syzbot


UBSAN: shift-out-of-bounds in taprio_change

Status: fixed on 2024/04/10 03:59
Subsystems: net
[Documentation on labels]
Fix commit: 343041b59b78 net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
First crash: 73d, last: 73d
Cause bisection: introduced by (bisect log) :
commit a54fc09e4cba3004443aa05979f8c678196c8226
Author: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Wed Sep 28 09:51:58 2022 +0000

  net/sched: taprio: allow user input of per-tc max SDU

Crash: UBSAN: shift-out-of-bounds in taprio_change (log)
Repro: C syz .config
  
Discussions (5)
Title Replies (including bot) Last reply
[PATCH 6.1 406/451] net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check 1 (1) 2024/03/24 23:11
[PATCH 6.6 585/638] net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check 1 (1) 2024/03/24 23:00
[PATCH 6.7 650/713] net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check 1 (1) 2024/03/24 22:46
[PATCH 6.8 648/715] net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check 1 (1) 2024/03/24 22:33
[PATCH net] net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check 3 (3) 2024/03/13 08:30
Last patch testing requests (1)
Created Duration User Patch Repo Result
2024/03/11 19:30 38m edumazet@google.com patch net OK log

Sample crash report:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18
shift exponent -2147418108 is negative
CPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c7/0x420 lib/ubsan.c:386
 taprio_parse_tc_entry net/sched/sch_taprio.c:1722 [inline]
 taprio_parse_tc_entries net/sched/sch_taprio.c:1768 [inline]
 taprio_change+0xb87/0x57d0 net/sched/sch_taprio.c:1877
 taprio_init+0x9da/0xc80 net/sched/sch_taprio.c:2134
 qdisc_create+0x9d4/0x1190 net/sched/sch_api.c:1355
 tc_modify_qdisc+0xa26/0x1e40 net/sched/sch_api.c:1776
 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6617
 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543
 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
 netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367
 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:745
 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
 ___sys_sendmsg net/socket.c:2638 [inline]
 __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
 do_syscall_64+0xf9/0x240
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f1b2dea3759
Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4de452f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759
RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004
RBP: 0000000000000003 R08: 0000555500000000 R09: 0000555500000000
R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffd4de45340
R13: 00007ffd4de45310 R14: 0000000000000001 R15: 00007ffd4de45340
 </TASK>
---[ end trace ]---

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/11 19:10 net c8a5c731fd12 6ee49f2e .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in taprio_change
2024/03/11 19:40 net-next c2b25092864a 6ee49f2e .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: shift-out-of-bounds in taprio_change
2024/03/11 19:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 6ee49f2e .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: shift-out-of-bounds in taprio_change
2024/03/11 18:43 net c8a5c731fd12 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: shift-out-of-bounds in taprio_change
* Struck through repros no longer work on HEAD.