Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in sctp_sched_prio_free
BUG: kernel NULL pointer dereference, address: 0000000000000008
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 10e9f2067 P4D 10e9f2067 PUD 10e9fc067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 4081 Comm: syz-executor.0 Not tainted 5.18.0-rc3-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:sctp_sched_prio_free+0x105/0x250 net/sctp/stream_sched_prio.c:221
Code: f7 e5 48 89 d8 48 c1 ea 07 48 89 d1 48 69 d2 aa 00 00 00 48 c1 e1 0c 48 29 d0 48 8d 04 40 4c 8d 2c c1 4c 89 ee e8 1b a5 39 fe <48> 83 78 08 00 74 2f e8 ef 22 3c fd 4c 89 ee 4c 89 e7 e8 04 a5 39
RSP: 0018:ffffc90003edf9e8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888113ef2a80 RSI: ffffffff8233be70 RDI: 0000000000000003
RBP: c0c0c0c0c0c0c0c1 R08: 0000000000000000 R09: 0000000000000004
R10: ffffffff8233be0e R11: 0000000000000000 R12: ffff8881134a4560
R13: 0000000000000000 R14: ffffc90003edf9f0 R15: ffffc90003edfbc0
FS: 000055555753e400(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 00000001134c2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
sctp_stream_free+0x28/0xb0 net/sctp/stream.c:190
sctp_association_free+0xda/0x2a0 net/sctp/associola.c:353
sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:940 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1324 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1195 [inline]
sctp_do_sm+0x1cc9/0x2290 net/sctp/sm_sideeffect.c:1166
sctp_assoc_bh_rcv+0x1e3/0x300 net/sctp/associola.c:1054
sctp_inq_push+0x93/0xc0 net/sctp/inqueue.c:80
sctp_backlog_rcv+0xa2/0x4f0 net/sctp/input.c:344
sk_backlog_rcv include/net/sock.h:1051 [inline]
__release_sock+0xbe/0x140 net/core/sock.c:2794
release_sock+0x32/0xd0 net/core/sock.c:3327
sctp_close+0x212/0x490 net/sctp/socket.c:1533
inet_release+0x7c/0xe0 net/ipv4/af_inet.c:428
inet6_release+0x31/0x50 net/ipv6/af_inet6.c:481
__sock_release+0x47/0xd0 net/socket.c:650
sock_close+0x15/0x20 net/socket.c:1318
__fput+0x105/0x430 fs/file_table.c:317
task_work_run+0x73/0xb0 kernel/task_work.c:164
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
exit_to_user_mode_prepare+0x154/0x160 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff885e3bd2b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd4b38b9b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007ff885e3bd2b
RDX: 00007ff885fa07f0 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007ff885f9d960 R08: 0000000000000000 R09: 00007ff885fa07f8
R10: 00007ffd4b38bab0 R11: 0000000000000293 R12: 000000000000f0f9
R13: 00007ffd4b38bab0 R14: 00007ff885f9bf60 R15: 0000000000000032
</TASK>
Modules linked in:
CR2: 0000000000000008
---[ end trace 0000000000000000 ]---
RIP: 0010:sctp_sched_prio_free+0x105/0x250 net/sctp/stream_sched_prio.c:221
Code: f7 e5 48 89 d8 48 c1 ea 07 48 89 d1 48 69 d2 aa 00 00 00 48 c1 e1 0c 48 29 d0 48 8d 04 40 4c 8d 2c c1 4c 89 ee e8 1b a5 39 fe <48> 83 78 08 00 74 2f e8 ef 22 3c fd 4c 89 ee 4c 89 e7 e8 04 a5 39
RSP: 0018:ffffc90003edf9e8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888113ef2a80 RSI: ffffffff8233be70 RDI: 0000000000000003
RBP: c0c0c0c0c0c0c0c1 R08: 0000000000000000 R09: 0000000000000004
R10: ffffffff8233be0e R11: 0000000000000000 R12: ffff8881134a4560
R13: 0000000000000000 R14: ffffc90003edf9f0 R15: ffffc90003edfbc0
FS: 000055555753e400(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 00000001134c2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: f7 e5 mul %ebp
2: 48 89 d8 mov %rbx,%rax
5: 48 c1 ea 07 shr $0x7,%rdx
9: 48 89 d1 mov %rdx,%rcx
c: 48 69 d2 aa 00 00 00 imul $0xaa,%rdx,%rdx
13: 48 c1 e1 0c shl $0xc,%rcx
17: 48 29 d0 sub %rdx,%rax
1a: 48 8d 04 40 lea (%rax,%rax,2),%rax
1e: 4c 8d 2c c1 lea (%rcx,%rax,8),%r13
22: 4c 89 ee mov %r13,%rsi
25: e8 1b a5 39 fe callq 0xfe39a545
* 2a: 48 83 78 08 00 cmpq $0x0,0x8(%rax) <-- trapping instruction
2f: 74 2f je 0x60
31: e8 ef 22 3c fd callq 0xfd3c2325
36: 4c 89 ee mov %r13,%rsi
39: 4c 89 e7 mov %r12,%rdi
3c: e8 .byte 0xe8
3d: 04 a5 add $0xa5,%al
3f: 39 .byte 0x39
console output:
https://syzkaller.appspot.com/x/log.txt?x=17f1f9dd880000
patch:
https://syzkaller.appspot.com/x/patch.diff?x=120e25dd880000