syzbot

 sign-in | mailing list | source | docs
🐞 Open [994] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12516] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in free_percpu

Status: fixed on 2022/03/08 16:11
Subsystems: net
[Documentation on labels]
Fix commit: 158b515f703e tun: avoid double free in tun_free_netdev
First crash: 1115d, last: 848d
Cause bisection: introduced by (bisect log) [no-op commit]:
commit a51482458dafb836dbf7c8ae3200ca8db7348201
Author: Zhan Liu <zhan.liu@amd.com>
Date: Mon Jun 14 18:54:14 2021 +0000

  drm/amd/display: Enabling eDP no power sequencing with DAL feature mask

Crash: general protection fault in free_percpu (log)
Repro: syz .config
  
Fix bisection: fixed by (bisect log) :
commit 158b515f703e75e7d68289bf4d98c664e1d632df
Author: George Kennedy <george.kennedy@oracle.com>
Date: Thu Dec 16 18:25:32 2021 +0000

  tun: avoid double free in tun_free_netdev

  
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 general protection fault in free_percpu C 2 1202d 1202d 0/2 auto-obsoleted due to no activity on 2023/04/17 16:54
android-6-1 general protection fault in free_percpu 1 291d 291d 0/2 auto-obsoleted due to no activity on 2023/10/08 15:48
upstream general protection fault in free_percpu (2) wireless 1 470d 470d 22/26 fixed on 2023/06/08 14:41

