syzbot

 sign-in | mailing list | source | docs
🐞 Open [987] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel paging request in do_xdp_generic

Status: fixed on 2020/07/17 17:58
Fix commit: 96aa1b22bd6b tun: correct header offsets in napi frags mode
First crash: 1558d, last: 1452d
Cause bisection: introduced by (bisect log) :
commit 58956317c8de52009d1a38a721474c24aef74fe7
Author: David Ahern <dsahern@gmail.com>
Date: Fri Dec 7 20:24:57 2018 +0000

  neighbor: Improve garbage collection

Crash: KASAN: use-after-free Read in neigh_mark_dead (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit 96aa1b22bd6bb9fccf62f6261f390ed6f3e7967f
Author: Willem de Bruijn <willemb@google.com>
Date: Sat May 30 19:41:31 2020 +0000

  tun: correct header offsets in napi frags mode

  
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 BUG: unable to handle kernel paging request in do_xdp_generic C 189 1528d 1558d 1/2 fixed on 2021/10/12 13:38

Sample crash report:
BUG: unable to handle page fault for address: ffff887f87dfffff
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7076 Comm: syz-executor537 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:is_multicast_ether_addr_64bits include/linux/etherdevice.h:135 [inline]
RIP: 0010:netif_receive_generic_xdp net/core/dev.c:4555 [inline]
RIP: 0010:do_xdp_generic.part.0+0x45f/0x1780 net/core/dev.c:4652
Code: 4c 89 f8 4c 29 f0 4c 89 ac 24 b0 00 00 00 48 89 84 24 b8 00 00 00 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 bd 10 00 00 <49> 8b 45 00 49 8d 7d 0c 48 ba 00 00 00 00 00 fc ff df 48 89 44 24
RSP: 0018:ffffc90001867648 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff888087dfffff RCX: 00000000ffff0101
RDX: 1ffff10ff0fbffff RSI: ffffffff8621a610 RDI: 0000000000000005
RBP: ffff88809140b1c0 R08: ffff88808a3701c0 R09: ffffed1010fbe7dd
R10: ffff888087df3ee3 R11: ffffed1010fbe7dc R12: ffffc90000e8e000
R13: ffff887f87dfffff R14: 0000000000000100 R15: ffff888087df0100
FS:  00007effe1b7b700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff887f87dfffff CR3: 000000009cb90000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_xdp_generic+0x2b/0x40 net/core/dev.c:4647
 tun_get_user+0x2993/0x3c70 drivers/net/tun.c:1901
 tun_chr_write_iter+0xba/0x151 drivers/net/tun.c:1992
 call_write_iter include/linux/fs.h:1907 [inline]
 new_sync_write+0x4a2/0x700 fs/read_write.c:484
 __vfs_write+0xc9/0x100 fs/read_write.c:497
 __kernel_write+0x11c/0x3a0 fs/read_write.c:516
 write_pipe_buf+0x153/0x1e0 fs/splice.c:809
 splice_from_pipe_feed fs/splice.c:512 [inline]
 __splice_from_pipe+0x3e6/0x7b0 fs/splice.c:636
 splice_from_pipe+0xd9/0x140 fs/splice.c:671
 default_file_splice_write+0x37/0x90 fs/splice.c:821
 do_splice_from fs/splice.c:863 [inline]
 do_splice+0xb2e/0x1550 fs/splice.c:1170
 __do_sys_splice fs/splice.c:1447 [inline]
 __se_sys_splice fs/splice.c:1427 [inline]
 __x64_sys_splice+0x2c1/0x330 fs/splice.c:1427
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x4464c9
Code: e8 1c ba 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab 0e fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007effe1b7ad98 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 00000000006dbc78 RCX: 00000000004464c9
RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000006dbc70 R08: 0000000000010008 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc7c
R13: 0000000000003172 R14: 656c6c616b7a7973 R15: 0000000000000064
Modules linked in:
CR2: ffff887f87dfffff
---[ end trace 0611c69468c3b7e8 ]---
RIP: 0010:is_multicast_ether_addr_64bits include/linux/etherdevice.h:135 [inline]
RIP: 0010:netif_receive_generic_xdp net/core/dev.c:4555 [inline]
RIP: 0010:do_xdp_generic.part.0+0x45f/0x1780 net/core/dev.c:4652
Code: 4c 89 f8 4c 29 f0 4c 89 ac 24 b0 00 00 00 48 89 84 24 b8 00 00 00 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 bd 10 00 00 <49> 8b 45 00 49 8d 7d 0c 48 ba 00 00 00 00 00 fc ff df 48 89 44 24
RSP: 0018:ffffc90001867648 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff888087dfffff RCX: 00000000ffff0101
RDX: 1ffff10ff0fbffff RSI: ffffffff8621a610 RDI: 0000000000000005
RBP: ffff88809140b1c0 R08: ffff88808a3701c0 R09: ffffed1010fbe7dd
R10: ffff888087df3ee3 R11: ffffed1010fbe7dc R12: ffffc90000e8e000
R13: ffff887f87dfffff R14: 0000000000000100 R15: ffff888087df0100
FS:  00007effe1b7b700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff887f87dfffff CR3: 000000009cb90000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (7444):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/05 00:33 upstream 9851a0dee7c2 9941337c .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/05/03 09:10 upstream f66ed1ebbfde 5457883a .config console log report syz C ci-upstream-kasan-gce-root
2020/02/16 14:09 upstream db70e26e33ee cf914200 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/02/15 07:35 upstream 2019fc96af22 5d7b90f1 .config console log report syz C ci-upstream-kasan-gce-root
2020/02/15 07:00 upstream 2019fc96af22 5d7b90f1 .config console log report syz C ci-upstream-kasan-gce-root
2020/02/11 07:08 upstream 0a679e13ea30 084454ae .config console log report syz C ci-upstream-kasan-gce-root
2020/02/09 11:05 upstream fdfa3a6778b1 6ece2ea5 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/02/07 20:02 upstream 90568ecf5615 06150bf1 .config console log report syz C ci-upstream-kasan-gce-root
2020/02/07 13:21 upstream 90568ecf5615 06150bf1 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/02/05 03:40 upstream 33b40134e5cf 93e5e335 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/31 18:09 upstream ccaaaf6fe5a5 5ed23f9a .config console log report syz C ci-upstream-kasan-gce-root
2020/01/30 15:10 upstream 39bed42de2e7 5ed23f9a .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/29 21:18 upstream b3a608222336 5ed23f9a .config console log report syz C ci-upstream-kasan-gce-root
2020/01/22 20:08 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/22 14:43 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/22 08:03 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/22 06:15 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/22 00:00 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/21 20:44 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/21 19:55 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/21 16:22 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/21 14:31 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/21 13:29 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/21 11:12 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/21 10:22 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/21 08:36 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/21 04:23 upstream def9d2780727 d2557fb5 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/21 02:12 upstream def9d2780727 d2557fb5 .config console log report syz C ci-upstream-kasan-gce-root
2020/01/19 09:31 upstream 244dc2689085 bc8bc756 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/04/12 07:33 net-old 3b72f84f8fb6 a8c6a3f8 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/02/14 01:01 net-old 6ee2deb6fbed c5ed587f .config console log report syz C ci-upstream-net-this-kasan-gce
2020/02/09 12:44 net-old fdfa3a6778b1 6ece2ea5 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/02/05 17:15 net-old 52b5ae501c04 662cf49a .config console log report syz C ci-upstream-net-this-kasan-gce
2020/02/03 12:38 net-old 83d0585f91da 93e5e335 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/01/28 01:38 net-old 2821e26f3a0a 56cd6c9b .config console log report syz C ci-upstream-net-this-kasan-gce
2020/02/13 23:08 net-next-old fdfa3a6778b1 c5ed587f .config console log report syz C ci-upstream-net-kasan-gce
2020/02/13 22:32 net-next-old fdfa3a6778b1 c5ed587f .config console log report syz C ci-upstream-net-kasan-gce
2020/02/09 12:43 net-next-old fdfa3a6778b1 6ece2ea5 .config console log report syz C ci-upstream-net-kasan-gce
2020/02/06 02:13 net-next-old 33b40134e5cf 662cf49a .config console log report syz C ci-upstream-net-kasan-gce
2020/02/03 12:19 net-next-old 9f68e3655aae 93e5e335 .config console log report syz C ci-upstream-net-kasan-gce
2020/01/28 01:39 net-next-old 8e5aa6173ad3 56cd6c9b .config console log report syz C ci-upstream-net-kasan-gce
2020/01/19 09:22 net-next-old 9aaa29494030 bc8bc756 .config console log report syz C ci-upstream-net-kasan-gce
2020/05/04 16:38 linux-next ac935d227366 58ae5e18 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/02/17 04:19 linux-next 9f01828e9e16 1f448cd6 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/02/15 03:28 linux-next 9f01828e9e16 5d7b90f1 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/01/21 13:44 upstream d96d875ef5dd 8eda0b95 .config console log report syz ci-upstream-kasan-gce-root
2020/02/18 11:56 upstream 11a48a5a18c6 1ce142dc .config console log report ci-upstream-kasan-gce-root
2020/02/18 06:34 upstream 11a48a5a18c6 1ce142dc .config console log report ci-upstream-kasan-gce-root
2020/04/19 20:12 net-old 9bacd256f135 6dfd45e1 .config console log report ci-upstream-net-this-kasan-gce
2020/04/18 18:17 net-old 2fcd80144b93 365fba24 .config console log report ci-upstream-net-this-kasan-gce
2020/03/09 15:01 net-old 17c25cafd4d3 2e9971bb .config console log report ci-upstream-net-this-kasan-gce
2020/02/18 07:42 net-old a81541041ceb 1ce142dc .config console log report ci-upstream-net-this-kasan-gce
2020/02/18 02:11 net-old a81541041ceb 1ce142dc .config console log report ci-upstream-net-this-kasan-gce
2020/02/18 01:29 net-old a81541041ceb 1ce142dc .config console log report ci-upstream-net-this-kasan-gce
2020/02/18 01:07 net-old a81541041ceb 1ce142dc .config console log report ci-upstream-net-this-kasan-gce
2020/02/17 23:42 net-old 0d4597c8c5ab 2b411596 .config console log report ci-upstream-net-this-kasan-gce
2020/02/17 22:16 net-old 0d4597c8c5ab 2b411596 .config console log report ci-upstream-net-this-kasan-gce
2020/02/17 14:15 net-old 0d4597c8c5ab 2b411596 .config console log report ci-upstream-net-this-kasan-gce
2020/02/17 11:32 net-old 0d4597c8c5ab 2b411596 .config console log report ci-upstream-net-this-kasan-gce
2020/02/17 10:12 net-old 0d4597c8c5ab 2b411596 .config console log report ci-upstream-net-this-kasan-gce
2020/02/17 09:07 net-old 0d4597c8c5ab 1f448cd6 .config console log report ci-upstream-net-this-kasan-gce
2020/02/17 08:00 net-old 0d4597c8c5ab 1f448cd6 .config console log report ci-upstream-net-this-kasan-gce
2020/04/27 18:36 net-next-old 3fd8dc269ff0 0ce7569e .config console log report ci-upstream-net-kasan-gce
2020/04/24 13:46 net-next-old 493f3cc7ee02 03d97a1b .config console log report ci-upstream-net-kasan-gce
2020/04/22 10:22 net-next-old 44dd5efc97da 2e44d63e .config console log report ci-upstream-net-kasan-gce
2020/03/28 20:47 net-next-old 1a147b74c2fd f1ebdfba .config console log report ci-upstream-net-kasan-gce
2020/03/25 09:08 net-next-old cd556e40fdf3 41f049cc .config console log report ci-upstream-net-kasan-gce
2020/02/18 12:59 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 12:56 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 11:06 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 11:03 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 10:00 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 09:52 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 08:45 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 06:15 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 04:49 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/18 03:34 net-next-old 725d23b59cd1 1ce142dc .config console log report ci-upstream-net-kasan-gce
2020/02/17 22:41 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 21:13 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 20:19 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 19:19 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 17:28 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 16:28 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 15:28 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 13:02 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 11:47 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 10:28 net-next-old ce7805513d90 2b411596 .config console log report ci-upstream-net-kasan-gce
2020/02/17 07:36 net-next-old ce7805513d90 1f448cd6 .config console log report ci-upstream-net-kasan-gce
2020/02/17 06:57 net-next-old ce7805513d90 1f448cd6 .config console log report ci-upstream-net-kasan-gce
2020/01/19 08:11 net-next-old 9aaa29494030 bc8bc756 .config console log report ci-upstream-net-kasan-gce
2020/02/17 18:40 linux-next c25a951c50dc 2b411596 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.