syzbot


general protection fault in packet_lookup_frame

Status: fixed on 2019/09/06 20:45
Subsystems: net
[Documentation on labels]
Fix commit: 32d3182cd2cd net/packet: fix race in tpacket_snd()
First crash: 1688d, last: 1688d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: BUG: unable to handle kernel NULL pointer dereference in packet_lookup_frame (log)
Repro: C syz .config
  
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in packet_lookup_frame C done 1 1688d 1688d 1/1 fixed on 2019/12/04 13:46
linux-4.19 general protection fault in packet_lookup_frame C done 1 1688d 1688d 1/1 fixed on 2019/12/04 13:46

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9867 Comm: syz-executor304 Not tainted 5.3.0-rc4+ #108
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:packet_lookup_frame+0x8d/0x270 net/packet/af_packet.c:474
Code: c1 ee 03 f7 73 0c 80 3c 0e 00 0f 85 cb 01 00 00 48 8b 0b 89 c0 4c 8d 24 c1 48 b8 00 00 00 00 00 fc ff df 4c 89 e1 48 c1 e9 03 <80> 3c 01 00 0f 85 94 01 00 00 48 8d 7b 10 4d 8b 3c 24 48 b8 00 00
RSP: 0018:ffff8880894977b8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff888093434ef0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 1ffff110126869de RDI: ffff888093434efc
RBP: ffff8880894977e8 R08: ffff888093cba000 R09: fffffbfff134ae50
R10: fffffbfff134ae4f R11: ffffffff89a5727f R12: 0000000000000000
R13: 0000000000000001 R14: ffff888093434980 R15: 0000000000000000
FS:  00007f42c09db700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f42c09dae78 CR3: 000000008abef000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 packet_current_frame net/packet/af_packet.c:487 [inline]
 tpacket_snd net/packet/af_packet.c:2667 [inline]
 packet_sendmsg+0x590/0x6250 net/packet/af_packet.c:2975
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:657
 ___sys_sendmsg+0x3e2/0x920 net/socket.c:2311
 __sys_sendmmsg+0x1bf/0x4d0 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2439
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4479b9
Code: e8 8c e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f42c09dada8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000006dcc38 RCX: 00000000004479b9
RDX: 0400000000000328 RSI: 0000000020008a80 RDI: 0000000000000003
RBP: 00000000006dcc30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc3c
R13: 0000315f6576616c R14: 735f656764697262 R15: 00000000006dcc3c
Modules linked in:
---[ end trace ef3062cf89fe028a ]---
RIP: 0010:packet_lookup_frame+0x8d/0x270 net/packet/af_packet.c:474
Code: c1 ee 03 f7 73 0c 80 3c 0e 00 0f 85 cb 01 00 00 48 8b 0b 89 c0 4c 8d 24 c1 48 b8 00 00 00 00 00 fc ff df 4c 89 e1 48 c1 e9 03 <80> 3c 01 00 0f 85 94 01 00 00 48 8d 7b 10 4d 8b 3c 24 48 b8 00 00
RSP: 0018:ffff8880894977b8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff888093434ef0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 1ffff110126869de RDI: ffff888093434efc
RBP: ffff8880894977e8 R08: ffff888093cba000 R09: fffffbfff134ae50
R10: fffffbfff134ae4f R11: ffffffff89a5727f R12: 0000000000000000
R13: 0000000000000001 R14: ffff888093434980 R15: 0000000000000000
FS:  00007f42c09db700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f42c09dae78 CR3: 000000008abef000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/14 01:39 upstream ee1c7bd33e66 ef801a3e .config console log report syz C ci-upstream-kasan-gce-root
2019/08/13 21:36 upstream ee1c7bd33e66 ef801a3e .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/08/13 21:23 upstream ee1c7bd33e66 ef801a3e .config console log report syz C ci-upstream-kasan-gce
2019/08/13 21:59 upstream ee1c7bd33e66 ef801a3e .config console log report syz C ci-upstream-kasan-gce-386
2019/08/13 21:16 net-old bb0ce4c1517d ef801a3e .config console log report syz C ci-upstream-net-this-kasan-gce
2019/08/13 21:15 net-next-old 53f6f391786e ef801a3e .config console log report syz C ci-upstream-net-kasan-gce
2019/08/13 22:12 linux-next 0b821f0a8339 ef801a3e .config console log report syz C ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.