syzbot


BUG: unable to handle kernel (2)

Status: fixed on 2018/04/06 16:37
Subsystems: net
[Documentation on labels]
Fix commit: c769accdf3d8 vlan: Fix vlan insertion for packets without ethernet header
First crash: 2218d, last: 2218d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 BUG: unable to handle kernel C inconclusive 2 1224d 1641d 0/1 upstream: reported C repro on 2019/10/25 23:52
upstream BUG: unable to handle kernel (3) mm C 2 2120d 2156d 0/26 closed as invalid on 2019/06/10 23:32
upstream BUG: unable to handle kernel 1 2424d 2424d 0/26 closed as invalid on 2017/09/03 08:49

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
kasan: CONFIG_KASAN_INLINE enabled
BUG: unable to handle kernel 
kasan: GPF could be caused by NULL-ptr deref or user memory access
paging request at ffff8801b4435000
IP: __memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43
PGD 9cee067 P4D 9cee067 PUD 1ba6a6063 PMD 1d158f063 PTE 80000001b4435161
Oops: 0003 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4326 Comm: syz-executor4 Not tainted 4.16.0-rc7+ #278
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43
RSP: 0018:ffff8801bcc2edd8 EFLAGS: 00010287
RAX: ffff8801b3b950c4 RBX: fffffffffffffffe RCX: ffffffffff7600c2
RDX: fffffffffffffffe RSI: ffff8801b4434ffc RDI: ffff8801b4435000
RBP: ffff8801bcc2edf8 R08: ffff8801b3b950be R09: ffffed0036772a19
R10: 0000000000000001 R11: ffffed0036772a18 R12: ffff8801b3b950c4
R13: ffff8801b3b950c0 R14: ffff8801bc67ae86 R15: ffff8801bc67adc0
FS:  0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f7f33b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff8801b4435000 CR3: 00000001bee22001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 memmove include/linux/string.h:360 [inline]
 skb_reorder_vlan_header net/core/skbuff.c:5031 [inline]
 skb_vlan_untag+0x470/0xc40 net/core/skbuff.c:5061
 __netif_receive_skb_core+0x119c/0x3460 net/core/dev.c:4460
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4627
 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4701
 netif_receive_skb+0xae/0x390 net/core/dev.c:4725
 tun_rx_batched.isra.50+0x5ee/0x870 drivers/net/tun.c:1555
 tun_get_user+0x299e/0x3c20 drivers/net/tun.c:1962
 tun_chr_write_iter+0xb9/0x160 drivers/net/tun.c:1990
 call_write_iter include/linux/fs.h:1782 [inline]
 new_sync_write fs/read_write.c:469 [inline]
 __vfs_write+0x684/0x970 fs/read_write.c:482
 vfs_write+0x189/0x510 fs/read_write.c:544
 SYSC_write fs/read_write.c:589 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:581
 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f37c99
RSP: 002b:00000000f7f3309c EFLAGS: 00000286 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020000180
RDX: 000000000000004a RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: 90 90 90 90 90 90 90 48 89 f8 48 83 fa 20 0f 82 03 01 00 00 48 39 fe 7d 0f 49 89 f0 49 01 d0 49 39 f8 0f 8f 9f 00 00 00 48 89 d1 <f3> a4 c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 3b 48 83 ea 20 
RIP: __memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43 RSP: ffff8801bcc2edd8
CR2: ffff8801b4435000
---[ end trace bba77f887fd99164 ]---
general protection fault: 0000 [#2] SMP KASAN
Dumping ftrace buffer:

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/03/27 22:15 upstream 3eb2ce825ea1 bf5e585c .config console log report syz ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.