[Android 5.4] general protection fault in skb_segment
4 views
Skip to first unread message
syzbot
Dec 10, 2023, 8:55:23 AM12/10/23
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 1303f659c2b1 UPSTREAM: netfilter: nf_tables: remove busy m..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=175df02ae80000
kernel config: https://syzkaller.appspot.com/x/.config?x=eabcbd9ceab29189
dashboard link: https://syzkaller.appspot.com/bug?extid=3f124e609b90027ed1e1
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=105e085ce80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e58332e80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ee91fb0246ef/disk-1303f659.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/209ebe93651b/vmlinux-1303f659.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3854fd834cd0/bzImage-1303f659.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3f124e...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 356 Comm: syz-executor203 Not tainted 5.4.259-syzkaller-00006-g1303f659c2b1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:skb_segment+0x2940/0x3f30 net/core/skbuff.c:3903
Code: 89 bc 24 90 00 00 00 81 7c 24 3c ff ff 00 00 0f 85 6b e2 ff ff e8 90 63 ea fd 48 8b 44 24 78 48 8d 58 70 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 47 08 00 00 8b 03 48 89 44 24 40 48 8b
RSP: 0018:ffff8881dc75f060 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff8881dc719f80
RDX: 0000000000000000 RSI: ffff8881f21ef1be RDI: 000000000000ffff
RBP: ffff8881dc75f2f0 R08: ffffffff8379c2ce R09: ffffffff837dfe9b
R10: ffff8881dc719f80 R11: 0000000000000002 R12: 000000000000003e
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881de396800
FS: 00005555558cd380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 00000001dc574000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
udp6_ufo_fragment+0x866/0xcd0 net/ipv6/udp_offload.c:107
ipv6_gso_segment+0x65e/0x1130 net/ipv6/ip6_offload.c:113
skb_mac_gso_segment+0x27c/0x490 net/core/dev.c:2970
__skb_gso_segment+0x305/0x4a0 net/core/dev.c:3043
skb_gso_segment include/linux/netdevice.h:4488 [inline]
validate_xmit_skb+0x30a/0xc50 net/core/dev.c:3283
__dev_queue_xmit+0xf7d/0x27e0 net/core/dev.c:3786
packet_snd net/packet/af_packet.c:3009 [inline]
packet_sendmsg+0x4747/0x6100 net/packet/af_packet.c:3038
sock_sendmsg_nosec net/socket.c:638 [inline]
__sock_sendmsg net/socket.c:650 [inline]
__sys_sendto+0x4f3/0x6c0 net/socket.c:1959
__do_sys_sendto net/socket.c:1971 [inline]
__se_sys_sendto net/socket.c:1967 [inline]
__x64_sys_sendto+0xda/0xf0 net/socket.c:1967
do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
Modules linked in:
---[ end trace a3432f496e43c9ce ]---
RIP: 0010:skb_segment+0x2940/0x3f30 net/core/skbuff.c:3903
Code: 89 bc 24 90 00 00 00 81 7c 24 3c ff ff 00 00 0f 85 6b e2 ff ff e8 90 63 ea fd 48 8b 44 24 78 48 8d 58 70 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 47 08 00 00 8b 03 48 89 44 24 40 48 8b
RSP: 0018:ffff8881dc75f060 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff8881dc719f80
RDX: 0000000000000000 RSI: ffff8881f21ef1be RDI: 000000000000ffff
RBP: ffff8881dc75f2f0 R08: ffffffff8379c2ce R09: ffffffff837dfe9b
R10: ffff8881dc719f80 R11: 0000000000000002 R12: 000000000000003e
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881de396800
FS: 00005555558cd380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 00000001dc574000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 bc 24 90 00 00 00 mov %edi,0x90(%rsp)
7: 81 7c 24 3c ff ff 00 cmpl $0xffff,0x3c(%rsp)
e: 00
f: 0f 85 6b e2 ff ff jne 0xffffe280
15: e8 90 63 ea fd call 0xfdea63aa
1a: 48 8b 44 24 78 mov 0x78(%rsp),%rax
1f: 48 8d 58 70 lea 0x70(%rax),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 47 08 00 00 jne 0x87e
37: 8b 03 mov (%rbx),%eax
39: 48 89 44 24 40 mov %rax,0x40(%rsp)
3e: 48 rex.W
3f: 8b .byte 0x8b
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 1303f659c2b1 UPSTREAM: netfilter: nf_tables: remove busy m..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=175df02ae80000
kernel config: https://syzkaller.appspot.com/x/.config?x=eabcbd9ceab29189
dashboard link: https://syzkaller.appspot.com/bug?extid=3f124e609b90027ed1e1
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=105e085ce80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e58332e80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ee91fb0246ef/disk-1303f659.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/209ebe93651b/vmlinux-1303f659.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3854fd834cd0/bzImage-1303f659.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3f124e...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 356 Comm: syz-executor203 Not tainted 5.4.259-syzkaller-00006-g1303f659c2b1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:skb_segment+0x2940/0x3f30 net/core/skbuff.c:3903
Code: 89 bc 24 90 00 00 00 81 7c 24 3c ff ff 00 00 0f 85 6b e2 ff ff e8 90 63 ea fd 48 8b 44 24 78 48 8d 58 70 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 47 08 00 00 8b 03 48 89 44 24 40 48 8b
RSP: 0018:ffff8881dc75f060 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff8881dc719f80
RDX: 0000000000000000 RSI: ffff8881f21ef1be RDI: 000000000000ffff
RBP: ffff8881dc75f2f0 R08: ffffffff8379c2ce R09: ffffffff837dfe9b
R10: ffff8881dc719f80 R11: 0000000000000002 R12: 000000000000003e
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881de396800
FS: 00005555558cd380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 00000001dc574000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
udp6_ufo_fragment+0x866/0xcd0 net/ipv6/udp_offload.c:107
ipv6_gso_segment+0x65e/0x1130 net/ipv6/ip6_offload.c:113
skb_mac_gso_segment+0x27c/0x490 net/core/dev.c:2970
__skb_gso_segment+0x305/0x4a0 net/core/dev.c:3043
skb_gso_segment include/linux/netdevice.h:4488 [inline]
validate_xmit_skb+0x30a/0xc50 net/core/dev.c:3283
__dev_queue_xmit+0xf7d/0x27e0 net/core/dev.c:3786
packet_snd net/packet/af_packet.c:3009 [inline]
packet_sendmsg+0x4747/0x6100 net/packet/af_packet.c:3038
sock_sendmsg_nosec net/socket.c:638 [inline]
__sock_sendmsg net/socket.c:650 [inline]
__sys_sendto+0x4f3/0x6c0 net/socket.c:1959
__do_sys_sendto net/socket.c:1971 [inline]
__se_sys_sendto net/socket.c:1967 [inline]
__x64_sys_sendto+0xda/0xf0 net/socket.c:1967
do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
Modules linked in:
---[ end trace a3432f496e43c9ce ]---
RIP: 0010:skb_segment+0x2940/0x3f30 net/core/skbuff.c:3903
Code: 89 bc 24 90 00 00 00 81 7c 24 3c ff ff 00 00 0f 85 6b e2 ff ff e8 90 63 ea fd 48 8b 44 24 78 48 8d 58 70 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 47 08 00 00 8b 03 48 89 44 24 40 48 8b
RSP: 0018:ffff8881dc75f060 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff8881dc719f80
RDX: 0000000000000000 RSI: ffff8881f21ef1be RDI: 000000000000ffff
RBP: ffff8881dc75f2f0 R08: ffffffff8379c2ce R09: ffffffff837dfe9b
R10: ffff8881dc719f80 R11: 0000000000000002 R12: 000000000000003e
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881de396800
FS: 00005555558cd380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 00000001dc574000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 bc 24 90 00 00 00 mov %edi,0x90(%rsp)
7: 81 7c 24 3c ff ff 00 cmpl $0xffff,0x3c(%rsp)
e: 00
f: 0f 85 6b e2 ff ff jne 0xffffe280
15: e8 90 63 ea fd call 0xfdea63aa
1a: 48 8b 44 24 78 mov 0x78(%rsp),%rax
1f: 48 8d 58 70 lea 0x70(%rax),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 47 08 00 00 jne 0x87e
37: 8b 03 mov (%rbx),%eax
39: 48 89 44 24 40 mov %rax,0x40(%rsp)
3e: 48 rex.W
3f: 8b .byte 0x8b
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Dec 10, 2023, 11:44:24 AM12/10/23
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 389683767761 UPSTREAM: interconnect: qcom: Add support for..
syzbot found the following issue on:
git tree: android13-5.10-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12cd103ae80000
kernel config: https://syzkaller.appspot.com/x/.config?x=34f8569ca5081fa
dashboard link: https://syzkaller.appspot.com/bug?extid=d8934bd490d6cfc2eba2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=148bb6fae80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12eaccfae80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d1ea2fcb51ee/disk-38968376.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bb5d88166233/vmlinux-38968376.xz
kernel image: https://storage.googleapis.com/syzbot-assets/72e628a92de6/bzImage-38968376.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
CPU: 0 PID: 288 Comm: syz-executor161 Not tainted 5.10.201-syzkaller-00620-g389683767761 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:skb_segment+0x2abb/0x4130 net/core/skbuff.c:3937
Code: 24 20 8b 5c 24 30 e9 8d e0 ff ff e8 0f 77 ab fd 48 8b 44 24 60 4c 8d 70 70 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 ef 08 00 00 41 8b 1e 4c 8b b4 24 a8 00 00
RSP: 0018:ffffc90000b07080 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff88810ab10e3e RDI: 000000000000ffff
RBP: ffffc90000b072f0 R08: ffffffff83bf0cd3 R09: ffffffff83c3846b
R10: 0000000000000002 R11: ffff88811e8c93c0 R12: 000000000000003e
R13: 0000000000000011 R14: 0000000000000070 R15: ffff88810ab65000
FS: 0000555555a6c380(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 000000011eabb000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
udp6_ufo_fragment+0x866/0xcd0 net/ipv6/udp_offload.c:107
ipv6_gso_segment+0x64a/0x1120 net/ipv6/ip6_offload.c:115
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
udp6_ufo_fragment+0x866/0xcd0 net/ipv6/udp_offload.c:107
skb_mac_gso_segment+0x27c/0x490 net/core/dev.c:3356
__skb_gso_segment+0x32d/0x4c0 net/core/dev.c:3429
skb_gso_segment include/linux/netdevice.h:4808 [inline]
validate_xmit_skb+0x30a/0xc50 net/core/dev.c:3669
__dev_queue_xmit+0x1144/0x28e0 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4215
packet_snd net/packet/af_packet.c:3036 [inline]
packet_sendmsg+0x4526/0x60a0 net/packet/af_packet.c:3068
sock_sendmsg_nosec net/socket.c:652 [inline]
__sock_sendmsg net/socket.c:664 [inline]
__sys_sendto+0x545/0x700 net/socket.c:2004
__do_sys_sendto net/socket.c:2016 [inline]
__se_sys_sendto net/socket.c:2012 [inline]
__x64_sys_sendto+0xe5/0x100 net/socket.c:2012
do_syscall_64+0x34/0x70
entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7f21ad998419
Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe76b38628 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f21ad9e5390 RCX: 00007f21ad998419
RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000020000540 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe76b38680
R13: 00007ffe76b38650 R14: 0000000000000001 R15: 00007ffe76b38680
Modules linked in:
---[ end trace 73b284e4cf1b4834 ]---
RIP: 0010:skb_segment+0x2abb/0x4130 net/core/skbuff.c:3937
Code: 24 20 8b 5c 24 30 e9 8d e0 ff ff e8 0f 77 ab fd 48 8b 44 24 60 4c 8d 70 70 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 ef 08 00 00 41 8b 1e 4c 8b b4 24 a8 00 00
RSP: 0018:ffffc90000b07080 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff88810ab10e3e RDI: 000000000000ffff
RBP: ffffc90000b072f0 R08: ffffffff83bf0cd3 R09: ffffffff83c3846b
R10: 0000000000000002 R11: ffff88811e8c93c0 R12: 000000000000003e
R13: 0000000000000011 R14: 0000000000000070 R15: ffff88810ab65000
FS: 0000555555a6c380(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 000000011eabb000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 24 20 and $0x20,%al
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
2: 8b 5c 24 30 mov 0x30(%rsp),%ebx
6: e9 8d e0 ff ff jmp 0xffffe098
b: e8 0f 77 ab fd call 0xfdab771f
10: 48 8b 44 24 60 mov 0x60(%rsp),%rax
15: 4c 8d 70 70 lea 0x70(%rax),%r14
19: 4c 89 f0 mov %r14,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 ef 08 00 00 jne 0x925
36: 41 8b 1e mov (%r14),%ebx
39: 4c rex.WR
3a: 8b .byte 0x8b
3b: b4 24 mov $0x24,%ah
3d: a8 00 test $0x0,%al
syzbot
Dec 10, 2023, 9:29:26 PM12/10/23
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: b1355f1607d5 ANDROID: sort Bazel load statements
syzbot found the following issue on:
git tree: android13-5.15-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12e8dcf4e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=7c90e68490a9346d
dashboard link: https://syzkaller.appspot.com/bug?extid=b0285c01c1cd09086300
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1335aebce80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=111b2eeae80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/426a22ad5b04/disk-b1355f16.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/df8dc992df16/vmlinux-b1355f16.xz
kernel image: https://storage.googleapis.com/syzbot-assets/63615ae91f6f/bzImage-b1355f16.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:skb_segment+0x2ebe/0x4540 net/core/skbuff.c:4132
Code: 30 81 7c 24 40 ff ff 00 00 0f 85 49 de ff ff e8 a8 ef 8f fd 49 8d 5c 24 70 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 bf 08 00 00 44 8b 2b 4c 8b b4 24 a8 00 00
RSP: 0018:ffffc90000927060 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff88811f6f557e RDI: 000000000000ffff
RBP: ffffc900009272d0 R08: ffffffff83dfedba R09: ffffffff83e4748c
R10: 0000000000000002 R11: ffff88811e32e2c0 R12: 0000000000000000
R13: ffff88811f6f55d4 R14: ffff88811f6f5570 R15: 0000000000000000
FS: 000055555596d380(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 000000011e5a0000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
udp6_ufo_fragment+0x87a/0xd40 net/ipv6/udp_offload.c:107
ipv6_gso_segment+0x64a/0x1120 net/ipv6/ip6_offload.c:116
skb_mac_gso_segment+0x27c/0x490 net/core/dev.c:3370
__skb_gso_segment+0x32d/0x4c0 net/core/dev.c:3443
skb_gso_segment include/linux/netdevice.h:5009 [inline]
validate_xmit_skb+0x30a/0xce0 net/core/dev.c:3702
__dev_queue_xmit+0x12d2/0x2e70 net/core/dev.c:4243
dev_queue_xmit+0x17/0x20 net/core/dev.c:4285
packet_snd net/packet/af_packet.c:3039 [inline]
packet_sendmsg+0x47a9/0x6350 net/packet/af_packet.c:3070
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
__sys_sendto+0x564/0x720 net/socket.c:2056
__do_sys_sendto net/socket.c:2068 [inline]
__se_sys_sendto net/socket.c:2064 [inline]
__x64_sys_sendto+0xe5/0x100 net/socket.c:2064
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fd15b634419
Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff05299ae8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fd15b681390 RCX: 00007fd15b634419
RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000020000540 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff05299b40
RBP: 0000000000000003 R08: 0000000020000540 R09: 0000000000000014
R13: 00007fff05299b10 R14: 0000000000000001 R15: 00007fff05299b40
</TASK>
Modules linked in:
---[ end trace 1ba3712c5c047f80 ]---
RIP: 0010:skb_segment+0x2ebe/0x4540 net/core/skbuff.c:4132
Code: 30 81 7c 24 40 ff ff 00 00 0f 85 49 de ff ff e8 a8 ef 8f fd 49 8d 5c 24 70 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 bf 08 00 00 44 8b 2b 4c 8b b4 24 a8 00 00
RSP: 0018:ffffc90000927060 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff88811f6f557e RDI: 000000000000ffff
RBP: ffffc900009272d0 R08: ffffffff83dfedba R09: ffffffff83e4748c
R10: 0000000000000002 R11: ffff88811e32e2c0 R12: 0000000000000000
R13: ffff88811f6f55d4 R14: ffff88811f6f5570 R15: 0000000000000000
FS: 000055555596d380(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 000000011e5a0000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
0: 81 7c 24 40 ff ff 00 cmpl $0xffff,0x40(%rsp)
7: 00
8: 0f 85 49 de ff ff jne 0xffffde57
e: e8 a8 ef 8f fd call 0xfd8fefbb
13: 49 8d 5c 24 70 lea 0x70(%r12),%rbx
18: 48 89 d8 mov %rbx,%rax
1b: 48 c1 e8 03 shr $0x3,%rax
1f: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
26: fc ff df
* 29: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction
2d: 84 c0 test %al,%al
2f: 0f 85 bf 08 00 00 jne 0x8f4
35: 44 8b 2b mov (%rbx),%r13d
38: 4c rex.WR
39: 8b .byte 0x8b
3a: b4 24 mov $0x24,%ah
3c: a8 00 test $0x0,%al
syzbot
Dec 12, 2023, 10:03:34 PM12/12/23
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: a9567a35d0b8 ANDROID: arm64: Disable workaround for CPU er..
syzbot found the following issue on:
git tree: android14-6.1
console+strace: https://syzkaller.appspot.com/x/log.txt?x=13bf2966e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=2efa7ec05407068e
dashboard link: https://syzkaller.appspot.com/bug?extid=ddab8c245da95f68494a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1705a15ce80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1571313ae80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b22283185730/disk-a9567a35.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7aea83d3c2f1/vmlinux-a9567a35.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8fe25626267f/bzImage-a9567a35.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:skb_segment+0x2f49/0x46c0 net/core/skbuff.c:4241
Code: bc 24 90 00 00 00 e9 19 de ff ff e8 f1 4f 73 fd 48 8b 44 24 28 48 8d 58 70 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 0d 09 00 00 44 8b 23 4c 8b b4 24 b0 00 00
RSP: 0018:ffffc90000dd7000 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff88810e9c443e RDI: 000000000000ffff
RBP: ffffc90000dd7270 R08: ffffffff8401be79 R09: ffffffff8406447c
R10: 0000000000000002 R11: ffff88811d78a880 R12: 0000000000000000
R13: 000000000000003e R14: ffff88810e9c4430 R15: ffff88810f17b002
FS: 000055555573a380(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 00000001096eb000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
udp6_ufo_fragment+0x94d/0xe50 net/ipv6/udp_offload.c:108
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ipv6_gso_segment+0x6ff/0x1960 net/ipv6/ip6_offload.c:138
skb_mac_gso_segment+0x296/0x550 net/core/gro.c:141
__skb_gso_segment+0x32d/0x4c0 net/core/dev.c:3425
skb_gso_segment include/linux/netdevice.h:4852 [inline]
validate_xmit_skb+0x323/0xe40 net/core/dev.c:3683
__dev_queue_xmit+0x1636/0x36e0 net/core/dev.c:4260
dev_queue_xmit+0x17/0x20 include/linux/netdevice.h:3076
packet_snd net/packet/af_packet.c:3077 [inline]
packet_sendmsg+0x48dd/0x6510 net/packet/af_packet.c:3108
sock_sendmsg_nosec net/socket.c:716 [inline]
__sock_sendmsg net/socket.c:728 [inline]
__sys_sendto+0x471/0x5f0 net/socket.c:2134
__do_sys_sendto net/socket.c:2146 [inline]
__se_sys_sendto net/socket.c:2142 [inline]
__x64_sys_sendto+0xe5/0x100 net/socket.c:2142
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
RIP: 0033:0x7f8391916419
Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdf6e22238 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f8391963390 RCX: 00007f8391916419
RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000020000540 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdf6e22290
RBP: 0000000000000003 R08: 0000000020000540 R09: 0000000000000014
R13: 00007ffdf6e22260 R14: 0000000000000001 R15: 00007ffdf6e22290
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_segment+0x2f49/0x46c0 net/core/skbuff.c:4241
Code: bc 24 90 00 00 00 e9 19 de ff ff e8 f1 4f 73 fd 48 8b 44 24 28 48 8d 58 70 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 0d 09 00 00 44 8b 23 4c 8b b4 24 b0 00 00
RSP: 0018:ffffc90000dd7000 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff88810e9c443e RDI: 000000000000ffff
RBP: ffffc90000dd7270 R08: ffffffff8401be79 R09: ffffffff8406447c
R10: 0000000000000002 R11: ffff88811d78a880 R12: 0000000000000000
R13: 000000000000003e R14: ffff88810e9c4430 R15: ffff88810f17b002
FS: 000055555573a380(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 00000001096eb000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 4 bytes skipped:
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
0: 00 00 add %al,(%rax)
2: e9 19 de ff ff jmp 0xffffde20
7: e8 f1 4f 73 fd call 0xfd734ffd
c: 48 8b 44 24 28 mov 0x28(%rsp),%rax
11: 48 8d 58 70 lea 0x70(%rax),%rbx
15: 48 89 d8 mov %rbx,%rax
18: 48 c1 e8 03 shr $0x3,%rax
1c: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
23: fc ff df
* 26: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction
2a: 84 c0 test %al,%al
2c: 0f 85 0d 09 00 00 jne 0x93f
32: 44 8b 23 mov (%rbx),%r12d
35: 4c rex.WR
36: 8b .byte 0x8b
37: b4 24 mov $0x24,%ah
39: b0 00 mov $0x0,%al
syzbot
Dec 13, 2023, 2:01:06 AM12/13/23
to syzkaller-a...@googlegroups.com
syzbot has bisected this issue to:
commit dfed913e8b55a0c2c4906f1242fd38fd9a116e49
Author: Hangbin Liu <liuha...@gmail.com>
Date: Mon Apr 25 01:45:02 2022 +0000
net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=122ef5eae80000
start commit: a9567a35d0b8 ANDROID: arm64: Disable workaround for CPU er..
git tree: android14-6.1
final oops: https://syzkaller.appspot.com/x/report.txt?x=112ef5eae80000
console output: https://syzkaller.appspot.com/x/log.txt?x=162ef5eae80000
Fixes: dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit dfed913e8b55a0c2c4906f1242fd38fd9a116e49
Author: Hangbin Liu <liuha...@gmail.com>
Date: Mon Apr 25 01:45:02 2022 +0000
net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=122ef5eae80000
start commit: a9567a35d0b8 ANDROID: arm64: Disable workaround for CPU er..
git tree: android14-6.1
final oops: https://syzkaller.appspot.com/x/report.txt?x=112ef5eae80000
console output: https://syzkaller.appspot.com/x/log.txt?x=162ef5eae80000
kernel config: https://syzkaller.appspot.com/x/.config?x=2efa7ec05407068e
dashboard link: https://syzkaller.appspot.com/bug?extid=ddab8c245da95f68494a
dashboard link: https://syzkaller.appspot.com/bug?extid=ddab8c245da95f68494a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1705a15ce80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1571313ae80000
Reported-by: syzbot+ddab8c...@syzkaller.appspotmail.com
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1571313ae80000
Fixes: dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Jan 23, 2024, 3:23:09 PMJan 23
to syzkaller-a...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 9e0d18f946b2209dffd5bbe213d20bc4b0ca5684
Author: Eric Dumazet <edum...@google.com>
Date: Tue Dec 19 12:53:31 2023 +0000
net: check dev->gso_max_size in gso_features_check()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=132d1cc3e80000
start commit: 389683767761 UPSTREAM: interconnect: qcom: Add support for..
git tree: android13-5.10-lts
#syz fix: net: check dev->gso_max_size in gso_features_check()
commit 9e0d18f946b2209dffd5bbe213d20bc4b0ca5684
Author: Eric Dumazet <edum...@google.com>
Date: Tue Dec 19 12:53:31 2023 +0000
net: check dev->gso_max_size in gso_features_check()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=132d1cc3e80000
start commit: 389683767761 UPSTREAM: interconnect: qcom: Add support for..
git tree: android13-5.10-lts
kernel config: https://syzkaller.appspot.com/x/.config?x=34f8569ca5081fa
dashboard link: https://syzkaller.appspot.com/bug?extid=d8934bd490d6cfc2eba2
dashboard link: https://syzkaller.appspot.com/bug?extid=d8934bd490d6cfc2eba2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=148bb6fae80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12eaccfae80000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12eaccfae80000
#syz fix: net: check dev->gso_max_size in gso_features_check()
syzbot
Jan 27, 2024, 1:10:07 PMJan 27
to syzkaller-a...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit a1ab650f1421af85657b436ec10e6cd7b9e43b0c
Author: Eric Dumazet <edum...@google.com>
Date: Tue Dec 19 12:53:31 2023 +0000
net: check dev->gso_max_size in gso_features_check()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=113719a0180000
Date: Tue Dec 19 12:53:31 2023 +0000
net: check dev->gso_max_size in gso_features_check()
start commit: b1355f1607d5 ANDROID: sort Bazel load statements
git tree: android13-5.15-lts
kernel config: https://syzkaller.appspot.com/x/.config?x=7c90e68490a9346d
dashboard link: https://syzkaller.appspot.com/bug?extid=b0285c01c1cd09086300
dashboard link: https://syzkaller.appspot.com/bug?extid=b0285c01c1cd09086300
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1335aebce80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=111b2eeae80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=111b2eeae80000
syzbot
Apr 2, 2024, 12:56:35 PMApr 2
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
syzbot
Apr 2, 2024, 10:38:16 PMApr 2
to syzkaller-a...@googlegroups.com
syzbot
Apr 14, 2024, 9:09:04 AM (14 days ago) Apr 14
to syzkaller-a...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 3e617c7e39eb6e605f86d5e726476ebd002d9ddf
Author: Eric Dumazet <edum...@google.com>
Date: Tue Dec 19 12:53:31 2023 +0000
net: check dev->gso_max_size in gso_features_check()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=164f7af5180000
Date: Tue Dec 19 12:53:31 2023 +0000
net: check dev->gso_max_size in gso_features_check()
start commit: a9567a35d0b8 ANDROID: arm64: Disable workaround for CPU er..
git tree: android14-6.1
kernel config: https://syzkaller.appspot.com/x/.config?x=2efa7ec05407068e
dashboard link: https://syzkaller.appspot.com/bug?extid=ddab8c245da95f68494a
dashboard link: https://syzkaller.appspot.com/bug?extid=ddab8c245da95f68494a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1705a15ce80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1571313ae80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1571313ae80000
Reply all
Reply to author
Forward
0 new messages