general protection fault in rds_ib_get_mr

[syzbot]

Hello,

syzbot hit the following crash on upstream commit
3215b9d57a2c75c4305a3956ca303d7004485200 (Wed Mar 21 00:44:27 2018 +0000)
Merge tag 'clk-fixes-for-linus' of
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=b51c77ef956678a65834

So far this crash happened 4 times on net-next, upstream.
C reproducer is attached.
syzkaller reproducer is attached.
Raw console output is attached.
compiler: gcc (GCC) 7.1.1 20170620
.config is attached.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b51c77...@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

audit: type=1400 audit(1521615317.627:7): avc: denied { map } for
pid=4240 comm="syzkaller468044" path="/root/syzkaller468044973" dev="sda1"
ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4244 Comm: syzkaller468044 Not tainted 4.16.0-rc6+ #361
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:rds_ib_get_mr+0x5c/0x230 net/rds/ib_rdma.c:544
RSP: 0018:ffff8801b059f890 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8801b07e1300 RCX: ffffffff8562d96e
RDX: 000000000000000d RSI: 0000000000000001 RDI: 0000000000000068
RBP: ffff8801b059f8b8 R08: ffffed0036274244 R09: ffff8801b13a1200
R10: 0000000000000004 R11: ffffed0036274243 R12: ffff8801b13a1200
R13: 0000000000000001 R14: ffff8801ca09fa9c R15: 0000000000000000
FS: 00007f4d050af700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4d050aee78 CR3: 00000001b0d9b006 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__rds_rdma_map+0x710/0x1050 net/rds/rdma.c:271
rds_get_mr_for_dest+0x1d4/0x2c0 net/rds/rdma.c:357
rds_setsockopt+0x6cc/0x980 net/rds/af_rds.c:347
SYSC_setsockopt net/socket.c:1849 [inline]
SyS_setsockopt+0x189/0x360 net/socket.c:1828
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4456d9
RSP: 002b:00007f4d050aedb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000006dac3c RCX: 00000000004456d9
RDX: 0000000000000007 RSI: 0000000000000114 RDI: 0000000000000004
RBP: 00000000006dac38 R08: 00000000000000a0 R09: 0000000000000000
R10: 0000000020000380 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffbfb36d6f R14: 00007f4d050af9c0 R15: 0000000000000005
Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 cc 01 00 00 4c 8b bb 80 04 00 00 48
b8 00 00 00 00 00 fc ff df 49 8d 7f 68 48 89 fa 48 c1 ea 03 <80> 3c 02 00
0f 85 9c 01 00 00 4d 8b 7f 68 48 b8 00 00 00 00 00
RIP: rds_ib_get_mr+0x5c/0x230 net/rds/ib_rdma.c:544 RSP: ffff8801b059f890
---[ end trace 7e1cea13b85473b0 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.

[Eric Biggers]

Still reproducible on Linus' tree (commit 66e1c94db3cd4) and linux-next
(next-20180511). Here's a simplified reproducer:

#include <linux/rds.h>
#include <netinet/in.h>
#include <unistd.h>

int main()
{
int transport = RDS_TRANS_IB;
int fd;

fd = socket(AF_RDS, SOCK_SEQPACKET, 0);
setsockopt(fd, SOL_RDS, SO_RDS_TRANSPORT, &transport, sizeof(transport));

if (fork()) {
for (;;) {
struct sockaddr_in addr = {
.sin_family = AF_INET,
.sin_port = 0,
.sin_addr = { htobe32(0x7f000001) },
};
bind(fd, (struct sockaddr *)&addr, sizeof(addr));
}
} else {
for (;;) {
char buf[128] = { 0 };
struct rds_get_mr_for_dest_args args = {
.vec = {
.addr = (unsigned long)buf,
.bytes = sizeof(buf),
},
};

setsockopt(fd, SOL_RDS, RDS_GET_MR_FOR_DEST, &args, sizeof(args));
}
}
}

BUG: unable to handle kernel NULL pointer dereference at 0000000000000068
PGD 0 P4D 0
Oops: 0000 [#1] SMP
CPU: 4 PID: 224 Comm: syz_rdma Not tainted 4.17.0-rc4-next-20180511 #40
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
RIP: 0010:rds_ib_get_mr+0x23/0xb0 net/rds/ib_rdma.c:547
Code: 93 5a a6 ff 5b 5d c3 55 48 89 e5 41 57 49 89 cf 41 56 41 55 49 89 f5 41 54 49 89 fc 53 48 8b 82 68 04 00 00 8b ba 50 04 00 00 <48> 8b 40 68 4c 8b b0 98 00 00 00 e8 fd ef ff ff 48 85 c0 0f 84 a6
RSP: 0018:ffffb39f4088fd10 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8c69f8f05a80 RCX: ffff8c69f986f49c
RDX: ffff8c69f8d75840 RSI: 0000000000000002 RDI: 000000000100007f
RBP: ffffb39f4088fd38 R08: ffff8c69f9a1a980 R09: 0000000000000002
R10: 0000000087654321 R11: 0000000000000000 R12: ffff8c69f8f05a80
R13: 0000000000000002 R14: ffff8c69f986f480 R15: ffff8c69f986f49c
FS: 00007f140caf4740(0000) GS:ffff8c69ffd00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000000000000068 CR3: 0000000078c2d000 CR4: 00000000003406e0
Call Trace:
__rds_rdma_map+0x36f/0x4c0 net/rds/rdma.c:271
rds_get_mr_for_dest+0x84/0xb0 net/rds/rdma.c:357
rds_setsockopt+0x176/0x360 net/rds/af_rds.c:350
__sys_setsockopt+0x6d/0xd0 net/socket.c:1910
__do_sys_setsockopt net/socket.c:1921 [inline]
__se_sys_setsockopt net/socket.c:1918 [inline]
__x64_sys_setsockopt+0x1f/0x30 net/socket.c:1918
do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f140c1fd20a
Code: 9c 2b 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e6 9b 2b 00 f7 d8 64 89 01 48
RSP: 002b:00007fffcaa06f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007fffcaa06f30 RCX: 00007f140c1fd20a
RDX: 0000000000000007 RSI: 0000000000000114 RDI: 0000000000000003
RBP: 00007fffcaa06fd0 R08: 00000000000000a0 R09: 00007f140c8da010
R10: 00007fffcaa06f30 R11: 0000000000000246 R12: 0000000000000003
R13: 00007fffcaa06f30 R14: 0000000000000000 R15: 0000000000000000
CR2: 0000000000000068
---[ end trace fd75e4e4e9b87576 ]---

[santosh....@oracle.com]

On 5/13/18 2:10 PM, Eric Biggers wrote:
> On Wed, Mar 21, 2018 at 09:00:01AM -0700, syzbot wrote:

[...]

> Still reproducible on Linus' tree (commit 66e1c94db3cd4) and linux-next
> (next-20180511). Here's a simplified reproducer:
>

Thanks for the test case !!

Regards,
Santosh

[Eric Biggers]

Ping; this RDS bug is still unfixed. The same reproducer I gave earlier still
works, even when run as a non-root user. I tested upstream commit
fc36def997cfd6 (v4.18-rc3-113-gfc36def997cfd), and linux-next commit
bce40927669338 (next-20180704).

- Eric

[santosh....@oracle.com]

On 7/4/18 2:35 PM, Eric Biggers wrote:
> On Sun, May 13, 2018 at 10:46:37PM -0700, santosh....@oracle.com wrote:
>> On 5/13/18 2:10 PM, Eric Biggers wrote:
>>> On Wed, Mar 21, 2018 at 09:00:01AM -0700, syzbot wrote:
>>
>> [...]
>>
>>
>>> Still reproducible on Linus' tree (commit 66e1c94db3cd4) and linux-next
>>> (next-20180511). Here's a simplified reproducer:
>>>
>> Thanks for the test case !!
>>

[...]

>
> Ping; this RDS bug is still unfixed. The same reproducer I gave earlier still
> works, even when run as a non-root user. I tested upstream commit
> fc36def997cfd6 (v4.18-rc3-113-gfc36def997cfd), and linux-next commit
> bce40927669338 (next-20180704).
>

Yeah I haven't sent a fix for this yet. Downstream we have refactored
MR code and I wanted to get that upstream. With that this bug will
also get addressed. I was hoping to get that series but since some
optimisation is still pending investigations its getting delayed.

Will find out if I can fix this panic in meantime with smaller change.
Thanks for reminder.

Regards,
Santosh

[Johannes Thumshirn]

Oh please sent bug fixes _before_ refactoring in that area. Otherwise
it's a pain for everybody backporting the fix to a stable kernel.

Thanks,
Johannes
--
Johannes Thumshirn Storage
jthum...@suse.de +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850

[Santosh Shilimkar]

On 7/5/2018 12:06 AM, Johannes Thumshirn wrote:
> On Wed, Jul 04, 2018 at 05:32:20PM -0700, santosh....@oracle.com wrote:
>> On 7/4/18 2:35 PM, Eric Biggers wrote:
>>> On Sun, May 13, 2018 at 10:46:37PM -0700, santosh....@oracle.com wrote:
>>>> On 5/13/18 2:10 PM, Eric Biggers wrote:
>>>>> On Wed, Mar 21, 2018 at 09:00:01AM -0700, syzbot wrote:
>>>>
>>>> [...]
>>>>
>>>>
>>>>> Still reproducible on Linus' tree (commit 66e1c94db3cd4) and linux-next
>>>>> (next-20180511). Here's a simplified reproducer:
>>>>>
>>>> Thanks for the test case !!
>>>>
>>
>> [...]
>>
>>>
>>> Ping; this RDS bug is still unfixed. The same reproducer I gave earlier still
>>> works, even when run as a non-root user. I tested upstream commit
>>> fc36def997cfd6 (v4.18-rc3-113-gfc36def997cfd), and linux-next commit
>>> bce40927669338 (next-20180704).
>>>
>> Yeah I haven't sent a fix for this yet. Downstream we have refactored
>> MR code and I wanted to get that upstream. With that this bug will
>> also get addressed. I was hoping to get that series but since some
>> optimisation is still pending investigations its getting delayed.
>>
>> Will find out if I can fix this panic in meantime with smaller change.
>> Thanks for reminder.
>
> Oh please sent bug fixes _before_ refactoring in that area. Otherwise
> it's a pain for everybody backporting the fix to a stable kernel.
>

OK. we will look into it if an interim fix can be made....

[Johannes Thumshirn]

On Thu, Jul 05, 2018 at 09:09:44AM -0700, Santosh Shilimkar wrote:
> OK. we will look into it if an interim fix can be made....

Thanks a lot.

[santosh....@oracle.com]

On 7/6/18 1:11 AM, Johannes Thumshirn wrote:
> On Thu, Jul 05, 2018 at 09:09:44AM -0700, Santosh Shilimkar wrote:
>> OK. we will look into it if an interim fix can be made....
>
> Thanks a lot.
>

Intermediate fix is posted here [1]

Regards,
Santosh

[1] https://patchwork.ozlabs.org/patch/949010/

[Johannes Thumshirn]

Thanks,