divide error in genelink_tx_fixup
7 views
Skip to first unread message
syzbot
Oct 17, 2021, 7:27:20 PM10/17/21
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 73e6d86c30ee ANDROID: ABI: update symbols to unisoc whitel..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1727ab58b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=12fdca0186751701
dashboard link: https://syzkaller.appspot.com/bug?extid=70a89270303b4f68b3d0
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+70a892...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.125-syzkaller-00028-g73e6d86c30ee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:genelink_tx_fixup+0x435/0x5f0 drivers/net/usb/gl620a.c:172
Code: 03 42 8a 04 20 84 c0 0f 85 e9 00 00 00 8b 2b 49 83 ed 80 4c 89 e8 48 c1 e8 03 42 8a 04 20 84 c0 0f 85 ed 00 00 00 89 e8 31 d2 <41> f7 75 00 89 d3 31 ff 89 d6 e8 9c 20 a1 fe 85 db 74 07 e8 f3 1c
RSP: 0018:ffff8881f5e1efd0 EFLAGS: 00010246
RAX: 0000000000000062 RBX: ffff8881e9087570 RCX: ffff8881f5e13f00
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881e9087570
RBP: 0000000000000062 R08: ffffffff82c43537 R09: 0000000000000003
R10: ffffed103ebc3e2d R11: 0000000000000004 R12: dffffc0000000000
R13: ffff8881eb4969c0 R14: 000000000000005a R15: ffff8881e9087500
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561aedc10368 CR3: 00000001b1078000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
usbnet_start_xmit+0x107/0x1a10 drivers/net/usb/usbnet.c:1363
__netdev_start_xmit include/linux/netdevice.h:4506 [inline]
netdev_start_xmit include/linux/netdevice.h:4520 [inline]
xmit_one+0xfa/0x470 net/core/dev.c:3203
dev_hard_start_xmit+0xac/0x1b0 net/core/dev.c:3219
sch_direct_xmit+0x28c/0x9e0 net/sched/sch_generic.c:336
qdisc_restart net/sched/sch_generic.c:401 [inline]
__qdisc_run+0x245/0x420 net/sched/sch_generic.c:409
qdisc_run include/net/pkt_sched.h:121 [inline]
__dev_xmit_skb net/core/dev.c:3395 [inline]
__dev_queue_xmit+0xd2c/0x2e50 net/core/dev.c:3748
neigh_output include/net/neighbour.h:519 [inline]
ip6_finish_output2+0xed9/0x15c0 net/ipv6/ip6_output.c:116
NF_HOOK_COND include/linux/netfilter.h:297 [inline]
ip6_output+0x1c1/0x420 net/ipv6/ip6_output.c:214
dst_output include/net/dst.h:444 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
mld_sendpack+0x606/0xb30 net/ipv6/mcast.c:1679
mld_send_cr net/ipv6/mcast.c:1975 [inline]
mld_ifc_timer_expire+0x804/0xb30 net/ipv6/mcast.c:2474
call_timer_fn+0x30/0x330 kernel/time/timer.c:1416
expire_timers+0x214/0x410 kernel/time/timer.c:1461
__run_timers+0x603/0x740 kernel/time/timer.c:1785
run_timer_softirq+0x46/0x80 kernel/time/timer.c:1798
__do_softirq+0x23e/0x615 kernel/softirq.c:292
run_ksoftirqd+0x1f/0x30 kernel/softirq.c:603
smpboot_thread_fn+0x551/0x930 kernel/smpboot.c:165
kthread+0x30f/0x330 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 0622518b2ebf2479 ]---
RIP: 0010:genelink_tx_fixup+0x435/0x5f0 drivers/net/usb/gl620a.c:172
Code: 03 42 8a 04 20 84 c0 0f 85 e9 00 00 00 8b 2b 49 83 ed 80 4c 89 e8 48 c1 e8 03 42 8a 04 20 84 c0 0f 85 ed 00 00 00 89 e8 31 d2 <41> f7 75 00 89 d3 31 ff 89 d6 e8 9c 20 a1 fe 85 db 74 07 e8 f3 1c
RSP: 0018:ffff8881f5e1efd0 EFLAGS: 00010246
RAX: 0000000000000062 RBX: ffff8881e9087570 RCX: ffff8881f5e13f00
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881e9087570
RBP: 0000000000000062 R08: ffffffff82c43537 R09: 0000000000000003
R10: ffffed103ebc3e2d R11: 0000000000000004 R12: dffffc0000000000
R13: ffff8881eb4969c0 R14: 000000000000005a R15: ffff8881e9087500
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561aedc10368 CR3: 00000001b1078000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 03 42 8a add -0x76(%rdx),%eax
