syzbot


general protection fault in btf_array_resolve

Status: fixed on 2019/08/05 13:45
Subsystems: bpf
[Documentation on labels]
Fix commit: e4f07120210a bpf: fix NULL deref in btf_type_is_resolve_source_only
First crash: 1801d, last: 1778d
Cause bisection: failed (error log, bisect log)
  

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7825 Comm: syz-executor108 Not tainted 5.2.0-rc5+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:btf_type_is_var kernel/bpf/btf.c:392 [inline]
RIP: 0010:btf_type_is_resolve_source_only kernel/bpf/btf.c:405 [inline]
RIP: 0010:btf_array_resolve+0x1b4/0x18f0 kernel/bpf/btf.c:1931
Code: 00 00 00 00 00 fc ff df 42 80 3c 30 00 74 08 48 89 df e8 ff 86 25 00 48 8b 03 48 89 44 24 70 48 8d 50 04 49 89 d7 49 c1 ef 03 <43> 8a 04 37 84 c0 48 89 54 24 30 0f 85 ec 10 00 00 44 8b 32 44 89
RSP: 0018:ffff888098a27560 EFLAGS: 00010247
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff888096860440
RDX: 0000000000000004 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff888098a27690 R08: ffffffff818953cd R09: ffffffff8188fb11
R10: ffff888096860440 R11: 0000000000000003 R12: 0000000000000002
R13: 1ffff11012edb311 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000555556912880(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000100 CR3: 000000008cea2000 CR4: 00000000001406e0
Call Trace:
 btf_resolve+0x3ed/0xda0 kernel/bpf/btf.c:3037
 btf_check_all_types kernel/bpf/btf.c:3076 [inline]
 btf_parse_type_sec kernel/bpf/btf.c:3117 [inline]
 btf_parse kernel/bpf/btf.c:3346 [inline]
 btf_new_fd+0x216a/0x37b0 kernel/bpf/btf.c:3394
 bpf_btf_load kernel/bpf/syscall.c:2630 [inline]
 __do_sys_bpf+0x1212/0xc5d0 kernel/bpf/syscall.c:2854
 __se_sys_bpf kernel/bpf/syscall.c:2772 [inline]
 __x64_sys_bpf+0x7a/0x90 kernel/bpf/syscall.c:2772
 do_syscall_64+0xfe/0x140 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4401f9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffde88cfce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004401f9
RDX: 0000000000000020 RSI: 0000000020000100 RDI: 0000000000000012
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000401a80
R13: 0000000000401b10 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 929e38cf8f1c69c9 ]---
RIP: 0010:btf_type_is_var kernel/bpf/btf.c:392 [inline]
RIP: 0010:btf_type_is_resolve_source_only kernel/bpf/btf.c:405 [inline]
RIP: 0010:btf_array_resolve+0x1b4/0x18f0 kernel/bpf/btf.c:1931
Code: 00 00 00 00 00 fc ff df 42 80 3c 30 00 74 08 48 89 df e8 ff 86 25 00 48 8b 03 48 89 44 24 70 48 8d 50 04 49 89 d7 49 c1 ef 03 <43> 8a 04 37 84 c0 48 89 54 24 30 0f 85 ec 10 00 00 44 8b 32 44 89
RSP: 0018:ffff888098a27560 EFLAGS: 00010247
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff888096860440
RDX: 0000000000000004 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff888098a27690 R08: ffffffff818953cd R09: ffffffff8188fb11
R10: ffff888096860440 R11: 0000000000000003 R12: 0000000000000002
R13: 1ffff11012edb311 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000555556912880(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000100 CR3: 000000008cea2000 CR4: 00000000001406e0

Crashes (109):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/19 08:32 upstream bed3c0d84e7e 34bf9440 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/07/11 23:06 upstream 5450e8a316a6 186a30b9 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/09 13:53 upstream 5ad18b2e60b7 f62e1e85 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/08 08:16 upstream 0ecfebd2b524 f62e1e85 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/07 16:54 upstream 46713c3d2f8d f62e1e85 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/02 04:54 upstream 6fbc7275c7a9 cccc4302 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/02 04:52 upstream 6fbc7275c7a9 cccc4302 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 17:59 upstream 6fbc7275c7a9 907bf746 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 15:54 upstream 6fbc7275c7a9 907bf746 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 10:46 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 05:41 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 04:29 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/07/01 00:50 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 20:39 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 15:49 upstream 6fbc7275c7a9 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 12:52 upstream 728254541ebc 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 08:17 upstream 728254541ebc 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/30 04:56 upstream 728254541ebc 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 23:16 upstream 01305db842e1 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 18:48 upstream 01305db842e1 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 16:09 upstream 01305db842e1 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 14:42 upstream 01305db842e1 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 13:21 upstream 01305db842e1 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 10:05 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 07:17 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 05:01 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 02:47 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 01:30 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/29 00:00 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/28 22:07 upstream 556e2f6020bf 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/28 13:24 upstream c84afab02c31 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/28 11:22 upstream c84afab02c31 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/28 10:16 upstream c84afab02c31 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/28 08:54 upstream c84afab02c31 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/28 07:14 upstream c84afab02c31 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/28 01:40 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/28 00:17 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/27 22:43 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/27 20:09 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/27 19:43 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/27 15:14 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/27 13:34 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/27 10:27 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/27 04:06 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/26 23:49 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/26 21:20 upstream 249155c20f9b 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/19 07:14 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.