general protection fault in rose_send_frame
18 views
Skip to first unread message
syzbot
Apr 21, 2019, 5:06:06 AM4/21/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: c98875d9 Linux 4.19.36
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=123b85f3200000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e40ac5fbcc6366d
dashboard link: https://syzkaller.appspot.com/bug?extid=41614fd010c6acf9a8dd
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+41614f...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
EXT4-fs (loop4): Couldn't mount because of unsupported optional features
(21ae1021)
CPU: 1 PID: 26932 Comm: syz-executor.2 Not tainted 4.19.36 #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:rose_send_frame+0x1a8/0x280 net/rose/rose_link.c:104
Code: c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 b8 00 00 00 00 00 fc ff df
4c 8b 63 20 49 8d bc 24 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
7e 49 8b 94 24 58 03 00 00 e9 b8 fe ff ff e8 40 26
kobject: 'loop5' (000000001e675dd1): kobject_uevent_env
RSP: 0018:ffff8880ae907ae8 EFLAGS: 00010202
kobject: 'loop1' (000000004ee8db6f): kobject_uevent_env
RAX: dffffc0000000000 RBX: ffff8882160c60c0 RCX: ffffffff86251d4b
RDX: 000000000000006b RSI: ffffffff86251e7c RDI: 0000000000000358
RBP: ffff8880ae907b18 R08: ffff888053334240 R09: ffffed1011bf8b6d
R10: ffffed1011bf8b6c R11: ffff88808dfc5b63 R12: 0000000000000000
R13: 0000000000000078 R14: 0000000000000005 R15: ffff8880a8756200
kobject: 'loop5' (000000001e675dd1): fill_kobj_path: path
= '/devices/virtual/block/loop5'
FS: 0000000000d83940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
kobject: 'kvm' (00000000a299e9da): kobject_uevent_env
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 000000009bfa1000 CR4: 00000000001426e0
Call Trace:
<IRQ>
rose_transmit_clear_request+0x1de/0x2a0 net/rose/rose_link.c:258
kobject: 'loop1' (000000004ee8db6f): fill_kobj_path: path
= '/devices/virtual/block/loop1'
rose_rx_call_request+0x4f0/0x19a0 net/rose/af_rose.c:999
rose_loopback_timer+0x270/0x3f0 net/rose/rose_loopback.c:100
call_timer_fn+0x190/0x720 kernel/time/timer.c:1326
kobject: 'kvm' (00000000a299e9da): fill_kobj_path: path
= '/devices/virtual/misc/kvm'
kobject: 'kvm' (00000000a299e9da): kobject_uevent_env
kobject: 'kvm' (00000000a299e9da): fill_kobj_path: path
= '/devices/virtual/misc/kvm'
kobject: 'kvm' (00000000a299e9da): kobject_uevent_env
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers kernel/time/timer.c:1682 [inline]
__run_timers kernel/time/timer.c:1650 [inline]
run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1695
__do_softirq+0x266/0x92f kernel/softirq.c:292
kobject: 'kvm' (00000000a299e9da): fill_kobj_path: path
= '/devices/virtual/misc/kvm'
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1056
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:867
</IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169
[inline]
RIP: 0010:_raw_spin_unlock_irq+0x54/0x90 kernel/locking/spinlock.c:192
Code: c0 18 33 72 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00
75 33 48 83 3d ed 6c 83 01 00 74 20 fb 66 0f 1f 44 00 00 <bf> 01 00 00 00
e8 a2 a1 5a fa 65 8b 05 8b 27 13 79 85 c0 74 06 41
kobject: 'kvm' (00000000a299e9da): kobject_uevent_env
RSP: 0018:ffff888095aa7b18 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e4663 RBX: ffff888053334240 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888053334abc
RBP: ffff888095aa7b20 R08: ffff888053334240 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ae92cd80
R13: ffff8880a9862140 R14: ffff88809a2703c0 R15: 0000000000000402
finish_lock_switch kernel/sched/core.c:2576 [inline]
finish_task_switch+0x146/0x790 kernel/sched/core.c:2676
kobject: 'kvm' (00000000a299e9da): fill_kobj_path: path
= '/devices/virtual/misc/kvm'
context_switch kernel/sched/core.c:2829 [inline]
__schedule+0x81b/0x1d00 kernel/sched/core.c:3474
schedule+0x92/0x1c0 kernel/sched/core.c:3518
freezable_schedule include/linux/freezer.h:172 [inline]
do_nanosleep+0x201/0x6a0 kernel/time/hrtimer.c:1688
hrtimer_nanosleep+0x2a6/0x570 kernel/time/hrtimer.c:1742
__do_sys_nanosleep kernel/time/hrtimer.c:1776 [inline]
__se_sys_nanosleep kernel/time/hrtimer.c:1763 [inline]
__x64_sys_nanosleep+0x1a6/0x220 kernel/time/hrtimer.c:1763
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4863f0
Code: 00 00 48 c7 c0 d4 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb be 66 0f 1f
44 00 00 83 3d 61 03 5d 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 0f 83 b4 e0 f8 ff c3 48 83 ec 08 e8 ea 53 fd ff
RSP: 002b:00007ffd87e07168 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: ffffffffffffffda RBX: 00000000001f5f1d RCX: 00000000004863f0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffd87e07170
RBP: 00000000000022ff R08: 0000000000000001 R09: 0000000000d83940
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007
R13: 00007ffd87e071c0 R14: 00000000001f5edd R15: 00007ffd87e071d0
Modules linked in:
---[ end trace 577956cd2c33cdf3 ]---
RIP: 0010:rose_send_frame+0x1a8/0x280 net/rose/rose_link.c:104
Code: c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 b8 00 00 00 00 00 fc ff df
4c 8b 63 20 49 8d bc 24 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
7e 49 8b 94 24 58 03 00 00 e9 b8 fe ff ff e8 40 26
RSP: 0018:ffff8880ae907ae8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8882160c60c0 RCX: ffffffff86251d4b
RDX: 000000000000006b RSI: ffffffff86251e7c RDI: 0000000000000358
RBP: ffff8880ae907b18 R08: ffff888053334240 R09: ffffed1011bf8b6d
R10: ffffed1011bf8b6c R11: ffff88808dfc5b63 R12: 0000000000000000
R13: 0000000000000078 R14: 0000000000000005 R15: ffff8880a8756200
FS: 0000000000d83940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 000000009bfa1000 CR4: 00000000001426e0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: c98875d9 Linux 4.19.36
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=123b85f3200000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e40ac5fbcc6366d
dashboard link: https://syzkaller.appspot.com/bug?extid=41614fd010c6acf9a8dd
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+41614f...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
EXT4-fs (loop4): Couldn't mount because of unsupported optional features
(21ae1021)
CPU: 1 PID: 26932 Comm: syz-executor.2 Not tainted 4.19.36 #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:rose_send_frame+0x1a8/0x280 net/rose/rose_link.c:104
Code: c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 b8 00 00 00 00 00 fc ff df
4c 8b 63 20 49 8d bc 24 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
7e 49 8b 94 24 58 03 00 00 e9 b8 fe ff ff e8 40 26
kobject: 'loop5' (000000001e675dd1): kobject_uevent_env
RSP: 0018:ffff8880ae907ae8 EFLAGS: 00010202
kobject: 'loop1' (000000004ee8db6f): kobject_uevent_env
RAX: dffffc0000000000 RBX: ffff8882160c60c0 RCX: ffffffff86251d4b
RDX: 000000000000006b RSI: ffffffff86251e7c RDI: 0000000000000358
RBP: ffff8880ae907b18 R08: ffff888053334240 R09: ffffed1011bf8b6d
R10: ffffed1011bf8b6c R11: ffff88808dfc5b63 R12: 0000000000000000
R13: 0000000000000078 R14: 0000000000000005 R15: ffff8880a8756200
kobject: 'loop5' (000000001e675dd1): fill_kobj_path: path
= '/devices/virtual/block/loop5'
FS: 0000000000d83940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
kobject: 'kvm' (00000000a299e9da): kobject_uevent_env
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 000000009bfa1000 CR4: 00000000001426e0
Call Trace:
<IRQ>
rose_transmit_clear_request+0x1de/0x2a0 net/rose/rose_link.c:258
kobject: 'loop1' (000000004ee8db6f): fill_kobj_path: path
= '/devices/virtual/block/loop1'
rose_rx_call_request+0x4f0/0x19a0 net/rose/af_rose.c:999
