bisecting fixing commit since c3d8f220d01220a5b253e422be407d068dc65511 building syzkaller on cef5ae6814696260ff58c538a1b6044af90c5979 testing commit c3d8f220d01220a5b253e422be407d068dc65511 with gcc (GCC) 8.1.0 kernel signature: 2fc50fe61577ad55e2f0fea82d0121bfee926ed30418b6e3e1ebd6da168b1bb3 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole testing current HEAD 60e720931556fc1034d0981460164dcf02697679 testing commit 60e720931556fc1034d0981460164dcf02697679 with gcc (GCC) 8.1.0 kernel signature: 60335dd6718cebb2b2de096a92901063bec312d08619dad3163f6c84519c08e8 all runs: OK # git bisect start 60e720931556fc1034d0981460164dcf02697679 c3d8f220d01220a5b253e422be407d068dc65511 Bisecting: 844 revisions left to test after this (roughly 10 steps) [74c7b80e222b58d3cea731d31e2a31a77fea8345] net: lantiq: use netif_tx_napi_add() for TX NAPI testing commit 74c7b80e222b58d3cea731d31e2a31a77fea8345 with gcc (GCC) 8.1.0 kernel signature: be7225fccea34d0fdb750a8543b0f700ccc6dfbc524eabf3d4e0b4b61bc8a963 all runs: OK # git bisect bad 74c7b80e222b58d3cea731d31e2a31a77fea8345 Bisecting: 421 revisions left to test after this (roughly 9 steps) [d37d56920004cae612fa32d1f92aaacca5e145f7] Merge branch 'linux-5.9' of git://github.com/skeggsb/linux into drm-fixes testing commit d37d56920004cae612fa32d1f92aaacca5e145f7 with gcc (GCC) 8.1.0 kernel signature: d4e387cd172b30287f9e92a91ef08c1e6c42347a344b47b41a1f0330fb96f62f all runs: OK # git bisect bad d37d56920004cae612fa32d1f92aaacca5e145f7 Bisecting: 187 revisions left to test after this (roughly 8 steps) [5ec06b5c0d259a8c7c4376b121b2f62dfbfe57ef] Merge tag 'drm-fixes-2020-08-28' of git://anongit.freedesktop.org/drm/drm testing commit 5ec06b5c0d259a8c7c4376b121b2f62dfbfe57ef with gcc (GCC) 8.1.0 kernel signature: 4fa7a8f6ac057f5883bef32dfda550e6d0b15b6903410968bfa91e19a9d162fa all runs: OK # git bisect bad 5ec06b5c0d259a8c7c4376b121b2f62dfbfe57ef Bisecting: 110 revisions left to test after this (roughly 7 steps) [c41c3ec4a2bcd3f24ab753bb337ec342f24bdf94] Merge tag 'io_uring-5.9-2020-08-23' of git://git.kernel.dk/linux-block testing commit c41c3ec4a2bcd3f24ab753bb337ec342f24bdf94 with gcc (GCC) 8.1.0 kernel signature: b505d7a769bb4cfba10b07a474c12f2904019bfb91baa6216afb8bd0fe7dff8e all runs: OK # git bisect bad c41c3ec4a2bcd3f24ab753bb337ec342f24bdf94 Bisecting: 62 revisions left to test after this (roughly 6 steps) [e99b2507baccca79394ec646e3d1a0884667ea98] Merge tag 'core-urgent-2020-08-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit e99b2507baccca79394ec646e3d1a0884667ea98 with gcc (GCC) 8.1.0 kernel signature: 8e6bdfe1ee8ce641b6a8c4c18af232a0dbbde70af2fa62297ab356150d6becd9 all runs: OK # git bisect bad e99b2507baccca79394ec646e3d1a0884667ea98 Bisecting: 29 revisions left to test after this (roughly 5 steps) [ce51f63e63c52a4e1eee4dd040fb0ba0af3b43ab] net/smc: Prevent kernel-infoleak in __smc_diag_dump() testing commit ce51f63e63c52a4e1eee4dd040fb0ba0af3b43ab with gcc (GCC) 8.1.0 kernel signature: dfe03f0e4efa16881d2bc0abb1138630bea2aab31c9becfeaf80027c160cb302 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good ce51f63e63c52a4e1eee4dd040fb0ba0af3b43ab Bisecting: 18 revisions left to test after this (roughly 4 steps) [b16fc097bc283184cde40e5b30d15705e1590410] bpf: Fix two typos in uapi/linux/bpf.h testing commit b16fc097bc283184cde40e5b30d15705e1590410 with gcc (GCC) 8.1.0 kernel signature: d6f73dd28d12f496785f403fcc6ac5faccf3ddd2e2efb222fb99783251973a7e all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good b16fc097bc283184cde40e5b30d15705e1590410 Bisecting: 9 revisions left to test after this (roughly 3 steps) [774d977abfd024e6f73484544b9abe5a5cd62de7] net: dsa: b53: check for timeout testing commit 774d977abfd024e6f73484544b9abe5a5cd62de7 with gcc (GCC) 8.1.0 kernel signature: 53d4a6724341473ca4797423dfe115b718c49112952f8fe1f85704e849fe44c2 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good 774d977abfd024e6f73484544b9abe5a5cd62de7 Bisecting: 3 revisions left to test after this (roughly 2 steps) [9d045ed1ebe1a6115d3fa9930c5371defb31d95a] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 9d045ed1ebe1a6115d3fa9930c5371defb31d95a with gcc (GCC) 8.1.0 kernel signature: 81dfab31f0f32e4c0729c00b8ff9c6eca3d1b32db0d561cd46984b0b0b1652a5 all runs: OK # git bisect bad 9d045ed1ebe1a6115d3fa9930c5371defb31d95a Bisecting: 2 revisions left to test after this (roughly 2 steps) [f320ac6e131669345c7f4abefbb228b570eb9199] Merge branch 'work.epoll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs testing commit f320ac6e131669345c7f4abefbb228b570eb9199 with gcc (GCC) 8.1.0 kernel signature: 708629b07318d26e35e6bbcebee5ebb8b434fb4debed15e137738b2649616ce6 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good f320ac6e131669345c7f4abefbb228b570eb9199 Bisecting: 0 revisions left to test after this (roughly 1 step) [eeaac3634ee0e3f35548be35275efeca888e9b23] net: nexthop: don't allow empty NHA_GROUP testing commit eeaac3634ee0e3f35548be35275efeca888e9b23 with gcc (GCC) 8.1.0 kernel signature: 2b298de394bbffdd3d3dc10d293d1315241458448a1c0ee2cb925226238d042c all runs: OK # git bisect bad eeaac3634ee0e3f35548be35275efeca888e9b23 Bisecting: 0 revisions left to test after this (roughly 0 steps) [4af7b32f84aa4cd60e39b355bc8a1eab6cd8d8a4] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf testing commit 4af7b32f84aa4cd60e39b355bc8a1eab6cd8d8a4 with gcc (GCC) 8.1.0 kernel signature: d75a7e625fceb6503f5900d19667ace3722e729c852cbe706b99f434f4dbfe31 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good 4af7b32f84aa4cd60e39b355bc8a1eab6cd8d8a4 eeaac3634ee0e3f35548be35275efeca888e9b23 is the first bad commit commit eeaac3634ee0e3f35548be35275efeca888e9b23 Author: Nikolay Aleksandrov Date: Sat Aug 22 15:06:36 2020 +0300 net: nexthop: don't allow empty NHA_GROUP Currently the nexthop code will use an empty NHA_GROUP attribute, but it requires at least 1 entry in order to function properly. Otherwise we end up derefencing null or random pointers all over the place due to not having any nh_grp_entry members allocated, nexthop code relies on having at least the first member present. Empty NHA_GROUP doesn't make any sense so just disallow it. Also add a WARN_ON for any future users of nexthop_create_group(). BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 0 PID: 558 Comm: ip Not tainted 5.9.0-rc1+ #93 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014 RIP: 0010:fib_check_nexthop+0x4a/0xaa Code: 0f 84 83 00 00 00 48 c7 02 80 03 f7 81 c3 40 80 fe fe 75 12 b8 ea ff ff ff 48 85 d2 74 6b 48 c7 02 40 03 f7 81 c3 48 8b 40 10 <48> 8b 80 80 00 00 00 eb 36 80 78 1a 00 74 12 b8 ea ff ff ff 48 85 RSP: 0018:ffff88807983ba00 EFLAGS: 00010213 RAX: 0000000000000000 RBX: ffff88807983bc00 RCX: 0000000000000000 RDX: ffff88807983bc00 RSI: 0000000000000000 RDI: ffff88807bdd0a80 RBP: ffff88807983baf8 R08: 0000000000000dc0 R09: 000000000000040a R10: 0000000000000000 R11: ffff88807bdd0ae8 R12: 0000000000000000 R13: 0000000000000000 R14: ffff88807bea3100 R15: 0000000000000001 FS: 00007f10db393700(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000080 CR3: 000000007bd0f004 CR4: 00000000003706f0 Call Trace: fib_create_info+0x64d/0xaf7 fib_table_insert+0xf6/0x581 ? __vma_adjust+0x3b6/0x4d4 inet_rtm_newroute+0x56/0x70 rtnetlink_rcv_msg+0x1e3/0x20d ? rtnl_calcit.isra.0+0xb8/0xb8 netlink_rcv_skb+0x5b/0xac netlink_unicast+0xfa/0x17b netlink_sendmsg+0x334/0x353 sock_sendmsg_nosec+0xf/0x3f ____sys_sendmsg+0x1a0/0x1fc ? copy_msghdr_from_user+0x4c/0x61 ___sys_sendmsg+0x63/0x84 ? handle_mm_fault+0xa39/0x11b5 ? sockfd_lookup_light+0x72/0x9a __sys_sendmsg+0x50/0x6e do_syscall_64+0x54/0xbe entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f10dacc0bb7 Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb cd 66 0f 1f 44 00 00 8b 05 9a 4b 2b 00 85 c0 75 2e 48 63 ff 48 63 d2 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 f2 2a 00 f7 d8 64 89 02 48 RSP: 002b:00007ffcbe628bf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ffcbe628f80 RCX: 00007f10dacc0bb7 RDX: 0000000000000000 RSI: 00007ffcbe628c60 RDI: 0000000000000003 RBP: 000000005f41099c R08: 0000000000000001 R09: 0000000000000008 R10: 00000000000005e9 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffcbe628d70 R15: 0000563a86c6e440 Modules linked in: CR2: 0000000000000080 CC: David Ahern Fixes: 430a049190de ("nexthop: Add support for nexthop groups") Reported-by: syzbot+a61aa19b0c14c8770bd9@syzkaller.appspotmail.com Signed-off-by: Nikolay Aleksandrov Reviewed-by: David Ahern Signed-off-by: David S. Miller net/ipv4/nexthop.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) culprit signature: 2b298de394bbffdd3d3dc10d293d1315241458448a1c0ee2cb925226238d042c parent signature: d75a7e625fceb6503f5900d19667ace3722e729c852cbe706b99f434f4dbfe31 revisions tested: 14, total time: 3h8m53.952424208s (build: 1h12m39.35789172s, test: 1h54m51.902008834s) first good commit: eeaac3634ee0e3f35548be35275efeca888e9b23 net: nexthop: don't allow empty NHA_GROUP recipients (to): ["davem@davemloft.net" "dsahern@gmail.com" "nikolay@cumulusnetworks.com"] recipients (cc): []