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 PID: 10800 Comm: syz-executor.3 Not tainted 5.14.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:pcpu_get_page_chunk mm/percpu.c:267 [inline]
RIP: 0010:pcpu_chunk_addr_search mm/percpu.c:1626 [inline]
RIP: 0010:free_percpu mm/percpu.c:2285 [inline]
RIP: 0010:free_percpu+0x182/0x10b0 mm/percpu.c:2268
Code: 80 3c 02 00 0f 85 8e 0e 00 00 48 8b 3b 48 01 ef e8 e3 0f 0a 00 48 ba 00 00 00 00 00 fc ff df 48 8d 78 20 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 36 0e 00 00 48 8b 58 20 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc90001a97c18 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88823ffe3c00 RCX: 0000000000000004
RDX: dffffc0000000000 RSI: ffffffff81afb6bf RDI: 0000000000000020
RBP: ffffe8fffc239600 R08: 0000000000000000 R09: 0000000000000003
R10: ffffffff81afb840 R11: 0000000000000002 R12: ffff8880b9c53000
R13: 0000607f42639600 R14: ffff88823ffe3a08 R15: 0000000000000003
FS:  00007f040dec3700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000543db8 CR3: 0000000035dc8000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 tun_free_netdev+0x78/0x140 drivers/net/tun.c:2203
 netdev_run_todo+0x6b4/0xa80 net/core/dev.c:10643
 __tun_chr_ioctl.isra.0+0x9c4/0x4270 drivers/net/tun.c:3297
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:1069 [inline]
 __se_sys_ioctl fs/ioctl.c:1055 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:1055
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f040dec3188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665e9
RDX: 0000000020000040 RSI: 00000000400454ca RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c038
R13: 00007fff8ac0e52f R14: 00007f040dec3300 R15: 0000000000022000
Modules linked in:
---[ end trace 749e09b7ab3026ba ]---
RIP: 0010:pcpu_get_page_chunk mm/percpu.c:267 [inline]
RIP: 0010:pcpu_chunk_addr_search mm/percpu.c:1626 [inline]
RIP: 0010:free_percpu mm/percpu.c:2285 [inline]
RIP: 0010:free_percpu+0x182/0x10b0 mm/percpu.c:2268
Code: 80 3c 02 00 0f 85 8e 0e 00 00 48 8b 3b 48 01 ef e8 e3 0f 0a 00 48 ba 00 00 00 00 00 fc ff df 48 8d 78 20 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 36 0e 00 00 48 8b 58 20 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc90001a97c18 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88823ffe3c00 RCX: 0000000000000004
RDX: dffffc0000000000 RSI: ffffffff81afb6bf RDI: 0000000000000020
RBP: ffffe8fffc239600 R08: 0000000000000000 R09: 0000000000000003
R10: ffffffff81afb840 R11: 0000000000000002 R12: ffff8880b9c53000
R13: 0000607f42639600 R14: ffff88823ffe3a08 R15: 0000000000000003
FS:  00007f040dec3700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000543db8 CR3: 0000000035dc8000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (80):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/29 23:46 bpf fc16a5322ee6 b44001ce .config console log report syz ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/09/21 10:16 upstream e8f71f89236e af796c18 .config console log report info ci-upstream-kasan-gce general protection fault in free_percpu
2021/12/30 20:46 bpf 819d11507f66 2e49f10d .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/28 16:41 bpf 819d11507f66 6b3c5e64 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/28 07:56 bpf 819d11507f66 6b3c5e64 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/26 19:57 bpf 819d11507f66 e4f103c4 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/22 04:58 bpf 819d11507f66 6caa12e4 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/17 19:48 bpf 0c3e24746055 44068e19 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/15 05:31 bpf f7abc4c8df8c f752fb53 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/13 01:23 bpf 0be2516f865f 49ca1f59 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/09 16:48 bpf a50e659b2a1b b54aa474 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/03 01:22 bpf 7d9b3ad424f4 61f86278 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/11/24 14:59 bpf c0d95d3380ee 545ab074 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/11/14 11:34 bpf ba05fd36b851 83f5c9b5 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/11/10 19:54 bpf fceb07950a7a 75b04091 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/10/20 22:19 bpf 732b74d64704 f111d03b .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/10/16 16:01 bpf 732b74d64704 0c5d9412 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/09/29 09:25 bpf 571fa247ab41 d82cb927 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/09/23 03:11 bpf 7c3a00911b3d 8cac236e .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/09/21 13:59 bpf bc23f7244817 169724fe .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/09/14 13:03 bpf 57f780f1c433 58d09404 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/09/11 19:36 bpf 57f780f1c433 5ae8508a .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/09/09 20:58 bpf 57f780f1c433 e2776ee4 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/09/08 18:39 bpf 57f780f1c433 e2776ee4 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/08/05 08:48 bpf a02215ce72a3 7f7bb950 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/08/05 08:09 bpf a02215ce72a3 7f7bb950 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/07/30 17:36 bpf b4f0c24a5eaf 6c236867 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/07/28 00:37 bpf f1fdee33f5b4 17d6ab15 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/07/16 17:23 bpf 20192d9c9f6a f115ae98 .config console log report info ci-upstream-bpf-kasan-gce general protection fault in free_percpu
2021/12/30 23:17 bpf-next 4b443bc1785f 2e49f10d .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/12/30 08:12 bpf-next 4b443bc1785f 6cc879d4 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/12/26 18:00 bpf-next 4b443bc1785f e4f103c4 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/12/24 21:25 bpf-next 4b443bc1785f 6caa12e4 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/12/21 14:20 bpf-next 4b443bc1785f a938f0b8 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/12/16 00:38 bpf-next 4b443bc1785f 572bcb40 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/12/13 13:37 bpf-next 4b443bc1785f 49ca1f59 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/12/11 06:49 bpf-next 666af7064562 49ca1f59 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/11/12 00:40 bpf-next 5577f24cb04a 75b04091 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/10/29 05:44 net-next-old a812a046c22d 2353a3ec .config console log report info ci-upstream-net-kasan-gce general protection fault in free_percpu
2021/10/24 12:53 bpf-next c825f5fee19c 282f03fb .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/10/22 16:56 bpf-next 29da17c48886 55f90bc6 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/10/20 06:34 bpf-next 32fa0efab63e 466b7db1 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/10/14 06:58 bpf-next 431bfb9ee3e2 5462d470 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/10/12 05:39 bpf-next 431bfb9ee3e2 838e7e2c .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/10/10 00:31 bpf-next 5319255b8df9 838e7e2c .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/10/03 09:15 bpf-next d636c8da2d60 db0f5787 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/29 18:11 bpf-next 3103836496e7 be530f6c .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/25 02:01 bpf-next 091037fb770e 8cac236e .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/22 01:47 bpf-next cf8980a36235 169724fe .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/17 09:10 bpf-next 336562752acc 5b989942 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/14 06:41 bpf-next 14bef1ab3037 58d09404 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/09 22:14 bpf-next 006a5099fc18 e2776ee4 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/09 01:21 bpf-next 006a5099fc18 e2776ee4 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/07 04:55 bpf-next 27151f177827 6ca60148 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/04 07:01 bpf-next a16ef91aa61a d236a457 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/09/03 05:22 bpf-next a16ef91aa61a 15cea0a3 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/31 04:42 bpf-next fca35b11e18a 8f58a0ef .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/28 19:26 bpf-next 47bb27a20d6e be2c130d .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/28 08:42 bpf-next 47bb27a20d6e d5a29e53 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/26 23:56 bpf-next 48b2e71c2e53 b318694d .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/26 07:50 bpf-next eb529c5b10b9 b599f2fc .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/24 22:59 bpf-next a6258837c8a8 b599f2fc .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/23 20:48 bpf-next d359902d5c35 b599f2fc .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/23 20:07 bpf-next d359902d5c35 b599f2fc .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/23 02:40 bpf-next f2a6ee924d26 b599f2fc .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/23 00:13 bpf-next f2a6ee924d26 b599f2fc .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/13 18:27 bpf-next 5236ad82962e 3fd2ea69 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/11 01:57 bpf-next 874be05f525e 6972b106 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/10 02:00 bpf-next c83ae15dc947 6972b106 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/09 03:08 bpf-next c83ae15dc947 6972b106 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/08/06 07:07 bpf-next 372642ea83ff d2d6e680 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/07/30 16:41 bpf-next f309b4ba989d c585c7b0 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/07/29 16:31 bpf-next 33b57e0cc78e b44001ce .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/07/27 04:25 bpf-next 793eccae89bb fd511809 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/07/23 15:30 bpf-next 724f17b7d45d bc5f1d88 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/07/22 17:01 bpf-next 807b8f0e24e6 302e51de .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/07/21 17:30 bpf-next 807b8f0e24e6 29c3f20f .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/07/21 00:39 bpf-next c39aa2159974 1b201b48 .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/06/28 23:26 bpf-next 328aac5ecd11 9d2ab5df .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
2021/04/08 01:29 bpf-next 957dca3df624 6a81331a .config console log report info ci-upstream-bpf-next-kasan-gce general protection fault in free_percpu
* Struck through repros no longer work on HEAD.