general protection fault in tipc_conn

general protection fault in tipc_conn_close (2)
Status: upstream: reported on 2021/12/04 09:55
Reported-by: syzbot+d28b439975080ea97feb@syzkaller.appspotmail.com
First crash: 37d, last: 15d

similar bugs (2):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	general protection fault in tipc_conn_close	C			3	1386d	1387d	6/22	fixed on 2018/05/08 18:30
linux-4.19	general protection fault in tipc_conn_close	C		error	2	80d	219d	0/1	upstream: reported C repro on 2021/05/01 19:58

Sample crash report:

general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 PID: 9168 Comm: kworker/u4:4 Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:tipc_conn_close+0x4c/0x210 net/tipc/topsrv.c:157
Code: 5d 08 49 89 dc 49 c1 ec 03 43 80 3c 34 00 74 08 48 89 df e8 e6 b3 0a f8 48 89 1c 24 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 c5 b3 0a f8 48 8b 1b 4c 8d bb b0
RSP: 0018:ffffc90004777ad8 EFLAGS: 00010206
RAX: 0000000000000003 RBX: 0000000000000018 RCX: ffff888077731d00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807a888000
RBP: ffff88807a888000 R08: dffffc0000000000 R09: fffffbfff1ff33de
R10: fffffbfff1ff33de R11: 0000000000000000 R12: 1ffff1100f511001
R13: ffff88807a888000 R14: dffffc0000000000 R15: ffff88807d345098
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560b6e50e788 CR3: 0000000089eb7000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 tipc_topsrv_stop net/tipc/topsrv.c:694 [inline]
 tipc_topsrv_exit_net+0xf8/0x310 net/tipc/topsrv.c:715
 ops_exit_list net/core/net_namespace.c:168 [inline]
 cleanup_net+0x758/0xc50 net/core/net_namespace.c:593
 process_one_work+0x853/0x1140 kernel/workqueue.c:2298
 worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
 kthread+0x468/0x490 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30
 </TASK>
Modules linked in:
---[ end trace ff1ddf3c30f0c3d0 ]---
RIP: 0010:tipc_conn_close+0x4c/0x210 net/tipc/topsrv.c:157
Code: 5d 08 49 89 dc 49 c1 ec 03 43 80 3c 34 00 74 08 48 89 df e8 e6 b3 0a f8 48 89 1c 24 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 c5 b3 0a f8 48 8b 1b 4c 8d bb b0
RSP: 0018:ffffc90004777ad8 EFLAGS: 00010206
RAX: 0000000000000003 RBX: 0000000000000018 RCX: ffff888077731d00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807a888000
RBP: ffff88807a888000 R08: dffffc0000000000 R09: fffffbfff1ff33de
R10: fffffbfff1ff33de R11: 0000000000000000 R12: 1ffff1100f511001
R13: ffff88807a888000 R14: dffffc0000000000 R15: ffff88807d345098
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe625c1d058 CR3: 000000003b6ba000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	5d                   	pop    %rbp
   1:	08 49 89             	or     %cl,-0x77(%rcx)
   4:	dc 49 c1             	fmull  -0x3f(%rcx)
   7:	ec                   	in     (%dx),%al
   8:	03 43 80             	add    -0x80(%rbx),%eax
   b:	3c 34                	cmp    $0x34,%al
   d:	00 74 08 48          	add    %dh,0x48(%rax,%rcx,1)
  11:	89 df                	mov    %ebx,%edi
  13:	e8 e6 b3 0a f8       	callq  0xf80ab3fe
  18:	48 89 1c 24          	mov    %rbx,(%rsp)
  1c:	48 8b 1b             	mov    (%rbx),%rbx
  1f:	48 83 c3 18          	add    $0x18,%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 c5 b3 0a f8       	callq  0xf80ab3fe
  39:	48 8b 1b             	mov    (%rbx),%rbx
  3c:	4c                   	rex.WR
  3d:	8d                   	.byte 0x8d
  3e:	bb                   	.byte 0xbb
  3f:	b0                   	.byte 0xb0

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-kasan-gce-smack-root	2021/11/22 02:02	upstream	40c93d7fff6f	4eb20a4e	.config	log	report			info	general protection fault in tipc_conn_close
ci-upstream-kasan-gce-root	2021/10/30 14:41	upstream	f25a5481af12	098b5d53	.config	log	report			info	general protection fault in tipc_conn_close