general protection fault in ucma_set_ib_path (2)

[syzbot]

Hello,

syzbot hit the following crash on upstream commit
642e7fd23353e22290e3d51719fcb658dc252342 (Tue Apr 3 04:22:12 2018 +0000)
Merge branch 'syscalls-next' of
git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=a67bc93e14682d92fc2f

So far this crash happened 3 times on upstream.
C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5952837750095872
syzkaller reproducer:
https://syzkaller.appspot.com/x/repro.syz?id=6196262000918528
Raw console output:
https://syzkaller.appspot.com/x/log.txt?id=4604792739463168
Kernel config:
https://syzkaller.appspot.com/x/.config?id=-6874493495260513980
compiler: gcc (GCC) 7.1.1 20170620

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a67bc9...@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4443 Comm: syzkaller826180 Not tainted 4.16.0+ #377
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:rdma_cap_opa_ah include/rdma/ib_verbs.h:2773 [inline]
RIP: 0010:ucma_set_ib_path.isra.14+0x26a/0x850
drivers/infiniband/core/ucma.c:1249
RSP: 0018:ffff8801da4cf7f0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000029
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000148
RBP: ffff8801da4cf9f0 R08: ffffed003b499f18 R09: ffffffff87b6c65c
R10: 0000000000000002 R11: ffffed003b499f17 R12: ffff8801da4cf8a0
R13: 1ffff1003b499f00 R14: ffff8801d91a11b0 R15: ffff8801d95cadc0
FS: 0000000001ef1880(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 00000001d956e001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ucma_set_option_ib drivers/infiniband/core/ucma.c:1272 [inline]
ucma_set_option_level drivers/infiniband/core/ucma.c:1291 [inline]
ucma_set_option+0x234/0x520 drivers/infiniband/core/ucma.c:1325
ucma_write+0x2d6/0x3d0 drivers/infiniband/core/ucma.c:1656
__vfs_write+0xef/0x970 fs/read_write.c:485
vfs_write+0x189/0x510 fs/read_write.c:549
ksys_write+0xef/0x220 fs/read_write.c:598
SYSC_write fs/read_write.c:610 [inline]
SyS_write+0x24/0x30 fs/read_write.c:607
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x440039
RSP: 002b:00007ffdc2f973a8 EFLAGS: 00000217 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440039
RDX: 0000000000000020 RSI: 0000000020001500 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000217 R12: 0000000000401960
R13: 00000000004019f0 R14: 0000000000000000 R15: 0000000000000000
Code: 00 00 48 c1 ea 03 80 3c 02 00 0f 85 0d 05 00 00 49 8b 07 48 ba 00 00
00 00 00 fc ff df 48 8d b8 48 01 00 00 48 89 f9 48 c1 e9 03 <80> 3c 11 00
0f 85 54 05 00 00 48 c1 e3 04 48 03 98 48 01 00 00
RIP: rdma_cap_opa_ah include/rdma/ib_verbs.h:2773 [inline] RSP:
ffff8801da4cf7f0
RIP: ucma_set_ib_path.isra.14+0x26a/0x850
drivers/infiniband/core/ucma.c:1249 RSP: ffff8801da4cf7f0
---[ end trace 96ad186dbb9ca6d0 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

kernel build failed: failed to run /usr/bin/make [make bzImage -j 32
CC=/syzkaller/gcc/bin/gcc]: exit status 2
scripts/kconfig/conf --silentoldconfig Kconfig
CHK include/config/kernel.release
CHK include/generated/uapi/linux/version.h
SYSTBL arch/x86/include/generated/asm/syscalls_32.h
SYSHDR arch/x86/include/generated/asm/unistd_32_ia32.h
SYSHDR arch/x86/include/generated/uapi/asm/unistd_32.h
UPD include/config/kernel.release
CHK include/generated/utsrelease.h
UPD include/generated/utsrelease.h
DESCEND objtool
CC /syzkaller/jobs/linux/kernel/tools/objtool/check.o
CC /syzkaller/jobs/linux/kernel/tools/objtool/str_error_r.o
CC scripts/mod/empty.o
CC scripts/mod/devicetable-offsets.s
MKELF scripts/mod/elfconfig.h
HOSTCC scripts/mod/modpost.o
HOSTCC scripts/mod/sumversion.o
CC kernel/bounds.s
CHK include/generated/timeconst.h
In file included from ./include/linux/uuid.h:20,
from ./include/linux/mod_devicetable.h:13,
from scripts/mod/devicetable-offsets.c:3:
./include/linux/string.h:9:10: fatal error: stdarg.h: No such file or
directory
#include <stdarg.h>
^~~~~~~~~~
compilation terminated.
In file included from ./include/asm-generic/bug.h:18,
from ./arch/x86/include/asm/bug.h:83,
from ./include/linux/bug.h:5,
from ./include/linux/page-flags.h:10,
from kernel/bounds.c:10:
./include/linux/kernel.h:6:10: fatal error: stdarg.h: No such file or
directory
#include <stdarg.h>
^~~~~~~~~~
compilation terminated.
scripts/Makefile.build:150: recipe for
target 'scripts/mod/devicetable-offsets.s' failed
make[2]: *** [scripts/mod/devicetable-offsets.s] Error 1
make[2]: *** Waiting for unfinished jobs....
Kbuild:21: recipe for target 'kernel/bounds.s' failed
make[1]: *** [kernel/bounds.s] Error 1
Makefile:1098: recipe for target 'prepare0' failed
make: *** [prepare0] Error 2
make: *** Waiting for unfinished jobs....
scripts/Makefile.build:583: recipe for target 'scripts/mod' failed
make[1]: *** [scripts/mod] Error 2
Makefile:565: recipe for target 'scripts' failed
make: *** [scripts] Error 2
LD /syzkaller/jobs/linux/kernel/tools/objtool/objtool-in.o
LINK /syzkaller/jobs/linux/kernel/tools/objtool/objtool



Tested on upstream commit
f2d285669aae656dfeafa0bf25e86bbbc5d22329 (Tue Apr 3 17:45:39 2018 +0000)
Merge tag 'pm-4.17-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

compiler: gcc (GCC) 8.0.1 20180301 (experimental)
Patch: https://syzkaller.appspot.com/x/patch.diff?id=5702084942888960

[Dmitry Vyukov]

Hi Roland,

This is a transient error due to a bad compiler update. Should be
fixed soon. Sorry for that.

> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-bugs/001a11c1461cfbebd60568f65acd%40google.com.
>
> For more options, visit https://groups.google.com/d/optout.

[Dmitry Vyukov]

On Tue, Apr 3, 2018 at 9:12 PM, Dmitry Vyukov <dvy...@google.com> wrote:
> Hi Roland,
>
> This is a transient error due to a bad compiler update. Should be
> fixed soon. Sorry for that.

Let's try this again, should be fixed now.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

kernel build failed: failed to run /usr/bin/make [make bzImage -j 32
CC=/syzkaller/gcc/bin/gcc]: exit status 2
scripts/kconfig/conf --silentoldconfig Kconfig
CHK include/config/kernel.release
CHK include/generated/uapi/linux/version.h

DESCEND objtool
CHK include/generated/utsrelease.h
CC scripts/mod/devicetable-offsets.s
gcc: error: unrecognized command line option
‘-fsanitize-coverage=trace-cmp’; did you mean
‘-fsanitize-coverage=trace-pc’?

scripts/Makefile.build:150: recipe for
target 'scripts/mod/devicetable-offsets.s' failed
make[2]: *** [scripts/mod/devicetable-offsets.s] Error 1

scripts/Makefile.build:583: recipe for target 'scripts/mod' failed
make[1]: *** [scripts/mod] Error 2
Makefile:565: recipe for target 'scripts' failed
make: *** [scripts] Error 2
make: *** Waiting for unfinished jobs....

