general protection fault in l3mdev_master_ifindex_rcu
4 views
Skip to first unread message
syzbot
Jul 9, 2020, 12:56:20 AM7/9/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: b850307b Linux 4.14.184
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15e5960b100000
kernel config: https://syzkaller.appspot.com/x/.config?x=ddc0f08dd6b981c5
dashboard link: https://syzkaller.appspot.com/bug?extid=28a5444880f00ec4a185
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+28a544...@syzkaller.appspotmail.com
caif:caif_disconnect_client(): nothing to disconnect
caif:caif_disconnect_client(): nothing to disconnect
caif:caif_disconnect_client(): nothing to disconnect
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 19699 Comm: syz-executor.4 Not tainted 4.14.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88808f298100 task.stack: ffff88820ee88000
RIP: 0010:netif_is_l3_master include/linux/netdevice.h:4225 [inline]
RIP: 0010:l3mdev_master_ifindex_rcu+0x32/0x120 net/l3mdev/l3mdev.c:28
RSP: 0018:ffff88820ee8f5f8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffffffffffffffb0 RCX: ffffc9000c6d2000
RDX: 0000000000000039 RSI: ffffffff86369c7a RDI: 00000000000001cc
RBP: ffffffffffffffb0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88820ee8f698 R14: ffff88805d17c140 R15: ffff88805d17c2b8
FS: 00007fd9e61e3700(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31520000 CR3: 0000000097bd6000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ipv6_dev_get_saddr+0x43e/0x9c0 net/ipv6/addrconf.c:1732
ip6_route_get_saddr include/net/ip6_route.h:111 [inline]
ip6_dst_lookup_tail+0x1162/0x16a0 net/ipv6/ip6_output.c:977
ip6_dst_lookup_flow+0x7c/0x190 net/ipv6/ip6_output.c:1098
sctp_v6_get_dst+0x4c1/0x1650 net/sctp/ipv6.c:274
sctp_transport_route+0xa1/0x410 net/sctp/transport.c:305
sctp_assoc_add_peer+0x458/0xf80 net/sctp/associola.c:661
__sctp_connect+0x203/0xb60 net/sctp/socket.c:1230
__sctp_setsockopt_connectx+0x1e9/0x280 net/sctp/socket.c:1386
sctp_setsockopt_connectx net/sctp/socket.c:1417 [inline]
sctp_setsockopt net/sctp/socket.c:4037 [inline]
sctp_setsockopt+0x2152/0x3be0 net/sctp/socket.c:3994
SYSC_setsockopt net/socket.c:1865 [inline]
SyS_setsockopt+0x110/0x1e0 net/socket.c:1844
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cba9
RSP: 002b:00007fd9e61e2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000506360 RCX: 000000000045cba9
RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000006
RBP: 000000000078bf00 R08: 000000000000001c R09: 0000000000000000
R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000b2e R14: 00000000004d7ef8 R15: 00007fd9e61e36d4
Code: e8 74 09 24 fb 48 85 ed 0f 84 92 00 00 00 e8 66 09 24 fb 48 8d bd 1c 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP: netif_is_l3_master include/linux/netdevice.h:4225 [inline] RSP: ffff88820ee8f5f8
RIP: l3mdev_master_ifindex_rcu+0x32/0x120 net/l3mdev/l3mdev.c:28 RSP: ffff88820ee8f5f8
---[ end trace 8bdbd7b9bba68921 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: b850307b Linux 4.14.184
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15e5960b100000
kernel config: https://syzkaller.appspot.com/x/.config?x=ddc0f08dd6b981c5
dashboard link: https://syzkaller.appspot.com/bug?extid=28a5444880f00ec4a185
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+28a544...@syzkaller.appspotmail.com
caif:caif_disconnect_client(): nothing to disconnect
caif:caif_disconnect_client(): nothing to disconnect
caif:caif_disconnect_client(): nothing to disconnect
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 19699 Comm: syz-executor.4 Not tainted 4.14.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88808f298100 task.stack: ffff88820ee88000
RIP: 0010:netif_is_l3_master include/linux/netdevice.h:4225 [inline]
RIP: 0010:l3mdev_master_ifindex_rcu+0x32/0x120 net/l3mdev/l3mdev.c:28
RSP: 0018:ffff88820ee8f5f8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffffffffffffffb0 RCX: ffffc9000c6d2000
RDX: 0000000000000039 RSI: ffffffff86369c7a RDI: 00000000000001cc
RBP: ffffffffffffffb0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88820ee8f698 R14: ffff88805d17c140 R15: ffff88805d17c2b8
FS: 00007fd9e61e3700(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31520000 CR3: 0000000097bd6000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ipv6_dev_get_saddr+0x43e/0x9c0 net/ipv6/addrconf.c:1732
ip6_route_get_saddr include/net/ip6_route.h:111 [inline]
ip6_dst_lookup_tail+0x1162/0x16a0 net/ipv6/ip6_output.c:977
ip6_dst_lookup_flow+0x7c/0x190 net/ipv6/ip6_output.c:1098
sctp_v6_get_dst+0x4c1/0x1650 net/sctp/ipv6.c:274
sctp_transport_route+0xa1/0x410 net/sctp/transport.c:305
sctp_assoc_add_peer+0x458/0xf80 net/sctp/associola.c:661
__sctp_connect+0x203/0xb60 net/sctp/socket.c:1230
__sctp_setsockopt_connectx+0x1e9/0x280 net/sctp/socket.c:1386
sctp_setsockopt_connectx net/sctp/socket.c:1417 [inline]
sctp_setsockopt net/sctp/socket.c:4037 [inline]
sctp_setsockopt+0x2152/0x3be0 net/sctp/socket.c:3994
SYSC_setsockopt net/socket.c:1865 [inline]
SyS_setsockopt+0x110/0x1e0 net/socket.c:1844
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45cba9
RSP: 002b:00007fd9e61e2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000506360 RCX: 000000000045cba9
RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000006
RBP: 000000000078bf00 R08: 000000000000001c R09: 0000000000000000
R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000b2e R14: 00000000004d7ef8 R15: 00007fd9e61e36d4
Code: e8 74 09 24 fb 48 85 ed 0f 84 92 00 00 00 e8 66 09 24 fb 48 8d bd 1c 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP: netif_is_l3_master include/linux/netdevice.h:4225 [inline] RSP: ffff88820ee8f5f8
RIP: l3mdev_master_ifindex_rcu+0x32/0x120 net/l3mdev/l3mdev.c:28 RSP: ffff88820ee8f5f8
---[ end trace 8bdbd7b9bba68921 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Dec 30, 2020, 6:41:10 AM12/30/20
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages