syzbot

 sign-in | mailing list | source | docs
🐞 Open [717] 🐞 Fixed [181] 🐞 Invalid [640] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in do_tcp_sendpages

Status: auto-closed as invalid on 2019/12/20 03:47
Reported-by: syzbot+8d0c6ced2b1d45f6bb76@syzkaller.appspotmail.com
First crash: 1681d, last: 1671d
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 general protection fault in do_tcp_sendpages 234 1670d 1681d 0/1 auto-closed as invalid on 2019/12/20 15:51

Sample crash report:
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
hrtimer: interrupt took 36546 ns
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 7009 Comm: syz-executor.3 Not tainted 4.14.145 #0
kobject: 'hsr0' (ffff888063df8db0): kobject_add_internal: parent: 'net', set: 'devices'
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
kobject: 'hsr0' (ffff888063df8db0): kobject_uevent_env
task: ffff888063c981c0 task.stack: ffff888063ca0000
RIP: 0010:do_tcp_sendpages+0x33d/0x18f0 net/ipv4/tcp.c:967
RSP: 0018:ffff888063ca7898 EFLAGS: 00010202
RAX: 0000000000000010 RBX: 0000000000000000 RCX: ffffc90006036000
kobject: 'hsr0' (ffff888063df8db0): fill_kobj_path: path = '/devices/virtual/net/hsr0'
RDX: 00000000000007b7 RSI: ffffffff8523f1eb RDI: 0000000000000080
RBP: ffff888063ca79c0 R08: ffff888063c981c0 R09: 0000000000000001
R10: 0000000000000000 R11: ffff888063c981c0 R12: 0000000000005555
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88809703c040
FS:  00007f0aacf9b700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f326000 CR3: 000000007bdf4000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
kobject: 'queues' (ffff8880a1586b48): kobject_add_internal: parent: 'hsr0', set: '<NULL>'
Call Trace:
kobject: 'queues' (ffff8880a1586b48): kobject_uevent_env
 tls_push_sg+0x1e1/0x660 net/tls/tls_main.c:120
 tls_push_record+0xa4a/0x1210 net/tls/tls_sw.c:287
kobject: 'queues' (ffff8880a1586b48): kobject_uevent_env: filter function caused the event to drop!
 tls_sw_sendmsg+0x9e8/0x1020 net/tls/tls_sw.c:457
kobject: 'rx-0' (ffff8880a018a250): kobject_add_internal: parent: 'queues', set: 'queues'
kobject: 'rx-0' (ffff8880a018a250): kobject_uevent_env
 inet_sendmsg+0x122/0x500 net/ipv4/af_inet.c:762
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xce/0x110 net/socket.c:656
 SYSC_sendto+0x206/0x310 net/socket.c:1763
kobject: 'rx-0' (ffff8880a018a250): fill_kobj_path: path = '/devices/virtual/net/hsr0/queues/rx-0'
kobject: 'tx-0' (ffff8880a828d798): kobject_add_internal: parent: 'queues', set: 'queues'
 SyS_sendto+0x40/0x50 net/socket.c:1731
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
kobject: 'tx-0' (ffff8880a828d798): kobject_uevent_env
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x459a09
kobject: 'tx-0' (ffff8880a828d798): fill_kobj_path: path = '/devices/virtual/net/hsr0/queues/tx-0'
RSP: 002b:00007f0aacf9ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459a09
RDX: ffffffffffffffc1 RSI: 0000000020000080 RDI: 0000000000000007
RBP: 000000000075bf20 R08: 0000000000000000 R09: fffffffffffffe5b
R10: 0000000000000040 R11: 0000000000000246 R12: 00007f0aacf9b6d4
kobject: 'batman_adv' (ffff88809714dd00): kobject_add_internal: parent: 'hsr0', set: '<NULL>'
R13: 00000000004c79b8 R14: 00000000004dd418 R15: 00000000ffffffff
Code: 
device hsr_slave_0 entered promiscuous mode
ff ff 48 0f 44 d8 e8 13 f1 38 fc 4d 85 e4 0f 84 9b 03 00 00 e8 05 f1 38 fc 48 8d bb 80 00 00 00 44 8b 65 a8 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 03 0f 8e 85 11 00 00 44 2b a3 80 
RIP: do_tcp_sendpages+0x33d/0x18f0 net/ipv4/tcp.c:967 RSP: ffff888063ca7898
---[ end trace 762ba515e8e6adf2 ]---