3: 04 20 add $0x20,%al
5: 84 c0 test %al,%al
7: 0f 85 e9 00 00 00 jne 0xf6
d: 8b 2b mov (%rbx),%ebp
f: 49 83 ed 80 sub $0xffffffffffffff80,%r13
13: 4c 89 e8 mov %r13,%rax
16: 48 c1 e8 03 shr $0x3,%rax
1a: 42 8a 04 20 mov (%rax,%r12,1),%al
1e: 84 c0 test %al,%al
20: 0f 85 ed 00 00 00 jne 0x113
26: 89 e8 mov %ebp,%eax
28: 31 d2 xor %edx,%edx
* 2a: 41 f7 75 00 divl 0x0(%r13) <-- trapping instruction
2e: 89 d3 mov %edx,%ebx
30: 31 ff xor %edi,%edi
32: 89 d6 mov %edx,%esi
34: e8 9c 20 a1 fe callq 0xfea120d5
39: 85 db test %ebx,%ebx
3b: 74 07 je 0x44
3d: e8 .byte 0xe8
3e: f3 repz
3f: 1c .byte 0x1c
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 73e6d86c30ee ANDROID: ABI: update symbols to unisoc whitel..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1727ab58b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=12fdca0186751701
dashboard link: https://syzkaller.appspot.com/bug?extid=70a89270303b4f68b3d0
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+70a892...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.125-syzkaller-00028-g73e6d86c30ee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:genelink_tx_fixup+0x435/0x5f0 drivers/net/usb/gl620a.c:172
Code: 03 42 8a 04 20 84 c0 0f 85 e9 00 00 00 8b 2b 49 83 ed 80 4c 89 e8 48 c1 e8 03 42 8a 04 20 84 c0 0f 85 ed 00 00 00 89 e8 31 d2 <41> f7 75 00 89 d3 31 ff 89 d6 e8 9c 20 a1 fe 85 db 74 07 e8 f3 1c
RSP: 0018:ffff8881f5e1efd0 EFLAGS: 00010246
RAX: 0000000000000062 RBX: ffff8881e9087570 RCX: ffff8881f5e13f00
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881e9087570
RBP: 0000000000000062 R08: ffffffff82c43537 R09: 0000000000000003
R10: ffffed103ebc3e2d R11: 0000000000000004 R12: dffffc0000000000
R13: ffff8881eb4969c0 R14: 000000000000005a R15: ffff8881e9087500
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561aedc10368 CR3: 00000001b1078000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
usbnet_start_xmit+0x107/0x1a10 drivers/net/usb/usbnet.c:1363
__netdev_start_xmit include/linux/netdevice.h:4506 [inline]
netdev_start_xmit include/linux/netdevice.h:4520 [inline]
xmit_one+0xfa/0x470 net/core/dev.c:3203
dev_hard_start_xmit+0xac/0x1b0 net/core/dev.c:3219
sch_direct_xmit+0x28c/0x9e0 net/sched/sch_generic.c:336
qdisc_restart net/sched/sch_generic.c:401 [inline]
__qdisc_run+0x245/0x420 net/sched/sch_generic.c:409
qdisc_run include/net/pkt_sched.h:121 [inline]
__dev_xmit_skb net/core/dev.c:3395 [inline]
__dev_queue_xmit+0xd2c/0x2e50 net/core/dev.c:3748
neigh_output include/net/neighbour.h:519 [inline]
ip6_finish_output2+0xed9/0x15c0 net/ipv6/ip6_output.c:116
NF_HOOK_COND include/linux/netfilter.h:297 [inline]
ip6_output+0x1c1/0x420 net/ipv6/ip6_output.c:214
dst_output include/net/dst.h:444 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
mld_sendpack+0x606/0xb30 net/ipv6/mcast.c:1679
mld_send_cr net/ipv6/mcast.c:1975 [inline]
mld_ifc_timer_expire+0x804/0xb30 net/ipv6/mcast.c:2474
call_timer_fn+0x30/0x330 kernel/time/timer.c:1416
expire_timers+0x214/0x410 kernel/time/timer.c:1461
__run_timers+0x603/0x740 kernel/time/timer.c:1785
run_timer_softirq+0x46/0x80 kernel/time/timer.c:1798
__do_softirq+0x23e/0x615 kernel/softirq.c:292
run_ksoftirqd+0x1f/0x30 kernel/softirq.c:603
smpboot_thread_fn+0x551/0x930 kernel/smpboot.c:165
kthread+0x30f/0x330 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 0622518b2ebf2479 ]---
RIP: 0010:genelink_tx_fixup+0x435/0x5f0 drivers/net/usb/gl620a.c:172
Code: 03 42 8a 04 20 84 c0 0f 85 e9 00 00 00 8b 2b 49 83 ed 80 4c 89 e8 48 c1 e8 03 42 8a 04 20 84 c0 0f 85 ed 00 00 00 89 e8 31 d2 <41> f7 75 00 89 d3 31 ff 89 d6 e8 9c 20 a1 fe 85 db 74 07 e8 f3 1c
RSP: 0018:ffff8881f5e1efd0 EFLAGS: 00010246
RAX: 0000000000000062 RBX: ffff8881e9087570 RCX: ffff8881f5e13f00
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881e9087570
RBP: 0000000000000062 R08: ffffffff82c43537 R09: 0000000000000003
R10: ffffed103ebc3e2d R11: 0000000000000004 R12: dffffc0000000000
R13: ffff8881eb4969c0 R14: 000000000000005a R15: ffff8881e9087500
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561aedc10368 CR3: 00000001b1078000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 03 42 8a add -0x76(%rdx),%eax
3: 04 20 add $0x20,%al
5: 84 c0 test %al,%al
7: 0f 85 e9 00 00 00 jne 0xf6
d: 8b 2b mov (%rbx),%ebp
f: 49 83 ed 80 sub $0xffffffffffffff80,%r13
13: 4c 89 e8 mov %r13,%rax
16: 48 c1 e8 03 shr $0x3,%rax
1a: 42 8a 04 20 mov (%rax,%r12,1),%al
1e: 84 c0 test %al,%al
20: 0f 85 ed 00 00 00 jne 0x113
26: 89 e8 mov %ebp,%eax
28: 31 d2 xor %edx,%edx
* 2a: 41 f7 75 00 divl 0x0(%r13) <-- trapping instruction
2e: 89 d3 mov %edx,%ebx
30: 31 ff xor %edi,%edi
32: 89 d6 mov %edx,%esi
34: e8 9c 20 a1 fe callq 0xfea120d5
39: 85 db test %ebx,%ebx
3b: 74 07 je 0x44
3d: e8 .byte 0xe8
3e: f3 repz
3f: 1c .byte 0x1c
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Oct 17, 2021, 7:36:24 PM10/17/21
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 73e6d86c30ee ANDROID: ABI: update symbols to unisoc whitel..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=16735734b00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10e57a44b00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+70a892...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.4.125-syzkaller-00028-g73e6d86c30ee #0
RAX: 0000000000000062 RBX: ffff8881de33b430 RCX: ffff8881f5dc3f00
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881de33b430
R13: ffff8881de5dc9c0 R14: 000000000000005a R15: ffff8881de33b3c0
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
HEAD commit: 73e6d86c30ee ANDROID: ABI: update symbols to unisoc whitel..
git tree: android12-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=12fdca0186751701
dashboard link: https://syzkaller.appspot.com/bug?extid=70a89270303b4f68b3d0
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15bd3d42b00000
dashboard link: https://syzkaller.appspot.com/bug?extid=70a89270303b4f68b3d0
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10e57a44b00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+70a892...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:genelink_tx_fixup+0x435/0x5f0 drivers/net/usb/gl620a.c:172
Code: 03 42 8a 04 20 84 c0 0f 85 e9 00 00 00 8b 2b 49 83 ed 80 4c 89 e8 48 c1 e8 03 42 8a 04 20 84 c0 0f 85 ed 00 00 00 89 e8 31 d2 <41> f7 75 00 89 d3 31 ff 89 d6 e8 9c 20 a1 fe 85 db 74 07 e8 f3 1c
RSP: 0018:ffff8881f5dcefd0 EFLAGS: 00010246
RIP: 0010:genelink_tx_fixup+0x435/0x5f0 drivers/net/usb/gl620a.c:172
Code: 03 42 8a 04 20 84 c0 0f 85 e9 00 00 00 8b 2b 49 83 ed 80 4c 89 e8 48 c1 e8 03 42 8a 04 20 84 c0 0f 85 ed 00 00 00 89 e8 31 d2 <41> f7 75 00 89 d3 31 ff 89 d6 e8 9c 20 a1 fe 85 db 74 07 e8 f3 1c
RAX: 0000000000000062 RBX: ffff8881de33b430 RCX: ffff8881f5dc3f00
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881de33b430
RBP: 0000000000000062 R08: ffffffff82c43537 R09: 0000000000000003
R10: ffffed103ebb9e2d R11: 0000000000000004 R12: dffffc0000000000
R13: ffff8881de5dc9c0 R14: 000000000000005a R15: ffff8881de33b3c0
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563baef42368 CR3: 00000001e4a54000 CR4: 00000000003406f0
syzbot
Apr 19, 2023, 9:40:53 AM4/19/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages