syzbot


general protection fault in batadv_iv_ogm_schedule

Status: fixed on 2020/04/15 17:19
Subsystems: batman
[Documentation on labels]
Reported-by: syzbot+ac36b6a33c28a491e929@syzkaller.appspotmail.com
Fix commit: 8e8ce08198de batman-adv: Don't schedule OGM for disabled interface
First crash: 1539d, last: 1525d
Discussions (13)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 5.4 01/73] cgroup-v1: cgroup_pidlist_next should update position index 80 (80) 2020/04/08 09:48
[PATCH 4.4 00/93] 4.4.217-rc1 review 100 (100) 2020/03/21 07:12
[PATCH 4.9 00/90] 4.9.217-rc1 review 94 (94) 2020/03/21 00:48
[PATCH 4.14 00/99] 4.14.174-rc1 review 103 (103) 2020/03/21 00:44
[PATCH 4.19 00/89] 4.19.111-rc1 review 97 (97) 2020/03/19 10:04
[PATCH AUTOSEL 4.9 01/15] batman-adv: Don't schedule OGM for disabled interface 15 (15) 2020/03/18 20:56
[PATCH AUTOSEL 4.14 01/28] cgroup-v1: cgroup_pidlist_next should update position index 28 (28) 2020/03/18 20:55
[PATCH AUTOSEL 4.19 01/37] cgroup-v1: cgroup_pidlist_next should update position index 37 (37) 2020/03/18 20:55
[PATCH AUTOSEL 5.5 01/84] cgroup-v1: cgroup_pidlist_next should update position index 8 (8) 2020/03/18 20:52
[PATCH 5.5 000/151] 5.5.10-rc1 review 158 (158) 2020/03/18 10:00
[PATCH 5.4 000/123] 5.4.26-rc1 review 127 (127) 2020/03/18 00:04
[PATCH 0/1] pull request for net: batman-adv 2020-03-06 3 (3) 2020/03/10 02:25
general protection fault in batadv_iv_ogm_schedule 0 (1) 2020/02/08 18:58
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in batadv_iv_ogm_schedule 4 1499d 1555d 0/1 auto-closed as invalid on 2020/07/17 09:16
upstream general protection fault in batadv_iv_ogm_schedule (2) batman 1 1324d 1324d 0/26 auto-closed as invalid on 2021/01/08 06:33

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 47 Comm: kworker/u4:2 Not tainted 5.6.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
RIP: 0010:batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:814 [inline]
RIP: 0010:batadv_iv_ogm_schedule+0x220/0xf00 net/batman-adv/bat_iv_ogm.c:865
Code: e8 c5 41 bf f9 4c 89 ad 60 ff ff ff 4d 8b 75 00 66 41 c1 c7 08 49 8d 5e 16 48 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 8a 04 28 84 c0 0f 85 e0 0b 00 00 66 44 89 3b 4c 89 a5 78 ff ff
RSP: 0018:ffffc90000f97b78 EFLAGS: 00010203
RAX: 0000000000000002 RBX: 0000000000000016 RCX: 1ffff11013463d11
RDX: 0000000000000000 RSI: ffff8880a9606ef0 RDI: 0000000000000282
RBP: ffffc90000f97c38 R08: dffffc0000000000 R09: fffffbfff12d36e5
R10: fffffbfff12d36e5 R11: 0000000000000000 R12: ffff88809a31e800
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc66a47ff8 CR3: 000000009fe80000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 batadv_iv_send_outstanding_bat_ogm_packet+0x664/0x770 net/batman-adv/bat_iv_ogm.c:1718
 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264
 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410
 kthread+0x332/0x350 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 89842ccefd032021 ]---
RIP: 0010:batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:814 [inline]
RIP: 0010:batadv_iv_ogm_schedule+0x220/0xf00 net/batman-adv/bat_iv_ogm.c:865
Code: e8 c5 41 bf f9 4c 89 ad 60 ff ff ff 4d 8b 75 00 66 41 c1 c7 08 49 8d 5e 16 48 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 8a 04 28 84 c0 0f 85 e0 0b 00 00 66 44 89 3b 4c 89 a5 78 ff ff
RSP: 0018:ffffc90000f97b78 EFLAGS: 00010203
RAX: 0000000000000002 RBX: 0000000000000016 RCX: 1ffff11013463d11
RDX: 0000000000000000 RSI: ffff8880a9606ef0 RDI: 0000000000000282
RBP: ffffc90000f97c38 R08: dffffc0000000000 R09: fffffbfff12d36e5
R10: fffffbfff12d36e5 R11: 0000000000000000 R12: ffff88809a31e800
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc66a47ff8 CR3: 0000000062e41000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/22 00:13 upstream b0dd1eb220c0 2ffa6679 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/08 16:41 upstream f757165705e9 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.