kernel BUG at net/rxrpc/local_object.c:LINE!

10 views
Skip to first unread message

syzbot

unread,
Jul 31, 2019, 8:50:07 AM7/31/19
to syzkaller...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 10d6aa56 Linux 4.14.135
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1546048a600000
kernel config: https://syzkaller.appspot.com/x/.config?x=ff4089e901d1d013
dashboard link: https://syzkaller.appspot.com/bug?extid=fbf6d471ed10506d3c2e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fbf6d4...@syzkaller.appspotmail.com

bond0 (unregistering): Releasing backup interface bond_slave_1
bond0 (unregistering): Releasing backup interface bond_slave_0
bond0 (unregistering): Released all slaves
rxrpc: AF_RXRPC: Leaked local ffff88809e38b6c0 {1}
------------[ cut here ]------------
kernel BUG at net/rxrpc/local_object.c:405!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 32 Comm: kworker/u4:2 Not tainted 4.14.135 #31
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: netns cleanup_net
task: ffff8880a9f12100 task.stack: ffff8880a9f20000
RIP: 0010:rxrpc_destroy_all_locals+0xee/0xfa net/rxrpc/local_object.c:405
RSP: 0018:ffff8880a9f27bc8 EFLAGS: 00010292
RAX: dffffc0000000000 RBX: ffff8880649b8880 RCX: 0000000000000003
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000286
RBP: ffff8880a9f27bf0 R08: fffffbfff12354d8 R09: ffff8880a9f12100
R10: dffffc0000000000 R11: 0000000000000000 R12: ffff8880649b88a0
R13: ffff8880649b88a0 R14: ffff8880649b88b0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c42b465c00 CR3: 0000000083e36000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
rxrpc_exit_net+0x15d/0x270 net/rxrpc/net_ns.c:78
ops_exit_list.isra.0+0xaa/0x150 net/core/net_namespace.c:142
cleanup_net+0x3ba/0x880 net/core/net_namespace.c:484
process_one_work+0x863/0x1600 kernel/workqueue.c:2114
worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 00 00 00 00 00 fc ff df 48 83 eb 20 e8 0c b5 c6 fb 4c 8d 6b 20 4d 39
ec 0f 85 52 00 00 00 e8 fa b4 c6 fb 4c 89 f7 e8 f2 f5 84 00 <0f> 0b 4c 89
e7 e8 68 61 f0 fb eb c0 e8 e1 b4 c6 fb 48 c7 c7 40
RIP: rxrpc_destroy_all_locals+0xee/0xfa net/rxrpc/local_object.c:405 RSP:
ffff8880a9f27bc8
---[ end trace a587cbd017ac3d4f ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Jul 31, 2019, 8:54:07 AM7/31/19
to syzkaller...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 9a9de33a Linux 4.19.63
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1622f6d8600000
kernel config: https://syzkaller.appspot.com/x/.config?x=92b8e10c68c8329
dashboard link: https://syzkaller.appspot.com/bug?extid=45bb3012919c888fa10d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+45bb30...@syzkaller.appspotmail.com

rxrpc: AF_RXRPC: Leaked local 0000000026e8b237 {0}
------------[ cut here ]------------
kernel BUG at net/rxrpc/local_object.c:497!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 10821 Comm: kworker/u4:8 Not tainted 4.19.63 #37
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:rxrpc_destroy_all_locals+0xf2/0x174 net/rxrpc/local_object.c:497
Code: 00 49 bf 00 00 00 00 00 fc ff df 48 83 eb 20 e8 d4 59 13 fb 4c 8d 6b
20 4d 39 ec 75 19 e8 c6 59 13 fb 4c 89 f7 e8 fe a9 9a 00 <0f> 0b 4c 89 e7
e8 c4 ec 49 fb eb c4 e8 ad 59 13 fb 48 8d 7b 10 be
RSP: 0018:ffff8880539a7bb0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888076871ed8 RCX: ffffffff86f29c38
RDX: 0000000000000001 RSI: 1ffff1100a734f61 RDI: ffff888076871f08
RBP: ffff8880539a7be0 R08: 1ffff1100ed0e3e1 R09: ffffed100ed0e3e2
R10: ffffed100ed0e3e1 R11: ffff888076871f0f R12: ffff888076871ef8
R13: ffff888076871ef8 R14: ffff888076871f08 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000009493f000 CR4: 00000000001406f0
Call Trace:
rxrpc_exit_net+0x1d2/0x310 net/rxrpc/net_ns.c:125
ops_exit_list.isra.0+0xaa/0x150 net/core/net_namespace.c:153
cleanup_net+0x3fb/0x960 net/core/net_namespace.c:552
process_one_work+0x989/0x1750 kernel/workqueue.c:2153
worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace 7f6765a77d7613fc ]---
RIP: 0010:rxrpc_destroy_all_locals+0xf2/0x174 net/rxrpc/local_object.c:497
Code: 00 49 bf 00 00 00 00 00 fc ff df 48 83 eb 20 e8 d4 59 13 fb 4c 8d 6b
20 4d 39 ec 75 19 e8 c6 59 13 fb 4c 89 f7 e8 fe a9 9a 00 <0f> 0b 4c 89 e7
e8 c4 ec 49 fb eb c4 e8 ad 59 13 fb 48 8d 7b 10 be
RSP: 0018:ffff8880539a7bb0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888076871ed8 RCX: ffffffff86f29c38
RDX: 0000000000000001 RSI: 1ffff1100a734f61 RDI: ffff888076871f08
RBP: ffff8880539a7be0 R08: 1ffff1100ed0e3e1 R09: ffffed100ed0e3e2
R10: ffffed100ed0e3e1 R11: ffff888076871f0f R12: ffff888076871ef8
R13: ffff888076871ef8 R14: ffff888076871f08 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000014cd3d8 CR3: 0000000088572000 CR4: 00000000001406e0

syzbot

unread,
Aug 1, 2019, 2:39:06 AM8/1/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 10d6aa56 Linux 4.14.135
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15a216b2600000
kernel config: https://syzkaller.appspot.com/x/.config?x=ff4089e901d1d013
dashboard link: https://syzkaller.appspot.com/bug?extid=fbf6d471ed10506d3c2e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1795b8dc600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12e426e8600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fbf6d4...@syzkaller.appspotmail.com

IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
rxrpc: AF_RXRPC: Leaked local ffff88808c9b44c0 {1}
------------[ cut here ]------------
kernel BUG at net/rxrpc/local_object.c:405!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 5 Comm: kworker/u4:0 Not tainted 4.14.135 #31
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: netns cleanup_net
task: ffff8880a9cc2140 task.stack: ffff8880a9cd0000
RIP: 0010:rxrpc_destroy_all_locals+0xee/0xfa net/rxrpc/local_object.c:405
RSP: 0018:ffff8880a9cd7bc8 EFLAGS: 00010292
RAX: dffffc0000000000 RBX: ffff888081280680 RCX: 0000000000000003
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000286
RBP: ffff8880a9cd7bf0 R08: fffffbfff12354d8 R09: ffff8880a9cc2140
R10: dffffc0000000000 R11: 0000000000000000 R12: ffff8880812806a0
R13: ffff8880812806a0 R14: ffff8880812806b0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006ceb60 CR3: 0000000097a54000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
rxrpc_exit_net+0x15d/0x270 net/rxrpc/net_ns.c:78
ops_exit_list.isra.0+0xaa/0x150 net/core/net_namespace.c:142
cleanup_net+0x3ba/0x880 net/core/net_namespace.c:484
process_one_work+0x863/0x1600 kernel/workqueue.c:2114
worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 00 00 00 00 00 fc ff df 48 83 eb 20 e8 0c b5 c6 fb 4c 8d 6b 20 4d 39
ec 0f 85 52 00 00 00 e8 fa b4 c6 fb 4c 89 f7 e8 f2 f5 84 00 <0f> 0b 4c 89
e7 e8 68 61 f0 fb eb c0 e8 e1 b4 c6 fb 48 c7 c7 40
RIP: rxrpc_destroy_all_locals+0xee/0xfa net/rxrpc/local_object.c:405 RSP:
ffff8880a9cd7bc8
---[ end trace 18ae6206400a454d ]---

syzbot

unread,
Aug 29, 2019, 4:17:06 AM8/29/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 97ab07e1 Linux 4.19.69
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10fa0846600000
kernel config: https://syzkaller.appspot.com/x/.config?x=a73820df154c3af
dashboard link: https://syzkaller.appspot.com/bug?extid=45bb3012919c888fa10d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a2fe7a600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f142de600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+45bb30...@syzkaller.appspotmail.com

audit: type=1400 audit(1567066353.696:36): avc: denied { map } for
pid=7563 comm="syz-executor170" path="/root/syz-executor170878093"
dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
IPVS: ftp: loaded support on port[0] = 21
rxrpc: Assertion failed
------------[ cut here ]------------
kernel BUG at net/rxrpc/local_object.c:437!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3222 Comm: kworker/1:2 Not tainted 4.19.69 #43
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: krxrpcd rxrpc_local_processor
RIP: 0010:rxrpc_local_destroyer net/rxrpc/local_object.c:437 [inline]
RIP: 0010:rxrpc_local_processor.cold+0x24/0x29 net/rxrpc/local_object.c:470
Code: 3f 7a fd fa 0f 0b e8 24 14 13 fb 48 c7 c7 a0 52 f1 87 e8 2c 7a fd fa
0f 0b e8 11 14 13 fb 48 c7 c7 a0 52 f1 87 e8 19 7a fd fa <0f> 0b 90 90 90
55 48 89 e5 41 57 49 89 ff 41 56 41 55 41 54 53 48
RSP: 0018:ffff88809bd77ce8 EFLAGS: 00010282
RAX: 0000000000000017 RBX: ffff8880a5f6c938 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8155cdd6 RDI: ffffed10137aef8f
RBP: ffff88809bd77d30 R08: 0000000000000017 R09: ffffed1015d25079
R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: ffff8880a5f6c1c8
R13: ffff88809f1d0748 R14: ffff8880a5f6c900 R15: ffff888094baca00
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 000000008c0c2000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
process_one_work+0x989/0x1750 kernel/workqueue.c:2153
worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace 3dcbb8a41ecb67e8 ]---
RIP: 0010:rxrpc_local_destroyer net/rxrpc/local_object.c:437 [inline]
RIP: 0010:rxrpc_local_processor.cold+0x24/0x29 net/rxrpc/local_object.c:470
Code: 3f 7a fd fa 0f 0b e8 24 14 13 fb 48 c7 c7 a0 52 f1 87 e8 2c 7a fd fa
0f 0b e8 11 14 13 fb 48 c7 c7 a0 52 f1 87 e8 19 7a fd fa <0f> 0b 90 90 90
55 48 89 e5 41 57 49 89 ff 41 56 41 55 41 54 53 48
RSP: 0018:ffff88809bd77ce8 EFLAGS: 00010282
RAX: 0000000000000017 RBX: ffff8880a5f6c938 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8155cdd6 RDI: ffffed10137aef8f
RBP: ffff88809bd77d30 R08: 0000000000000017 R09: ffffe

syzbot

unread,
Mar 27, 2020, 3:23:04 PM3/27/20
to syzkaller...@googlegroups.com
syzbot suspects this bug was fixed by commit:

commit 792668145b56165fd113f318f531e499a23e9a52
Author: David Howells <dhow...@redhat.com>
Date: Thu Aug 29 13:12:11 2019 +0000

rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2]

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14cc6025e00000
start commit: dc4ba5be Linux 4.19.97
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=cc17a984a7e9c2f3
dashboard link: https://syzkaller.appspot.com/bug?extid=45bb3012919c888fa10d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1161f959e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1715dfaee00000

If the result looks correct, please mark the bug fixed by replying with:

#syz fix: rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2]

For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages