[v5.15] WARNING in sock_map_delete_elem
0 views
Skip to first unread message
syzbot
Mar 14, 2024, 3:46:24 PMMar 14
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 574362648507 Linux 5.15.151
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15a07ca5180000
kernel config: https://syzkaller.appspot.com/x/.config?x=6c9a42d9e3519ca9
dashboard link: https://syzkaller.appspot.com/bug?extid=3731df9e87e5cf890e25
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16574cc9180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=166e5fae180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f00d4062000b/disk-57436264.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3a74c2b6ca62/vmlinux-57436264.xz
kernel image: https://storage.googleapis.com/syzbot-assets/93bd706dc219/bzImage-57436264.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3731df...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3500 at kernel/softirq.c:363 __local_bh_enable_ip+0x1b3/0x1f0
Modules linked in:
CPU: 0 PID: 3500 Comm: syz-executor388 Not tainted 5.15.151-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
RIP: 0010:__local_bh_enable_ip+0x1b3/0x1f0 kernel/softirq.c:363
Code: 04 25 28 00 00 00 48 3b 44 24 60 75 4a 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b e9 d0 fe ff ff e8 3f 00 00 00 eb a2 <0f> 0b e9 02 ff ff ff 48 c7 c1 84 c0 e3 8d 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc900020a75a0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff92000414eb8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff884e695b
RBP: ffffc900020a7658 R08: dffffc0000000000 R09: ffffed100f6774b6
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff888024b4e180 R14: ffffc900020a75e0 R15: 0000000000000201
FS: 000055555752c380(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9f4d513130 CR3: 0000000071899000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__sock_map_delete net/core/sock_map.c:426 [inline]
sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
bpf_prog_2c29ac5cdc6b1842+0x3a/0xd04
bpf_dispatcher_nop_func include/linux/bpf.h:780 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
__bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
__traceiter_kmem_cache_free+0x2e/0x50 include/trace/events/kmem.h:138
trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
kmem_cache_free+0x1ce/0x1f0 mm/slub.c:3516
__exit_signal kernel/exit.c:206 [inline]
release_task+0x1204/0x1750 kernel/exit.c:246
wait_task_zombie kernel/exit.c:1179 [inline]
wait_consider_task+0x1994/0x2e50 kernel/exit.c:1406
do_wait_thread kernel/exit.c:1469 [inline]
do_wait+0x30c/0xaf0 kernel/exit.c:1586
kernel_wait4+0x29e/0x3e0 kernel/exit.c:1749
__do_sys_wait4 kernel/exit.c:1777 [inline]
__se_sys_wait4 kernel/exit.c:1773 [inline]
__x64_sys_wait4+0x130/0x1e0 kernel/exit.c:1773
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f9f4d4968f3
Code: fe ff e9 41 ff ff ff 31 c9 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 80 3d 91 a7 07 00 00 49 89 ca 74 14 b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5d c3 0f 1f 40 00 48 83 ec 28 89 54 24 14 48
RSP: 002b:00007fffdf066eb8 EFLAGS: 00000202 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000000db2 RCX: 00007f9f4d4968f3
RDX: 0000000040000001 RSI: 00007fffdf066ecc RDI: 00000000ffffffff
RBP: 00000000000f4240 R08: 00007fffdf18a0b0 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000a3d7
R13: 00007fffdf066ecc R14: 00007fffdf066ee0 R15: 00007fffdf066ed0
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 574362648507 Linux 5.15.151
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15a07ca5180000
kernel config: https://syzkaller.appspot.com/x/.config?x=6c9a42d9e3519ca9
dashboard link: https://syzkaller.appspot.com/bug?extid=3731df9e87e5cf890e25
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16574cc9180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=166e5fae180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f00d4062000b/disk-57436264.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3a74c2b6ca62/vmlinux-57436264.xz
kernel image: https://storage.googleapis.com/syzbot-assets/93bd706dc219/bzImage-57436264.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3731df...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3500 at kernel/softirq.c:363 __local_bh_enable_ip+0x1b3/0x1f0
Modules linked in:
CPU: 0 PID: 3500 Comm: syz-executor388 Not tainted 5.15.151-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
RIP: 0010:__local_bh_enable_ip+0x1b3/0x1f0 kernel/softirq.c:363
Code: 04 25 28 00 00 00 48 3b 44 24 60 75 4a 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b e9 d0 fe ff ff e8 3f 00 00 00 eb a2 <0f> 0b e9 02 ff ff ff 48 c7 c1 84 c0 e3 8d 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc900020a75a0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff92000414eb8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff884e695b
RBP: ffffc900020a7658 R08: dffffc0000000000 R09: ffffed100f6774b6
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff888024b4e180 R14: ffffc900020a75e0 R15: 0000000000000201
FS: 000055555752c380(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9f4d513130 CR3: 0000000071899000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__sock_map_delete net/core/sock_map.c:426 [inline]
sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
bpf_prog_2c29ac5cdc6b1842+0x3a/0xd04
bpf_dispatcher_nop_func include/linux/bpf.h:780 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918
__bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
__traceiter_kmem_cache_free+0x2e/0x50 include/trace/events/kmem.h:138
trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
kmem_cache_free+0x1ce/0x1f0 mm/slub.c:3516
__exit_signal kernel/exit.c:206 [inline]
release_task+0x1204/0x1750 kernel/exit.c:246
wait_task_zombie kernel/exit.c:1179 [inline]
wait_consider_task+0x1994/0x2e50 kernel/exit.c:1406
do_wait_thread kernel/exit.c:1469 [inline]
do_wait+0x30c/0xaf0 kernel/exit.c:1586
kernel_wait4+0x29e/0x3e0 kernel/exit.c:1749
__do_sys_wait4 kernel/exit.c:1777 [inline]
__se_sys_wait4 kernel/exit.c:1773 [inline]
__x64_sys_wait4+0x130/0x1e0 kernel/exit.c:1773
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f9f4d4968f3
Code: fe ff e9 41 ff ff ff 31 c9 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 80 3d 91 a7 07 00 00 49 89 ca 74 14 b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5d c3 0f 1f 40 00 48 83 ec 28 89 54 24 14 48
RSP: 002b:00007fffdf066eb8 EFLAGS: 00000202 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000000db2 RCX: 00007f9f4d4968f3
RDX: 0000000040000001 RSI: 00007fffdf066ecc RDI: 00000000ffffffff
RBP: 00000000000f4240 R08: 00007fffdf18a0b0 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000a3d7
R13: 00007fffdf066ecc R14: 00007fffdf066ee0 R15: 00007fffdf066ed0
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Mar 14, 2024, 4:08:27 PMMar 14
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 61adba85cc40 Linux 6.1.81
syzbot found the following issue on:
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12454b11180000
kernel config: https://syzkaller.appspot.com/x/.config?x=41dc7343796eb054
dashboard link: https://syzkaller.appspot.com/bug?extid=c8f2e144ac0887001c53
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127f0185180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1479a831180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/15f4df42f73e/disk-61adba85.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/773cd7f79956/vmlinux-61adba85.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6455b0fc2f11/bzImage-61adba85.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3546 at kernel/softirq.c:376 __local_bh_enable_ip+0x1b3/0x1f0
Modules linked in:
CPU: 1 PID: 3546 Comm: syz-executor401 Not tainted 6.1.81-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
RIP: 0010:__local_bh_enable_ip+0x1b3/0x1f0 kernel/softirq.c:376
Code: 04 25 28 00 00 00 48 3b 44 24 60 75 4a 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b e9 d0 fe ff ff e8 3f 00 00 00 eb a2 <0f> 0b e9 02 ff ff ff 48 c7 c1 64 94 73 8e 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc90003aff5c0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff9200075febc RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff88974e3b
RBP: ffffc90003aff678 R08: dffffc0000000000 R09: ffffed100f66ad46
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff88802773a000 R14: ffffc90003aff600 R15: 0000000000000201
FS: 0000555556808380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f81a6241130 CR3: 0000000076b8e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__sock_map_delete net/core/sock_map.c:426 [inline]
sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
bpf_prog_2c29ac5cdc6b1842+0x3a/0x3e
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__sock_map_delete net/core/sock_map.c:426 [inline]
sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448
bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
__bpf_prog_run include/linux/filter.h:600 [inline]
bpf_prog_run include/linux/filter.h:607 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
bpf_trace_run3+0x231/0x440 kernel/trace/bpf_trace.c:2313
__bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:114
__traceiter_kmem_cache_free+0x2e/0x50 include/trace/events/kmem.h:114
trace_kmem_cache_free include/trace/events/kmem.h:114 [inline]
kmem_cache_free+0x418/0x510 mm/slub.c:3682
__exit_signal kernel/exit.c:209 [inline]
release_task+0x118c/0x16d0 kernel/exit.c:255
wait_task_zombie kernel/exit.c:1205 [inline]
wait_consider_task+0x1a64/0x2e90 kernel/exit.c:1432
do_wait_thread kernel/exit.c:1495 [inline]
do_wait+0x32b/0xb80 kernel/exit.c:1612
kernel_wait4+0x29e/0x3e0 kernel/exit.c:1775
__do_sys_wait4 kernel/exit.c:1803 [inline]
__se_sys_wait4 kernel/exit.c:1799 [inline]
__x64_sys_wait4+0x130/0x1e0 kernel/exit.c:1799
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f81a61c48f3
Code: fe ff e9 41 ff ff ff 31 c9 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 80 3d 91 a7 07 00 00 49 89 ca 74 14 b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5d c3 0f 1f 40 00 48 83 ec 28 89 54 24 14 48
RSP: 002b:00007ffd53cb6488 EFLAGS: 00000202 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 0000000000000ddf RCX: 00007f81a61c48f3
RDX: 0000000040000001 RSI: 00007ffd53cb649c RDI: 00000000ffffffff
RBP: 00000000000f4240 R08: 00007ffd53d6d0b0 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000202 R12: 00000000000107f6
R13: 00007ffd53cb649c R14: 00007ffd53cb64b0 R15: 00007ffd53cb64a0
Reply all
Reply to author
Forward
0 new messages