BUG: stack guard page was hit in sys_creat (6)
0 views
Skip to first unread message
syzbot
Mar 26, 2022, 5:24:20 AM3/26/22
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: ab2d1d40a128 Revert "vsock: each transport cycles only on ..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=136a0e93700000
kernel config: https://syzkaller.appspot.com/x/.config?x=75791a4a1d0f0a62
dashboard link: https://syzkaller.appspot.com/bug?extid=a24574248eb1b64261c1
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1777e62b700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17de883d700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a24574...@syzkaller.appspotmail.com
BUG: stack guard page was hit at ffffc900009a7ff8 (stack is ffffc900009a8000..ffffc900009affff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 365 Comm: syz-executor292 Not tainted 5.10.108-syzkaller-00653-gab2d1d40a128 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:stack_trace_save+0x86/0x1e0 kernel/stacktrace.c:115
Code: 4c 8d 7c 24 20 49 c1 ef 03 48 b8 f1 f1 f1 f1 00 00 00 f3 4b 89 04 2f 43 c7 44 2f 08 f3 f3 f3 f3 ba 18 00 00 00 4c 89 f7 31 f6 <e8> 65 09 4b 00 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7
RSP: 0018:ffffc900009a8000 EFLAGS: 00010246
RAX: f3000000f1f1f1f1 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffffc900009a8040
RBP: ffffc900009a80d0 R08: dffffc0000000000 R09: ffffc900009a80e0
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc900009a80e0
R13: dffffc0000000000 R14: ffffc900009a8040 R15: 1ffff92000135004
FS: 00007f82ba1a8700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900009a7ff8 CR3: 000000011d12d000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
__kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x1a2/0x380 mm/slub.c:2969
__d_alloc+0x2d/0x6b0 fs/dcache.c:1709
d_alloc fs/dcache.c:1788 [inline]
d_alloc_parallel+0xf3/0x1360 fs/dcache.c:2540
__lookup_slow+0x14e/0x400 fs/namei.c:1613
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
lookup_open fs/namei.c:3162 [inline]
open_last_lookups fs/namei.c:3253 [inline]
path_openat+0x11c0/0x3500 fs/namei.c:3441
do_filp_open+0x200/0x440 fs/namei.c:3471
do_sys_openat2+0x13b/0x470 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_creat fs/open.c:1301 [inline]
__se_sys_creat fs/open.c:1295 [inline]
__x64_sys_creat+0x11f/0x160 fs/open.c:1295
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f82ba1fdd89
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f82ba1a82f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f82ba1fdd89
RDX: 00007f82ba1fdd89 RSI: 0000000000000000 RDI: 0000000020000000
RBP: 00007f82ba27e3c8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82ba27e3c0
R13: 00007f82ba27e3cc R14: 0030656c69662f2e R15: 2f30656c69662f2e
Modules linked in:
---[ end trace 9986c7bfb392b6f4 ]---
RIP: 0010:stack_trace_save+0x86/0x1e0 kernel/stacktrace.c:115
Code: 4c 8d 7c 24 20 49 c1 ef 03 48 b8 f1 f1 f1 f1 00 00 00 f3 4b 89 04 2f 43 c7 44 2f 08 f3 f3 f3 f3 ba 18 00 00 00 4c 89 f7 31 f6 <e8> 65 09 4b 00 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7
RSP: 0018:ffffc900009a8000 EFLAGS: 00010246
RAX: f3000000f1f1f1f1 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffffc900009a8040
RBP: ffffc900009a80d0 R08: dffffc0000000000 R09: ffffc900009a80e0
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc900009a80e0
R13: dffffc0000000000 R14: ffffc900009a8040 R15: 1ffff92000135004
FS: 00007f82ba1a8700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900009a7ff8 CR3: 000000011d12d000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 4c 8d 7c 24 20 lea 0x20(%rsp),%r15
5: 49 c1 ef 03 shr $0x3,%r15
9: 48 b8 f1 f1 f1 f1 00 movabs $0xf3000000f1f1f1f1,%rax
10: 00 00 f3
13: 4b 89 04 2f mov %rax,(%r15,%r13,1)
17: 43 c7 44 2f 08 f3 f3 movl $0xf3f3f3f3,0x8(%r15,%r13,1)
1e: f3 f3
20: ba 18 00 00 00 mov $0x18,%edx
25: 4c 89 f7 mov %r14,%rdi
28: 31 f6 xor %esi,%esi
* 2a: e8 65 09 4b 00 callq 0x4b0994 <-- trapping instruction
2f: 4c 89 f0 mov %r14,%rax
32: 48 c1 e8 03 shr $0x3,%rax
36: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
3b: 74 08 je 0x45
3d: 4c 89 f7 mov %r14,%rdi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: ab2d1d40a128 Revert "vsock: each transport cycles only on ..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=136a0e93700000
kernel config: https://syzkaller.appspot.com/x/.config?x=75791a4a1d0f0a62
dashboard link: https://syzkaller.appspot.com/bug?extid=a24574248eb1b64261c1
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1777e62b700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17de883d700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a24574...@syzkaller.appspotmail.com
BUG: stack guard page was hit at ffffc900009a7ff8 (stack is ffffc900009a8000..ffffc900009affff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 365 Comm: syz-executor292 Not tainted 5.10.108-syzkaller-00653-gab2d1d40a128 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:stack_trace_save+0x86/0x1e0 kernel/stacktrace.c:115
Code: 4c 8d 7c 24 20 49 c1 ef 03 48 b8 f1 f1 f1 f1 00 00 00 f3 4b 89 04 2f 43 c7 44 2f 08 f3 f3 f3 f3 ba 18 00 00 00 4c 89 f7 31 f6 <e8> 65 09 4b 00 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7
RSP: 0018:ffffc900009a8000 EFLAGS: 00010246
RAX: f3000000f1f1f1f1 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffffc900009a8040
RBP: ffffc900009a80d0 R08: dffffc0000000000 R09: ffffc900009a80e0
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc900009a80e0
R13: dffffc0000000000 R14: ffffc900009a8040 R15: 1ffff92000135004
FS: 00007f82ba1a8700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900009a7ff8 CR3: 000000011d12d000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
__kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x1a2/0x380 mm/slub.c:2969
__d_alloc+0x2d/0x6b0 fs/dcache.c:1709
d_alloc fs/dcache.c:1788 [inline]
d_alloc_parallel+0xf3/0x1360 fs/dcache.c:2540
__lookup_slow+0x14e/0x400 fs/namei.c:1613
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
lookup_open fs/namei.c:3162 [inline]
open_last_lookups fs/namei.c:3253 [inline]
path_openat+0x11c0/0x3500 fs/namei.c:3441
do_filp_open+0x200/0x440 fs/namei.c:3471
do_sys_openat2+0x13b/0x470 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_creat fs/open.c:1301 [inline]
__se_sys_creat fs/open.c:1295 [inline]
__x64_sys_creat+0x11f/0x160 fs/open.c:1295
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f82ba1fdd89
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f82ba1a82f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f82ba1fdd89
RDX: 00007f82ba1fdd89 RSI: 0000000000000000 RDI: 0000000020000000
RBP: 00007f82ba27e3c8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82ba27e3c0
R13: 00007f82ba27e3cc R14: 0030656c69662f2e R15: 2f30656c69662f2e
Modules linked in:
---[ end trace 9986c7bfb392b6f4 ]---
RIP: 0010:stack_trace_save+0x86/0x1e0 kernel/stacktrace.c:115
Code: 4c 8d 7c 24 20 49 c1 ef 03 48 b8 f1 f1 f1 f1 00 00 00 f3 4b 89 04 2f 43 c7 44 2f 08 f3 f3 f3 f3 ba 18 00 00 00 4c 89 f7 31 f6 <e8> 65 09 4b 00 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7
RSP: 0018:ffffc900009a8000 EFLAGS: 00010246
RAX: f3000000f1f1f1f1 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffffc900009a8040
RBP: ffffc900009a80d0 R08: dffffc0000000000 R09: ffffc900009a80e0
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc900009a80e0
R13: dffffc0000000000 R14: ffffc900009a8040 R15: 1ffff92000135004
FS: 00007f82ba1a8700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900009a7ff8 CR3: 000000011d12d000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 4c 8d 7c 24 20 lea 0x20(%rsp),%r15
5: 49 c1 ef 03 shr $0x3,%r15
9: 48 b8 f1 f1 f1 f1 00 movabs $0xf3000000f1f1f1f1,%rax
10: 00 00 f3
13: 4b 89 04 2f mov %rax,(%r15,%r13,1)
17: 43 c7 44 2f 08 f3 f3 movl $0xf3f3f3f3,0x8(%r15,%r13,1)
1e: f3 f3
20: ba 18 00 00 00 mov $0x18,%edx
25: 4c 89 f7 mov %r14,%rdi
28: 31 f6 xor %esi,%esi
* 2a: e8 65 09 4b 00 callq 0x4b0994 <-- trapping instruction
2f: 4c 89 f0 mov %r14,%rax
32: 48 c1 e8 03 shr $0x3,%rax
36: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
3b: 74 08 je 0x45
3d: 4c 89 f7 mov %r14,%rdi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Tadeusz Struk
Mar 28, 2022, 12:21:28 PM3/28/22
to syzbot, syzkaller-a...@googlegroups.com
syzbot
Mar 28, 2022, 5:33:14 PM3/28/22
to syzkaller-a...@googlegroups.com, tadeus...@linaro.org
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
hin address ffffc90000b471c0 with insufficient space
for an object of type 'struct sk_buff'
CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
dump_stack+0x15/0x1d lib/dump_stack.c:135
ubsan_epilogue lib/ubsan.c:148 [inline]
handle_object_size_mismatch lib/ubsan.c:297 [inline]
ubsan_type_mismatch_common+0x1ed/0x3a0 lib/ubsan.c:310
__ubsan_handle_type_mismatch_v1+0x5b/0x70 lib/ubsan.c:339
__skb_insert include/linux/skbuff.h:1932 [inline]
__skb_queue_before include/linux/skbuff.h:2039 [inline]
__skb_queue_tail include/linux/skbuff.h:2072 [inline]
wg_xmit+0x513/0xae0 drivers/net/wireguard/device.c:185
__netdev_start_xmit include/linux/netdevice.h:4831 [inline]
netdev_start_xmit+0x8a/0x160 include/linux/netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================
Warning: Permanently added '10.128.1.51' (ECDSA) to the list of known hosts.
2022/03/28 21:32:14 fuzzer started
2022/03/28 21:32:15 connecting to host at 10.128.0.163:44135
2022/03/28 21:32:15 checking machine...
2022/03/28 21:32:15 checking revisions...
2022/03/28 21:32:15 testing simple program...
[ 20.408316][ T23] audit: type=1400 audit(1648503135.250:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.415081][ T23] audit: type=1400 audit(1648503135.250:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.419589][ T23] audit: type=1400 audit(1648503135.250:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.424662][ T23] audit: type=1400 audit(1648503135.270:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 20.425051][ T370] cgroup: Unknown subsys name 'net'
[ 20.435173][ T23] audit: type=1400 audit(1648503135.270:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 20.464264][ T370] cgroup: Unknown subsys name 'devices'
[ 20.464296][ T23] audit: type=1400 audit(1648503135.270:78): avc: denied { mounton } for pid=370 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 20.492820][ T23] audit: type=1400 audit(1648503135.270:79): avc: denied { mount } for pid=370 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 20.515531][ T23] audit: type=1400 audit(1648503135.290:80): avc: denied { unmount } for pid=370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 20.621310][ T370] cgroup: Unknown subsys name 'hugetlb'
[ 20.627374][ T370] cgroup: Unknown subsys name 'rlimit'
[ 20.690547][ T23] audit: type=1400 audit(1648503135.540:81): avc: denied { setattr } for pid=370 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 20.717334][ T23] audit: type=1400 audit(1648503135.570:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 20.771728][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.779061][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 20.787128][ T373] device bridge_slave_0 entered promiscuous mode
[ 20.794192][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.801798][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.810862][ T373] device bridge_slave_1 entered promiscuous mode
[ 20.841928][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.849391][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.857089][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.864304][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.883253][ T108] bridge0: port 1(bridge_slave_0) entered disabled state
[ 20.890737][ T108] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.898079][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 20.905914][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 20.915359][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 20.924008][ T24] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.931054][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.950388][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 20.958982][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 20.968321][ T24] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.975373][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.982927][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 20.990932][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 21.000842][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 21.015923][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 21.025222][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 21.037426][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 21.047045][ T108] ================================================================================
[ 21.056394][ T108] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 21.064393][ T108] member access within address ffffc90000b471c0 with insufficient space
[ 21.072834][ T108] for an object of type 'struct sk_buff'
[ 21.078463][ T108] CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 21.088338][ T108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 21.098645][ T108] Workqueue: ipv6_addrconf addrconf_dad_work
[ 21.104605][ T108] Call Trace:
[ 21.107915][ T108] dump_stack_lvl+0x1e2/0x24b
[ 21.112841][ T108] ? show_regs_print_info+0x18/0x18
[ 21.118131][ T108] ? wg_allowedips_lookup_dst+0x190/0x190
[ 21.123915][ T108] dump_stack+0x15/0x1d
[ 21.128058][ T108] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 21.133760][ T108] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 21.140021][ T108] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 21.146239][ T108] wg_xmit+0x4a2/0xae0
[ 21.150379][ T108] ? wg_stop+0x5d0/0x5d0
[ 21.154919][ T108] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 21.161494][ T108] netdev_start_xmit+0x8a/0x160
[ 21.166413][ T108] dev_hard_start_xmit+0x18d/0x2f0
[ 21.171533][ T108] __dev_queue_xmit+0x100c/0x1c30
[ 21.176539][ T108] ? dev_queue_xmit+0x20/0x20
[ 21.181291][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.187890][ T108] ? ndisc_constructor+0x690/0x8a0
[ 21.192980][ T108] ? _raw_write_unlock_bh+0x31/0x47
[ 21.198160][ T108] ? ___neigh_create+0x162d/0x1ab0
[ 21.203522][ T108] ? dev_hard_header+0xdb/0xf0
[ 21.208281][ T108] dev_queue_xmit+0x17/0x20
[ 21.212947][ T108] neigh_connected_output+0x288/0x2b0
[ 21.218386][ T108] ip6_finish_output2+0xde2/0x1440
[ 21.223568][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.228497][ T108] ? __ip6_finish_output+0x520/0x520
[ 21.234221][ T108] ? dst_cow_metrics_generic+0x55/0x1d0
[ 21.239748][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.246400][ T108] ? ip6_skb_dst_mtu+0xaf/0x260
[ 21.251414][ T108] __ip6_finish_output+0x3e4/0x520
[ 21.256909][ T108] ip6_finish_output+0x3f/0x220
[ 21.261944][ T108] ? ip6_output+0x1d3/0x4b0
[ 21.266978][ T108] ip6_output+0x1f8/0x4b0
[ 21.271300][ T108] ? asan.module_dtor+0x20/0x20
[ 21.276143][ T108] ? skb_dst+0x40/0x40
[ 21.280204][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.285037][ T108] ? selinux_ipv6_forward+0x50/0x50
[ 21.290303][ T108] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 21.296019][ T108] ? nf_hook_slow+0x150/0x1b0
[ 21.300764][ T108] NF_HOOK+0xdd/0x280
[ 21.304922][ T108] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 21.310880][ T108] ? NF_HOOK+0x280/0x280
[ 21.315110][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.319943][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.326253][ T108] ? ndisc_send_skb+0x547/0x9f0
[ 21.331173][ T108] ? memcpy+0x56/0x70
[ 21.335491][ T108] ndisc_send_skb+0x646/0x9f0
[ 21.340492][ T108] ? slab_post_alloc_hook+0x90/0xa0
[ 21.345683][ T108] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 21.352207][ T108] ? skb_set_owner_w+0x1a8/0x310
[ 21.357306][ T108] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 21.363030][ T108] ? skb_put+0x11d/0x210
[ 21.367339][ T108] ndisc_send_rs+0x26c/0x360
[ 21.372346][ T108] addrconf_dad_completed+0x4f3/0x9f0
[ 21.377700][ T108] ? addrconf_dad_stop+0x430/0x430
[ 21.382930][ T108] ? mutex_unlock+0x34/0x40
[ 21.387443][ T108] addrconf_dad_work+0x9c1/0x1520
[ 21.392803][ T108] ? move_linked_works+0x118/0x130
[ 21.397901][ T108] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 21.403608][ T108] ? __kasan_check_write+0x14/0x20
[ 21.408961][ T108] process_one_work+0x3ca/0x660
[ 21.413967][ T108] worker_thread+0x709/0xa20
[ 21.418628][ T108] ? __kthread_parkme+0x11b/0x150
[ 21.423653][ T108] kthread+0x389/0x3c0
[ 21.427715][ T108] ? pr_cont_work+0x110/0x110
[ 21.432467][ T108] ? __list_add+0xc0/0xc0
[ 21.436873][ T108] ret_from_fork+0x1f/0x30
[ 21.441312][ T108] ================================================================================
[ 21.450711][ T108] ================================================================================
[ 21.460037][ T108] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 21.468115][ T108] member access within address ffffc90000b471c0 with insufficient space
[ 21.476685][ T108] for an object of type 'struct sk_buff'
[ 21.482355][ T108] CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 21.493265][ T108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 21.503687][ T108] Workqueue: ipv6_addrconf addrconf_dad_work
[ 21.510086][ T108] Call Trace:
[ 21.513462][ T108] dump_stack_lvl+0x1e2/0x24b
[ 21.518302][ T108] ? show_regs_print_info+0x18/0x18
[ 21.523498][ T108] ? wg_allowedips_lookup_dst+0x190/0x190
[ 21.529311][ T108] dump_stack+0x15/0x1d
[ 21.533541][ T108] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 21.539242][ T108] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 21.545300][ T108] wg_xmit+0x513/0xae0
[ 21.549487][ T108] ? wg_stop+0x5d0/0x5d0
[ 21.553729][ T108] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 21.559971][ T108] netdev_start_xmit+0x8a/0x160
[ 21.564935][ T108] dev_hard_start_xmit+0x18d/0x2f0
[ 21.570166][ T108] __dev_queue_xmit+0x100c/0x1c30
[ 21.575263][ T108] ? dev_queue_xmit+0x20/0x20
[ 21.580012][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.586668][ T108] ? ndisc_constructor+0x690/0x8a0
[ 21.591773][ T108] ? _raw_write_unlock_bh+0x31/0x47
[ 21.597141][ T108] ? ___neigh_create+0x162d/0x1ab0
[ 21.602513][ T108] ? dev_hard_header+0xdb/0xf0
[ 21.610577][ T108] dev_queue_xmit+0x17/0x20
[ 21.615066][ T108] neigh_connected_output+0x288/0x2b0
[ 21.620422][ T108] ip6_finish_output2+0xde2/0x1440
[ 21.625520][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.630263][ T108] ? __ip6_finish_output+0x520/0x520
[ 21.635529][ T108] ? dst_cow_metrics_generic+0x55/0x1d0
[ 21.641065][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.647423][ T108] ? ip6_skb_dst_mtu+0xaf/0x260
[ 21.652510][ T108] __ip6_finish_output+0x3e4/0x520
[ 21.657609][ T108] ip6_finish_output+0x3f/0x220
[ 21.662530][ T108] ? ip6_output+0x1d3/0x4b0
[ 21.667380][ T108] ip6_output+0x1f8/0x4b0
[ 21.671779][ T108] ? asan.module_dtor+0x20/0x20
[ 21.676880][ T108] ? skb_dst+0x40/0x40
[ 21.680930][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.685674][ T108] ? selinux_ipv6_forward+0x50/0x50
[ 21.690854][ T108] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 21.697753][ T108] ? nf_hook_slow+0x150/0x1b0
[ 21.702416][ T108] NF_HOOK+0xdd/0x280
[ 21.706466][ T108] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 21.712273][ T108] ? NF_HOOK+0x280/0x280
[ 21.716507][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.721258][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.727669][ T108] ? ndisc_send_skb+0x547/0x9f0
[ 21.732756][ T108] ? memcpy+0x56/0x70
[ 21.736713][ T108] ndisc_send_skb+0x646/0x9f0
[ 21.741367][ T108] ? slab_post_alloc_hook+0x90/0xa0
[ 21.746546][ T108] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 21.752081][ T108] ? skb_set_owner_w+0x1a8/0x310
[ 21.757170][ T108] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 21.762880][ T108] ? skb_put+0x11d/0x210
[ 21.767282][ T108] ndisc_send_rs+0x26c/0x360
[ 21.771865][ T108] addrconf_dad_completed+0x4f3/0x9f0
[ 21.777233][ T108] ? addrconf_dad_stop+0x430/0x430
[ 21.782515][ T108] ? mutex_unlock+0x34/0x40
[ 21.787198][ T108] addrconf_dad_work+0x9c1/0x1520
[ 21.792205][ T108] ? move_linked_works+0x118/0x130
[ 21.797291][ T108] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 21.802987][ T108] ? __kasan_check_write+0x14/0x20
[ 21.808080][ T108] process_one_work+0x3ca/0x660
[ 21.812907][ T108] worker_thread+0x709/0xa20
[ 21.817472][ T108] ? __kthread_parkme+0x11b/0x150
[ 21.822488][ T108] kthread+0x389/0x3c0
[ 21.826534][ T108] ? pr_cont_work+0x110/0x110
[ 21.831199][ T108] ? __list_add+0xc0/0xc0
[ 21.835504][ T108] ret_from_fork+0x1f/0x30
[ 21.840047][ T108] ================================================================================
2022/03/28 21:32:16 building call list...
