syzbot

 sign-in | mailing list | source | docs
šŸž Open [984] ā‰” Subsystems šŸž Fixed [5216] šŸž Invalid [12476] ā¬‡ Missing Backports [82] šŸ“ˆ Kernel Health šŸ“ˆ Bug Lifetimes šŸ“ˆ Fuzzing šŸ“ˆ Crashes šŸ’¬ Send us feedback

suspicious RCU usage at ./include/linux/inetdevice.h:LINE

Status: fixed on 2018/02/01 10:32
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+e52a2ae091b628f72765583c9faedc961c83b7e7@syzkaller.appspotmail.com
Fix commit: 25dd169aea65 fib: fib_dump_info can no longer use __in_dev_get_rtnl
First crash: 2375d, last: 2352d
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream suspicious RCU usage at ./include/linux/inetdevice.h:LINE (2) net C 4 2269d 2269d 4/26 fixed on 2018/02/04 23:45
android-49 suspicious RCU usage at ./include/linux/inetdevice.h:LINE C 2 2269d 1832d 0/3 public: reported C repro on 2019/04/14 08:51

Sample crash report:
=============================
WARNING: suspicious RCU usage
4.14.0-rc6+ #151 Not tainted
-----------------------------
./include/linux/inetdevice.h:230 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz-executor5/15708:
 #0:  (rcu_read_lock){....}, at: [<ffffffff84029440>] inet_rtm_getroute+0xaa0/0x2d70 net/ipv4/route.c:2738

stack backtrace:
CPU: 0 PID: 15708 Comm: syz-executor5 Not tainted 4.14.0-rc6+ #151
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4665
 __in_dev_get_rtnl include/linux/inetdevice.h:230 [inline]
 fib_dump_info+0x1136/0x13d0 net/ipv4/fib_semantics.c:1377
 inet_rtm_getroute+0xf97/0x2d70 net/ipv4/route.c:2785
 rtnetlink_rcv_msg+0x51c/0x1090 net/core/rtnetlink.c:4240
 netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2409
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4264
 netlink_unicast_kernel net/netlink/af_netlink.c:1273 [inline]
 netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1299
 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1862
 sock_sendmsg_nosec net/socket.c:633 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:643
 sock_write_iter+0x31a/0x5d0 net/socket.c:912
 call_write_iter include/linux/fs.h:1770 [inline]
 new_sync_write fs/read_write.c:468 [inline]
 __vfs_write+0x684/0x970 fs/read_write.c:481
 vfs_write+0x189/0x510 fs/read_write.c:543
 SYSC_write fs/read_write.c:588 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:580
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x452869
RSP: 002b:00007f5e5e829be8 EFLAGS: 00000212 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452869
RDX: 0000000000000024 RSI: 0000000020226000 RDI: 0000000000000015
RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000
R13: 0000000000a6f7ff R14: 00007f5e5e82a9c0 R15: 0000000000000000
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=65535 sclass=netlink_audit_socket pig=15745 comm=syz-executor2
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=30 sclass=netlink_audit_socket pig=15745 comm=syz-executor2
tmpfs: Bad mount option qü]gĀ4„ÆG
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=65535 sclass=netlink_audit_socket pig=15745 comm=syz-executor2
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=30 sclass=netlink_audit_socket pig=15761 comm=syz-executor2
netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'.
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'.
tmpfs: Bad mount option qü]gĀ4„ÆG
rpcbind: RPC call returned error 22
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
rpcbind: RPC call returned error 22
rpcbind: RPC call returned error 22
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device gre0 entered promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
dccp_invalid_packet: pskb_may_pull failed
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
QAT: Invalid ioctl
device lo entered promiscuous mode
QAT: Invalid ioctl
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
QAT: Invalid ioctl
QAT: Invalid ioctl
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
dccp_invalid_packet: pskb_may_pull failed
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
nla_parse: 12 callbacks suppressed
netlink: 21 bytes leftover after parsing attributes in process `syz-executor3'.
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
netlink: 8 bytes leftover after parsing attributes in process `syz-executor4'.
device lo left promiscuous mode
netlink: 21 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 13 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 13 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
device gre0 entered promiscuous mode
netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 2 bytes leftover after parsing attributes in process `syz-executor5'.
IPv6: Can't replace route, no match found
IPv6: Can't replace route, no match found
FAULT_FLAG_ALLOW_RETRY missing 31
CPU: 1 PID: 16554 Comm: syz-executor0 Not tainted 4.14.0-rc6+ #151
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 handle_userfault+0x11ec/0x23a0 fs/userfaultfd.c:427
 do_anonymous_page mm/memory.c:3135 [inline]
 handle_pte_fault mm/memory.c:3908 [inline]
 __handle_mm_fault+0x3823/0x39c0 mm/memory.c:4034
 handle_mm_fault+0x334/0x8d0 mm/memory.c:4071
 __do_page_fault+0x5bd/0xd60 arch/x86/mm/fault.c:1444
 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1520
 page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1066
RIP: 0010:copy_user_generic_unrolled+0x89/0xc0 arch/x86/lib/copy_user_64.S:66
RSP: 0018:ffff8801d804fe38 EFLAGS: 00010202
RAX: ffffed003b009fd5 RBX: 0000000000000008 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffff8801d804fea0 RDI: 0000000020002000
RBP: ffff8801d804fe68 R08: 0000001f0000001e R09: ffffed003b009fd5
R10: 0000000000000001 R11: ffffed003b009fd4 R12: 0000000020002000
R13: ffff8801d804fea0 R14: 00007ffffffff000 R15: 0000000020002008
 copy_to_user include/linux/uaccess.h:154 [inline]
 SYSC_pipe2 fs/pipe.c:846 [inline]
 SyS_pipe2 fs/pipe.c:838 [inline]
 SYSC_pipe fs/pipe.c:862 [inline]
 SyS_pipe+0xfd/0x2e0 fs/pipe.c:860
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x452869
RSP: 002b:00007f433a768be8 EFLAGS: 00000212 ORIG_RAX: 0000000000000016
RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452869
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020002000
RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f6e78
R13: 00000000ffffffff R14: 00007f433a7696d4 R15: 0000000000000000
device syz7 left promiscuous mode
dccp_v6_rcv: dropped packet with invalid checksum
dccp_v6_rcv: dropped packet with invalid checksum
audit: type=1326 audit(1509237309.645:4011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=16799 comm="syz-executor4" exe="/root/syz-executor4" sig=9 arch=c000003e syscall=202 compat=0 ip=0x452869 code=0x0
audit: type=1326 audit(1509237309.775:4012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=16799 comm="syz-executor4" exe="/root/syz-executor4" sig=9 arch=c000003e syscall=202 compat=0 ip=0x452869 code=0x0
irq bypass consumer (token ffff8801d146a780) registration fails: -16
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51847 sclass=netlink_route_socket pig=16898 comm=syz-executor1
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51847 sclass=netlink_route_socket pig=16898 comm=syz-executor1
sctp: [Deprecated]: syz-executor6 (pid 16893) Use of int in max_burst socket option.
Use struct sctp_assoc_value instead
sctp: [Deprecated]: syz-executor6 (pid 16929) Use of int in max_burst socket option.
Use struct sctp_assoc_value instead
audit: type=1326 audit(1509237310.752:4013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=17054 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452869 code=0x7ffc0000
audit: type=1326 audit(1509237310.752:4014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=17054 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452869 code=0x7ffc0000
audit: type=1326 audit(1509237310.753:4015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=17054 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=41 compat=0 ip=0x452869 code=0x7ffc0000
audit: type=1326 audit(1509237310.753:4016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=17054 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452869 code=0x7ffc0000
audit: type=1326 audit(1509237310.753:4017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=17054 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452869 code=0x7ffc0000
audit: type=1326 audit(1509237310.755:4018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=17054 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=55 compat=0 ip=0x452869 code=0x7ffc0000
audit: type=1326 audit(1509237310.756:4019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=17054 comm="syz-executor6" exe="/root/syz-executor6" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452869 code=0x7ffc0000
device gre0 entered promiscuous mode
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
device gre0 entered promiscuous mode
nla_parse: 9 callbacks suppressed
netlink: 12 bytes leftover after parsing attributes in process `syz-executor1'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor1'.
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl

Crashes (28):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/10/29 00:35 upstream 781402340475 80c74880 .config console log report ci-upstream-kasan-gce
2017/10/28 18:52 upstream 781402340475 80c74880 .config console log report ci-upstream-kasan-gce
2017/10/25 01:06 upstream ae59df0349ba 3d7d860f .config console log report ci-upstream-kasan-gce
2017/10/24 21:10 upstream ae59df0349ba 3d7d860f .config console log report ci-upstream-kasan-gce
2017/10/22 14:13 upstream b5ac3beb5a9f ab829b1b .config console log report ci-upstream-kasan-gce
2017/10/22 11:18 upstream b5ac3beb5a9f ab829b1b .config console log report ci-upstream-kasan-gce
2017/10/22 07:24 upstream 0787643a5f6a 4d9c0713 .config console log report ci-upstream-kasan-gce
2017/10/22 07:19 upstream 0787643a5f6a 4d9c0713 .config console log report ci-upstream-kasan-gce
2017/10/22 01:38 upstream 0787643a5f6a 4d9c0713 .config console log report ci-upstream-kasan-gce
2017/10/22 01:07 upstream 0787643a5f6a 4d9c0713 .config console log report ci-upstream-kasan-gce
2017/10/19 15:15 upstream 73d3393ada4f 3704c601 .config console log report ci-upstream-kasan-gce
2017/10/26 06:41 upstream f34157878d3b 83d9c302 .config console log report ci-upstream-kasan-gce-386
2017/10/21 13:28 upstream 9c323bff13f9 4d9c0713 .config console log report ci-upstream-kasan-gce-386
2017/10/20 18:42 upstream ce43f4fd6f10 4d9c0713 .config console log report ci-upstream-kasan-gce-386
2017/11/09 21:15 mmots 0f611fb6dcc0 e0a2b195 .config console log report ci-upstream-mmots-kasan-gce
2017/11/02 17:12 linux-next fa8785e862ef 02b8363d .config console log report skylake-linux-next-kasan-qemu
2017/10/29 18:32 linux-next 36ef71cae353 e511d9f8 .config console log report ci-upstream-next-kasan-gce
2017/10/21 10:58 mmots 0f611fb6dcc0 e0a2b195 .config console log report ci-upstream-mmots-kasan-gce
2017/10/20 22:38 linux-next 36ef71cae353 e511d9f8 .config console log report ci-upstream-next-kasan-gce
2017/10/19 02:29 mmots 3ac81ebcbbb3 355f57c5 .config console log report ci-upstream-mmots-kasan-gce
* Struck through repros no longer work on HEAD.