syzbot


BUG: unable to handle kernel paging request in netif_receive_generic_xdp

Status: fixed on 2020/07/27 11:41
Fix commit: 96aa1b22bd6b tun: correct header offsets in napi frags mode
First crash: 1531d, last: 1394d
Cause bisection: introduced by (bisect log) :
commit 58956317c8de52009d1a38a721474c24aef74fe7
Author: David Ahern <dsahern@gmail.com>
Date: Fri Dec 7 20:24:57 2018 +0000

  neighbor: Improve garbage collection

Crash: BUG: corrupted list in neigh_mark_dead (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit 96aa1b22bd6bb9fccf62f6261f390ed6f3e7967f
Author: Willem de Bruijn <willemb@google.com>
Date: Sat May 30 19:41:31 2020 +0000

  tun: correct header offsets in napi frags mode

  
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 BUG: unable to handle kernel paging request in netif_receive_generic_xdp 1 1431d 1431d 0/2 auto-closed as invalid on 2020/08/26 09:44
Fix bisection attempts (4)
Created Duration User Patch Repo Result
2020/07/26 03:30 3h37m bisect fix upstream job log (1)
2020/06/03 13:26 18m bisect fix upstream job log (0) log
2020/04/17 19:56 19m bisect fix upstream job log (0) log
2020/03/18 16:54 22m bisect fix upstream job log (0) log

Sample crash report:
BUG: unable to handle page fault for address: ffff887f93c07fff
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7095 Comm: syz-executor058 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:is_multicast_ether_addr_64bits include/linux/etherdevice.h:135 [inline]
RIP: 0010:netif_receive_generic_xdp+0x5ad/0x11b0 net/core/dev.c:4555
Code: e8 03 42 80 3c 20 00 74 08 48 89 df e8 4c 91 52 fb 48 89 2b 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 b3 90 52 fb <49> 8b 75 00 83 e6 01 31 ff 48 89 b4 24 d8 00 00 00 e8 6d b1 14 fb
RSP: 0018:ffffc90001607798 EFLAGS: 00010246
RAX: 1ffff10ff2780fff RBX: ffffc900016078d0 RCX: 0000000000000100
RDX: ffffffffffff0101 RSI: 0000000000000000 RDI: ffff8880a93f19f6
RBP: ffff888093bf8000 R08: ffffffff865eb1d2 R09: ffffed101277f7dd
R10: ffffed101277f7dd R11: 0000000000000000 R12: dffffc0000000000
R13: ffff887f93c07fff R14: 00000000ffff10fd R15: ffff8880a93f1940
FS:  00007f1dacf41700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff887f93c07fff CR3: 00000000a4d83000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_xdp_generic+0x34/0x100 net/core/dev.c:4652
 tun_get_user+0x1c86/0x3670 drivers/net/tun.c:1901
 tun_chr_write_iter+0x99/0x120 drivers/net/tun.c:1992
 call_write_iter include/linux/fs.h:1907 [inline]
 new_sync_write fs/read_write.c:484 [inline]
 __vfs_write+0x54c/0x710 fs/read_write.c:497
 __kernel_write+0x120/0x350 fs/read_write.c:516
 write_pipe_buf+0xf9/0x150 fs/splice.c:809
 splice_from_pipe_feed fs/splice.c:512 [inline]
 __splice_from_pipe+0x329/0x870 fs/splice.c:636
 splice_from_pipe fs/splice.c:671 [inline]
 default_file_splice_write+0x112/0x1b0 fs/splice.c:821
 do_splice_from fs/splice.c:863 [inline]
 do_splice+0xdcd/0x18c0 fs/splice.c:1170
 __do_sys_splice fs/splice.c:1447 [inline]
 __se_sys_splice+0x172/0x230 fs/splice.c:1427
 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x446bb9
Code: e8 ec 0f 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b 0e fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1dacf40d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 00000000006dcc78 RCX: 0000000000446bb9
RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000006dcc70 R08: 0000000000010008 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc7c
R13: 0000000000003172 R14: 656c6c616b7a7973 R15: 0000000000000064
Modules linked in:
CR2: ffff887f93c07fff
---[ end trace 4c8fae086c48d4f1 ]---
RIP: 0010:is_multicast_ether_addr_64bits include/linux/etherdevice.h:135 [inline]
RIP: 0010:netif_receive_generic_xdp+0x5ad/0x11b0 net/core/dev.c:4555
Code: e8 03 42 80 3c 20 00 74 08 48 89 df e8 4c 91 52 fb 48 89 2b 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 b3 90 52 fb <49> 8b 75 00 83 e6 01 31 ff 48 89 b4 24 d8 00 00 00 e8 6d b1 14 fb
RSP: 0018:ffffc90001607798 EFLAGS: 00010246
RAX: 1ffff10ff2780fff RBX: ffffc900016078d0 RCX: 0000000000000100
RDX: ffffffffffff0101 RSI: 0000000000000000 RDI: ffff8880a93f19f6
RBP: ffff888093bf8000 R08: ffffffff865eb1d2 R09: ffffed101277f7dd
R10: ffffed101277f7dd R11: 0000000000000000 R12: dffffc0000000000
R13: ffff887f93c07fff R14: 00000000ffff10fd R15: ffff8880a93f1940
FS:  00007f1dacf41700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff887f93c07fff CR3: 00000000a4d83000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (160):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/04 13:26 upstream 0e698dfa2822 58ae5e18 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/02/13 23:08 upstream 0bf999f9c5e7 c5ed587f .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/02/13 22:26 upstream 0bf999f9c5e7 c5ed587f .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/02/09 14:09 upstream fdfa3a6778b1 6ece2ea5 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/02/06 10:37 upstream 4c7d00ccf40d 662cf49a .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/02/03 15:47 upstream 46d6b7becb1d 93e5e335 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/30 13:35 upstream 39bed42de2e7 5ed23f9a .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/28 03:17 upstream d5226fa6dbae 56cd6c9b .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/21 19:49 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/21 09:57 upstream d96d875ef5dd 8eda0b95 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/20 22:41 upstream def9d2780727 d2557fb5 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/20 11:19 upstream def9d2780727 0342f8c7 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/20 10:38 upstream def9d2780727 0342f8c7 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/20 05:22 upstream 8f8972a3127f 0342f8c7 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/20 01:43 upstream 8f8972a3127f 0342f8c7 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/20 00:05 upstream 8f8972a3127f 0342f8c7 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/19 21:44 upstream 8f8972a3127f 0342f8c7 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/19 13:04 upstream 244dc2689085 bc8bc756 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/01/19 12:24 upstream 244dc2689085 bc8bc756 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/02/17 13:36 upstream 11a48a5a18c6 2b411596 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/17 10:33 upstream 11a48a5a18c6 2b411596 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/17 07:40 upstream 11a48a5a18c6 1f448cd6 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/16 09:22 upstream db70e26e33ee 5d7b90f1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/16 04:11 upstream 829e69446995 5d7b90f1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/15 22:19 upstream 829e69446995 5d7b90f1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/14 22:53 upstream 2019fc96af22 5d7b90f1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/14 17:01 upstream b19e8c684703 5d7b90f1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/14 15:38 upstream b19e8c684703 5d7b90f1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/14 14:28 upstream b19e8c684703 5d7b90f1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/14 07:02 upstream b19e8c684703 5d7b90f1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/13 20:50 upstream 0bf999f9c5e7 c5ed587f .config console log report ci-upstream-kasan-gce-smack-root
2020/02/12 15:02 upstream 359c92c02bfa 84f4fc8a .config console log report ci-upstream-kasan-gce-smack-root
2020/02/12 13:18 upstream 359c92c02bfa a75b198c .config console log report ci-upstream-kasan-gce-smack-root
2020/02/12 12:00 upstream 359c92c02bfa a75b198c .config console log report ci-upstream-kasan-gce-smack-root
2020/02/12 03:22 upstream 359c92c02bfa a75b198c .config console log report ci-upstream-kasan-gce-smack-root
2020/02/12 02:02 upstream 0a679e13ea30 4d1ab643 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/11 15:44 upstream 0a679e13ea30 4d1ab643 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/11 14:33 upstream 0a679e13ea30 4d1ab643 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/11 08:08 upstream 0a679e13ea30 084454ae .config console log report ci-upstream-kasan-gce-smack-root
2020/02/11 04:15 upstream 0a679e13ea30 084454ae .config console log report ci-upstream-kasan-gce-smack-root
2020/02/10 22:25 upstream bb6d3fb354c5 18847f55 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/10 20:54 upstream bb6d3fb354c5 18847f55 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/10 14:48 upstream bb6d3fb354c5 18847f55 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/10 12:42 upstream bb6d3fb354c5 35f5e45e .config console log report ci-upstream-kasan-gce-smack-root
2020/02/09 22:41 upstream d1ea35f4cdd4 35f5e45e .config console log report ci-upstream-kasan-gce-smack-root
2020/02/09 14:08 upstream fdfa3a6778b1 6ece2ea5 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/08 20:17 upstream f757165705e9 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/08 12:20 upstream f757165705e9 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/08 10:21 upstream 41dcd67e8868 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/08 05:03 upstream 41dcd67e8868 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/07 23:14 upstream 41dcd67e8868 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/07 20:28 upstream 90568ecf5615 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/07 13:55 upstream 90568ecf5615 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/07 07:56 upstream 90568ecf5615 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/07 02:41 upstream 90568ecf5615 06150bf1 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/06 03:58 upstream 4c7d00ccf40d 662cf49a .config console log report ci-upstream-kasan-gce-smack-root
2020/02/05 13:58 upstream 6992ca0dd017 662cf49a .config console log report ci-upstream-kasan-gce-smack-root
2020/02/05 10:03 upstream 6992ca0dd017 93e5e335 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/05 08:22 upstream 33b40134e5cf 93e5e335 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/04 17:50 upstream 322bf2d3446a 93e5e335 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/03 14:34 upstream 46d6b7becb1d 93e5e335 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/03 12:55 upstream 46d6b7becb1d 93e5e335 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/03 10:03 upstream 46d6b7becb1d 93e5e335 .config console log report ci-upstream-kasan-gce-smack-root
2020/02/03 01:21 upstream 46d6b7becb1d 93e5e335 .config console log report ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.