[ 21.858222][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 22.328878][ T7] device bridge_slave_1 left promiscuous mode
[ 22.335275][ T7] bridge0: port 2(bridge_slave_1) entered disabled state
[ 22.343417][ T7] device bridge_slave_0 left promiscuous mode
[ 22.349792][ T7] bridge0: port 1(bridge_slave_0) entered disabled state
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=102c04fb700000
Tested on:
commit: ec7c9ea9 ANDROID: Update the ABI representation
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
syzbot tried to test the proposed patch but the build/boot failed:
hin address ffffc90000b471c0 with insufficient space
for an object of type 'struct sk_buff'
CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
dump_stack+0x15/0x1d lib/dump_stack.c:135
ubsan_epilogue lib/ubsan.c:148 [inline]
handle_object_size_mismatch lib/ubsan.c:297 [inline]
ubsan_type_mismatch_common+0x1ed/0x3a0 lib/ubsan.c:310
__ubsan_handle_type_mismatch_v1+0x5b/0x70 lib/ubsan.c:339
__skb_insert include/linux/skbuff.h:1932 [inline]
__skb_queue_before include/linux/skbuff.h:2039 [inline]
__skb_queue_tail include/linux/skbuff.h:2072 [inline]
wg_xmit+0x513/0xae0 drivers/net/wireguard/device.c:185
__netdev_start_xmit include/linux/netdevice.h:4831 [inline]
netdev_start_xmit+0x8a/0x160 include/linux/netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================
Warning: Permanently added '10.128.1.51' (ECDSA) to the list of known hosts.
2022/03/28 21:32:14 fuzzer started
2022/03/28 21:32:15 connecting to host at 10.128.0.163:44135
2022/03/28 21:32:15 checking machine...
2022/03/28 21:32:15 checking revisions...
2022/03/28 21:32:15 testing simple program...
[ 20.408316][ T23] audit: type=1400 audit(1648503135.250:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.415081][ T23] audit: type=1400 audit(1648503135.250:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.419589][ T23] audit: type=1400 audit(1648503135.250:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.424662][ T23] audit: type=1400 audit(1648503135.270:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 20.425051][ T370] cgroup: Unknown subsys name 'net'
[ 20.435173][ T23] audit: type=1400 audit(1648503135.270:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 20.464264][ T370] cgroup: Unknown subsys name 'devices'
[ 20.464296][ T23] audit: type=1400 audit(1648503135.270:78): avc: denied { mounton } for pid=370 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 20.492820][ T23] audit: type=1400 audit(1648503135.270:79): avc: denied { mount } for pid=370 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 20.515531][ T23] audit: type=1400 audit(1648503135.290:80): avc: denied { unmount } for pid=370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 20.621310][ T370] cgroup: Unknown subsys name 'hugetlb'
[ 20.627374][ T370] cgroup: Unknown subsys name 'rlimit'
[ 20.690547][ T23] audit: type=1400 audit(1648503135.540:81): avc: denied { setattr } for pid=370 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 20.717334][ T23] audit: type=1400 audit(1648503135.570:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 20.771728][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.779061][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 20.787128][ T373] device bridge_slave_0 entered promiscuous mode
[ 20.794192][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.801798][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.810862][ T373] device bridge_slave_1 entered promiscuous mode
[ 20.841928][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.849391][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.857089][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.864304][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.883253][ T108] bridge0: port 1(bridge_slave_0) entered disabled state
[ 20.890737][ T108] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.898079][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 20.905914][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 20.915359][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 20.924008][ T24] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.931054][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.950388][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 20.958982][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 20.968321][ T24] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.975373][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.982927][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 20.990932][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 21.000842][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 21.015923][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 21.025222][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 21.037426][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 21.047045][ T108] ================================================================================
[ 21.056394][ T108] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 21.064393][ T108] member access within address ffffc90000b471c0 with insufficient space
[ 21.072834][ T108] for an object of type 'struct sk_buff'
[ 21.078463][ T108] CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 21.088338][ T108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 21.098645][ T108] Workqueue: ipv6_addrconf addrconf_dad_work
[ 21.104605][ T108] Call Trace:
[ 21.107915][ T108] dump_stack_lvl+0x1e2/0x24b
[ 21.112841][ T108] ? show_regs_print_info+0x18/0x18
[ 21.118131][ T108] ? wg_allowedips_lookup_dst+0x190/0x190
[ 21.123915][ T108] dump_stack+0x15/0x1d
[ 21.128058][ T108] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 21.133760][ T108] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 21.140021][ T108] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 21.146239][ T108] wg_xmit+0x4a2/0xae0
[ 21.150379][ T108] ? wg_stop+0x5d0/0x5d0
[ 21.154919][ T108] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 21.161494][ T108] netdev_start_xmit+0x8a/0x160
[ 21.166413][ T108] dev_hard_start_xmit+0x18d/0x2f0
[ 21.171533][ T108] __dev_queue_xmit+0x100c/0x1c30
[ 21.176539][ T108] ? dev_queue_xmit+0x20/0x20
[ 21.181291][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.187890][ T108] ? ndisc_constructor+0x690/0x8a0
[ 21.192980][ T108] ? _raw_write_unlock_bh+0x31/0x47
[ 21.198160][ T108] ? ___neigh_create+0x162d/0x1ab0
[ 21.203522][ T108] ? dev_hard_header+0xdb/0xf0
[ 21.208281][ T108] dev_queue_xmit+0x17/0x20
[ 21.212947][ T108] neigh_connected_output+0x288/0x2b0
[ 21.218386][ T108] ip6_finish_output2+0xde2/0x1440
[ 21.223568][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.228497][ T108] ? __ip6_finish_output+0x520/0x520
[ 21.234221][ T108] ? dst_cow_metrics_generic+0x55/0x1d0
[ 21.239748][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.246400][ T108] ? ip6_skb_dst_mtu+0xaf/0x260
[ 21.251414][ T108] __ip6_finish_output+0x3e4/0x520
[ 21.256909][ T108] ip6_finish_output+0x3f/0x220
[ 21.261944][ T108] ? ip6_output+0x1d3/0x4b0
[ 21.266978][ T108] ip6_output+0x1f8/0x4b0
[ 21.271300][ T108] ? asan.module_dtor+0x20/0x20
[ 21.276143][ T108] ? skb_dst+0x40/0x40
[ 21.280204][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.285037][ T108] ? selinux_ipv6_forward+0x50/0x50
[ 21.290303][ T108] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 21.296019][ T108] ? nf_hook_slow+0x150/0x1b0
[ 21.300764][ T108] NF_HOOK+0xdd/0x280
[ 21.304922][ T108] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 21.310880][ T108] ? NF_HOOK+0x280/0x280
[ 21.315110][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.319943][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.326253][ T108] ? ndisc_send_skb+0x547/0x9f0
[ 21.331173][ T108] ? memcpy+0x56/0x70
[ 21.335491][ T108] ndisc_send_skb+0x646/0x9f0
[ 21.340492][ T108] ? slab_post_alloc_hook+0x90/0xa0
[ 21.345683][ T108] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 21.352207][ T108] ? skb_set_owner_w+0x1a8/0x310
[ 21.357306][ T108] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 21.363030][ T108] ? skb_put+0x11d/0x210
[ 21.367339][ T108] ndisc_send_rs+0x26c/0x360
[ 21.372346][ T108] addrconf_dad_completed+0x4f3/0x9f0
[ 21.377700][ T108] ? addrconf_dad_stop+0x430/0x430
[ 21.382930][ T108] ? mutex_unlock+0x34/0x40
[ 21.387443][ T108] addrconf_dad_work+0x9c1/0x1520
[ 21.392803][ T108] ? move_linked_works+0x118/0x130
[ 21.397901][ T108] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 21.403608][ T108] ? __kasan_check_write+0x14/0x20
[ 21.408961][ T108] process_one_work+0x3ca/0x660
[ 21.413967][ T108] worker_thread+0x709/0xa20
[ 21.418628][ T108] ? __kthread_parkme+0x11b/0x150
[ 21.423653][ T108] kthread+0x389/0x3c0
[ 21.427715][ T108] ? pr_cont_work+0x110/0x110
[ 21.432467][ T108] ? __list_add+0xc0/0xc0
[ 21.436873][ T108] ret_from_fork+0x1f/0x30
[ 21.441312][ T108] ================================================================================
[ 21.450711][ T108] ================================================================================
[ 21.460037][ T108] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 21.468115][ T108] member access within address ffffc90000b471c0 with insufficient space
[ 21.476685][ T108] for an object of type 'struct sk_buff'
[ 21.482355][ T108] CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 21.493265][ T108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 21.503687][ T108] Workqueue: ipv6_addrconf addrconf_dad_work
[ 21.510086][ T108] Call Trace:
[ 21.513462][ T108] dump_stack_lvl+0x1e2/0x24b
[ 21.518302][ T108] ? show_regs_print_info+0x18/0x18
[ 21.523498][ T108] ? wg_allowedips_lookup_dst+0x190/0x190
[ 21.529311][ T108] dump_stack+0x15/0x1d
[ 21.533541][ T108] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 21.539242][ T108] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 21.545300][ T108] wg_xmit+0x513/0xae0
[ 21.549487][ T108] ? wg_stop+0x5d0/0x5d0
[ 21.553729][ T108] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 21.559971][ T108] netdev_start_xmit+0x8a/0x160
[ 21.564935][ T108] dev_hard_start_xmit+0x18d/0x2f0
[ 21.570166][ T108] __dev_queue_xmit+0x100c/0x1c30
[ 21.575263][ T108] ? dev_queue_xmit+0x20/0x20
[ 21.580012][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.586668][ T108] ? ndisc_constructor+0x690/0x8a0
[ 21.591773][ T108] ? _raw_write_unlock_bh+0x31/0x47
[ 21.597141][ T108] ? ___neigh_create+0x162d/0x1ab0
[ 21.602513][ T108] ? dev_hard_header+0xdb/0xf0
[ 21.610577][ T108] dev_queue_xmit+0x17/0x20
[ 21.615066][ T108] neigh_connected_output+0x288/0x2b0
[ 21.620422][ T108] ip6_finish_output2+0xde2/0x1440
[ 21.625520][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.630263][ T108] ? __ip6_finish_output+0x520/0x520
[ 21.635529][ T108] ? dst_cow_metrics_generic+0x55/0x1d0
[ 21.641065][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.647423][ T108] ? ip6_skb_dst_mtu+0xaf/0x260
[ 21.652510][ T108] __ip6_finish_output+0x3e4/0x520
[ 21.657609][ T108] ip6_finish_output+0x3f/0x220
[ 21.662530][ T108] ? ip6_output+0x1d3/0x4b0
[ 21.667380][ T108] ip6_output+0x1f8/0x4b0
[ 21.671779][ T108] ? asan.module_dtor+0x20/0x20
[ 21.676880][ T108] ? skb_dst+0x40/0x40
[ 21.680930][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.685674][ T108] ? selinux_ipv6_forward+0x50/0x50
[ 21.690854][ T108] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 21.697753][ T108] ? nf_hook_slow+0x150/0x1b0
[ 21.702416][ T108] NF_HOOK+0xdd/0x280
[ 21.706466][ T108] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 21.712273][ T108] ? NF_HOOK+0x280/0x280
[ 21.716507][ T108] ? __rcu_read_lock+0x50/0x50
[ 21.721258][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.727669][ T108] ? ndisc_send_skb+0x547/0x9f0
[ 21.732756][ T108] ? memcpy+0x56/0x70
[ 21.736713][ T108] ndisc_send_skb+0x646/0x9f0
[ 21.741367][ T108] ? slab_post_alloc_hook+0x90/0xa0
[ 21.746546][ T108] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 21.752081][ T108] ? skb_set_owner_w+0x1a8/0x310
[ 21.757170][ T108] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 21.762880][ T108] ? skb_put+0x11d/0x210
[ 21.767282][ T108] ndisc_send_rs+0x26c/0x360
[ 21.771865][ T108] addrconf_dad_completed+0x4f3/0x9f0
[ 21.777233][ T108] ? addrconf_dad_stop+0x430/0x430
[ 21.782515][ T108] ? mutex_unlock+0x34/0x40
[ 21.787198][ T108] addrconf_dad_work+0x9c1/0x1520
[ 21.792205][ T108] ? move_linked_works+0x118/0x130
[ 21.797291][ T108] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 21.802987][ T108] ? __kasan_check_write+0x14/0x20
[ 21.808080][ T108] process_one_work+0x3ca/0x660
[ 21.812907][ T108] worker_thread+0x709/0xa20
[ 21.817472][ T108] ? __kthread_parkme+0x11b/0x150
[ 21.822488][ T108] kthread+0x389/0x3c0
[ 21.826534][ T108] ? pr_cont_work+0x110/0x110
[ 21.831199][ T108] ? __list_add+0xc0/0xc0
[ 21.835504][ T108] ret_from_fork+0x1f/0x30
[ 21.840047][ T108] ================================================================================
2022/03/28 21:32:16 building call list...
[ 21.858222][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 22.328878][ T7] device bridge_slave_1 left promiscuous mode
[ 22.335275][ T7] bridge0: port 2(bridge_slave_1) entered disabled state
[ 22.343417][ T7] device bridge_slave_0 left promiscuous mode
[ 22.349792][ T7] bridge0: port 1(bridge_slave_0) entered disabled state
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=102c04fb700000
Tested on:
commit: ec7c9ea9 ANDROID: Update the ABI representation
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=a24574248eb1b64261c1
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Tadeusz Struk
Mar 29, 2022, 6:19:36 PM3/29/22
to syzbot+a24574...@syzkaller.appspotmail.com, syzkaller-a...@googlegroups.com, tadeus...@linaro.org
=======================================
index 3a02503b3637..76cc25bc140d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -291,9 +291,11 @@ struct tc_skb_ext {
#endif
struct sk_buff_head {
+ struct_group_tagged(sk_buff_list, list,
/* These two members must be first. */
struct sk_buff *next;
struct sk_buff *prev;
+ );
__u32 qlen;
spinlock_t lock;
@@ -1929,8 +1931,8 @@ static inline void __skb_insert(struct sk_buff *newsk,
*/
WRITE_ONCE(newsk->next, next);
WRITE_ONCE(newsk->prev, prev);
- WRITE_ONCE(next->prev, newsk);
- WRITE_ONCE(prev->next, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)next)->prev, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)prev)->next, newsk);
WRITE_ONCE(list->qlen, list->qlen + 1);
}
@@ -2026,7 +2028,7 @@ static inline void __skb_queue_after(struct sk_buff_head *list,
struct sk_buff *prev,
struct sk_buff *newsk)
{
- __skb_insert(newsk, prev, prev->next, list);
+ __skb_insert(newsk, prev, ((struct sk_buff_list *)prev)->next, list);
}
void skb_append(struct sk_buff *old, struct sk_buff *newsk,
@@ -2036,7 +2038,7 @@ static inline void __skb_queue_before(struct sk_buff_head *list,
struct sk_buff *next,
struct sk_buff *newsk)
{
- __skb_insert(newsk, next->prev, next, list);
+ __skb_insert(newsk, ((struct sk_buff_list *)next)->prev, next, list);
}
/**
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 998a4ba28eba..938216f8ab7e 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -36,4 +36,52 @@ enum {
#define offsetofend(TYPE, MEMBER) \
(offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
+/**
+ * struct_group() - Wrap a set of declarations in a mirrored struct
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members.
+ */
+#define struct_group(NAME, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, /* no attrs */, MEMBERS)
+
+/**
+ * struct_group_attr() - Create a struct_group() with trailing attributes
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes to apply
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes structure attributes argument.
+ */
+#define struct_group_attr(NAME, ATTRS, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, ATTRS, MEMBERS)
+
+/**
+ * struct_group_tagged() - Create a struct_group with a reusable tag
+ *
+ * @TAG: The tag name for the named sub-struct
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes struct tag argument for the named copy,
+ * so the specified layout can be reused later.
+ */
+#define struct_group_tagged(TAG, NAME, MEMBERS...) \
+ __struct_group(TAG, NAME, /* no attrs */, MEMBERS)
+
#endif
diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
index ee8220f8dcf5..22aa0e2177ea 100644
--- a/include/uapi/linux/stddef.h
+++ b/include/uapi/linux/stddef.h
@@ -4,3 +4,41 @@
#ifndef __always_inline
#define __always_inline inline
#endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse, as well
+ * as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+ struct TAG { MEMBERS } ATTRS NAME; \
+ }
+
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ struct { \
+ struct { } __empty_ ## NAME; \
+ TYPE NAME[]; \
+ }
+
--
2.35.1
index 3a02503b3637..76cc25bc140d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -291,9 +291,11 @@ struct tc_skb_ext {
#endif
struct sk_buff_head {
+ struct_group_tagged(sk_buff_list, list,
/* These two members must be first. */
struct sk_buff *next;
struct sk_buff *prev;
+ );
__u32 qlen;
spinlock_t lock;
@@ -1929,8 +1931,8 @@ static inline void __skb_insert(struct sk_buff *newsk,
*/
WRITE_ONCE(newsk->next, next);
WRITE_ONCE(newsk->prev, prev);
- WRITE_ONCE(next->prev, newsk);
- WRITE_ONCE(prev->next, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)next)->prev, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)prev)->next, newsk);
WRITE_ONCE(list->qlen, list->qlen + 1);
}
@@ -2026,7 +2028,7 @@ static inline void __skb_queue_after(struct sk_buff_head *list,
struct sk_buff *prev,
struct sk_buff *newsk)
{
- __skb_insert(newsk, prev, prev->next, list);
+ __skb_insert(newsk, prev, ((struct sk_buff_list *)prev)->next, list);
}
void skb_append(struct sk_buff *old, struct sk_buff *newsk,
@@ -2036,7 +2038,7 @@ static inline void __skb_queue_before(struct sk_buff_head *list,
struct sk_buff *next,
struct sk_buff *newsk)
{
- __skb_insert(newsk, next->prev, next, list);
+ __skb_insert(newsk, ((struct sk_buff_list *)next)->prev, next, list);
}
/**
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 998a4ba28eba..938216f8ab7e 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -36,4 +36,52 @@ enum {
#define offsetofend(TYPE, MEMBER) \
(offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
+/**
+ * struct_group() - Wrap a set of declarations in a mirrored struct
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members.
+ */
+#define struct_group(NAME, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, /* no attrs */, MEMBERS)
+
+/**
+ * struct_group_attr() - Create a struct_group() with trailing attributes
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes to apply
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes structure attributes argument.
+ */
+#define struct_group_attr(NAME, ATTRS, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, ATTRS, MEMBERS)
+
+/**
+ * struct_group_tagged() - Create a struct_group with a reusable tag
+ *
+ * @TAG: The tag name for the named sub-struct
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes struct tag argument for the named copy,
+ * so the specified layout can be reused later.
+ */
+#define struct_group_tagged(TAG, NAME, MEMBERS...) \
+ __struct_group(TAG, NAME, /* no attrs */, MEMBERS)
+
#endif
diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
index ee8220f8dcf5..22aa0e2177ea 100644
--- a/include/uapi/linux/stddef.h
+++ b/include/uapi/linux/stddef.h
@@ -4,3 +4,41 @@
#ifndef __always_inline
#define __always_inline inline
#endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse, as well
+ * as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+ struct TAG { MEMBERS } ATTRS NAME; \
+ }
+
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ struct { \
+ struct { } __empty_ ## NAME; \
+ TYPE NAME[]; \
+ }
+
--
2.35.1
syzbot
Mar 29, 2022, 6:28:07 PM3/29/22
to syzkaller-a...@googlegroups.com, tadeus...@linaro.org
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+a24574...@syzkaller.appspotmail.com
Tested on:
commit: e69c61cf ANDROID: KVM: arm64: iommu: Create parent/chi..
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+a24574...@syzkaller.appspotmail.com
Tested on:
commit: e69c61cf ANDROID: KVM: arm64: iommu: Create parent/chi..
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=a24574248eb1b64261c1
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=11e5b553700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=a24574248eb1b64261c1
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Note: testing is done by a robot and is best-effort only.
Tadeusz Struk
Mar 30, 2022, 1:23:02 PM3/30/22
to syzkaller-a...@googlegroups.com
On 3/26/22 02:24, syzbot wrote:
syzbot
Mar 30, 2022, 1:23:04 PM3/30/22
to Tadeusz Struk, syzkaller-a...@googlegroups.com, tadeus...@linaro.org
Please resend the email to syzbo...@syzkaller.appspotmail.com address
that is the sender of the bug report (also present in the Reported-by tag).
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-android-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-android...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-android-bugs/0847c3a1-0348-dbb1-9a1e-6596f49078d5%40linaro.org.
Tadeusz Struk
Mar 30, 2022, 1:27:47 PM3/30/22
to syzbot, syzkaller-a...@googlegroups.com
On 3/26/22 02:24, syzbot wrote:
Reply all
Reply to author
Forward
0 new messages