syzbot


BUG: unable to handle kernel paging request in rhashtable_replace_fast

Status: fixed on 2020/02/18 14:31
Subsystems: net
[Documentation on labels]
Fix commit: 41cdc741048b netdevsim: fix nsim_fib6_rt_create() error path
First crash: 1784d, last: 1777d

Sample crash report:
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: 00000000000008a4 R14: 00000000004c9be0 R15: 0000000000000006
BUG: unable to handle page fault for address: fffffffffffffff4
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 9870067 P4D 9870067 PUD 9872067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15630 Comm: syz-executor.4 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:jhash2 include/linux/jhash.h:125 [inline]
RIP: 0010:rht_key_get_hash include/linux/rhashtable.h:142 [inline]
RIP: 0010:rht_key_hashfn include/linux/rhashtable.h:159 [inline]
RIP: 0010:rht_head_hashfn include/linux/rhashtable.h:174 [inline]
RIP: 0010:__rhashtable_replace_fast include/linux/rhashtable.h:1160 [inline]
RIP: 0010:rhashtable_replace_fast.isra.0.constprop.0+0x3f5/0xfa0 include/linux/rhashtable.h:1224
Code: fc ff df 8b 75 b8 48 89 d0 48 c1 e8 03 0f b6 0c 38 48 89 d0 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85 83 0b 00 00 48 8d 7a 04 <8b> 02 49 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 46 0f b6
RSP: 0018:ffffc900015e6f28 EFLAGS: 00010246
RAX: 0000000000000007 RBX: ffff88805c7a4000 RCX: 0000000000000000
RDX: fffffffffffffff4 RSI: 0000000000000007 RDI: fffffffffffffff8
RBP: ffffc900015e6fa8 R08: ffff88809e23c480 R09: 0000000000000000
R10: dffffc0000000000 R11: dffffc0000000000 R12: 000000008c1a4ec5
R13: 000000008c1a4ec5 R14: fffffffffffffff4 R15: 000000008c1a4ec5
FS:  00007f1e5d9a2700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 0000000095cf2000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 nsim_fib6_rt_replace drivers/net/netdevsim/fib.c:628 [inline]
 nsim_fib6_rt_insert drivers/net/netdevsim/fib.c:660 [inline]
 nsim_fib6_event drivers/net/netdevsim/fib.c:719 [inline]
 nsim_fib_event drivers/net/netdevsim/fib.c:744 [inline]
 nsim_fib_event_nb+0xc3a/0x2600 drivers/net/netdevsim/fib.c:772
 notifier_call_chain+0xc2/0x230 kernel/notifier.c:83
 __atomic_notifier_call_chain+0xa6/0x1a0 kernel/notifier.c:173
 atomic_notifier_call_chain+0x2e/0x40 kernel/notifier.c:183
 call_fib_notifiers+0x173/0x2a0 net/core/fib_notifier.c:35
 call_fib6_notifiers+0x4b/0x60 net/ipv6/fib6_notifier.c:22
 call_fib6_entry_notifiers+0xfb/0x150 net/ipv6/ip6_fib.c:399
 fib6_add_rt2node net/ipv6/ip6_fib.c:1263 [inline]
 fib6_add+0x33c3/0x3ec0 net/ipv6/ip6_fib.c:1471
 __ip6_ins_rt+0x54/0x80 net/ipv6/route.c:1315
 ip6_route_add+0x5e/0x110 net/ipv6/route.c:3711
 inet6_rtm_newroute+0x16c/0x180 net/ipv6/route.c:5335
 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5429
 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5447
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:672
 ____sys_sendmsg+0x358/0x880 net/socket.c:2343
 ___sys_sendmsg+0x100/0x170 net/socket.c:2397
 __sys_sendmmsg+0x1bf/0x4d0 net/socket.c:2487
 __do_sys_sendmmsg net/socket.c:2516 [inline]
 __se_sys_sendmmsg net/socket.c:2513 [inline]
 __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2513
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45aff9
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1e5d9a1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f1e5d9a26d4 RCX: 000000000045aff9
RDX: 0000000004924b68 RSI: 0000000020000140 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: 00000000000008a4 R14: 00000000004c9be0 R15: 0000000000000006
Modules linked in:
CR2: fffffffffffffff4
---[ end trace 8109e61a033c89c9 ]---
RIP: 0010:jhash2 include/linux/jhash.h:125 [inline]
RIP: 0010:rht_key_get_hash include/linux/rhashtable.h:142 [inline]
RIP: 0010:rht_key_hashfn include/linux/rhashtable.h:159 [inline]
RIP: 0010:rht_head_hashfn include/linux/rhashtable.h:174 [inline]
RIP: 0010:__rhashtable_replace_fast include/linux/rhashtable.h:1160 [inline]
RIP: 0010:rhashtable_replace_fast.isra.0.constprop.0+0x3f5/0xfa0 include/linux/rhashtable.h:1224
Code: fc ff df 8b 75 b8 48 89 d0 48 c1 e8 03 0f b6 0c 38 48 89 d0 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85 83 0b 00 00 48 8d 7a 04 <8b> 02 49 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 46 0f b6
RSP: 0018:ffffc900015e6f28 EFLAGS: 00010246
RAX: 0000000000000007 RBX: ffff88805c7a4000 RCX: 0000000000000000
RDX: fffffffffffffff4 RSI: 0000000000000007 RDI: fffffffffffffff8
RBP: ffffc900015e6fa8 R08: ffff88809e23c480 R09: 0000000000000000
R10: dffffc0000000000 R11: dffffc0000000000 R12: 000000008c1a4ec5
R13: 000000008c1a4ec5 R14: fffffffffffffff4 R15: 000000008c1a4ec5
FS:  00007f1e5d9a2700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 0000000095cf2000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/16 08:14 net-next-old 4e2fa6b90275 f9b69507 .config console log report ci-upstream-net-kasan-gce
2020/01/23 16:32 linux-next 2747d5fdab78 3334d684 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.