syzbot


BUG: unable to handle kernel NULL pointer dereference in fib_rules_lookup

Status: closed as invalid on 2018/09/05 12:51
Subsystems: net
[Documentation on labels]
First crash: 2445d, last: 2444d

Sample crash report:
kernel msg: ebtables bug: please report to author: bad policy
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
PGD 80000001ea317067 P4D 80000001ea317067 PUD 1f4561067 PMD 0 
Oops: 0000 [#1] SMP PTI
CPU: 1 PID: 6068 Comm: kworker/u4:4 Not tainted 4.18.0-rc8+ #32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: krdsd rds_connect_worker
RIP: 0010:fib_rules_lookup+0x45/0x2c0 net/core/fib_rules.c:286
Code: 49 89 fd e8 ed 23 e5 fe 4d 8d b5 88 00 00 00 49 8b 9d 88 00 00 00 4c 39 f3 75 0f e8 d5 23 e5 fe e9 d1 01 00 00 e8 cb 23 e5 fe <8b> 43 10 85 c0 74 14 41 3b 44 24 04 75 2d e8 b8 23 e5 fe eb 0b 66 
RSP: 0018:ffff8802119c3b50 EFLAGS: 00010213
RAX: ffffffff82318a53 RBX: 0000000000000000 RCX: ffff8802162a0000
RDX: 0000000000000000 RSI: ffff88020096de00 RDI: ffff8801ef9c0180
RBP: ffff8802119c3b88 R08: 00000000020000e0 R09: 0000000000000000
R10: ffff8801ebf8e5c0 R11: ffffffff824d2550 R12: ffff88020096de00
R13: ffff8801ef9c0180 R14: ffff8801ef9c0208 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 00000001f4fe6000 CR4: 00000000001406e0
Call Trace:
 __fib_lookup+0x6a/0xb0 net/ipv4/fib_rules.c:93
 fib_lookup include/net/ip_fib.h:322 [inline]
 ip_route_output_key_hash_rcu+0x17e/0xc00 net/ipv4/route.c:2434
 ip_route_output_key_hash+0x70/0x80 net/ipv4/route.c:2327
 __ip_route_output_key include/net/route.h:124 [inline]
 ip_route_connect include/net/route.h:303 [inline]
 tcp_v4_connect+0x1a1/0x5a0 net/ipv4/tcp_ipv4.c:232
 __inet_stream_connect+0xb1/0x440 net/ipv4/af_inet.c:655
 inet_stream_connect+0x3b/0x60 net/ipv4/af_inet.c:719
 rds_tcp_conn_path_connect+0x133/0x1b0 net/rds/tcp_connect.c:135
 rds_connect_worker+0x77/0xc0 net/rds/threads.c:175
 process_one_work+0x28e/0x580 kernel/workqueue.c:2153
 worker_thread+0x317/0x690 kernel/workqueue.c:2296
 kthread+0x127/0x140 kernel/kthread.c:247
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:415
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: 0000000000000010
---[ end trace 810704b3ae7f705b ]---
RIP: 0010:fib_rules_lookup+0x45/0x2c0 net/core/fib_rules.c:286
Code: 49 89 fd e8 ed 23 e5 fe 4d 8d b5 88 00 00 00 49 8b 9d 88 00 00 00 4c 39 f3 75 0f e8 d5 23 e5 fe e9 d1 01 00 00 e8 cb 23 e5 fe <8b> 43 10 85 c0 74 14 41 3b 44 24 04 75 2d e8 b8 23 e5 fe eb 0b 66 
RSP: 0018:ffff8802119c3b50 EFLAGS: 00010213
RAX: ffffffff82318a53 RBX: 0000000000000000 RCX: ffff8802162a0000
RDX: 0000000000000000 RSI: ffff88020096de00 RDI: ffff8801ef9c0180
RBP: ffff8802119c3b88 R08: 00000000020000e0 R09: 0000000000000000
R10: ffff8801ebf8e5c0 R11: ffffffff824d2550 R12: ffff88020096de00
R13: ffff8801ef9c0180 R14: ffff8801ef9c0208 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 00000001f4fe6000 CR4: 00000000001406e0

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/08/09 13:30 https://github.com/google/kmsan.git master 0cc51dc9a291 2eeda842 .config console log report ci-upstream-kmsan-gce
2018/08/09 08:59 https://github.com/google/kmsan.git master 0cc51dc9a291 2eeda842 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.