general protection fault in tcf_generic_walker

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ad2b9b0f tcp: skip DSACKs with dubious sequence ranges
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=13baee3d900000
kernel config: https://syzkaller.appspot.com/x/.config?x=5f4c828c9e3cef97
dashboard link: https://syzkaller.appspot.com/bug?extid=b47bc4f247856fb4d9e1
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b47bc4...@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 PID: 22478 Comm: syz-executor.4 Not tainted 5.9.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:tcf_dump_walker net/sched/act_api.c:240 [inline]
RIP: 0010:tcf_generic_walker+0x367/0xba0 net/sched/act_api.c:343
Code: 24 31 ff 48 89 de e8 b8 6c ed fa 48 85 db 74 3f e8 2e 70 ed fa 48 8d 7d 30 48 b9 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 26 07 00 00 48 8b 5d 30 31 ff 48 2b 1c 24 48 89
RSP: 0018:ffffc90006657268 EFLAGS: 00010202
RAX: 0000000000000004 RBX: c000000100004f6c RCX: dffffc0000000000
RDX: 0000000000040000 RSI: ffffffff8688ce12 RDI: 0000000000000020
RBP: fffffffffffffff0 R08: 0000000000000000 R09: ffff8880a6270207
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809d5c3d40
R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000
FS: 00007f9807b99700(0000) GS:ffff8880ae400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f01a8629db8 CR3: 00000000553cb000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
tc_dump_action+0x6d5/0xe60 net/sched/act_api.c:1623
netlink_dump+0x4cd/0xf60 net/netlink/af_netlink.c:2246
__netlink_dump_start+0x643/0x900 net/netlink/af_netlink.c:2354
netlink_dump_start include/linux/netlink.h:246 [inline]
rtnetlink_rcv_msg+0x70f/0xad0 net/core/rtnetlink.c:5526
netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2470
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:671
____sys_sendmsg+0x331/0x810 net/socket.c:2353
___sys_sendmsg+0xf3/0x170 net/socket.c:2407
__sys_sendmmsg+0x195/0x480 net/socket.c:2497
__do_sys_sendmmsg net/socket.c:2526 [inline]
__se_sys_sendmmsg net/socket.c:2523 [inline]
__x64_sys_sendmmsg+0x99/0x100 net/socket.c:2523
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e179
Code: 3d b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f9807b98c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000027f40 RCX: 000000000045e179
RDX: 049249249249252e RSI: 0000000020000140 RDI: 0000000000000003
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff4792d6cf R14: 00007f9807b999c0 R15: 000000000118cf4c
Modules linked in:
---[ end trace dd2fc9d645cefc73 ]---
RIP: 0010:tcf_dump_walker net/sched/act_api.c:240 [inline]
RIP: 0010:tcf_generic_walker+0x367/0xba0 net/sched/act_api.c:343
Code: 24 31 ff 48 89 de e8 b8 6c ed fa 48 85 db 74 3f e8 2e 70 ed fa 48 8d 7d 30 48 b9 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 26 07 00 00 48 8b 5d 30 31 ff 48 2b 1c 24 48 89
RSP: 0018:ffffc90006657268 EFLAGS: 00010202
RAX: 0000000000000004 RBX: c000000100004f6c RCX: dffffc0000000000
RDX: 0000000000040000 RSI: ffffffff8688ce12 RDI: 0000000000000020
RBP: fffffffffffffff0 R08: 0000000000000000 R09: ffff8880a6270207
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809d5c3d40
R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000
FS: 00007f9807b99700(0000) GS:ffff8880ae400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000016a9e60 CR3: 00000000553cb000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 2b3e981a Merge branch 'mptcp-Fix-for-32-bit-DATA_FIN'
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=16537247900000
kernel config: https://syzkaller.appspot.com/x/.config?x=99a7c78965c75e07

dashboard link: https://syzkaller.appspot.com/bug?extid=b47bc4f247856fb4d9e1
compiler: gcc (GCC) 10.1.0-syz 20200507

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1412a5a7900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b47bc4...@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]

CPU: 0 PID: 8855 Comm: syz-executor.1 Not tainted 5.9.0-rc6-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:tcf_dump_walker net/sched/act_api.c:240 [inline]
RIP: 0010:tcf_generic_walker+0x367/0xba0 net/sched/act_api.c:343

Code: 24 31 ff 48 89 de e8 c8 55 eb fa 48 85 db 74 3f e8 3e 59 eb fa 48 8d 7d 30 48 b9 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 26 07 00 00 48 8b 5d 30 31 ff 48 2b 1c 24 48 89
RSP: 0018:ffffc9000b6ff3a8 EFLAGS: 00010202
RAX: 0000000000000004 RBX: c0000000ffffaae4 RCX: dffffc0000000000
RDX: ffff8880a82aa140 RSI: ffffffff868ae502 RDI: 0000000000000020
RBP: fffffffffffffff0 R08: 0000000000000000 R09: ffff8880a8c41e07
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809f226340

R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000

FS: 00007f156f7fa700(0000) GS:ffff8880ae400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055d25128b348 CR3: 00000000a7d3d000 CR4: 00000000001506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

tc_dump_action+0x6d5/0xe60 net/sched/act_api.c:1609

netlink_dump+0x4cd/0xf60 net/netlink/af_netlink.c:2246
__netlink_dump_start+0x643/0x900 net/netlink/af_netlink.c:2354
netlink_dump_start include/linux/netlink.h:246 [inline]
rtnetlink_rcv_msg+0x70f/0xad0 net/core/rtnetlink.c:5526
netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2470
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:671

____sys_sendmsg+0x6e8/0x810 net/socket.c:2353
___sys_sendmsg+0xf3/0x170 net/socket.c:2407
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2440
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45dd99
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f156f7f9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000002d3c0 RCX: 000000000045dd99
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000005
RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c
R13: 00007ffc8f863a6f R14: 00007f156f7fa9c0 R15: 000000000118bf2c
Modules linked in:
---[ end trace 5123f6b953bfe0e8 ]---

RIP: 0010:tcf_dump_walker net/sched/act_api.c:240 [inline]
RIP: 0010:tcf_generic_walker+0x367/0xba0 net/sched/act_api.c:343

Code: 24 31 ff 48 89 de e8 c8 55 eb fa 48 85 db 74 3f e8 3e 59 eb fa 48 8d 7d 30 48 b9 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 26 07 00 00 48 8b 5d 30 31 ff 48 2b 1c 24 48 89
RSP: 0018:ffffc9000b6ff3a8 EFLAGS: 00010202
RAX: 0000000000000004 RBX: c0000000ffffaae4 RCX: dffffc0000000000
RDX: ffff8880a82aa140 RSI: ffffffff868ae502 RDI: 0000000000000020
RBP: fffffffffffffff0 R08: 0000000000000000 R09: ffff8880a8c41e07
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809f226340

R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000

FS: 00007f156f7fa700(0000) GS:ffff8880ae400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055d251258ed8 CR3: 00000000a7d3d000 CR4: 00000000001506f0

[Cong Wang]

Probably just need another IS_ERR() check on the dump path.
I will take a second look.

Thanks.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in tcf_generic_walker

general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]

CPU: 0 PID: 11950 Comm: syz-executor.1 Not tainted 5.9.0-rc6-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:tcf_dump_walker net/sched/act_api.c:240 [inline]
RIP: 0010:tcf_generic_walker+0x367/0xba0 net/sched/act_api.c:343

Code: 24 31 ff 48 89 de e8 88 67 eb fa 48 85 db 74 3f e8 fe 6a eb fa 48 8d 7d 30 48 b9 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 26 07 00 00 48 8b 5d 30 31 ff 48 2b 1c 24 48 89
RSP: 0018:ffffc900065b73a8 EFLAGS: 00010202
RAX: 0000000000000004 RBX: c0000000ffffb196 RCX: dffffc0000000000
RDX: ffff888081abc140 RSI: ffffffff868ad342 RDI: 0000000000000020
RBP: fffffffffffffff0 R08: 0000000000000000 R09: ffff88808f069807
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888080eb7d40

R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000

FS: 00007f13937f7700(0000) GS:ffff8880ae400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000000000401e20 CR3: 00000000a15f7000 CR4: 00000000001506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

tc_dump_action+0x6d5/0xe60 net/sched/act_api.c:1638

netlink_dump+0x4cd/0xf60 net/netlink/af_netlink.c:2246
__netlink_dump_start+0x643/0x900 net/netlink/af_netlink.c:2354
netlink_dump_start include/linux/netlink.h:246 [inline]
rtnetlink_rcv_msg+0x70f/0xad0 net/core/rtnetlink.c:5526
netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2470
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:671
____sys_sendmsg+0x6e8/0x810 net/socket.c:2353
___sys_sendmsg+0xf3/0x170 net/socket.c:2407
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2440
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45dd99
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00

RSP: 002b:00007f13937f6c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e

RAX: ffffffffffffffda RBX: 000000000002d3c0 RCX: 000000000045dd99
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000005
RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c

R13: 00007ffd4844476f R14: 00007f13937f79c0 R15: 000000000118bf2c
Modules linked in:
---[ end trace c89f84ff9d4eabc1 ]---

RIP: 0010:tcf_dump_walker net/sched/act_api.c:240 [inline]
RIP: 0010:tcf_generic_walker+0x367/0xba0 net/sched/act_api.c:343

Code: 24 31 ff 48 89 de e8 88 67 eb fa 48 85 db 74 3f e8 fe 6a eb fa 48 8d 7d 30 48 b9 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 26 07 00 00 48 8b 5d 30 31 ff 48 2b 1c 24 48 89
RSP: 0018:ffffc900065b73a8 EFLAGS: 00010202
RAX: 0000000000000004 RBX: c0000000ffffb196 RCX: dffffc0000000000
RDX: ffff888081abc140 RSI: ffffffff868ad342 RDI: 0000000000000020
RBP: fffffffffffffff0 R08: 0000000000000000 R09: ffff88808f069807
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888080eb7d40

R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000

FS: 00007f13937f7700(0000) GS:ffff8880ae400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000056182aa85160 CR3: 00000000a15f7000 CR4: 00000000001506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Tested on:

commit: d5b70379 request_module()
git tree: https://github.com/congwang/linux.git net
console output: https://syzkaller.appspot.com/x/log.txt?x=1608bde3900000

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+b47bc4...@syzkaller.appspotmail.com

Tested on:

commit: 031113c9 net_sched: check error pointer in tcf_dump_walker()

git tree: https://github.com/congwang/linux.git net

kernel config: https://syzkaller.appspot.com/x/.config?x=99a7c78965c75e07
dashboard link: https://syzkaller.appspot.com/bug?extid=b47bc4f247856fb4d9e1
compiler: gcc (GCC) 10.1.0-syz 20200507

Note: testing is done by a robot and is best-effort only.