kernel BUG in rxrpc_new_incoming_call
7 views
Skip to first unread message
syzbot
Feb 19, 2023, 7:12:50 PM2/19/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=112ddaab480000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=a9af0843a79dcc8069cd
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a9af08...@syzkaller.appspotmail.com
audit: type=1804 audit(1676851898.726:421): pid=14491 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir2237101494/syzkaller.Hm8bHp/98/file0/bus" dev="loop4" ino=41 res=1
XFS (loop3): Mounting V4 Filesystem
XFS (loop3): Ending clean mount
------------[ cut here ]------------
kernel BUG at net/rxrpc/call_accept.c:432!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 14562 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RSP: 0018:ffff88804cb1f270 EFLAGS: 00010293
RAX: ffff88804740e680 RBX: ffff8880b2bf26c0 RCX: ffffffff8756f7eb
RDX: 0000000000000000 RSI: ffffffff87570fb0 RDI: 0000000000000005
RBP: ffff888095600d80 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff8880af320dc0
R13: ffff888095600480 R14: ffff888095601008 R15: 0000000000000004
FS: 00007f1bd75e2700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f33e5a68710 CR3: 00000000b2945000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
rxrpc_input_packet+0x2241/0x5350 net/rxrpc/input.c:1411
udp_queue_rcv_skb+0x8d2/0x1a70 net/ipv4/udp.c:1977
__udp4_lib_mcast_deliver net/ipv4/udp.c:2121 [inline]
__udp4_lib_rcv+0x262a/0x3180 net/ipv4/udp.c:2252
ip_local_deliver_finish+0x495/0xc00 net/ipv4/ip_input.c:215
NF_HOOK include/linux/netfilter.h:289 [inline]
ip_local_deliver+0x188/0x500 net/ipv4/ip_input.c:256
dst_input include/net/dst.h:461 [inline]
ip_rcv_finish+0x1ca/0x2e0 net/ipv4/ip_input.c:414
NF_HOOK include/linux/netfilter.h:289 [inline]
ip_rcv+0xca/0x3c0 net/ipv4/ip_input.c:524
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954
__netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066
netif_receive_skb_internal+0xf0/0x3f0 net/core/dev.c:5156
tun_rx_batched.isra.0+0x472/0x740 drivers/net/tun.c:1543
tun_get_user+0x2ee5/0x5100 drivers/net/tun.c:1974
tun_chr_write_iter+0xdb/0x1d0 drivers/net/tun.c:2007
call_write_iter include/linux/fs.h:1821 [inline]
new_sync_write fs/read_write.c:474 [inline]
__vfs_write+0x51b/0x770 fs/read_write.c:487
vfs_write+0x1f3/0x540 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1bdf463e7f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f1bd75e2130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1bdf5d2120 RCX: 00007f1bdf463e7f
RDX: 0000000000000086 RSI: 00000000200000c0 RDI: 00000000000000c8
RBP: 00007f1bdf50dae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000086 R11: 0000000000000293 R12: 0000000000000000
R13: 00007ffe22dd19ff R14: 00007f1bd75e2300 R15: 0000000000022000
Modules linked in:
---[ end trace 233a71e9fddba65d ]---
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RSP: 0018:ffff88804cb1f270 EFLAGS: 00010293
RAX: ffff88804740e680 RBX: ffff8880b2bf26c0 RCX: ffffffff8756f7eb
RDX: 0000000000000000 RSI: ffffffff87570fb0 RDI: 0000000000000005
RBP: ffff888095600d80 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff8880af320dc0
R13: ffff888095600480 R14: ffff888095601008 R15: 0000000000000004
FS: 00007f1bd75e2700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f33e5a68710 CR3: 00000000b2945000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=112ddaab480000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=a9af0843a79dcc8069cd
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a9af08...@syzkaller.appspotmail.com
audit: type=1804 audit(1676851898.726:421): pid=14491 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir2237101494/syzkaller.Hm8bHp/98/file0/bus" dev="loop4" ino=41 res=1
XFS (loop3): Mounting V4 Filesystem
XFS (loop3): Ending clean mount
------------[ cut here ]------------
kernel BUG at net/rxrpc/call_accept.c:432!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 14562 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RSP: 0018:ffff88804cb1f270 EFLAGS: 00010293
RAX: ffff88804740e680 RBX: ffff8880b2bf26c0 RCX: ffffffff8756f7eb
RDX: 0000000000000000 RSI: ffffffff87570fb0 RDI: 0000000000000005
RBP: ffff888095600d80 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff8880af320dc0
R13: ffff888095600480 R14: ffff888095601008 R15: 0000000000000004
FS: 00007f1bd75e2700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f33e5a68710 CR3: 00000000b2945000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
rxrpc_input_packet+0x2241/0x5350 net/rxrpc/input.c:1411
udp_queue_rcv_skb+0x8d2/0x1a70 net/ipv4/udp.c:1977
__udp4_lib_mcast_deliver net/ipv4/udp.c:2121 [inline]
__udp4_lib_rcv+0x262a/0x3180 net/ipv4/udp.c:2252
ip_local_deliver_finish+0x495/0xc00 net/ipv4/ip_input.c:215
NF_HOOK include/linux/netfilter.h:289 [inline]
ip_local_deliver+0x188/0x500 net/ipv4/ip_input.c:256
dst_input include/net/dst.h:461 [inline]
ip_rcv_finish+0x1ca/0x2e0 net/ipv4/ip_input.c:414
NF_HOOK include/linux/netfilter.h:289 [inline]
ip_rcv+0xca/0x3c0 net/ipv4/ip_input.c:524
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954
__netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066
netif_receive_skb_internal+0xf0/0x3f0 net/core/dev.c:5156
tun_rx_batched.isra.0+0x472/0x740 drivers/net/tun.c:1543
tun_get_user+0x2ee5/0x5100 drivers/net/tun.c:1974
tun_chr_write_iter+0xdb/0x1d0 drivers/net/tun.c:2007
call_write_iter include/linux/fs.h:1821 [inline]
new_sync_write fs/read_write.c:474 [inline]
__vfs_write+0x51b/0x770 fs/read_write.c:487
vfs_write+0x1f3/0x540 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1bdf463e7f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f1bd75e2130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1bdf5d2120 RCX: 00007f1bdf463e7f
RDX: 0000000000000086 RSI: 00000000200000c0 RDI: 00000000000000c8
RBP: 00007f1bdf50dae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000086 R11: 0000000000000293 R12: 0000000000000000
R13: 00007ffe22dd19ff R14: 00007f1bd75e2300 R15: 0000000000022000
Modules linked in:
---[ end trace 233a71e9fddba65d ]---
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RSP: 0018:ffff88804cb1f270 EFLAGS: 00010293
RAX: ffff88804740e680 RBX: ffff8880b2bf26c0 RCX: ffffffff8756f7eb
RDX: 0000000000000000 RSI: ffffffff87570fb0 RDI: 0000000000000005
RBP: ffff888095600d80 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff8880af320dc0
R13: ffff888095600480 R14: ffff888095601008 R15: 0000000000000004
FS: 00007f1bd75e2700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f33e5a68710 CR3: 00000000b2945000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Feb 19, 2023, 8:56:47 PM2/19/23
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1209a378c80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/3708c0f111f2/mount_1.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a9af08...@syzkaller.appspotmail.com
XFS (loop1): Mounting V4 Filesystem
XFS (loop5): Mounting V4 Filesystem
RAX: ffff88809cb68480 RBX: ffff8880958a46c0 RCX: ffffffff8756f7eb
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888094df8dc0
R13: ffff8880abd72900 R14: ffff8880abd72288 R15: 0000000000000004
FS: 00007f1b021b2700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
RIP: 0033:0x7f1b02e12e7f
RAX: ffffffffffffffda RBX: 00007f1b02f81050 RCX: 00007f1b02e12e7f
Modules linked in:
---[ end trace f0597b44549ea042 ]---
RAX: ffff88809cb68480 RBX: ffff8880958a46c0 RCX: ffffffff8756f7eb
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888094df8dc0
R13: ffff8880abd72900 R14: ffff8880abd72288 R15: 0000000000000004
FS: 00007f1b021b2700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=a9af0843a79dcc8069cd
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16c4e040c80000
dashboard link: https://syzkaller.appspot.com/bug?extid=a9af0843a79dcc8069cd
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a9af08...@syzkaller.appspotmail.com
XFS (loop5): Mounting V4 Filesystem
XFS (loop3): Ending clean mount
XFS (loop1): Ending clean mount
------------[ cut here ]------------
kernel BUG at net/rxrpc/call_accept.c:432!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9674 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
kernel BUG at net/rxrpc/call_accept.c:432!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RSP: 0018:ffff88809bc17270 EFLAGS: 00010293
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RAX: ffff88809cb68480 RBX: ffff8880958a46c0 RCX: ffffffff8756f7eb
RDX: 0000000000000000 RSI: ffffffff87570fb0 RDI: 0000000000000005
RBP: ffff8880abd72000 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888094df8dc0
R13: ffff8880abd72900 R14: ffff8880abd72288 R15: 0000000000000004
FS: 00007f1b021b2700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b021b0ff8 CR3: 000000009edfa000 CR4: 00000000003406f0
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f1b021b2130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1b02f81050 RCX: 00007f1b02e12e7f
RDX: 0000000000000086 RSI: 00000000200000c0 RDI: 00000000000000c8
RBP: 00007f1b02ebcae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000086 R11: 0000000000000293 R12: 0000000000000000
R13: 00007ffc3011aaef R14: 00007f1b021b2300 R15: 0000000000022000
Modules linked in:
---[ end trace f0597b44549ea042 ]---
RIP: 0010:rxrpc_new_incoming_call+0x1db0/0x2040 net/rxrpc/call_accept.c:432
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RSP: 0018:ffff88809bc17270 EFLAGS: 00010293
Code: 41 fa e9 94 e7 ff ff e8 ce 52 41 fa e9 b1 e7 ff ff e8 c4 52 41 fa e9 df e7 ff ff e8 2a 52 41 fa e9 2b e8 ff ff e8 c0 75 0b fa <0f> 0b e8 b9 75 0b fa 0f 0b e8 a2 52 41 fa e9 71 e5 ff ff 48 89 cf
RAX: ffff88809cb68480 RBX: ffff8880958a46c0 RCX: ffffffff8756f7eb
RDX: 0000000000000000 RSI: ffffffff87570fb0 RDI: 0000000000000005
RBP: ffff8880abd72000 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888094df8dc0
R13: ffff8880abd72900 R14: ffff8880abd72288 R15: 0000000000000004
FS: 00007f1b021b2700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b021b0ff8 CR3: 000000009edfa000 CR4: 00000000003406f0
Reply all
Reply to author
Forward
0 new messages