BUG: stack guard page was hit in corrupted (16)
0 views
Skip to first unread message
syzbot
Mar 27, 2022, 10:31:23 AM3/27/22
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: ab2d1d40a128 Revert "vsock: each transport cycles only on ..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=13f0113b700000
kernel config: https://syzkaller.appspot.com/x/.config?x=75791a4a1d0f0a62
dashboard link: https://syzkaller.appspot.com/bug?extid=8ee032d1e53aacc92994
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f7672b700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a17ddd700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8ee032...@syzkaller.appspotmail.com
BUG: stack guard page was hit at ffffc90000997fa8 (stack is ffffc90000998000..ffffc9000099ffff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 365 Comm: syz-executor930 Not tainted 5.10.108-syzkaller-00653-gab2d1d40a128 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__unwind_start+0x2f/0x420 arch/x86/kernel/unwind_frame.c:368
Code: 57 41 56 41 55 41 54 53 48 83 ec 50 48 89 4d d0 49 89 d7 49 89 f6 49 89 fd 48 bb 00 00 00 00 00 fc ff df ba 60 00 00 00 31 f6 <e8> bc e8 72 00 49 8d 7d 28 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05
RSP: 0018:ffffc90000997fb8 EFLAGS: 00010246
RAX: ffff88811d1dbb40 RBX: dffffc0000000000 RCX: ffffc900009980d0
RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffffc90000998040
RBP: ffffc90000998030 R08: dffffc0000000000 R09: ffffc90000998120
R10: fffff52000133027 R11: 0000000000000000 R12: ffff88811d1dbb40
R13: ffffc90000998040 R14: ffff88811d1dbb40 R15: 0000000000000000
FS: 0000555555775300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000997fa8 CR3: 0000000107182000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace ed4e1c0bd2760598 ]---
RIP: 0010:__unwind_start+0x2f/0x420 arch/x86/kernel/unwind_frame.c:368
Code: 57 41 56 41 55 41 54 53 48 83 ec 50 48 89 4d d0 49 89 d7 49 89 f6 49 89 fd 48 bb 00 00 00 00 00 fc ff df ba 60 00 00 00 31 f6 <e8> bc e8 72 00 49 8d 7d 28 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05
RSP: 0018:ffffc90000997fb8 EFLAGS: 00010246
RAX: ffff88811d1dbb40 RBX: dffffc0000000000 RCX: ffffc900009980d0
RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffffc90000998040
RBP: ffffc90000998030 R08: dffffc0000000000 R09: ffffc90000998120
R10: fffff52000133027 R11: 0000000000000000 R12: ffff88811d1dbb40
R13: ffffc90000998040 R14: ffff88811d1dbb40 R15: 0000000000000000
FS: 0000555555775300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000997fa8 CR3: 0000000107182000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 57 push %rdi
1: 41 56 push %r14
3: 41 55 push %r13
5: 41 54 push %r12
7: 53 push %rbx
8: 48 83 ec 50 sub $0x50,%rsp
c: 48 89 4d d0 mov %rcx,-0x30(%rbp)
10: 49 89 d7 mov %rdx,%r15
13: 49 89 f6 mov %rsi,%r14
16: 49 89 fd mov %rdi,%r13
19: 48 bb 00 00 00 00 00 movabs $0xdffffc0000000000,%rbx
20: fc ff df
23: ba 60 00 00 00 mov $0x60,%edx
28: 31 f6 xor %esi,%esi
* 2a: e8 bc e8 72 00 callq 0x72e8eb <-- trapping instruction
2f: 49 8d 7d 28 lea 0x28(%r13),%rdi
33: 48 89 f8 mov %rdi,%rax
36: 48 c1 e8 03 shr $0x3,%rax
3a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
3e: 74 05 je 0x45
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: ab2d1d40a128 Revert "vsock: each transport cycles only on ..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=13f0113b700000
kernel config: https://syzkaller.appspot.com/x/.config?x=75791a4a1d0f0a62
dashboard link: https://syzkaller.appspot.com/bug?extid=8ee032d1e53aacc92994
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f7672b700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a17ddd700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8ee032...@syzkaller.appspotmail.com
BUG: stack guard page was hit at ffffc90000997fa8 (stack is ffffc90000998000..ffffc9000099ffff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 365 Comm: syz-executor930 Not tainted 5.10.108-syzkaller-00653-gab2d1d40a128 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__unwind_start+0x2f/0x420 arch/x86/kernel/unwind_frame.c:368
Code: 57 41 56 41 55 41 54 53 48 83 ec 50 48 89 4d d0 49 89 d7 49 89 f6 49 89 fd 48 bb 00 00 00 00 00 fc ff df ba 60 00 00 00 31 f6 <e8> bc e8 72 00 49 8d 7d 28 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05
RSP: 0018:ffffc90000997fb8 EFLAGS: 00010246
RAX: ffff88811d1dbb40 RBX: dffffc0000000000 RCX: ffffc900009980d0
RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffffc90000998040
RBP: ffffc90000998030 R08: dffffc0000000000 R09: ffffc90000998120
R10: fffff52000133027 R11: 0000000000000000 R12: ffff88811d1dbb40
R13: ffffc90000998040 R14: ffff88811d1dbb40 R15: 0000000000000000
FS: 0000555555775300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000997fa8 CR3: 0000000107182000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace ed4e1c0bd2760598 ]---
RIP: 0010:__unwind_start+0x2f/0x420 arch/x86/kernel/unwind_frame.c:368
Code: 57 41 56 41 55 41 54 53 48 83 ec 50 48 89 4d d0 49 89 d7 49 89 f6 49 89 fd 48 bb 00 00 00 00 00 fc ff df ba 60 00 00 00 31 f6 <e8> bc e8 72 00 49 8d 7d 28 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05
RSP: 0018:ffffc90000997fb8 EFLAGS: 00010246
RAX: ffff88811d1dbb40 RBX: dffffc0000000000 RCX: ffffc900009980d0
RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffffc90000998040
RBP: ffffc90000998030 R08: dffffc0000000000 R09: ffffc90000998120
R10: fffff52000133027 R11: 0000000000000000 R12: ffff88811d1dbb40
R13: ffffc90000998040 R14: ffff88811d1dbb40 R15: 0000000000000000
FS: 0000555555775300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000997fa8 CR3: 0000000107182000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 57 push %rdi
1: 41 56 push %r14
3: 41 55 push %r13
5: 41 54 push %r12
7: 53 push %rbx
8: 48 83 ec 50 sub $0x50,%rsp
c: 48 89 4d d0 mov %rcx,-0x30(%rbp)
10: 49 89 d7 mov %rdx,%r15
13: 49 89 f6 mov %rsi,%r14
16: 49 89 fd mov %rdi,%r13
19: 48 bb 00 00 00 00 00 movabs $0xdffffc0000000000,%rbx
20: fc ff df
23: ba 60 00 00 00 mov $0x60,%edx
28: 31 f6 xor %esi,%esi
* 2a: e8 bc e8 72 00 callq 0x72e8eb <-- trapping instruction
2f: 49 8d 7d 28 lea 0x28(%r13),%rdi
33: 48 89 f8 mov %rdi,%rax
36: 48 c1 e8 03 shr $0x3,%rax
3a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
3e: 74 05 je 0x45
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Tadeusz Struk
Mar 28, 2022, 12:21:59 PM3/28/22
to syzbot, syzkaller-a...@googlegroups.com
syzbot
Mar 28, 2022, 6:57:12 PM3/28/22
to syzkaller-a...@googlegroups.com, tadeus...@linaro.org
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================
syzkaller
syzkaller login: [ 12.153130][ T23] kauditd_printk_skb: 60 callbacks suppressed
[ 12.153142][ T23] audit: type=1400 audit(1648508151.229:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 12.161594][ T23] audit: type=1400 audit(1648508151.229:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[11524]" dev="pipefs" ino=11524 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
[ 12.299962][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
[ 12.303733][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
[ 13.328880][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
[ 13.368894][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
Warning: Permanently added '10.128.1.80' (ECDSA) to the list of known hosts.
2022/03/28 22:55:58 fuzzer started
2022/03/28 22:55:58 connecting to host at 10.128.0.163:34415
2022/03/28 22:55:58 checking machine...
2022/03/28 22:55:58 checking revisions...
2022/03/28 22:55:58 testing simple program...
[ 19.318789][ T23] audit: type=1400 audit(1648508158.389:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.322262][ T23] audit: type=1400 audit(1648508158.399:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.325730][ T23] audit: type=1400 audit(1648508158.399:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.329360][ T23] audit: type=1400 audit(1648508158.399:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.332638][ T23] audit: type=1400 audit(1648508158.399:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.340267][ T23] audit: type=1400 audit(1648508158.419:78): avc: denied { mounton } for pid=371 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 19.350523][ T371] cgroup: Unknown subsys name 'net'
[ 19.362913][ T23] audit: type=1400 audit(1648508158.429:79): avc: denied { mount } for pid=371 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 19.390581][ T371] cgroup: Unknown subsys name 'devices'
[ 19.390592][ T23] audit: type=1400 audit(1648508158.449:80): avc: denied { unmount } for pid=371 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 19.500588][ T371] cgroup: Unknown subsys name 'hugetlb'
[ 19.506576][ T371] cgroup: Unknown subsys name 'rlimit'
[ 19.600049][ T23] audit: type=1400 audit(1648508158.679:81): avc: denied { setattr } for pid=371 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.624234][ T23] audit: type=1400 audit(1648508158.699:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 19.692535][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.699803][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.707491][ T373] device bridge_slave_0 entered promiscuous mode
[ 19.714672][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.721766][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.729285][ T373] device bridge_slave_1 entered promiscuous mode
[ 19.762364][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.769437][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 19.776727][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.783772][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 19.803147][ T24] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.811031][ T24] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.818353][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 19.826261][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 19.836052][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 19.844371][ T47] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.851414][ T47] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 19.860143][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 19.870445][ T24] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.877505][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 19.891198][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 19.904658][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 19.914163][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 19.925612][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 19.942586][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 19.951656][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 19.960345][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 19.971946][ T107] ================================================================================
[ 19.981262][ T107] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 19.989085][ T107] member access within address ffffc90000af71c0 with insufficient space
[ 19.997427][ T107] for an object of type 'struct sk_buff'
[ 20.003088][ T107] CPU: 0 PID: 107 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 20.012973][ T107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 20.023040][ T107] Workqueue: ipv6_addrconf addrconf_dad_work
[ 20.029008][ T107] Call Trace:
[ 20.032293][ T107] dump_stack_lvl+0x1e2/0x24b
[ 20.036976][ T107] ? show_regs_print_info+0x18/0x18
[ 20.042169][ T107] ? wg_allowedips_lookup_dst+0x190/0x190
[ 20.047878][ T107] dump_stack+0x15/0x1d
[ 20.052022][ T107] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 20.057989][ T107] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 20.063869][ T107] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 20.069830][ T107] wg_xmit+0x4a2/0xae0
[ 20.073886][ T107] ? wg_stop+0x5d0/0x5d0
[ 20.078109][ T107] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 20.084331][ T107] netdev_start_xmit+0x8a/0x160
[ 20.089264][ T107] dev_hard_start_xmit+0x18d/0x2f0
[ 20.094362][ T107] __dev_queue_xmit+0x100c/0x1c30
[ 20.099388][ T107] ? dev_queue_xmit+0x20/0x20
[ 20.104054][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.110285][ T107] ? ndisc_constructor+0x690/0x8a0
[ 20.115377][ T107] ? _raw_write_unlock_bh+0x31/0x47
[ 20.120560][ T107] ? ___neigh_create+0x162d/0x1ab0
[ 20.125654][ T107] ? dev_hard_header+0xdb/0xf0
[ 20.130399][ T107] dev_queue_xmit+0x17/0x20
[ 20.134897][ T107] neigh_connected_output+0x288/0x2b0
[ 20.140250][ T107] ip6_finish_output2+0xde2/0x1440
[ 20.145342][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.150084][ T107] ? __ip6_finish_output+0x520/0x520
[ 20.155361][ T107] ? dst_cow_metrics_generic+0x55/0x1d0
[ 20.160902][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.167132][ T107] ? ip6_skb_dst_mtu+0xaf/0x260
[ 20.171974][ T107] __ip6_finish_output+0x3e4/0x520
[ 20.177079][ T107] ip6_finish_output+0x3f/0x220
[ 20.181909][ T107] ? ip6_output+0x1d3/0x4b0
[ 20.186406][ T107] ip6_output+0x1f8/0x4b0
[ 20.190713][ T107] ? asan.module_dtor+0x20/0x20
[ 20.195543][ T107] ? skb_dst+0x40/0x40
[ 20.199607][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.204350][ T107] ? selinux_ipv6_forward+0x50/0x50
[ 20.209536][ T107] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 20.215234][ T107] ? nf_hook_slow+0x150/0x1b0
[ 20.219893][ T107] NF_HOOK+0xdd/0x280
[ 20.223857][ T107] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 20.229515][ T107] ? NF_HOOK+0x280/0x280
[ 20.233736][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.238493][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.244713][ T107] ? ndisc_send_skb+0x547/0x9f0
[ 20.249543][ T107] ? memcpy+0x56/0x70
[ 20.253507][ T107] ndisc_send_skb+0x646/0x9f0
[ 20.258252][ T107] ? slab_post_alloc_hook+0x90/0xa0
[ 20.263441][ T107] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 20.268964][ T107] ? skb_set_owner_w+0x1a8/0x310
[ 20.273882][ T107] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 20.279580][ T107] ? skb_put+0x11d/0x210
[ 20.283803][ T107] ndisc_send_rs+0x26c/0x360
[ 20.288373][ T107] addrconf_dad_completed+0x4f3/0x9f0
[ 20.293725][ T107] ? addrconf_dad_stop+0x430/0x430
[ 20.298817][ T107] ? mutex_unlock+0x34/0x40
[ 20.303299][ T107] addrconf_dad_work+0x9c1/0x1520
[ 20.308393][ T107] ? move_linked_works+0x118/0x130
[ 20.313486][ T107] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 20.319207][ T107] ? __kasan_check_write+0x14/0x20
[ 20.324328][ T107] process_one_work+0x3ca/0x660
[ 20.329175][ T107] worker_thread+0x709/0xa20
[ 20.333758][ T107] ? __kthread_parkme+0x11b/0x150
[ 20.338759][ T107] kthread+0x389/0x3c0
[ 20.342810][ T107] ? pr_cont_work+0x110/0x110
[ 20.347465][ T107] ? __list_add+0xc0/0xc0
[ 20.351773][ T107] ret_from_fork+0x1f/0x30
[ 20.356218][ T107] ================================================================================
[ 20.365532][ T107] ================================================================================
[ 20.374829][ T107] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 20.382555][ T107] member access within address ffffc90000af71c0 with insufficient space
[ 20.390887][ T107] for an object of type 'struct sk_buff'
[ 20.396508][ T107] CPU: 0 PID: 107 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 20.406392][ T107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 20.416448][ T107] Workqueue: ipv6_addrconf addrconf_dad_work
[ 20.422416][ T107] Call Trace:
[ 20.425688][ T107] dump_stack_lvl+0x1e2/0x24b
[ 20.430376][ T107] ? show_regs_print_info+0x18/0x18
[ 20.435561][ T107] ? wg_allowedips_lookup_dst+0x190/0x190
[ 20.441358][ T107] dump_stack+0x15/0x1d
[ 20.445504][ T107] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 20.451215][ T107] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 20.457261][ T107] wg_xmit+0x513/0xae0
[ 20.461319][ T107] ? wg_stop+0x5d0/0x5d0
[ 20.465753][ T107] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 20.472020][ T107] netdev_start_xmit+0x8a/0x160
[ 20.476859][ T107] dev_hard_start_xmit+0x18d/0x2f0
[ 20.481956][ T107] __dev_queue_xmit+0x100c/0x1c30
[ 20.486969][ T107] ? dev_queue_xmit+0x20/0x20
[ 20.491625][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.497845][ T107] ? ndisc_constructor+0x690/0x8a0
[ 20.502935][ T107] ? _raw_write_unlock_bh+0x31/0x47
[ 20.508112][ T107] ? ___neigh_create+0x162d/0x1ab0
[ 20.513196][ T107] ? dev_hard_header+0xdb/0xf0
[ 20.517952][ T107] dev_queue_xmit+0x17/0x20
[ 20.522437][ T107] neigh_connected_output+0x288/0x2b0
[ 20.527788][ T107] ip6_finish_output2+0xde2/0x1440
[ 20.532877][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.537640][ T107] ? __ip6_finish_output+0x520/0x520
[ 20.542900][ T107] ? dst_cow_metrics_generic+0x55/0x1d0
[ 20.548423][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.554634][ T107] ? ip6_skb_dst_mtu+0xaf/0x260
[ 20.559464][ T107] __ip6_finish_output+0x3e4/0x520
[ 20.564565][ T107] ip6_finish_output+0x3f/0x220
[ 20.569510][ T107] ? ip6_output+0x1d3/0x4b0
[ 20.574020][ T107] ip6_output+0x1f8/0x4b0
[ 20.578346][ T107] ? asan.module_dtor+0x20/0x20
[ 20.583180][ T107] ? skb_dst+0x40/0x40
[ 20.587245][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.591997][ T107] ? selinux_ipv6_forward+0x50/0x50
[ 20.597191][ T107] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 20.603179][ T107] ? nf_hook_slow+0x150/0x1b0
[ 20.607882][ T107] NF_HOOK+0xdd/0x280
[ 20.611940][ T107] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 20.617566][ T107] ? NF_HOOK+0x280/0x280
[ 20.621940][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.626794][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.633097][ T107] ? ndisc_send_skb+0x547/0x9f0
[ 20.637960][ T107] ? memcpy+0x56/0x70
[ 20.641927][ T107] ndisc_send_skb+0x646/0x9f0
[ 20.646704][ T107] ? slab_post_alloc_hook+0x90/0xa0
[ 20.651880][ T107] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 20.657792][ T107] ? skb_set_owner_w+0x1a8/0x310
[ 20.662730][ T107] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 20.668433][ T107] ? skb_put+0x11d/0x210
[ 20.672747][ T107] ndisc_send_rs+0x26c/0x360
[ 20.678543][ T107] addrconf_dad_completed+0x4f3/0x9f0
[ 20.684067][ T107] ? addrconf_dad_stop+0x430/0x430
[ 20.689446][ T107] ? mutex_unlock+0x34/0x40
[ 20.693926][ T107] addrconf_dad_work+0x9c1/0x1520
[ 20.699061][ T107] ? move_linked_works+0x118/0x130
[ 20.704244][ T107] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 20.710119][ T107] ? __kasan_check_write+0x14/0x20
[ 20.715228][ T107] process_one_work+0x3ca/0x660
[ 20.720146][ T107] worker_thread+0x709/0xa20
[ 20.724771][ T107] ? __kthread_parkme+0x11b/0x150
[ 20.729782][ T107] kthread+0x389/0x3c0
[ 20.733848][ T107] ? pr_cont_work+0x110/0x110
[ 20.738504][ T107] ? __list_add+0xc0/0xc0
[ 20.742883][ T107] ret_from_fork+0x1f/0x30
[ 20.747354][ T107] ================================================================================
2022/03/28 22:55:59 building call list...
[ 20.759169][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 21.322517][ T177] device bridge_slave_1 left promiscuous mode
[ 21.328713][ T177] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.336664][ T177] device bridge_slave_0 left promiscuous mode
[ 21.342949][ T177] bridge0: port 1(bridge_slave_0) entered disabled state
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12614d67700000
Tested on:
commit: ec7c9ea9 ANDROID: Update the ABI representation
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
syzbot tried to test the proposed patch but the build/boot failed:
netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================
syzkaller
syzkaller login: [ 12.153130][ T23] kauditd_printk_skb: 60 callbacks suppressed
[ 12.153142][ T23] audit: type=1400 audit(1648508151.229:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 12.161594][ T23] audit: type=1400 audit(1648508151.229:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[11524]" dev="pipefs" ino=11524 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
[ 12.299962][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
[ 12.303733][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
[ 13.328880][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
[ 13.368894][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
Warning: Permanently added '10.128.1.80' (ECDSA) to the list of known hosts.
2022/03/28 22:55:58 fuzzer started
2022/03/28 22:55:58 connecting to host at 10.128.0.163:34415
2022/03/28 22:55:58 checking machine...
2022/03/28 22:55:58 checking revisions...
2022/03/28 22:55:58 testing simple program...
[ 19.318789][ T23] audit: type=1400 audit(1648508158.389:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.322262][ T23] audit: type=1400 audit(1648508158.399:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.325730][ T23] audit: type=1400 audit(1648508158.399:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.329360][ T23] audit: type=1400 audit(1648508158.399:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.332638][ T23] audit: type=1400 audit(1648508158.399:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.340267][ T23] audit: type=1400 audit(1648508158.419:78): avc: denied { mounton } for pid=371 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 19.350523][ T371] cgroup: Unknown subsys name 'net'
[ 19.362913][ T23] audit: type=1400 audit(1648508158.429:79): avc: denied { mount } for pid=371 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 19.390581][ T371] cgroup: Unknown subsys name 'devices'
[ 19.390592][ T23] audit: type=1400 audit(1648508158.449:80): avc: denied { unmount } for pid=371 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 19.500588][ T371] cgroup: Unknown subsys name 'hugetlb'
[ 19.506576][ T371] cgroup: Unknown subsys name 'rlimit'
[ 19.600049][ T23] audit: type=1400 audit(1648508158.679:81): avc: denied { setattr } for pid=371 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.624234][ T23] audit: type=1400 audit(1648508158.699:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 19.692535][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.699803][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.707491][ T373] device bridge_slave_0 entered promiscuous mode
[ 19.714672][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.721766][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.729285][ T373] device bridge_slave_1 entered promiscuous mode
[ 19.762364][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.769437][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 19.776727][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.783772][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 19.803147][ T24] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.811031][ T24] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.818353][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 19.826261][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 19.836052][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 19.844371][ T47] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.851414][ T47] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 19.860143][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 19.870445][ T24] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.877505][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 19.891198][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 19.904658][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 19.914163][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 19.925612][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 19.942586][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 19.951656][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 19.960345][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 19.971946][ T107] ================================================================================
[ 19.981262][ T107] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 19.989085][ T107] member access within address ffffc90000af71c0 with insufficient space
[ 19.997427][ T107] for an object of type 'struct sk_buff'
[ 20.003088][ T107] CPU: 0 PID: 107 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 20.012973][ T107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 20.023040][ T107] Workqueue: ipv6_addrconf addrconf_dad_work
[ 20.029008][ T107] Call Trace:
[ 20.032293][ T107] dump_stack_lvl+0x1e2/0x24b
[ 20.036976][ T107] ? show_regs_print_info+0x18/0x18
[ 20.042169][ T107] ? wg_allowedips_lookup_dst+0x190/0x190
[ 20.047878][ T107] dump_stack+0x15/0x1d
[ 20.052022][ T107] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 20.057989][ T107] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 20.063869][ T107] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 20.069830][ T107] wg_xmit+0x4a2/0xae0
[ 20.073886][ T107] ? wg_stop+0x5d0/0x5d0
[ 20.078109][ T107] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 20.084331][ T107] netdev_start_xmit+0x8a/0x160
[ 20.089264][ T107] dev_hard_start_xmit+0x18d/0x2f0
[ 20.094362][ T107] __dev_queue_xmit+0x100c/0x1c30
[ 20.099388][ T107] ? dev_queue_xmit+0x20/0x20
[ 20.104054][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.110285][ T107] ? ndisc_constructor+0x690/0x8a0
[ 20.115377][ T107] ? _raw_write_unlock_bh+0x31/0x47
[ 20.120560][ T107] ? ___neigh_create+0x162d/0x1ab0
[ 20.125654][ T107] ? dev_hard_header+0xdb/0xf0
[ 20.130399][ T107] dev_queue_xmit+0x17/0x20
[ 20.134897][ T107] neigh_connected_output+0x288/0x2b0
[ 20.140250][ T107] ip6_finish_output2+0xde2/0x1440
[ 20.145342][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.150084][ T107] ? __ip6_finish_output+0x520/0x520
[ 20.155361][ T107] ? dst_cow_metrics_generic+0x55/0x1d0
[ 20.160902][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.167132][ T107] ? ip6_skb_dst_mtu+0xaf/0x260
[ 20.171974][ T107] __ip6_finish_output+0x3e4/0x520
[ 20.177079][ T107] ip6_finish_output+0x3f/0x220
[ 20.181909][ T107] ? ip6_output+0x1d3/0x4b0
[ 20.186406][ T107] ip6_output+0x1f8/0x4b0
[ 20.190713][ T107] ? asan.module_dtor+0x20/0x20
[ 20.195543][ T107] ? skb_dst+0x40/0x40
[ 20.199607][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.204350][ T107] ? selinux_ipv6_forward+0x50/0x50
[ 20.209536][ T107] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 20.215234][ T107] ? nf_hook_slow+0x150/0x1b0
[ 20.219893][ T107] NF_HOOK+0xdd/0x280
[ 20.223857][ T107] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 20.229515][ T107] ? NF_HOOK+0x280/0x280
[ 20.233736][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.238493][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.244713][ T107] ? ndisc_send_skb+0x547/0x9f0
[ 20.249543][ T107] ? memcpy+0x56/0x70
[ 20.253507][ T107] ndisc_send_skb+0x646/0x9f0
[ 20.258252][ T107] ? slab_post_alloc_hook+0x90/0xa0
[ 20.263441][ T107] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 20.268964][ T107] ? skb_set_owner_w+0x1a8/0x310
[ 20.273882][ T107] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 20.279580][ T107] ? skb_put+0x11d/0x210
[ 20.283803][ T107] ndisc_send_rs+0x26c/0x360
[ 20.288373][ T107] addrconf_dad_completed+0x4f3/0x9f0
[ 20.293725][ T107] ? addrconf_dad_stop+0x430/0x430
[ 20.298817][ T107] ? mutex_unlock+0x34/0x40
[ 20.303299][ T107] addrconf_dad_work+0x9c1/0x1520
[ 20.308393][ T107] ? move_linked_works+0x118/0x130
[ 20.313486][ T107] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 20.319207][ T107] ? __kasan_check_write+0x14/0x20
[ 20.324328][ T107] process_one_work+0x3ca/0x660
[ 20.329175][ T107] worker_thread+0x709/0xa20
[ 20.333758][ T107] ? __kthread_parkme+0x11b/0x150
[ 20.338759][ T107] kthread+0x389/0x3c0
[ 20.342810][ T107] ? pr_cont_work+0x110/0x110
[ 20.347465][ T107] ? __list_add+0xc0/0xc0
[ 20.351773][ T107] ret_from_fork+0x1f/0x30
[ 20.356218][ T107] ================================================================================
[ 20.365532][ T107] ================================================================================
[ 20.374829][ T107] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 20.382555][ T107] member access within address ffffc90000af71c0 with insufficient space
[ 20.390887][ T107] for an object of type 'struct sk_buff'
[ 20.396508][ T107] CPU: 0 PID: 107 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 20.406392][ T107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 20.416448][ T107] Workqueue: ipv6_addrconf addrconf_dad_work
[ 20.422416][ T107] Call Trace:
[ 20.425688][ T107] dump_stack_lvl+0x1e2/0x24b
[ 20.430376][ T107] ? show_regs_print_info+0x18/0x18
[ 20.435561][ T107] ? wg_allowedips_lookup_dst+0x190/0x190
[ 20.441358][ T107] dump_stack+0x15/0x1d
[ 20.445504][ T107] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 20.451215][ T107] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 20.457261][ T107] wg_xmit+0x513/0xae0
[ 20.461319][ T107] ? wg_stop+0x5d0/0x5d0
[ 20.465753][ T107] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 20.472020][ T107] netdev_start_xmit+0x8a/0x160
[ 20.476859][ T107] dev_hard_start_xmit+0x18d/0x2f0
[ 20.481956][ T107] __dev_queue_xmit+0x100c/0x1c30
[ 20.486969][ T107] ? dev_queue_xmit+0x20/0x20
[ 20.491625][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.497845][ T107] ? ndisc_constructor+0x690/0x8a0
[ 20.502935][ T107] ? _raw_write_unlock_bh+0x31/0x47
[ 20.508112][ T107] ? ___neigh_create+0x162d/0x1ab0
[ 20.513196][ T107] ? dev_hard_header+0xdb/0xf0
[ 20.517952][ T107] dev_queue_xmit+0x17/0x20
[ 20.522437][ T107] neigh_connected_output+0x288/0x2b0
[ 20.527788][ T107] ip6_finish_output2+0xde2/0x1440
[ 20.532877][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.537640][ T107] ? __ip6_finish_output+0x520/0x520
[ 20.542900][ T107] ? dst_cow_metrics_generic+0x55/0x1d0
[ 20.548423][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.554634][ T107] ? ip6_skb_dst_mtu+0xaf/0x260
[ 20.559464][ T107] __ip6_finish_output+0x3e4/0x520
[ 20.564565][ T107] ip6_finish_output+0x3f/0x220
[ 20.569510][ T107] ? ip6_output+0x1d3/0x4b0
[ 20.574020][ T107] ip6_output+0x1f8/0x4b0
[ 20.578346][ T107] ? asan.module_dtor+0x20/0x20
[ 20.583180][ T107] ? skb_dst+0x40/0x40
[ 20.587245][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.591997][ T107] ? selinux_ipv6_forward+0x50/0x50
[ 20.597191][ T107] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 20.603179][ T107] ? nf_hook_slow+0x150/0x1b0
[ 20.607882][ T107] NF_HOOK+0xdd/0x280
[ 20.611940][ T107] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 20.617566][ T107] ? NF_HOOK+0x280/0x280
[ 20.621940][ T107] ? __rcu_read_lock+0x50/0x50
[ 20.626794][ T107] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.633097][ T107] ? ndisc_send_skb+0x547/0x9f0
[ 20.637960][ T107] ? memcpy+0x56/0x70
[ 20.641927][ T107] ndisc_send_skb+0x646/0x9f0
[ 20.646704][ T107] ? slab_post_alloc_hook+0x90/0xa0
[ 20.651880][ T107] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 20.657792][ T107] ? skb_set_owner_w+0x1a8/0x310
[ 20.662730][ T107] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 20.668433][ T107] ? skb_put+0x11d/0x210
[ 20.672747][ T107] ndisc_send_rs+0x26c/0x360
[ 20.678543][ T107] addrconf_dad_completed+0x4f3/0x9f0
[ 20.684067][ T107] ? addrconf_dad_stop+0x430/0x430
[ 20.689446][ T107] ? mutex_unlock+0x34/0x40
[ 20.693926][ T107] addrconf_dad_work+0x9c1/0x1520
[ 20.699061][ T107] ? move_linked_works+0x118/0x130
[ 20.704244][ T107] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 20.710119][ T107] ? __kasan_check_write+0x14/0x20
[ 20.715228][ T107] process_one_work+0x3ca/0x660
[ 20.720146][ T107] worker_thread+0x709/0xa20
[ 20.724771][ T107] ? __kthread_parkme+0x11b/0x150
[ 20.729782][ T107] kthread+0x389/0x3c0
[ 20.733848][ T107] ? pr_cont_work+0x110/0x110
[ 20.738504][ T107] ? __list_add+0xc0/0xc0
[ 20.742883][ T107] ret_from_fork+0x1f/0x30
[ 20.747354][ T107] ================================================================================
2022/03/28 22:55:59 building call list...
[ 20.759169][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 21.322517][ T177] device bridge_slave_1 left promiscuous mode
[ 21.328713][ T177] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.336664][ T177] device bridge_slave_0 left promiscuous mode
[ 21.342949][ T177] bridge0: port 1(bridge_slave_0) entered disabled state
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12614d67700000
Tested on:
commit: ec7c9ea9 ANDROID: Update the ABI representation
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=8ee032d1e53aacc92994
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Tadeusz Struk
Mar 29, 2022, 6:24:55 PM3/29/22
to syzbot+8ee032...@syzkaller.appspotmail.com, syzkaller-a...@googlegroups.com, tadeus...@linaro.org
=======================================
index 3a02503b3637..76cc25bc140d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -291,9 +291,11 @@ struct tc_skb_ext {
#endif
struct sk_buff_head {
+ struct_group_tagged(sk_buff_list, list,
/* These two members must be first. */
struct sk_buff *next;
struct sk_buff *prev;
+ );
__u32 qlen;
spinlock_t lock;
@@ -1929,8 +1931,8 @@ static inline void __skb_insert(struct sk_buff *newsk,
*/
WRITE_ONCE(newsk->next, next);
WRITE_ONCE(newsk->prev, prev);
- WRITE_ONCE(next->prev, newsk);
- WRITE_ONCE(prev->next, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)next)->prev, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)prev)->next, newsk);
WRITE_ONCE(list->qlen, list->qlen + 1);
}
@@ -2026,7 +2028,7 @@ static inline void __skb_queue_after(struct sk_buff_head *list,
struct sk_buff *prev,
struct sk_buff *newsk)
{
- __skb_insert(newsk, prev, prev->next, list);
+ __skb_insert(newsk, prev, ((struct sk_buff_list *)prev)->next, list);
}
void skb_append(struct sk_buff *old, struct sk_buff *newsk,
@@ -2036,7 +2038,7 @@ static inline void __skb_queue_before(struct sk_buff_head *list,
struct sk_buff *next,
struct sk_buff *newsk)
{
- __skb_insert(newsk, next->prev, next, list);
+ __skb_insert(newsk, ((struct sk_buff_list *)next)->prev, next, list);
}
/**
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 998a4ba28eba..938216f8ab7e 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -36,4 +36,52 @@ enum {
#define offsetofend(TYPE, MEMBER) \
(offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
+/**
+ * struct_group() - Wrap a set of declarations in a mirrored struct
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members.
+ */
+#define struct_group(NAME, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, /* no attrs */, MEMBERS)
+
+/**
+ * struct_group_attr() - Create a struct_group() with trailing attributes
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes to apply
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes structure attributes argument.
+ */
+#define struct_group_attr(NAME, ATTRS, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, ATTRS, MEMBERS)
+
+/**
+ * struct_group_tagged() - Create a struct_group with a reusable tag
+ *
+ * @TAG: The tag name for the named sub-struct
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes struct tag argument for the named copy,
+ * so the specified layout can be reused later.
+ */
+#define struct_group_tagged(TAG, NAME, MEMBERS...) \
+ __struct_group(TAG, NAME, /* no attrs */, MEMBERS)
+
#endif
diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
index ee8220f8dcf5..22aa0e2177ea 100644
--- a/include/uapi/linux/stddef.h
+++ b/include/uapi/linux/stddef.h
@@ -4,3 +4,41 @@
#ifndef __always_inline
#define __always_inline inline
#endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse, as well
+ * as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+ struct TAG { MEMBERS } ATTRS NAME; \
+ }
+
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ struct { \
+ struct { } __empty_ ## NAME; \
+ TYPE NAME[]; \
+ }
+
--
2.35.1
index 3a02503b3637..76cc25bc140d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -291,9 +291,11 @@ struct tc_skb_ext {
#endif
struct sk_buff_head {
+ struct_group_tagged(sk_buff_list, list,
/* These two members must be first. */
struct sk_buff *next;
struct sk_buff *prev;
+ );
__u32 qlen;
spinlock_t lock;
@@ -1929,8 +1931,8 @@ static inline void __skb_insert(struct sk_buff *newsk,
*/
WRITE_ONCE(newsk->next, next);
WRITE_ONCE(newsk->prev, prev);
- WRITE_ONCE(next->prev, newsk);
- WRITE_ONCE(prev->next, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)next)->prev, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)prev)->next, newsk);
WRITE_ONCE(list->qlen, list->qlen + 1);
}
@@ -2026,7 +2028,7 @@ static inline void __skb_queue_after(struct sk_buff_head *list,
struct sk_buff *prev,
struct sk_buff *newsk)
{
- __skb_insert(newsk, prev, prev->next, list);
+ __skb_insert(newsk, prev, ((struct sk_buff_list *)prev)->next, list);
}
void skb_append(struct sk_buff *old, struct sk_buff *newsk,
@@ -2036,7 +2038,7 @@ static inline void __skb_queue_before(struct sk_buff_head *list,
struct sk_buff *next,
struct sk_buff *newsk)
{
- __skb_insert(newsk, next->prev, next, list);
+ __skb_insert(newsk, ((struct sk_buff_list *)next)->prev, next, list);
}
/**
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 998a4ba28eba..938216f8ab7e 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -36,4 +36,52 @@ enum {
#define offsetofend(TYPE, MEMBER) \
(offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
+/**
+ * struct_group() - Wrap a set of declarations in a mirrored struct
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members.
+ */
+#define struct_group(NAME, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, /* no attrs */, MEMBERS)
+
+/**
+ * struct_group_attr() - Create a struct_group() with trailing attributes
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes to apply
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes structure attributes argument.
+ */
+#define struct_group_attr(NAME, ATTRS, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, ATTRS, MEMBERS)
+
+/**
+ * struct_group_tagged() - Create a struct_group with a reusable tag
+ *
+ * @TAG: The tag name for the named sub-struct
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes struct tag argument for the named copy,
+ * so the specified layout can be reused later.
+ */
+#define struct_group_tagged(TAG, NAME, MEMBERS...) \
+ __struct_group(TAG, NAME, /* no attrs */, MEMBERS)
+
#endif
diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
index ee8220f8dcf5..22aa0e2177ea 100644
--- a/include/uapi/linux/stddef.h
+++ b/include/uapi/linux/stddef.h
@@ -4,3 +4,41 @@
#ifndef __always_inline
#define __always_inline inline
#endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse, as well
+ * as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+ struct TAG { MEMBERS } ATTRS NAME; \
+ }
+
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ struct { \
+ struct { } __empty_ ## NAME; \
+ TYPE NAME[]; \
+ }
+
--
2.35.1
syzbot
Mar 29, 2022, 6:43:08 PM3/29/22
to syzkaller-a...@googlegroups.com, tadeus...@linaro.org
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+8ee032...@syzkaller.appspotmail.com
Tested on:
commit: e69c61cf ANDROID: KVM: arm64: iommu: Create parent/chi..
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+8ee032...@syzkaller.appspotmail.com
Tested on:
commit: e69c61cf ANDROID: KVM: arm64: iommu: Create parent/chi..
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=8ee032d1e53aacc92994
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=140662d7700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=8ee032d1e53aacc92994
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Note: testing is done by a robot and is best-effort only.
Tadeusz Struk
Mar 30, 2022, 1:23:20 PM3/30/22
to syzbot, syzkaller-a...@googlegroups.com
On 3/27/22 07:31, syzbot wrote:
Reply all
Reply to author
Forward
0 new messages