Tested on upstream commit
e40dc66220b7ff1b816311b135b9298f8ba14ce6 (Tue Apr 3 19:38:19 2018 +0000)
Merge tag 'leds_for_4.17-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds

compiler: gcc (GCC) 7.1.1 20170620

Patch: https://syzkaller.appspot.com/x/patch.diff?id=5755931753185280

[Roland Dreier]

On Tue, Apr 3, 2018 at 1:41 PM, syzbot
<syzbot+a67bc9...@syzkaller.appspotmail.com> wrote:
> CC scripts/mod/devicetable-offsets.s
> gcc: error: unrecognized command line option
> ‘-fsanitize-coverage=trace-cmp’; did you mean
> ‘-fsanitize-coverage=trace-pc’?
> scripts/Makefile.build:150: recipe for target
> 'scripts/mod/devicetable-offsets.s' failed

Looks like another toolchain issue?

- R.

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

kernel build failed: failed to run /usr/bin/make [make bzImage -j 32
CC=/syzkaller/gcc/bin/gcc]: exit status 2
scripts/kconfig/conf --silentoldconfig Kconfig
CHK include/config/kernel.release
CHK include/generated/uapi/linux/version.h
DESCEND objtool
CHK include/generated/utsrelease.h

CC scripts/mod/devicetable-offsets.s
gcc: error: unrecognized command line option
‘-fsanitize-coverage=trace-cmp’; did you mean
‘-fsanitize-coverage=trace-pc’?
scripts/Makefile.build:150: recipe for
target 'scripts/mod/devicetable-offsets.s' failed

make[2]: *** [scripts/mod/devicetable-offsets.s] Error 1
scripts/Makefile.build:583: recipe for target 'scripts/mod' failed
make[1]: *** [scripts/mod] Error 2
Makefile:565: recipe for target 'scripts' failed
make: *** [scripts] Error 2
make: *** Waiting for unfinished jobs....

CC kernel/bounds.s
CHK include/generated/timeconst.h

gcc: error: unrecognized command line option
‘-fsanitize-coverage=trace-cmp’; did you mean
‘-fsanitize-coverage=trace-pc’?

Kbuild:21: recipe for target 'kernel/bounds.s' failed
make[1]: *** [kernel/bounds.s] Error 1

make[1]: *** Waiting for unfinished jobs....

Makefile:1098: recipe for target 'prepare0' failed
make: *** [prepare0] Error 2

Tested on upstream commit
e40dc66220b7ff1b816311b135b9298f8ba14ce6 (Tue Apr 3 19:38:19 2018 +0000)
Merge tag 'leds_for_4.17-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds

compiler: gcc (GCC) 7.1.1 20170620

Patch: https://syzkaller.appspot.com/x/patch.diff?id=4798420334149632

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger
crash:

Reported-and-tested-by:
syzbot+a67bc9...@syzkaller.appspotmail.com

Note: the tag will also help syzbot to understand when the bug is fixed.

Tested on
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/v4.16
commit
0adb32858b0bddf4ada5f364a84ed60b196dbcda (Sun Apr 1 21:20:27 2018 +0000)
Linux 4.16

compiler: gcc (GCC) 7.1.1 20170620

Patch: https://syzkaller.appspot.com/x/patch.diff?id=5356155056422912
Kernel config:
https://syzkaller.appspot.com/x/.config?id=4966055677321908065


---
There is no WARRANTY for the result, to the extent permitted by applicable
law.
Except when otherwise stated in writing syzbot provides the result "AS IS"
without warranty of any kind, either expressed or implied, but not limited
to,
the implied warranties of merchantability and fittness for a particular
purpose.
The entire risk as to the quality of the result is with you. Should the
result
prove defective, you assume the cost of all necessary servicing, repair or
correction.

[Dmitry Vyukov]

Turned out to be some make problem, distclean healed it. Once again to
make sure:

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/syzkaller-bugs/00000000000088e5f60568f91bd8%40google.com.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger
crash:

Reported-and-tested-by:
syzbot+a67bc9...@syzkaller.appspotmail.com

Note: the tag will also help syzbot to understand when the bug is fixed.

Tested on upstream commit
06dd3dfeea60e2a6457a6aedf97afc8e6d2ba497 (Thu Apr 5 03:07:20 2018 +0000)
Merge tag 'char-misc-4.17-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

compiler: gcc (GCC) 8.0.1 20180301 (experimental)

Patch: https://syzkaller.appspot.com/x/patch.diff?id=5114623879544832
Kernel config: https://syzkaller.appspot.com/x/.config?id=216543573824217049