:1534
 tun_get_user+0x28b7/0x3e30 drivers/net/tun.c:1985
 tun_chr_write_iter+0xdb/0x200 drivers/net/tun.c:2015
 call_write_iter include/linux/fs.h:2050 [inline]
 new_sync_write+0x38a/0x560 fs/read_write.c:504
 vfs_write+0x7c0/0xac0 fs/read_write.c:591
 ksys_write+0x127/0x250 fs/read_write.c:644
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7faeeb3afd83
Code: e9 0e ec ff ff bf 01 00 00 00 e8 a8 6f 00 00 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007fff57b81668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007faeeb3afd83
RDX: 000000000000000e RSI: 0000000020000100 RDI: 00000000000000c8
RBP: 00007fff57b81690 R08: 0000000000000000 R09: 0000000000000001
R10: 00007fff57b81407 R11: 0000000000000246 R12: 0000000000000003
R13: 00007fff57b816b0 R14: 00007fff57b816a0 R15: 00007fff57b8167c
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_clone+0x107/0x3c0 net/core/skbuff.c:1512
Code: 00 00 49 8b 5c 24 28 48 85 db 0f 85 ec 00 00 00 e8 2e 9d 40 fa 4c 8d 7d 7e 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <0f> b6 04 02 4c 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 d3 01 00 00
RSP: 0018:ffffc9000389f488 EFLAGS: 00010217
RAX: dffffc0000000000 RBX: ffffc9000389f598 RCX: 0000000000000000
RDX: 000000000000000f RSI: ffffffff87388592 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000140 R09: ffffffff8bed9373
R10: fffffbfff17db26e R11: 0000000000000000 R12: ffff8880247e6c80
R13: 0000000000000a20 R14: ffff8880247e6d48 R15: 000000000000007e
FS:  00005555569b1300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faeeb423dd0 CR3: 00000000247e4000 CR4: 0000000000350ee0
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	49 8b 5c 24 28       	mov    0x28(%r12),%rbx
   7:	48 85 db             	test   %rbx,%rbx
   a:	0f 85 ec 00 00 00    	jne    0xfc
  10:	e8 2e 9d 40 fa       	callq  0xfa409d43
  15:	4c 8d 7d 7e          	lea    0x7e(%rbp),%r15
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	4c 89 fa             	mov    %r15,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	4c 89 fa             	mov    %r15,%rdx
  31:	83 e2 07             	and    $0x7,%edx
  34:	38 d0                	cmp    %dl,%al
  36:	7f 08                	jg     0x40
  38:	84 c0                	test   %al,%al
  3a:	0f 85 d3 01 00 00    	jne    0x213

Crashes (41):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/04/07 21:56 upstream 3e732ebf7316 c6ff3e05 .config console log report syz C ci-upstream-kasan-gce-root general protection fault in skb_clone
2021/12/14 05:26 upstream 5472f14a3742 5d14b1ea .config console log report syz C ci-upstream-kasan-gce general protection fault in skb_clone
2021/12/12 07:59 net-old ee60e626d536 49ca1f59 .config console log report syz C ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2021/12/12 06:50 net-next-old 77ab714f0070 49ca1f59 .config console log report syz C ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/05/14 16:46 linux-next 1e1b28b936ae 744a39e2 .config strace log report syz C ci-upstream-linux-next-kasan-gce-root general protection fault in skb_clone
2022/05/31 21:23 upstream 8ab2afa23bd1 af70c3a9 .config console log report info ci-upstream-kasan-gce general protection fault in skb_clone
2022/03/31 06:36 upstream 787af64d05cd 9d49f3a7 .config console log report info ci-upstream-kasan-gce-root general protection fault in skb_clone
2022/02/20 01:08 upstream 4f12b742eb2b 3cd800e4 .config console log report info ci-upstream-kasan-gce-root general protection fault in skb_clone
2022/01/19 00:58 upstream 99613159ad74 731a2d23 .config console log report info ci-upstream-kasan-gce general protection fault in skb_clone
2022/01/13 13:44 upstream f079ab01b560 44d1319a .config console log report info ci-upstream-kasan-gce-root general protection fault in skb_clone
2022/01/11 04:14 upstream 133d9c53c9dc ddb0ab8c .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in skb_clone
2021/12/16 05:12 upstream 2b14864acbaa 572bcb40 .config console log report info ci-upstream-kasan-gce general protection fault in skb_clone
2022/10/05 02:48 net-old 93e2be344a7d eab8f949 .config console log report info [disk image] [vmlinux] ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/09/06 02:19 net-old beb432528c79 9dcd38fc .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/08/26 01:59 net-old 0cf731f9ebb5 9b5bf4cd .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/06/21 23:37 net-old 69135c572d1f 0fc5c330 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/05/24 19:40 net-old 7fb0269720d7 fcfad4ff .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/05/23 04:45 net-old c12b95885ab2 7268fa62 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/04/21 07:47 net-old 5e6242151d7f d4befee1 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/01/20 21:39 net-old fa2e1ba3e9e3 b838eb76 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/01/18 12:11 net-old 5765cee119bf 731a2d23 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/01/16 02:41 net-old 9a9acdccdfa4 723cfaf0 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/01/06 09:37 net-old 502a2ce9cdf4 6acc789a .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/01/03 03:06 net-old 29262e1f773b e1768e9c .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2021/12/27 15:24 net-old c1833c3964d5 5140bd58 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2021/12/25 15:02 net-old b45396afa417 6caa12e4 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2021/12/22 02:19 net-old 1c15b05baea7 6caa12e4 .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2021/12/21 01:34 net-old 75a2f3152009 62bd192b .config console log report info ci-upstream-net-this-kasan-gce general protection fault in skb_clone
2022/09/30 10:31 net-next-old 510bbf82f8dc 1d385642 .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/07/03 05:06 net-next-old 04740c53cac4 1434eec0 .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/07/01 17:38 net-next-old 087b79854b9b 1434eec0 .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/06/25 22:33 net-next-old ebeae54d3a77 a371c43c .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/06/24 23:02 net-next-old 93817be8b62c a5dbd430 .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/06/24 22:04 net-next-old 93817be8b62c a5dbd430 .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/06/24 15:00 net-next-old 93817be8b62c a5dbd430 .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/02/22 05:31 net-next-old 7b779cc8846a 6e821dbf .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/02/20 15:50 net-next-old 48c77bdf729a 3cd800e4 .config console log report info ci-upstream-net-kasan-gce general protection fault in skb_clone
2022/02/17 09:24 linux-next ef6b35306dd8 2bea8a27 .config console log report info ci-upstream-linux-next-kasan-gce-root general protection fault in skb_clone
2022/09/23 17:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d2cd2931d2fd 0042f2b4 .config console log report info ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in skb_clone
2022/08/30 00:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a41a877bc12d 5b44472d .config console log report info ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in skb_clone
2022/08/24 00:13 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 1c23f9e627a7 cea8b0f7 .config console log report info ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in skb_clone
* Struck through repros no longer work on HEAD.