Crashes (279):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/21 03:31 linux-4.14.y b10ab5e2c476 d96e88f3 .config console log report ci2-linux-4-14
2019/09/21 01:55 linux-4.14.y b10ab5e2c476 d96e88f3 .config console log report ci2-linux-4-14
2019/09/20 17:35 linux-4.14.y b10ab5e2c476 d96e88f3 .config console log report ci2-linux-4-14
2019/09/20 11:11 linux-4.14.y b10ab5e2c476 d96e88f3 .config console log report ci2-linux-4-14
2019/09/20 04:57 linux-4.14.y b10ab5e2c476 4d3ae0b7 .config console log report ci2-linux-4-14
2019/09/20 02:56 linux-4.14.y b10ab5e2c476 4d3ae0b7 .config console log report ci2-linux-4-14
2019/09/19 22:49 linux-4.14.y b10ab5e2c476 4d3ae0b7 .config console log report ci2-linux-4-14
2019/09/19 19:12 linux-4.14.y b10ab5e2c476 eb940044 .config console log report ci2-linux-4-14
2019/09/19 09:46 linux-4.14.y b10ab5e2c476 eb940044 .config console log report ci2-linux-4-14
2019/09/19 01:33 linux-4.14.y 968722f5371a 46c0be24 .config console log report ci2-linux-4-14
2019/09/18 23:55 linux-4.14.y 968722f5371a 46c0be24 .config console log report ci2-linux-4-14
2019/09/18 22:47 linux-4.14.y 968722f5371a 46c0be24 .config console log report ci2-linux-4-14
2019/09/18 20:53 linux-4.14.y 968722f5371a 46c0be24 .config console log report ci2-linux-4-14
2019/09/18 18:35 linux-4.14.y 968722f5371a 46c0be24 .config console log report ci2-linux-4-14
2019/09/18 17:28 linux-4.14.y 968722f5371a 46c0be24 .config console log report ci2-linux-4-14
2019/09/18 17:11 linux-4.14.y 968722f5371a 46c0be24 .config console log report ci2-linux-4-14
2019/09/18 14:43 linux-4.14.y 968722f5371a 1037b424 .config console log report ci2-linux-4-14
2019/09/18 11:09 linux-4.14.y 968722f5371a 03e0d245 .config console log report ci2-linux-4-14
2019/09/18 08:40 linux-4.14.y 968722f5371a 03e0d245 .config console log report ci2-linux-4-14
2019/09/18 03:20 linux-4.14.y 968722f5371a 03e0d245 .config console log report ci2-linux-4-14
2019/09/18 01:19 linux-4.14.y 968722f5371a 03e0d245 .config console log report ci2-linux-4-14
2019/09/17 21:22 linux-4.14.y 968722f5371a 13dcda9b .config console log report ci2-linux-4-14
2019/09/17 10:11 linux-4.14.y 968722f5371a 51ca0454 .config console log report ci2-linux-4-14
2019/09/17 08:07 linux-4.14.y 968722f5371a 51ca0454 .config console log report ci2-linux-4-14
2019/09/17 05:38 linux-4.14.y 968722f5371a 51ca0454 .config console log report ci2-linux-4-14
2019/09/17 04:17 linux-4.14.y 968722f5371a 51ca0454 .config console log report ci2-linux-4-14
2019/09/17 03:25 linux-4.14.y 968722f5371a 51ca0454 .config console log report ci2-linux-4-14
2019/09/17 02:09 linux-4.14.y 968722f5371a 51ca0454 .config console log report ci2-linux-4-14
2019/09/17 00:46 linux-4.14.y 968722f5371a 51ca0454 .config console log report ci2-linux-4-14
2019/09/16 22:40 linux-4.14.y 968722f5371a 51ca0454 .config console log report ci2-linux-4-14
2019/09/16 17:23 linux-4.14.y 968722f5371a 55c50e70 .config console log report ci2-linux-4-14
2019/09/16 15:26 linux-4.14.y 968722f5371a 55c50e70 .config console log report ci2-linux-4-14
2019/09/16 05:12 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/16 02:41 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/16 00:53 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/16 00:27 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 23:24 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 22:23 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 21:19 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 19:41 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 19:22 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 17:36 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 16:36 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 15:22 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 14:17 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 10:01 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 09:06 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 07:50 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/15 06:40 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/10 11:05 linux-4.14.y e2cd24b62938 a60cb4cd .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.