syzbot

 sign-in | mailing list | source | docs
🐞 Open [1663]
≡ Subsystems
🐞 Fixed [5970]
🐞 Invalid [14635]
⬇ Missing Backports [124]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

general protection fault in reuseport_add_sock (2)

Status: closed as invalid on 2021/10/06 01:29
Subsystems: net
[Documentation on labels]
First crash: 1495d, last: 1281d
Cause bisection: introduced by (bisect log) :
commit 6ba84574026792ce33a40c7da721dea36d0f3973
Author: Xin Long <lucien.xin@gmail.com>
Date: Mon Nov 12 10:27:17 2018 +0000

  sctp: process sk_reuseport in sctp_get_port_local

Crash: general protection fault in reuseport_add_sock (log)
Repro: syz .config
  
Fix bisection the fix commit could be any of (bisect log):
  afae3cc2da10 net: atheros: simplify the return expression of atl2_phy_setup_autoneg_adv()
  6d72e7c767ac net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
   
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in reuseport_add_sock net 1 2158d 2158d 0/28 auto-closed as invalid on 2019/08/14 20:03
upstream general protection fault in reuseport_add_sock (3) net C done 3 168d 167d 28/28 fixed on 2024/10/03 15:25
▶ ▼ Fix bisection attempts (4)
Created Duration User Patch Repo Result
2021/04/27 08:59 22m bisect fix net-next-old OK (2) job log
2021/03/12 02:35 25m bisect fix net-next-old OK (0) job log log
2021/02/07 22:00 1m bisect fix net-next-old error job log
2021/01/08 21:42 17m bisect fix net-next-old OK (0) job log log

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 9131 Comm: syz-executor.0 Not tainted 5.13.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:reuseport_add_sock+0x1b8/0x580 net/core/sock_reuseport.c:264
Code: de e8 dc 2a 4f fa 66 83 fb 01 0f 85 57 03 00 00 e8 9d 22 4f fa 4c 8d 7d 12 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <0f> b6 14 02 4c 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 e9
RSP: 0018:ffffc90003267cd8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff87259c13 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000003
R10: ffffffff87259b35 R11: 0000000000000000 R12: ffff8880219b9700
R13: 0000000000000000 R14: ffff8880219b9b98 R15: 0000000000000012
FS:  00007f445c9c6700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f445c9a5718 CR3: 0000000018a16000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __sctp_hash_endpoint net/sctp/input.c:775 [inline]
 sctp_hash_endpoint+0x4fe/0x5f0 net/sctp/input.c:803
 sctp_listen_start net/sctp/socket.c:8515 [inline]
 sctp_inet_listen+0x714/0x920 net/sctp/socket.c:8570
 __sys_listen+0x17d/0x250 net/socket.c:1706
 __do_sys_listen net/socket.c:1715 [inline]
 __se_sys_listen net/socket.c:1713 [inline]
 __x64_sys_listen+0x50/0x70 net/socket.c:1713
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f445c9c6188 EFLAGS: 00000246 ORIG_RAX: 0000000000000032
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000050 RDI: 0000000000000004
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007fffc1ad707f R14: 00007f445c9c6300 R15: 0000000000022000
Modules linked in:
---[ end trace 62bae233c4f7e8ab ]---
RIP: 0010:reuseport_add_sock+0x1b8/0x580 net/core/sock_reuseport.c:264
Code: de e8 dc 2a 4f fa 66 83 fb 01 0f 85 57 03 00 00 e8 9d 22 4f fa 4c 8d 7d 12 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <0f> b6 14 02 4c 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 e9
RSP: 0018:ffffc90003267cd8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff87259c13 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000003
R10: ffffffff87259b35 R11: 0000000000000000 R12: ffff8880219b9700
R13: 0000000000000000 R14: ffff8880219b9b98 R15: 0000000000000012
FS:  00007f445c9c6700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f445c9a5718 CR3: 0000000018a16000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/12 03:13 upstream 98f7fdced2e0 8f5a7b8c .config console log report syz ci-upstream-kasan-gce-selinux-root general protection fault in reuseport_add_sock
2021/06/01 20:59 upstream c2131f7e73c9 032639db .config console log report syz ci-upstream-kasan-gce-smack-root general protection fault in reuseport_add_sock
2021/05/29 08:48 upstream 5ff2756afde0 858ea628 .config console log report syz ci-upstream-kasan-gce-root general protection fault in reuseport_add_sock
2021/06/22 13:24 linux-next a1f92694393a aba2b2fb .config console log report syz ci-upstream-linux-next-kasan-gce-root general protection fault in reuseport_add_sock
2020/12/09 21:00 net-next-old afae3cc2da10 c090b4da .config console log report syz ci-upstream-net-kasan-gce
2021/03/28 08:59 net-next-old a1281601f88e a8529b82 .config console log report info ci-upstream-net-kasan-gce general protection fault in reuseport_add_sock
* Struck through repros no longer work on HEAD.