[Android 5.15] kernel BUG in prog_array_map_poke_run

11 views
Skip to first unread message

syzbot

unread,
Nov 6, 2023, 10:46:31 PM11/6/23
to syzkaller-a...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 61cfd264993d Revert "ipv4/fib: send notify when delete sou..
git tree: android13-5.15-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=160970c0e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=86febd5cba631f80
dashboard link: https://syzkaller.appspot.com/bug?extid=4956f9b851d6402719ab
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13e4cd60e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11dc9ecf680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/12c3173d49c9/disk-61cfd264.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/aaf0b50ce030/vmlinux-61cfd264.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d32e9000a96b/bzImage-61cfd264.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4956f9...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at kernel/bpf/arraymap.c:1037!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 39 Comm: kworker/1:1 Not tainted 5.15.137-syzkaller-01792-g61cfd264993d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Workqueue: events prog_array_map_clear_deferred
RIP: 0010:prog_array_map_poke_run+0x696/0x6b0 kernel/bpf/arraymap.c:1037
Code: 47 e6 ff 48 83 c4 70 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 bd 47 e6 ff 0f 0b e9 de f9 ff ff e8 b1 47 e6 ff 0f 0b e8 aa 47 e6 ff <0f> 0b e8 a3 47 e6 ff 0f 0b e8 9c 47 e6 ff 0f 0b 66 2e 0f 1f 84 00
RSP: 0018:ffffc9000028fb70 EFLAGS: 00010293
RAX: ffffffff8189af86 RBX: ffff8881159343d0 RCX: ffff8881069ba780
RDX: 0000000000000000 RSI: 00000000fffffff0 RDI: 00000000ffffffea
RBP: ffffc9000028fc08 R08: ffffffff8189ad11 R09: fffff52000051f39
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888120d04380
R13: dffffc0000000000 R14: ffff888115034c00 R15: 00000000fffffff0
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fae19370628 CR3: 00000001191ef000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
fd_array_map_delete_elem+0x154/0x250 kernel/bpf/arraymap.c:830
bpf_fd_array_map_clear kernel/bpf/arraymap.c:878 [inline]
prog_array_map_clear_deferred+0xf8/0x210 kernel/bpf/arraymap.c:1057
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2317
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2464
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
Modules linked in:
---[ end trace ab3275692183dc20 ]---
RIP: 0010:prog_array_map_poke_run+0x696/0x6b0 kernel/bpf/arraymap.c:1037
Code: 47 e6 ff 48 83 c4 70 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 bd 47 e6 ff 0f 0b e9 de f9 ff ff e8 b1 47 e6 ff 0f 0b e8 aa 47 e6 ff <0f> 0b e8 a3 47 e6 ff 0f 0b e8 9c 47 e6 ff 0f 0b 66 2e 0f 1f 84 00
RSP: 0018:ffffc9000028fb70 EFLAGS: 00010293
RAX: ffffffff8189af86 RBX: ffff8881159343d0 RCX: ffff8881069ba780
RDX: 0000000000000000 RSI: 00000000fffffff0 RDI: 00000000ffffffea
RBP: ffffc9000028fc08 R08: ffffffff8189ad11 R09: fffff52000051f39
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888120d04380
R13: dffffc0000000000 R14: ffff888115034c00 R15: 00000000fffffff0
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fae192b3d58 CR3: 000000010c3dd000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,
Nov 6, 2023, 11:51:25 PM11/6/23
to syzkaller-a...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: d30b996835c0 Merge branch 'android13-5.10' into branch `an..
git tree: android13-5.10-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=112556eb680000
kernel config: https://syzkaller.appspot.com/x/.config?x=f13aac5231b00224
dashboard link: https://syzkaller.appspot.com/bug?extid=f8c117e3af198f898470
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=115ef6cf680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16e1a00f680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1eff8af192ac/disk-d30b9968.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e9e88fb972f1/vmlinux-d30b9968.xz
kernel image: https://storage.googleapis.com/syzbot-assets/41a7a22de0f7/bzImage-d30b9968.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f8c117...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at kernel/bpf/arraymap.c:990!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 25 Comm: kworker/1:1 Not tainted 5.10.199-syzkaller-00307-gd30b996835c0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Workqueue: events prog_array_map_clear_deferred
RIP: 0010:prog_array_map_poke_run+0x696/0x6b0 kernel/bpf/arraymap.c:990
Code: 95 e8 ff 48 83 c4 70 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 2d 95 e8 ff 0f 0b e9 de f9 ff ff e8 21 95 e8 ff 0f 0b e8 1a 95 e8 ff <0f> 0b e8 13 95 e8 ff 0f 0b e8 0c 95 e8 ff 0f 0b 66 2e 0f 1f 84 00
RSP: 0018:ffffc900001afb90 EFLAGS: 00010293
RAX: ffffffff81820e76 RBX: ffff888114949510 RCX: ffff888107d8bb40
RDX: 0000000000000000 RSI: 00000000fffffff0 RDI: 00000000ffffffea
RBP: ffffc900001afc28 R08: ffffffff81820c01 R09: fffffbfff0cdd641
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888109716b80
R13: dffffc0000000000 R14: ffff888118b7b000 R15: 00000000fffffff0
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3b95777a10 CR3: 000000010c0a8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
fd_array_map_delete_elem+0x154/0x250 kernel/bpf/arraymap.c:783
bpf_fd_array_map_clear kernel/bpf/arraymap.c:831 [inline]
prog_array_map_clear_deferred+0xf8/0x210 kernel/bpf/arraymap.c:1010
process_one_work+0x6dc/0xbd0 kernel/workqueue.c:2301
worker_thread+0xaea/0x1510 kernel/workqueue.c:2447
kthread+0x34b/0x3d0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299
Modules linked in:
---[ end trace 4f5109295c6a7c41 ]---
RIP: 0010:prog_array_map_poke_run+0x696/0x6b0 kernel/bpf/arraymap.c:990
Code: 95 e8 ff 48 83 c4 70 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 2d 95 e8 ff 0f 0b e9 de f9 ff ff e8 21 95 e8 ff 0f 0b e8 1a 95 e8 ff <0f> 0b e8 13 95 e8 ff 0f 0b e8 0c 95 e8 ff 0f 0b 66 2e 0f 1f 84 00
RSP: 0018:ffffc900001afb90 EFLAGS: 00010293
RAX: ffffffff81820e76 RBX: ffff888114949510 RCX: ffff888107d8bb40
RDX: 0000000000000000 RSI: 00000000fffffff0 RDI: 00000000ffffffea
RBP: ffffc900001afc28 R08: ffffffff81820c01 R09: fffffbfff0cdd641
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888109716b80
R13: dffffc0000000000 R14: ffff888118b7b000 R15: 00000000fffffff0
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3b95777a10 CR3: 0000000119f35000 CR4: 00000000003506a0

syzbot

unread,
Nov 7, 2023, 12:00:30 AM11/7/23
to syzkaller-a...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: fef66e854447 UPSTREAM: netfilter: ipset: add the missing I..
git tree: android14-6.1
console output: https://syzkaller.appspot.com/x/log.txt?x=1411a00f680000
kernel config: https://syzkaller.appspot.com/x/.config?x=e9500dd6486f6367
dashboard link: https://syzkaller.appspot.com/bug?extid=97a4fe20470e9bc30810
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10341787680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1420ef87680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fd60c4fde93/disk-fef66e85.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9fda75dc5d16/vmlinux-fef66e85.xz
kernel image: https://storage.googleapis.com/syzbot-assets/38078c4f9c03/bzImage-fef66e85.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+97a4fe...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at kernel/bpf/arraymap.c:1077!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 20553 Comm: kworker/0:11 Not tainted 6.1.43-syzkaller-00263-gfef66e854447 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Workqueue: events prog_array_map_clear_deferred
RIP: 0010:prog_array_map_poke_run+0x692/0x6b0 kernel/bpf/arraymap.c:1077
Code: 9e e4 ff 48 83 c4 70 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 41 9e e4 ff 0f 0b e9 e2 f9 ff ff e8 35 9e e4 ff 0f 0b e8 2e 9e e4 ff <0f> 0b e8 27 9e e4 ff 0f 0b e8 20 9e e4 ff 0f 0b 66 2e 0f 1f 84 00
RSP: 0018:ffffc9000448fb70 EFLAGS: 00010293
RAX: ffffffff81905ea2 RBX: ffff888120d5ccd0 RCX: ffff88810d87d100
RDX: 0000000000000000 RSI: 00000000fffffff0 RDI: 00000000ffffffea
RBP: ffffc9000448fc08 R08: ffffffff81905c2d R09: fffff52000891f3d
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888113b28700
R13: dffffc0000000000 R14: ffff8881196c3000 R15: 00000000fffffff0
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056137d159098 CR3: 000000010f280000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
fd_array_map_delete_elem+0x154/0x250 kernel/bpf/arraymap.c:871
bpf_fd_array_map_clear kernel/bpf/arraymap.c:918 [inline]
prog_array_map_clear_deferred+0xf8/0x210 kernel/bpf/arraymap.c:1097
process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299
worker_thread+0xa60/0x1260 kernel/workqueue.c:2446
kthread+0x26d/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:prog_array_map_poke_run+0x692/0x6b0 kernel/bpf/arraymap.c:1077
Code: 9e e4 ff 48 83 c4 70 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 41 9e e4 ff 0f 0b e9 e2 f9 ff ff e8 35 9e e4 ff 0f 0b e8 2e 9e e4 ff <0f> 0b e8 27 9e e4 ff 0f 0b e8 20 9e e4 ff 0f 0b 66 2e 0f 1f 84 00
RSP: 0018:ffffc9000448fb70 EFLAGS: 00010293
RAX: ffffffff81905ea2 RBX: ffff888120d5ccd0 RCX: ffff88810d87d100
RDX: 0000000000000000 RSI: 00000000fffffff0 RDI: 00000000ffffffea
RBP: ffffc9000448fc08 R08: ffffffff81905c2d R09: fffff52000891f3d
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888113b28700
R13: dffffc0000000000 R14: ffff8881196c3000 R15: 00000000fffffff0
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0026f5c248 CR3: 000000010f280000 CR4: 00000000003506b0

syzbot

unread,
Feb 23, 2024, 1:57:06 AMFeb 23
to syzkaller-a...@googlegroups.com
syzbot suspects this issue was fixed by commit:

commit 13578b4ea461da333b863e7a2f732f0f8e0ffbd0
Author: Jiri Olsa <jo...@kernel.org>
Date: Wed Dec 6 08:30:40 2023 +0000

bpf: Fix prog_array_map_poke_run map poke update

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=164cb658180000
start commit: 61cfd264993d Revert "ipv4/fib: send notify when delete sou..
git tree: android13-5.15-lts
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=130dd2c2e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13dbbac4e80000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: bpf: Fix prog_array_map_poke_run map poke update

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

syzbot

unread,
Mar 24, 2024, 3:32:12 AMMar 24
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages