KASAN: slab-out-of-bounds Write in netif_napi_del
25 views
Skip to first unread message
syzbot
Jun 17, 2022, 8:43:21 PM6/17/22
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 77dc925ddffb UPSTREAM: Revert "net: micrel: fix KS8851_MLL..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12d3fc60080000
kernel config: https://syzkaller.appspot.com/x/.config?x=d3ed5af00411ba5f
dashboard link: https://syzkaller.appspot.com/bug?extid=4cf3e704160dcf55065f
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17aa65b0080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=131297e8080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4cf3e7...@syzkaller.appspotmail.com
netlink: 20 bytes leftover after parsing attributes in process `syz-executor527'.
==================================================================
BUG: KASAN: slab-out-of-bounds in test_and_clear_bit include/asm-generic/bitops-instrumented.h:185 [inline]
BUG: KASAN: slab-out-of-bounds in napi_hash_del net/core/dev.c:6228 [inline]
BUG: KASAN: slab-out-of-bounds in netif_napi_del+0x2c/0x7a0 net/core/dev.c:6323
Write of size 8 at addr ffff8881ddb17f10 by task syz-executor527/305
CPU: 0 PID: 305 Comm: syz-executor527 Not tainted 5.4.190-syzkaller-00044-g77dc925ddffb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x18e/0x1d5 lib/dump_stack.c:118
print_address_description+0x8c/0x630 mm/kasan/report.c:384
__kasan_report+0xf6/0x130 mm/kasan/report.c:516
kasan_report+0x30/0x60 mm/kasan/common.c:653
check_memory_region_inline mm/kasan/generic.c:141 [inline]
check_memory_region+0x298/0x2d0 mm/kasan/generic.c:191
test_and_clear_bit include/asm-generic/bitops-instrumented.h:185 [inline]
napi_hash_del net/core/dev.c:6228 [inline]
netif_napi_del+0x2c/0x7a0 net/core/dev.c:6323
free_netdev+0x188/0x310 net/core/dev.c:9697
netdev_run_todo+0xa79/0xc80 net/core/dev.c:9447
rtnl_unlock net/core/rtnetlink.c:112 [inline]
rtnetlink_rcv_msg+0xa49/0xb90 net/core/rtnetlink.c:5263
netlink_rcv_skb+0x190/0x3a0 net/netlink/af_netlink.c:2500
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x771/0x8d0 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x913/0xb90 net/netlink/af_netlink.c:1933
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
____sys_sendmsg+0x4ee/0x7c0 net/socket.c:2287
___sys_sendmsg net/socket.c:2341 [inline]
__sys_sendmsg+0x235/0x2f0 net/socket.c:2387
do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f18abcb9e29
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f18abc6c308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f18abd42428 RCX: 00007f18abcb9e29
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004
RBP: 00007f18abd42420 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f18abd4242c
R13: 00007f18abd10004 R14: 74656e2f7665642f R15: 0000000000022000
Allocated by task 299:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
__kasan_kmalloc+0x131/0x1e0 mm/kasan/common.c:529
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2829 [inline]
slab_alloc mm/slub.c:2837 [inline]
__kmalloc_track_caller+0xfb/0x280 mm/slub.c:4449
__kmalloc_reserve net/core/skbuff.c:142 [inline]
__alloc_skb+0xb5/0x4d0 net/core/skbuff.c:210
__napi_alloc_skb+0x11f/0x540 net/core/skbuff.c:516
napi_alloc_skb include/linux/skbuff.h:2853 [inline]
page_to_skb+0x39/0x910 drivers/net/virtio_net.c:392
receive_mergeable+0x73e/0x2300 drivers/net/virtio_net.c:977
receive_buf+0x104/0x1940 drivers/net/virtio_net.c:1087
virtnet_receive drivers/net/virtio_net.c:1379 [inline]
virtnet_poll+0x554/0x10b0 drivers/net/virtio_net.c:1484
napi_poll+0x195/0x670 net/core/dev.c:6352
net_rx_action+0x2dd/0x890 net/core/dev.c:6420
__do_softirq+0x23e/0x643 kernel/softirq.c:292
Freed by task 0:
(stack is not available)
The buggy address belongs to the object at ffff8881ddb17800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 784 bytes to the right of
1024-byte region [ffff8881ddb17800, ffff8881ddb17c00)
The buggy address belongs to the page:
page:ffffea000776c400 refcount:1 mapcount:0 mapping:ffff8881f5c02280 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5c02280
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2165 [inline]
prep_new_page+0x194/0x380 mm/page_alloc.c:2171
get_page_from_freelist+0x524/0x560 mm/page_alloc.c:3794
__alloc_pages_nodemask+0x2ab/0x6f0 mm/page_alloc.c:4857
alloc_slab_page+0x39/0x3e0 mm/slub.c:343
allocate_slab mm/slub.c:1683 [inline]
new_slab+0x97/0x450 mm/slub.c:1749
new_slab_objects mm/slub.c:2506 [inline]
___slab_alloc+0x320/0x4b0 mm/slub.c:2667
__slab_alloc+0x5a/0x90 mm/slub.c:2707
slab_alloc_node mm/slub.c:2792 [inline]
slab_alloc mm/slub.c:2837 [inline]
__kmalloc_track_caller+0x168/0x280 mm/slub.c:4449
__kmalloc_reserve net/core/skbuff.c:142 [inline]
__alloc_skb+0xb5/0x4d0 net/core/skbuff.c:210
__napi_alloc_skb+0x11f/0x540 net/core/skbuff.c:516
napi_alloc_skb include/linux/skbuff.h:2853 [inline]
page_to_skb+0x39/0x910 drivers/net/virtio_net.c:392
receive_mergeable+0x73e/0x2300 drivers/net/virtio_net.c:977
receive_buf+0x104/0x1940 drivers/net/virtio_net.c:1087
virtnet_receive drivers/net/virtio_net.c:1379 [inline]
virtnet_poll+0x554/0x10b0 drivers/net/virtio_net.c:1484
napi_poll+0x195/0x670 net/core/dev.c:6352
net_rx_action+0x2dd/0x890 net/core/dev.c:6420
page_owner free stack trace missing
Memory state around the buggy address:
ffff8881ddb17e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881ddb17e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881ddb17f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8881ddb17f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881ddb18000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 305 Comm: syz-executor527 Tainted: G B 5.4.190-syzkaller-00044-g77dc925ddffb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:flush_gro_hash net/core/dev.c:6313 [inline]
RIP: 0010:netif_napi_del+0x28f/0x7a0 net/core/dev.c:6328
Code: 00 74 08 4c 89 ff e8 d0 39 32 fe 49 8b 2f 49 39 ef 75 10 e8 03 cd 05 fe eb 35 90 e8 fb cc 05 fe 48 89 dd 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 ef e8 a2 39 32 fe 48 8b 5d 00 48 89 ef
RSP: 0018:ffff8881e2db7790 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff1103bb62fff RCX: ffffffff835a6db0
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ddb17f38
RBP: 0000000000000000 R08: ffffffff835a6b83 R09: fffffbfff0d3170d
R10: fffffbfff0d3170d R11: 1ffffffff0d3170c R12: ffff8881ddb17f00
R13: dffffc0000000000 R14: ffff8881ddb17f00 R15: ffff8881ddb17f38
FS: 00007f18abc6c700(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffee66ba058 CR3: 00000001ddfa2000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
free_netdev+0x188/0x310 net/core/dev.c:9697
netdev_run_todo+0xa79/0xc80 net/core/dev.c:9447
rtnl_unlock net/core/rtnetlink.c:112 [inline]
rtnetlink_rcv_msg+0xa49/0xb90 net/core/rtnetlink.c:5263
netlink_rcv_skb+0x190/0x3a0 net/netlink/af_netlink.c:2500
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x771/0x8d0 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x913/0xb90 net/netlink/af_netlink.c:1933
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
____sys_sendmsg+0x4ee/0x7c0 net/socket.c:2287
___sys_sendmsg net/socket.c:2341 [inline]
__sys_sendmsg+0x235/0x2f0 net/socket.c:2387
do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f18abcb9e29
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f18abc6c308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f18abd42428 RCX: 00007f18abcb9e29
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004
RBP: 00007f18abd42420 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f18abd4242c
R13: 00007f18abd10004 R14: 74656e2f7665642f R15: 0000000000022000
Modules linked in:
---[ end trace 6244634e42fd974d ]---
RIP: 0010:flush_gro_hash net/core/dev.c:6313 [inline]
RIP: 0010:netif_napi_del+0x28f/0x7a0 net/core/dev.c:6328
Code: 00 74 08 4c 89 ff e8 d0 39 32 fe 49 8b 2f 49 39 ef 75 10 e8 03 cd 05 fe eb 35 90 e8 fb cc 05 fe 48 89 dd 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 ef e8 a2 39 32 fe 48 8b 5d 00 48 89 ef
RSP: 0018:ffff8881e2db7790 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff1103bb62fff RCX: ffffffff835a6db0
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ddb17f38
RBP: 0000000000000000 R08: ffffffff835a6b83 R09: fffffbfff0d3170d
R10: fffffbfff0d3170d R11: 1ffffffff0d3170c R12: ffff8881ddb17f00
R13: dffffc0000000000 R14: ffff8881ddb17f00 R15: ffff8881ddb17f38
FS: 00007f18abc6c700(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffee66ba058 CR3: 00000001ddfa2000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
4: 89 ff mov %edi,%edi
6: e8 d0 39 32 fe callq 0xfe3239db
b: 49 8b 2f mov (%r15),%rbp
e: 49 39 ef cmp %rbp,%r15
11: 75 10 jne 0x23
13: e8 03 cd 05 fe callq 0xfe05cd1b
18: eb 35 jmp 0x4f
1a: 90 nop
1b: e8 fb cc 05 fe callq 0xfe05cd1b
20: 48 89 dd mov %rbx,%rbp
23: 48 89 e8 mov %rbp,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 ef mov %rbp,%rdi
34: e8 a2 39 32 fe callq 0xfe3239db
39: 48 8b 5d 00 mov 0x0(%rbp),%rbx
3d: 48 89 ef mov %rbp,%rdi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 77dc925ddffb UPSTREAM: Revert "net: micrel: fix KS8851_MLL..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12d3fc60080000
kernel config: https://syzkaller.appspot.com/x/.config?x=d3ed5af00411ba5f
dashboard link: https://syzkaller.appspot.com/bug?extid=4cf3e704160dcf55065f
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17aa65b0080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=131297e8080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4cf3e7...@syzkaller.appspotmail.com
netlink: 20 bytes leftover after parsing attributes in process `syz-executor527'.
==================================================================
BUG: KASAN: slab-out-of-bounds in test_and_clear_bit include/asm-generic/bitops-instrumented.h:185 [inline]
BUG: KASAN: slab-out-of-bounds in napi_hash_del net/core/dev.c:6228 [inline]
BUG: KASAN: slab-out-of-bounds in netif_napi_del+0x2c/0x7a0 net/core/dev.c:6323
Write of size 8 at addr ffff8881ddb17f10 by task syz-executor527/305
CPU: 0 PID: 305 Comm: syz-executor527 Not tainted 5.4.190-syzkaller-00044-g77dc925ddffb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x18e/0x1d5 lib/dump_stack.c:118
print_address_description+0x8c/0x630 mm/kasan/report.c:384
__kasan_report+0xf6/0x130 mm/kasan/report.c:516
kasan_report+0x30/0x60 mm/kasan/common.c:653
check_memory_region_inline mm/kasan/generic.c:141 [inline]
check_memory_region+0x298/0x2d0 mm/kasan/generic.c:191
test_and_clear_bit include/asm-generic/bitops-instrumented.h:185 [inline]
napi_hash_del net/core/dev.c:6228 [inline]
netif_napi_del+0x2c/0x7a0 net/core/dev.c:6323
free_netdev+0x188/0x310 net/core/dev.c:9697
netdev_run_todo+0xa79/0xc80 net/core/dev.c:9447
rtnl_unlock net/core/rtnetlink.c:112 [inline]
rtnetlink_rcv_msg+0xa49/0xb90 net/core/rtnetlink.c:5263
netlink_rcv_skb+0x190/0x3a0 net/netlink/af_netlink.c:2500
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x771/0x8d0 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x913/0xb90 net/netlink/af_netlink.c:1933
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
____sys_sendmsg+0x4ee/0x7c0 net/socket.c:2287
___sys_sendmsg net/socket.c:2341 [inline]
__sys_sendmsg+0x235/0x2f0 net/socket.c:2387
do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f18abcb9e29
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f18abc6c308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f18abd42428 RCX: 00007f18abcb9e29
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004
RBP: 00007f18abd42420 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f18abd4242c
R13: 00007f18abd10004 R14: 74656e2f7665642f R15: 0000000000022000
Allocated by task 299:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
__kasan_kmalloc+0x131/0x1e0 mm/kasan/common.c:529
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2829 [inline]
slab_alloc mm/slub.c:2837 [inline]
__kmalloc_track_caller+0xfb/0x280 mm/slub.c:4449
__kmalloc_reserve net/core/skbuff.c:142 [inline]
__alloc_skb+0xb5/0x4d0 net/core/skbuff.c:210
__napi_alloc_skb+0x11f/0x540 net/core/skbuff.c:516
napi_alloc_skb include/linux/skbuff.h:2853 [inline]
page_to_skb+0x39/0x910 drivers/net/virtio_net.c:392
receive_mergeable+0x73e/0x2300 drivers/net/virtio_net.c:977
receive_buf+0x104/0x1940 drivers/net/virtio_net.c:1087
virtnet_receive drivers/net/virtio_net.c:1379 [inline]
virtnet_poll+0x554/0x10b0 drivers/net/virtio_net.c:1484
napi_poll+0x195/0x670 net/core/dev.c:6352
net_rx_action+0x2dd/0x890 net/core/dev.c:6420
__do_softirq+0x23e/0x643 kernel/softirq.c:292
Freed by task 0:
(stack is not available)
The buggy address belongs to the object at ffff8881ddb17800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 784 bytes to the right of
1024-byte region [ffff8881ddb17800, ffff8881ddb17c00)
The buggy address belongs to the page:
page:ffffea000776c400 refcount:1 mapcount:0 mapping:ffff8881f5c02280 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5c02280
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2165 [inline]
prep_new_page+0x194/0x380 mm/page_alloc.c:2171
get_page_from_freelist+0x524/0x560 mm/page_alloc.c:3794
__alloc_pages_nodemask+0x2ab/0x6f0 mm/page_alloc.c:4857
alloc_slab_page+0x39/0x3e0 mm/slub.c:343
allocate_slab mm/slub.c:1683 [inline]
new_slab+0x97/0x450 mm/slub.c:1749
new_slab_objects mm/slub.c:2506 [inline]
___slab_alloc+0x320/0x4b0 mm/slub.c:2667
__slab_alloc+0x5a/0x90 mm/slub.c:2707
slab_alloc_node mm/slub.c:2792 [inline]
slab_alloc mm/slub.c:2837 [inline]
__kmalloc_track_caller+0x168/0x280 mm/slub.c:4449
__kmalloc_reserve net/core/skbuff.c:142 [inline]
__alloc_skb+0xb5/0x4d0 net/core/skbuff.c:210
__napi_alloc_skb+0x11f/0x540 net/core/skbuff.c:516
napi_alloc_skb include/linux/skbuff.h:2853 [inline]
page_to_skb+0x39/0x910 drivers/net/virtio_net.c:392
receive_mergeable+0x73e/0x2300 drivers/net/virtio_net.c:977
receive_buf+0x104/0x1940 drivers/net/virtio_net.c:1087
virtnet_receive drivers/net/virtio_net.c:1379 [inline]
virtnet_poll+0x554/0x10b0 drivers/net/virtio_net.c:1484
napi_poll+0x195/0x670 net/core/dev.c:6352
net_rx_action+0x2dd/0x890 net/core/dev.c:6420
page_owner free stack trace missing
Memory state around the buggy address:
ffff8881ddb17e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881ddb17e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881ddb17f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8881ddb17f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881ddb18000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 305 Comm: syz-executor527 Tainted: G B 5.4.190-syzkaller-00044-g77dc925ddffb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:flush_gro_hash net/core/dev.c:6313 [inline]
RIP: 0010:netif_napi_del+0x28f/0x7a0 net/core/dev.c:6328
Code: 00 74 08 4c 89 ff e8 d0 39 32 fe 49 8b 2f 49 39 ef 75 10 e8 03 cd 05 fe eb 35 90 e8 fb cc 05 fe 48 89 dd 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 ef e8 a2 39 32 fe 48 8b 5d 00 48 89 ef
RSP: 0018:ffff8881e2db7790 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff1103bb62fff RCX: ffffffff835a6db0
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ddb17f38
RBP: 0000000000000000 R08: ffffffff835a6b83 R09: fffffbfff0d3170d
R10: fffffbfff0d3170d R11: 1ffffffff0d3170c R12: ffff8881ddb17f00
R13: dffffc0000000000 R14: ffff8881ddb17f00 R15: ffff8881ddb17f38
FS: 00007f18abc6c700(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffee66ba058 CR3: 00000001ddfa2000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
free_netdev+0x188/0x310 net/core/dev.c:9697
netdev_run_todo+0xa79/0xc80 net/core/dev.c:9447
rtnl_unlock net/core/rtnetlink.c:112 [inline]
rtnetlink_rcv_msg+0xa49/0xb90 net/core/rtnetlink.c:5263
netlink_rcv_skb+0x190/0x3a0 net/netlink/af_netlink.c:2500
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x771/0x8d0 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x913/0xb90 net/netlink/af_netlink.c:1933
sock_sendmsg_nosec net/socket.c:638 [inline]
sock_sendmsg net/socket.c:658 [inline]
____sys_sendmsg+0x4ee/0x7c0 net/socket.c:2287
___sys_sendmsg net/socket.c:2341 [inline]
__sys_sendmsg+0x235/0x2f0 net/socket.c:2387
do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f18abcb9e29
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f18abc6c308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f18abd42428 RCX: 00007f18abcb9e29
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004
RBP: 00007f18abd42420 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f18abd4242c
R13: 00007f18abd10004 R14: 74656e2f7665642f R15: 0000000000022000
Modules linked in:
---[ end trace 6244634e42fd974d ]---
RIP: 0010:flush_gro_hash net/core/dev.c:6313 [inline]
RIP: 0010:netif_napi_del+0x28f/0x7a0 net/core/dev.c:6328
Code: 00 74 08 4c 89 ff e8 d0 39 32 fe 49 8b 2f 49 39 ef 75 10 e8 03 cd 05 fe eb 35 90 e8 fb cc 05 fe 48 89 dd 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 ef e8 a2 39 32 fe 48 8b 5d 00 48 89 ef
RSP: 0018:ffff8881e2db7790 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff1103bb62fff RCX: ffffffff835a6db0
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881ddb17f38
RBP: 0000000000000000 R08: ffffffff835a6b83 R09: fffffbfff0d3170d
R10: fffffbfff0d3170d R11: 1ffffffff0d3170c R12: ffff8881ddb17f00
R13: dffffc0000000000 R14: ffff8881ddb17f00 R15: ffff8881ddb17f38
FS: 00007f18abc6c700(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffee66ba058 CR3: 00000001ddfa2000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
4: 89 ff mov %edi,%edi
6: e8 d0 39 32 fe callq 0xfe3239db
b: 49 8b 2f mov (%r15),%rbp
e: 49 39 ef cmp %rbp,%r15
11: 75 10 jne 0x23
13: e8 03 cd 05 fe callq 0xfe05cd1b
18: eb 35 jmp 0x4f
1a: 90 nop
1b: e8 fb cc 05 fe callq 0xfe05cd1b
20: 48 89 dd mov %rbx,%rbp
23: 48 89 e8 mov %rbp,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 ef mov %rbp,%rdi
34: e8 a2 39 32 fe callq 0xfe3239db
39: 48 8b 5d 00 mov 0x0(%rbp),%rbx
3d: 48 89 ef mov %rbp,%rdi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Apr 22, 2023, 10:06:44 AM4/22/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages