WARNING in __rate_control_send_low

已查看 6 次
跳至第一个未读帖子

syzbot

未读,
2020年10月7日 22:03:182020/10/7
收件人 syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1277a1fb900000
kernel config: https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link: https://syzkaller.appspot.com/bug?extid=18e5be9506dd34e8cc46
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+18e5be...@syzkaller.appspotmail.com

IPVS: sync thread started: state = MASTER, mcast_ifn = bond_slave_0, syncid = 4, id = 0
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
no supported rates (0xffffffff) in rate_mask 0x0 with flags 0x0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 145 at net/mac80211/rate.c:359 __rate_control_send_low.cold+0x6e/0x81 net/mac80211/rate.c:359
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 145 Comm: kworker/u4:3 Not tainted 4.14.198-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: krdsd rds_tcp_accept_worker
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x4b kernel/panic.c:547
report_bug+0x208/0x249 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:__rate_control_send_low.cold+0x6e/0x81 net/mac80211/rate.c:359
RSP: 0018:ffff8880aeb07088 EFLAGS: 00010282
RAX: 000000000000003f RBX: ffff8880a9af95a8 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff86ac12c0 RDI: ffffed1015d60e07
RBP: 00000000ffffffff R08: 000000000000003f R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805039b320
R13: 0000000000000000 R14: 0000000000000090 R15: 000000000000000c
rate_control_send_low+0x248/0x560 net/mac80211/rate.c:383
minstrel_ht_get_rate+0x56/0x13f0 net/mac80211/rc80211_minstrel_ht.c:1045
rate_control_get_rate+0x40d/0x4f0 net/mac80211/rate.c:910
ieee80211_tx_h_rate_ctrl+0x769/0x12d0 net/mac80211/tx.c:741
invoke_tx_handlers_early+0x724/0x1990 net/mac80211/tx.c:1697
ieee80211_tx+0x209/0x320 net/mac80211/tx.c:1839
ieee80211_xmit+0x2cc/0x3b0 net/mac80211/tx.c:1928
__ieee80211_subif_start_xmit+0x38c/0x730 net/mac80211/tx.c:3625
ieee80211_subif_start_xmit+0xc9/0xdf0 net/mac80211/tx.c:3761
__netdev_start_xmit include/linux/netdevice.h:4039 [inline]
netdev_start_xmit include/linux/netdevice.h:4048 [inline]
xmit_one net/core/dev.c:3005 [inline]
dev_hard_start_xmit+0x188/0x890 net/core/dev.c:3021
sch_direct_xmit+0x251/0x500 net/sched/sch_generic.c:186
__dev_xmit_skb net/core/dev.c:3214 [inline]
__dev_queue_xmit+0x1ab0/0x2480 net/core/dev.c:3489
neigh_resolve_output+0x4e5/0x870 net/core/neighbour.c:1369
neigh_output include/net/neighbour.h:500 [inline]
ip6_finish_output2+0xf48/0x1f10 net/ipv6/ip6_output.c:120
ip6_finish_output+0x60c/0xaf0 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:239 [inline]
ip6_output+0x1c5/0x660 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:470 [inline]
NF_HOOK include/linux/netfilter.h:250 [inline]
mld_sendpack+0x5fe/0xea0 net/ipv6/mcast.c:1660
mld_send_cr net/ipv6/mcast.c:1956 [inline]
mld_ifc_timer_expire+0x57c/0xcd0 net/ipv6/mcast.c:2455
call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
__run_timers kernel/time/timer.c:1644 [inline]
run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1657
__do_softirq+0x254/0xa1d kernel/softirq.c:288
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1016
</IRQ>
do_softirq.part.0+0x154/0x1b0 kernel/softirq.c:332
do_softirq kernel/softirq.c:324 [inline]
__local_bh_enable_ip+0x12b/0x170 kernel/softirq.c:185
lock_sock include/net/sock.h:1471 [inline]
tcp_close+0x25/0xed0 net/ipv4/tcp.c:2144
inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
__sock_release net/socket.c:602 [inline]
sock_release+0x87/0x1e0 net/socket.c:623
rds_tcp_accept_one+0x481/0x8b0 net/rds/tcp_listen.c:220
rds_tcp_accept_worker+0x4d/0x70 net/rds/tcp.c:407
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

未读,
2020年10月8日 04:05:172020/10/8
收件人 syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1209b6fb900000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ddf1fb900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1133a668500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+18e5be...@syzkaller.appspotmail.com

wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
no supported rates (0xffffffff) in rate_mask 0x0 with flags 0x0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 61 at net/mac80211/rate.c:359 __rate_control_send_low.cold+0x6e/0x81 net/mac80211/rate.c:359
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 61 Comm: kworker/u4:2 Not tainted 4.14.198-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy0 ieee80211_iface_work
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x4b kernel/panic.c:547
report_bug+0x208/0x249 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:__rate_control_send_low.cold+0x6e/0x81 net/mac80211/rate.c:359
RSP: 0018:ffff8880aeb07ad8 EFLAGS: 00010286
RAX: 000000000000003f RBX: ffff8880a58ca968 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff86e462c0 RDI: ffffed1015d60f51
RBP: 00000000ffffffff R08: 000000000000003f R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a0cb24a0
R13: 0000000000000000 R14: 0000000000000090 R15: 000000000000000c
rate_control_send_low+0x248/0x560 net/mac80211/rate.c:383
minstrel_ht_get_rate+0x56/0x13f0 net/mac80211/rc80211_minstrel_ht.c:1045
rate_control_get_rate+0x40d/0x4f0 net/mac80211/rate.c:910
__ieee80211_beacon_get+0x87b/0x1820 net/mac80211/tx.c:4308
ieee80211_beacon_get_tim+0x78/0x750 net/mac80211/tx.c:4335
ieee80211_beacon_get include/net/mac80211.h:4401 [inline]
mac80211_hwsim_beacon_tx+0xd8/0x570 drivers/net/wireless/mac80211_hwsim.c:1520
__iterate_interfaces+0x247/0x3c0 net/mac80211/util.c:613
ieee80211_iterate_active_interfaces_atomic+0x74/0x130 net/mac80211/util.c:649
mac80211_hwsim_beacon+0xbe/0x180 drivers/net/wireless/mac80211_hwsim.c:1558
__tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:618
tasklet_hi_action+0x195/0x330 kernel/softirq.c:549
__do_softirq+0x254/0xa1d kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:648 [inline]
smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1102
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
</IRQ>
RIP: 0010:unwind_next_frame+0x280/0x17d0 arch/x86/kernel/unwind_orc.c:356
RSP: 0018:ffff8880a942f5f8 EFLAGS: 00000a03 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: 1ffff11015285ec6 RCX: ffffffff88f2b068
RDX: 1ffffffff11e560d RSI: ffffffff88f2b068 RDI: ffffffff88a3994c
RBP: 0000000000000001 R08: ffffffff88f2b06c R09: ffffffff88f2b092
R10: 0000000000020316 R11: 0000000000058071 R12: ffff8880a942f6ed
R13: ffff8880a942f6f0 R14: ffff8880a942f708 R15: ffff8880a942f6b8
__save_stack_trace+0x90/0x160 arch/x86/kernel/stacktrace.c:44
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
slab_post_alloc_hook mm/slab.h:442 [inline]
slab_alloc mm/slab.c:3390 [inline]
kmem_cache_alloc_trace+0x11b/0x3d0 mm/slab.c:3616
kmalloc include/linux/slab.h:488 [inline]
kzalloc include/linux/slab.h:661 [inline]
cfg80211_ibss_joined+0x10b/0x5f0 net/wireless/ibss.c:72
__ieee80211_sta_join_ibss+0xb7a/0x1c80 net/mac80211/ibss.c:396
ieee80211_sta_create_ibss.cold+0xbb/0xf1 net/mac80211/ibss.c:1346
ieee80211_sta_find_ibss net/mac80211/ibss.c:1476 [inline]
ieee80211_ibss_work.cold+0x266/0x565 net/mac80211/ibss.c:1700
ieee80211_iface_work+0x690/0x770 net/mac80211/iface.c:1383
回复全部
回复作者
转发
0 个新帖子