bisecting fixing commit since c3d8f220d01220a5b253e422be407d068dc65511 building syzkaller on cef5ae6814696260ff58c538a1b6044af90c5979 testing commit c3d8f220d01220a5b253e422be407d068dc65511 with gcc (GCC) 8.1.0 kernel signature: 2aff23e9f0bf729776d8d2d5dd4f06da495e3806bb4779daf448c1ffda4c7f5e all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole testing current HEAD 60e720931556fc1034d0981460164dcf02697679 testing commit 60e720931556fc1034d0981460164dcf02697679 with gcc (GCC) 8.1.0 kernel signature: 5bdece28a99b81fa6324dc3d1670127461b7a0811dab05dcbd4c763ef170f83d all runs: OK # git bisect start 60e720931556fc1034d0981460164dcf02697679 c3d8f220d01220a5b253e422be407d068dc65511 Bisecting: 844 revisions left to test after this (roughly 10 steps) [74c7b80e222b58d3cea731d31e2a31a77fea8345] net: lantiq: use netif_tx_napi_add() for TX NAPI testing commit 74c7b80e222b58d3cea731d31e2a31a77fea8345 with gcc (GCC) 8.1.0 kernel signature: ef2f7b4f4b741c209af68d43e86d5162336640069063518ff8d67f0f5d1e92d9 all runs: OK # git bisect bad 74c7b80e222b58d3cea731d31e2a31a77fea8345 Bisecting: 421 revisions left to test after this (roughly 9 steps) [d37d56920004cae612fa32d1f92aaacca5e145f7] Merge branch 'linux-5.9' of git://github.com/skeggsb/linux into drm-fixes testing commit d37d56920004cae612fa32d1f92aaacca5e145f7 with gcc (GCC) 8.1.0 kernel signature: 31ed86d613695a30f3de2eb6b1023ffe7132f7c58831164678bc564f3b4ee7ba all runs: OK # git bisect bad d37d56920004cae612fa32d1f92aaacca5e145f7 Bisecting: 187 revisions left to test after this (roughly 8 steps) [5ec06b5c0d259a8c7c4376b121b2f62dfbfe57ef] Merge tag 'drm-fixes-2020-08-28' of git://anongit.freedesktop.org/drm/drm testing commit 5ec06b5c0d259a8c7c4376b121b2f62dfbfe57ef with gcc (GCC) 8.1.0 kernel signature: 450e31a4231b8cb5e31d721d3f959855735ea6803ae09e272417ee3f21a9491a all runs: OK # git bisect bad 5ec06b5c0d259a8c7c4376b121b2f62dfbfe57ef Bisecting: 110 revisions left to test after this (roughly 7 steps) [c41c3ec4a2bcd3f24ab753bb337ec342f24bdf94] Merge tag 'io_uring-5.9-2020-08-23' of git://git.kernel.dk/linux-block testing commit c41c3ec4a2bcd3f24ab753bb337ec342f24bdf94 with gcc (GCC) 8.1.0 kernel signature: c88bc1320ba38c801cb6f48636c8d00d989c97b703d9c4b0528b0581bac9eb9f all runs: OK # git bisect bad c41c3ec4a2bcd3f24ab753bb337ec342f24bdf94 Bisecting: 62 revisions left to test after this (roughly 6 steps) [e99b2507baccca79394ec646e3d1a0884667ea98] Merge tag 'core-urgent-2020-08-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit e99b2507baccca79394ec646e3d1a0884667ea98 with gcc (GCC) 8.1.0 kernel signature: 970a1131cde981b799895649d99de9b613ad02fcb5d6967dd97fe8ac4c7c680b all runs: OK # git bisect bad e99b2507baccca79394ec646e3d1a0884667ea98 Bisecting: 29 revisions left to test after this (roughly 5 steps) [ce51f63e63c52a4e1eee4dd040fb0ba0af3b43ab] net/smc: Prevent kernel-infoleak in __smc_diag_dump() testing commit ce51f63e63c52a4e1eee4dd040fb0ba0af3b43ab with gcc (GCC) 8.1.0 kernel signature: 32d6f3b4494d9bf2f34aec7a84f469aaea0d0a7c3c165d5aef5b7027d69c28fc all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good ce51f63e63c52a4e1eee4dd040fb0ba0af3b43ab Bisecting: 18 revisions left to test after this (roughly 4 steps) [b16fc097bc283184cde40e5b30d15705e1590410] bpf: Fix two typos in uapi/linux/bpf.h testing commit b16fc097bc283184cde40e5b30d15705e1590410 with gcc (GCC) 8.1.0 kernel signature: a3eb717a99502d99af4fabddcfcd6b6b043486a67f0786208c01778c5d7f044e all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good b16fc097bc283184cde40e5b30d15705e1590410 Bisecting: 9 revisions left to test after this (roughly 3 steps) [774d977abfd024e6f73484544b9abe5a5cd62de7] net: dsa: b53: check for timeout testing commit 774d977abfd024e6f73484544b9abe5a5cd62de7 with gcc (GCC) 8.1.0 kernel signature: 4dafabd5ddd9f98d6a12c2c14d51f3432ea56a82f6e36c7ddc6c52576c6556eb all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good 774d977abfd024e6f73484544b9abe5a5cd62de7 Bisecting: 3 revisions left to test after this (roughly 2 steps) [9d045ed1ebe1a6115d3fa9930c5371defb31d95a] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 9d045ed1ebe1a6115d3fa9930c5371defb31d95a with gcc (GCC) 8.1.0 kernel signature: e5b78f8925dcf2338d624bcabe377a9fbd4819985af4a4ba0d5c89cefc8ecfdd all runs: OK # git bisect bad 9d045ed1ebe1a6115d3fa9930c5371defb31d95a Bisecting: 2 revisions left to test after this (roughly 2 steps) [f320ac6e131669345c7f4abefbb228b570eb9199] Merge branch 'work.epoll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs testing commit f320ac6e131669345c7f4abefbb228b570eb9199 with gcc (GCC) 8.1.0 kernel signature: 249a2a32b92fc70a992355087ac2de70a947e65ef60d2d50e4f6ddde9fa29ac7 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good f320ac6e131669345c7f4abefbb228b570eb9199 Bisecting: 0 revisions left to test after this (roughly 1 step) [eeaac3634ee0e3f35548be35275efeca888e9b23] net: nexthop: don't allow empty NHA_GROUP testing commit eeaac3634ee0e3f35548be35275efeca888e9b23 with gcc (GCC) 8.1.0 kernel signature: fcc4889796aa711c9af28d1bc2cc88c08b25ef7d9113ee452e647ff91f240d0a all runs: OK # git bisect bad eeaac3634ee0e3f35548be35275efeca888e9b23 Bisecting: 0 revisions left to test after this (roughly 0 steps) [4af7b32f84aa4cd60e39b355bc8a1eab6cd8d8a4] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf testing commit 4af7b32f84aa4cd60e39b355bc8a1eab6cd8d8a4 with gcc (GCC) 8.1.0 kernel signature: c0a3431c0315a8100c72b794238cbccaaa85ed1c2a20584aa976e153768a919b all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in nexthop_is_blackhole # git bisect good 4af7b32f84aa4cd60e39b355bc8a1eab6cd8d8a4 eeaac3634ee0e3f35548be35275efeca888e9b23 is the first bad commit commit eeaac3634ee0e3f35548be35275efeca888e9b23 Author: Nikolay Aleksandrov Date: Sat Aug 22 15:06:36 2020 +0300 net: nexthop: don't allow empty NHA_GROUP Currently the nexthop code will use an empty NHA_GROUP attribute, but it requires at least 1 entry in order to function properly. Otherwise we end up derefencing null or random pointers all over the place due to not having any nh_grp_entry members allocated, nexthop code relies on having at least the first member present. Empty NHA_GROUP doesn't make any sense so just disallow it. Also add a WARN_ON for any future users of nexthop_create_group(). BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 0 PID: 558 Comm: ip Not tainted 5.9.0-rc1+ #93 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014 RIP: 0010:fib_check_nexthop+0x4a/0xaa Code: 0f 84 83 00 00 00 48 c7 02 80 03 f7 81 c3 40 80 fe fe 75 12 b8 ea ff ff ff 48 85 d2 74 6b 48 c7 02 40 03 f7 81 c3 48 8b 40 10 <48> 8b 80 80 00 00 00 eb 36 80 78 1a 00 74 12 b8 ea ff ff ff 48 85 RSP: 0018:ffff88807983ba00 EFLAGS: 00010213 RAX: 0000000000000000 RBX: ffff88807983bc00 RCX: 0000000000000000 RDX: ffff88807983bc00 RSI: 0000000000000000 RDI: ffff88807bdd0a80 RBP: ffff88807983baf8 R08: 0000000000000dc0 R09: 000000000000040a R10: 0000000000000000 R11: ffff88807bdd0ae8 R12: 0000000000000000 R13: 0000000000000000 R14: ffff88807bea3100 R15: 0000000000000001 FS: 00007f10db393700(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000080 CR3: 000000007bd0f004 CR4: 00000000003706f0 Call Trace: fib_create_info+0x64d/0xaf7 fib_table_insert+0xf6/0x581 ? __vma_adjust+0x3b6/0x4d4 inet_rtm_newroute+0x56/0x70 rtnetlink_rcv_msg+0x1e3/0x20d ? rtnl_calcit.isra.0+0xb8/0xb8 netlink_rcv_skb+0x5b/0xac netlink_unicast+0xfa/0x17b netlink_sendmsg+0x334/0x353 sock_sendmsg_nosec+0xf/0x3f ____sys_sendmsg+0x1a0/0x1fc ? copy_msghdr_from_user+0x4c/0x61 ___sys_sendmsg+0x63/0x84 ? handle_mm_fault+0xa39/0x11b5 ? sockfd_lookup_light+0x72/0x9a __sys_sendmsg+0x50/0x6e do_syscall_64+0x54/0xbe entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f10dacc0bb7 Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb cd 66 0f 1f 44 00 00 8b 05 9a 4b 2b 00 85 c0 75 2e 48 63 ff 48 63 d2 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 f2 2a 00 f7 d8 64 89 02 48 RSP: 002b:00007ffcbe628bf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ffcbe628f80 RCX: 00007f10dacc0bb7 RDX: 0000000000000000 RSI: 00007ffcbe628c60 RDI: 0000000000000003 RBP: 000000005f41099c R08: 0000000000000001 R09: 0000000000000008 R10: 00000000000005e9 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffcbe628d70 R15: 0000563a86c6e440 Modules linked in: CR2: 0000000000000080 CC: David Ahern Fixes: 430a049190de ("nexthop: Add support for nexthop groups") Reported-by: syzbot+a61aa19b0c14c8770bd9@syzkaller.appspotmail.com Signed-off-by: Nikolay Aleksandrov Reviewed-by: David Ahern Signed-off-by: David S. Miller net/ipv4/nexthop.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) culprit signature: fcc4889796aa711c9af28d1bc2cc88c08b25ef7d9113ee452e647ff91f240d0a parent signature: c0a3431c0315a8100c72b794238cbccaaa85ed1c2a20584aa976e153768a919b revisions tested: 14, total time: 2h56m16.81463474s (build: 1h11m47.475428729s, test: 1h43m17.277918742s) first good commit: eeaac3634ee0e3f35548be35275efeca888e9b23 net: nexthop: don't allow empty NHA_GROUP recipients (to): ["davem@davemloft.net" "dsahern@gmail.com" "nikolay@cumulusnetworks.com"] recipients (cc): []