rose_loopback_timer+0x270/0x3f0 net/rose/rose_loopback.c:100
call_timer_fn+0x190/0x720 kernel/time/timer.c:1326
kobject: 'kvm' (00000000a299e9da): fill_kobj_path: path
= '/devices/virtual/misc/kvm'
kobject: 'kvm' (00000000a299e9da): kobject_uevent_env
kobject: 'kvm' (00000000a299e9da): fill_kobj_path: path
= '/devices/virtual/misc/kvm'
kobject: 'kvm' (00000000a299e9da): kobject_uevent_env
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers kernel/time/timer.c:1682 [inline]
__run_timers kernel/time/timer.c:1650 [inline]
run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1695
__do_softirq+0x266/0x92f kernel/softirq.c:292
kobject: 'kvm' (00000000a299e9da): fill_kobj_path: path
= '/devices/virtual/misc/kvm'
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1056
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:867
</IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169
[inline]
RIP: 0010:_raw_spin_unlock_irq+0x54/0x90 kernel/locking/spinlock.c:192
Code: c0 18 33 72 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00
75 33 48 83 3d ed 6c 83 01 00 74 20 fb 66 0f 1f 44 00 00 <bf> 01 00 00 00
e8 a2 a1 5a fa 65 8b 05 8b 27 13 79 85 c0 74 06 41
kobject: 'kvm' (00000000a299e9da): kobject_uevent_env
RSP: 0018:ffff888095aa7b18 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e4663 RBX: ffff888053334240 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888053334abc
RBP: ffff888095aa7b20 R08: ffff888053334240 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ae92cd80
R13: ffff8880a9862140 R14: ffff88809a2703c0 R15: 0000000000000402
finish_lock_switch kernel/sched/core.c:2576 [inline]
finish_task_switch+0x146/0x790 kernel/sched/core.c:2676
kobject: 'kvm' (00000000a299e9da): fill_kobj_path: path
= '/devices/virtual/misc/kvm'
context_switch kernel/sched/core.c:2829 [inline]
__schedule+0x81b/0x1d00 kernel/sched/core.c:3474
schedule+0x92/0x1c0 kernel/sched/core.c:3518
freezable_schedule include/linux/freezer.h:172 [inline]
do_nanosleep+0x201/0x6a0 kernel/time/hrtimer.c:1688
hrtimer_nanosleep+0x2a6/0x570 kernel/time/hrtimer.c:1742
__do_sys_nanosleep kernel/time/hrtimer.c:1776 [inline]
__se_sys_nanosleep kernel/time/hrtimer.c:1763 [inline]
__x64_sys_nanosleep+0x1a6/0x220 kernel/time/hrtimer.c:1763
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4863f0
Code: 00 00 48 c7 c0 d4 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb be 66 0f 1f
44 00 00 83 3d 61 03 5d 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 0f 83 b4 e0 f8 ff c3 48 83 ec 08 e8 ea 53 fd ff
RSP: 002b:00007ffd87e07168 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: ffffffffffffffda RBX: 00000000001f5f1d RCX: 00000000004863f0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffd87e07170
RBP: 00000000000022ff R08: 0000000000000001 R09: 0000000000d83940
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007
R13: 00007ffd87e071c0 R14: 00000000001f5edd R15: 00007ffd87e071d0
Modules linked in:
---[ end trace 577956cd2c33cdf3 ]---
RIP: 0010:rose_send_frame+0x1a8/0x280 net/rose/rose_link.c:104
Code: c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 b8 00 00 00 00 00 fc ff df
4c 8b 63 20 49 8d bc 24 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
7e 49 8b 94 24 58 03 00 00 e9 b8 fe ff ff e8 40 26
RSP: 0018:ffff8880ae907ae8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8882160c60c0 RCX: ffffffff86251d4b
RDX: 000000000000006b RSI: ffffffff86251e7c RDI: 0000000000000358
RBP: ffff8880ae907b18 R08: ffff888053334240 R09: ffffed1011bf8b6d
R10: ffffed1011bf8b6c R11: ffff88808dfc5b63 R12: 0000000000000000
R13: 0000000000000078 R14: 0000000000000005 R15: ffff8880a8756200
FS: 0000000000d83940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 000000009bfa1000 CR4: 00000000001426e0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Apr 28, 2019, 6:09:07 AM4/28/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 19bb613a Linux 4.19.37
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11159390a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2f4f1677ff80cdff
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13f7e6cca00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+41614f...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
IPv6: ADDRCONF(NETDEV_CHANGE): rose0: link becomes ready
RDX: 000000000000006b RSI: ffffffff862508bc RDI: 0000000000000358
RBP: ffff8880ae907b18 R08: ffff8880aa2703c0 R09: ffffed1013f4be85
R10: ffffed1013f4be84 R11: ffff88809fa5f423 R12: 0000000000000000
R13: 0000000000000078 R14: 0000000000000005 R15: ffff8880861c6640
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
Code: ff ff ff 48 89 c7 48 89 45 d8 e8 f9 09 b3 fa 48 8b 45 d8 e9 ce fe ff
ff 48 89 df e8 e8 09 b3 fa eb 82 90 90 90 90 90 90 fb f4 <c3> 0f 1f 00 66
2e 0f 1f 84 00 00 00 00 00 f4 c3 90 90 90 90 90 90
RSP: 0018:ffff8880aa27fd00 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e466c RBX: ffff8880aa2703c0 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880aa270c3c
RBP: ffff8880aa27fd30 R08: ffff8880aa2703c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffffffff88723350 R14: 0000000000000001 R15: 0000000000000000
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:556
default_idle_call+0x36/0x90 kernel/sched/idle.c:93
cpuidle_idle_call kernel/sched/idle.c:153 [inline]
do_idle+0x377/0x560 kernel/sched/idle.c:262
cpu_startup_entry+0xc8/0xe0 kernel/sched/idle.c:368
start_secondary+0x404/0x5c0 arch/x86/kernel/smpboot.c:271
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243
Modules linked in:
---[ end trace 0327207222f10fbe ]---
RDX: 000000000000006b RSI: ffffffff862508bc RDI: 0000000000000358
RBP: ffff8880ae907b18 R08: ffff8880aa2703c0 R09: ffffed1013f4be85
R10: ffffed1013f4be84 R11: ffff88809fa5f423 R12: 0000000000000000
R13: 0000000000000078 R14: 0000000000000005 R15: ffff8880861c6640
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
HEAD commit: 19bb613a Linux 4.19.37
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11159390a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2f4f1677ff80cdff
dashboard link: https://syzkaller.appspot.com/bug?extid=41614fd010c6acf9a8dd
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15656e40a00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13f7e6cca00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+41614f...@syzkaller.appspotmail.com
8021q: adding VLAN 0 to HW filter on device batadv0
IPv6: ADDRCONF(NETDEV_CHANGE): rose0: link becomes ready
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.19.37 #5
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:rose_send_frame+0x1a8/0x280 net/rose/rose_link.c:104
Code: c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 b8 00 00 00 00 00 fc ff df
4c 8b 63 20 49 8d bc 24 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
7e 49 8b 94 24 58 03 00 00 e9 b8 fe ff ff e8 70 3e
Google 01/01/2011
RIP: 0010:rose_send_frame+0x1a8/0x280 net/rose/rose_link.c:104
Code: c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 b8 00 00 00 00 00 fc ff df
4c 8b 63 20 49 8d bc 24 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
RSP: 0018:ffff8880ae907ae8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8882160fc040 RCX: ffffffff8625078b
RDX: 000000000000006b RSI: ffffffff862508bc RDI: 0000000000000358
RBP: ffff8880ae907b18 R08: ffff8880aa2703c0 R09: ffffed1013f4be85
R10: ffffed1013f4be84 R11: ffff88809fa5f423 R12: 0000000000000000
R13: 0000000000000078 R14: 0000000000000005 R15: ffff8880861c6640
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000190 CR3: 0000000093922000 CR4: 00000000001406e0
Call Trace:
<IRQ>
rose_transmit_clear_request+0x1de/0x2a0 net/rose/rose_link.c:258
<IRQ>
rose_transmit_clear_request+0x1de/0x2a0 net/rose/rose_link.c:258
rose_rx_call_request+0x4f0/0x19a0 net/rose/af_rose.c:999
rose_loopback_timer+0x270/0x3f0 net/rose/rose_loopback.c:100
call_timer_fn+0x190/0x720 kernel/time/timer.c:1326
rose_loopback_timer+0x270/0x3f0 net/rose/rose_loopback.c:100
call_timer_fn+0x190/0x720 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers kernel/time/timer.c:1682 [inline]
__run_timers kernel/time/timer.c:1650 [inline]
run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1695
__do_softirq+0x266/0x92f kernel/softirq.c:292
__run_timers kernel/time/timer.c:1682 [inline]
__run_timers kernel/time/timer.c:1650 [inline]
run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1695
__do_softirq+0x266/0x92f kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1056
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:867
</IRQ>
RIP: 0010:native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:58
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1056
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:867
</IRQ>
Code: ff ff ff 48 89 c7 48 89 45 d8 e8 f9 09 b3 fa 48 8b 45 d8 e9 ce fe ff
ff 48 89 df e8 e8 09 b3 fa eb 82 90 90 90 90 90 90 fb f4 <c3> 0f 1f 00 66
2e 0f 1f 84 00 00 00 00 00 f4 c3 90 90 90 90 90 90
RSP: 0018:ffff8880aa27fd00 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e466c RBX: ffff8880aa2703c0 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880aa270c3c
RBP: ffff8880aa27fd30 R08: ffff8880aa2703c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffffffff88723350 R14: 0000000000000001 R15: 0000000000000000
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:556
default_idle_call+0x36/0x90 kernel/sched/idle.c:93
cpuidle_idle_call kernel/sched/idle.c:153 [inline]
do_idle+0x377/0x560 kernel/sched/idle.c:262
cpu_startup_entry+0xc8/0xe0 kernel/sched/idle.c:368
start_secondary+0x404/0x5c0 arch/x86/kernel/smpboot.c:271
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243
Modules linked in:
---[ end trace 0327207222f10fbe ]---
RIP: 0010:rose_send_frame+0x1a8/0x280 net/rose/rose_link.c:104
Code: c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 b8 00 00 00 00 00 fc ff df
4c 8b 63 20 49 8d bc 24 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
7e 49 8b 94 24 58 03 00 00 e9 b8 fe ff ff e8 70 3e
Code: c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 b8 00 00 00 00 00 fc ff df
4c 8b 63 20 49 8d bc 24 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
RSP: 0018:ffff8880ae907ae8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8882160fc040 RCX: ffffffff8625078b
RDX: 000000000000006b RSI: ffffffff862508bc RDI: 0000000000000358
RBP: ffff8880ae907b18 R08: ffff8880aa2703c0 R09: ffffed1013f4be85
R10: ffffed1013f4be84 R11: ffff88809fa5f423 R12: 0000000000000000
R13: 0000000000000078 R14: 0000000000000005 R15: ffff8880861c6640
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000190 CR3: 0000000093922000 CR4: 00000000001406e0
syzbot
Apr 28, 2019, 8:17:06 AM4/28/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: fa5941f4 Linux 4.14.114
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11854b38a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d7780000df8e070e
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a4007f9d3479e1f4e2
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f95c14a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b4a400...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
IPv6: ADDRCONF(NETDEV_CHANGE): rose0: link becomes ready
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.114 #4
RIP: 0010:rose_send_frame+0x18d/0x270 net/rose/rose_link.c:106
RSP: 0018:ffff8880aee07b48 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8882163fb780 RCX: 0000000000000006
RDX: 000000000000006b RSI: ffffffff86f9bae0 RDI: 0000000000000358
RBP: ffff8880aee07b78 R08: 1ffff110122e81b8 R09: ffff888091740dc0
R10: ffffed10122e81bc R11: ffff888091740de3 R12: ffff88808e793580
R13: 0000000000000078 R14: 0000000000000005 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
rose_transmit_clear_request+0x1da/0x290 net/rose/rose_link.c:260
rose_rx_call_request+0x452/0x1940 net/rose/af_rose.c:999
rose_loopback_timer+0x232/0x3b0 net/rose/rose_loopback.c:103
call_timer_fn+0x164/0x680 kernel/time/timer.c:1279
expire_timers kernel/time/timer.c:1318 [inline]
__run_timers kernel/time/timer.c:1634 [inline]
__run_timers kernel/time/timer.c:1602 [inline]
run_timer_softirq+0x5b4/0x1570 kernel/time/timer.c:1647
__do_softirq+0x24e/0x9ae kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x160/0x1b0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:648 [inline]
smp_apic_timer_interrupt+0x156/0x600 arch/x86/kernel/apic/apic.c:1064
apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:787
RAX: 1ffffffff0ee2970 RBX: ffffffff87676240 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffffffff87676abc
RBP: ffffffff87607e10 R08: 1ffffffff1049a01 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff87714b70
R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff87676240
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:557
default_idle_call+0x36/0x90 kernel/sched/idle.c:98
cpuidle_idle_call kernel/sched/idle.c:156 [inline]
do_idle+0x262/0x3d0 kernel/sched/idle.c:246
cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:351
rest_init+0xf1/0xf6 init/main.c:435
start_kernel+0x6e2/0x700 init/main.c:709
x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:380
x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:361
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240
Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 8b 00 00 00 48 b8 00 00 00 00 00 fc
ff df 4c 8b 7b 20 49 8d bf 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00
75 7d 49 8b 97 58 03 00 00 e9 c7 fe ff ff e8 2c 9b
RIP: rose_send_frame+0x18d/0x270 net/rose/rose_link.c:106 RSP:
ffff8880aee07b48
---[ end trace 4c6478e5ff1c6744 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following crash on:
HEAD commit: fa5941f4 Linux 4.14.114
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11854b38a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d7780000df8e070e
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a4007f9d3479e1f4e2
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143dac14a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f95c14a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
IPv6: ADDRCONF(NETDEV_CHANGE): rose0: link becomes ready
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.114 #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffffffff87676240 task.stack: ffffffff87600000
Google 01/01/2011
RIP: 0010:rose_send_frame+0x18d/0x270 net/rose/rose_link.c:106
RSP: 0018:ffff8880aee07b48 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8882163fb780 RCX: 0000000000000006
RDX: 000000000000006b RSI: ffffffff86f9bae0 RDI: 0000000000000358
RBP: ffff8880aee07b78 R08: 1ffff110122e81b8 R09: ffff888091740dc0
R10: ffffed10122e81bc R11: ffff888091740de3 R12: ffff88808e793580
R13: 0000000000000078 R14: 0000000000000005 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000190 CR3: 0000000082bbb000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
rose_transmit_clear_request+0x1da/0x290 net/rose/rose_link.c:260
rose_rx_call_request+0x452/0x1940 net/rose/af_rose.c:999
rose_loopback_timer+0x232/0x3b0 net/rose/rose_loopback.c:103
call_timer_fn+0x164/0x680 kernel/time/timer.c:1279
expire_timers kernel/time/timer.c:1318 [inline]
__run_timers kernel/time/timer.c:1634 [inline]
__run_timers kernel/time/timer.c:1602 [inline]
run_timer_softirq+0x5b4/0x1570 kernel/time/timer.c:1647
__do_softirq+0x24e/0x9ae kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x160/0x1b0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:648 [inline]
smp_apic_timer_interrupt+0x156/0x600 arch/x86/kernel/apic/apic.c:1064
apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:787
</IRQ>
RIP: 0010:native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:58
RSP: 0018:ffffffff87607de8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10
RIP: 0010:native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:58
RAX: 1ffffffff0ee2970 RBX: ffffffff87676240 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffffffff87676abc
RBP: ffffffff87607e10 R08: 1ffffffff1049a01 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff87714b70
R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff87676240
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:557
default_idle_call+0x36/0x90 kernel/sched/idle.c:98
cpuidle_idle_call kernel/sched/idle.c:156 [inline]
do_idle+0x262/0x3d0 kernel/sched/idle.c:246
cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:351
rest_init+0xf1/0xf6 init/main.c:435
start_kernel+0x6e2/0x700 init/main.c:709
x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:380
x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:361
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240
Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 8b 00 00 00 48 b8 00 00 00 00 00 fc
ff df 4c 8b 7b 20 49 8d bf 58 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00
75 7d 49 8b 97 58 03 00 00 e9 c7 fe ff ff e8 2c 9b
RIP: rose_send_frame+0x18d/0x270 net/rose/rose_link.c:106 RSP:
ffff8880aee07b48
---[ end trace 4c6478e5ff1c6744 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
https://goo.gl/tpsmEJ#testing-patches
syzbot
Dec 18, 2020, 11:40:03 PM12/18/20
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 731b9890a7f136971ac62f3276c4f6e5fa124887
Author: Anmol Karn <anmol.k...@gmail.com>
Date: Thu Nov 19 19:10:43 2020 +0000
rose: Fix Null pointer dereference in rose_send_frame()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12decb37500000
start commit: 17a87580 Linux 4.19.133
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=562879a87122f7ce
dashboard link: https://syzkaller.appspot.com/bug?extid=41614fd010c6acf9a8dd
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=166e0a44900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ddba78900000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: rose: Fix Null pointer dereference in rose_send_frame()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 731b9890a7f136971ac62f3276c4f6e5fa124887
Author: Anmol Karn <anmol.k...@gmail.com>
Date: Thu Nov 19 19:10:43 2020 +0000
rose: Fix Null pointer dereference in rose_send_frame()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12decb37500000
start commit: 17a87580 Linux 4.19.133
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=562879a87122f7ce
dashboard link: https://syzkaller.appspot.com/bug?extid=41614fd010c6acf9a8dd
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=166e0a44900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ddba78900000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: rose: Fix Null pointer dereference in rose_send_frame()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Palash Oswal
Oct 27, 2022, 6:09:49 PM10/27/22
to syzkaller-lts-bugs
On Friday, December 18, 2020 at 8:40:03 PM UTC-8 syzbot wrote:
syzbot suspects this issue was fixed by commit:
rose: Fix Null pointer dereference in rose_send_frame()
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: rose: Fix Null pointer dereference in rose_send_frame()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
This bug was observed again in 4.19.257 release on the linux-4.19.y tree
( HEAD : 41b46409f97a703ab1dd9227c40e76a0d3eeea1c )
All of the original C reproducers for this bug can be used to verify it:
Reply all
Reply to author
Forward
0 new messages