WARNING in hsr_addr_subst_dest
26 views
Skip to first unread message
syzbot
Apr 13, 2019, 12:23:10 AM4/13/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1145774b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=5e945d5336866aa7f96b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+5e945d...@syzkaller.appspotmail.com
tc_ctl_action: received NO action attribs
hsr_addr_subst_dest: Unknown node
skbuff: bad partial csum: csum=0/65535 len=14
------------[ cut here ]------------
WARNING: CPU: 1 PID: 30739 at net/hsr/hsr_framereg.c:313
hsr_addr_subst_dest.cold+0x45/0x4f net/hsr/hsr_framereg.c:313
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 30739 Comm: syz-executor.0 Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
panic+0x1f2/0x438 kernel/panic.c:182
__warn.cold+0x2f/0x34 kernel/panic.c:546
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
RIP: 0010:hsr_addr_subst_dest.cold+0x45/0x4f net/hsr/hsr_framereg.c:313
RSP: 0018:ffff88806b1ff158 EFLAGS: 00010282
RAX: 0000000000000021 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000007fc1 RSI: ffffffff814b2a55 RDI: ffffed100d63fe21
RBP: ffff88806b1ff198 R08: 0000000000000021 R09: ffff8880986d6d60
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880719a3520
R13: 00000000aaaaaaaa R14: ffff8880719a3520 R15: 000000000000aaaa
hsr_xmit net/hsr/hsr_forward.c:230 [inline]
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0x1025/0x1940 net/hsr/hsr_forward.c:373
hsr_dev_xmit+0x72/0xa0 net/hsr/hsr_device.c:242
__netdev_start_xmit include/linux/netdevice.h:4033 [inline]
netdev_start_xmit include/linux/netdevice.h:4042 [inline]
xmit_one net/core/dev.c:3009 [inline]
dev_hard_start_xmit+0x191/0x8c0 net/core/dev.c:3025
__dev_queue_xmit+0x1da3/0x25f0 net/core/dev.c:3525
dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
br_dev_queue_push_xmit+0x367/0x530 net/bridge/br_forward.c:55
NF_HOOK include/linux/netfilter.h:250 [inline]
NF_HOOK include/linux/netfilter.h:244 [inline]
br_forward_finish+0xbc/0x320 net/bridge/br_forward.c:67
NF_HOOK include/linux/netfilter.h:250 [inline]
NF_HOOK include/linux/netfilter.h:244 [inline]
__br_forward+0x560/0x9c0 net/bridge/br_forward.c:111
deliver_clone+0x61/0xc0 net/bridge/br_forward.c:127
maybe_deliver net/bridge/br_forward.c:168 [inline]
maybe_deliver net/bridge/br_forward.c:156 [inline]
br_flood+0x3c8/0x530 net/bridge/br_forward.c:210
br_dev_xmit+0x8dc/0xd50 net/bridge/br_device.c:87
__netdev_start_xmit include/linux/netdevice.h:4033 [inline]
netdev_start_xmit include/linux/netdevice.h:4042 [inline]
xmit_one net/core/dev.c:3009 [inline]
dev_hard_start_xmit+0x191/0x8c0 net/core/dev.c:3025
__dev_queue_xmit+0x1da3/0x25f0 net/core/dev.c:3525
dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
pppoe_sendmsg+0x5cf/0x730 drivers/net/ppp/pppoe.c:906
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xd0/0x110 net/socket.c:656
___sys_sendmsg+0x349/0x850 net/socket.c:2062
__sys_sendmmsg+0x152/0x3a0 net/socket.c:2152
SYSC_sendmmsg net/socket.c:2183 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2178
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x458c29
RSP: 002b:00007f3a34cefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458c29
RDX: 04000000000000eb RSI: 000000002000d180 RDI: 0000000000000005
kobject: 'loop4' (ffff8880a4a782a0): kobject_uevent_env
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a34cf06d4
R13: 00000000004c5e19 R14: 00000000004da5e0 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1145774b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=5e945d5336866aa7f96b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+5e945d...@syzkaller.appspotmail.com
tc_ctl_action: received NO action attribs
hsr_addr_subst_dest: Unknown node
skbuff: bad partial csum: csum=0/65535 len=14
------------[ cut here ]------------
WARNING: CPU: 1 PID: 30739 at net/hsr/hsr_framereg.c:313
hsr_addr_subst_dest.cold+0x45/0x4f net/hsr/hsr_framereg.c:313
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 30739 Comm: syz-executor.0 Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
panic+0x1f2/0x438 kernel/panic.c:182
__warn.cold+0x2f/0x34 kernel/panic.c:546
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
RIP: 0010:hsr_addr_subst_dest.cold+0x45/0x4f net/hsr/hsr_framereg.c:313
RSP: 0018:ffff88806b1ff158 EFLAGS: 00010282
RAX: 0000000000000021 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000007fc1 RSI: ffffffff814b2a55 RDI: ffffed100d63fe21
RBP: ffff88806b1ff198 R08: 0000000000000021 R09: ffff8880986d6d60
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880719a3520
R13: 00000000aaaaaaaa R14: ffff8880719a3520 R15: 000000000000aaaa
hsr_xmit net/hsr/hsr_forward.c:230 [inline]
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0x1025/0x1940 net/hsr/hsr_forward.c:373
hsr_dev_xmit+0x72/0xa0 net/hsr/hsr_device.c:242
__netdev_start_xmit include/linux/netdevice.h:4033 [inline]
netdev_start_xmit include/linux/netdevice.h:4042 [inline]
xmit_one net/core/dev.c:3009 [inline]
dev_hard_start_xmit+0x191/0x8c0 net/core/dev.c:3025
__dev_queue_xmit+0x1da3/0x25f0 net/core/dev.c:3525
dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
br_dev_queue_push_xmit+0x367/0x530 net/bridge/br_forward.c:55
NF_HOOK include/linux/netfilter.h:250 [inline]
NF_HOOK include/linux/netfilter.h:244 [inline]
br_forward_finish+0xbc/0x320 net/bridge/br_forward.c:67
NF_HOOK include/linux/netfilter.h:250 [inline]
NF_HOOK include/linux/netfilter.h:244 [inline]
__br_forward+0x560/0x9c0 net/bridge/br_forward.c:111
deliver_clone+0x61/0xc0 net/bridge/br_forward.c:127
maybe_deliver net/bridge/br_forward.c:168 [inline]
maybe_deliver net/bridge/br_forward.c:156 [inline]
br_flood+0x3c8/0x530 net/bridge/br_forward.c:210
br_dev_xmit+0x8dc/0xd50 net/bridge/br_device.c:87
__netdev_start_xmit include/linux/netdevice.h:4033 [inline]
netdev_start_xmit include/linux/netdevice.h:4042 [inline]
xmit_one net/core/dev.c:3009 [inline]
dev_hard_start_xmit+0x191/0x8c0 net/core/dev.c:3025
__dev_queue_xmit+0x1da3/0x25f0 net/core/dev.c:3525
dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
pppoe_sendmsg+0x5cf/0x730 drivers/net/ppp/pppoe.c:906
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xd0/0x110 net/socket.c:656
___sys_sendmsg+0x349/0x850 net/socket.c:2062
__sys_sendmmsg+0x152/0x3a0 net/socket.c:2152
SYSC_sendmmsg net/socket.c:2183 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2178
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x458c29
RSP: 002b:00007f3a34cefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458c29
RDX: 04000000000000eb RSI: 000000002000d180 RDI: 0000000000000005
kobject: 'loop4' (ffff8880a4a782a0): kobject_uevent_env
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a34cf06d4
R13: 00000000004c5e19 R14: 00000000004da5e0 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Apr 14, 2019, 2:01:05 PM4/14/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 4d552acf Linux 4.19.34
syzbot found the following crash on:
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1615f6d3200000
kernel config: https://syzkaller.appspot.com/x/.config?x=c95a88291f095edd
dashboard link: https://syzkaller.appspot.com/bug?extid=3f8f642174b51d0113d0
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3f8f64...@syzkaller.appspotmail.com
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
------------[ cut here ]------------
hsr_addr_subst_dest: Unknown node
WARNING: CPU: 1 PID: 20532 at net/hsr/hsr_framereg.c:313
hsr_addr_subst_dest+0x382/0x460 net/hsr/hsr_framereg.c:313
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 20532 Comm: syz-executor.3 Not tainted 4.19.34 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
Google 01/01/2011
Call Trace:
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x263/0x51d kernel/panic.c:185
__warn.cold+0x20/0x54 kernel/panic.c:540
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:997
RIP: 0010:hsr_addr_subst_dest+0x382/0x460 net/hsr/hsr_framereg.c:313
Code: 89 de e8 71 a9 85 fa 84 db 75 d3 e8 28 a8 85 fa 48 c7 c6 c0 5c fa 87
48 c7 c7 80 5c fa 87 c6 05 08 5a 50 02 01 e8 2c 83 59 fa <0f> 0b eb b0 e8
05 a8 85 fa 0f b6 1d f4 59 50 02 31 ff 89 de e8 35
RSP: 0018:ffff8881dec4efb0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000010581 RSI: ffffffff8155d206 RDI: ffffed103bd89de8
RBP: ffff8881dec4eff0 R08: ffff88805b1225c0 R09: ffff88805b122e60
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880643b4f20
R13: 00000000aaaaaaaa R14: 000000000000a600 R15: 000000000000aaaa
hsr_xmit net/hsr/hsr_forward.c:230 [inline]
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0x1276/0x1c10 net/hsr/hsr_forward.c:373
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_dev_xmit+0x72/0xa0 net/hsr/hsr_device.c:242
__netdev_start_xmit include/linux/netdevice.h:4300 [inline]
netdev_start_xmit include/linux/netdevice.h:4309 [inline]
xmit_one net/core/dev.c:3243 [inline]
dev_hard_start_xmit+0x1aa/0x980 net/core/dev.c:3259
__dev_queue_xmit+0x2718/0x3020 net/core/dev.c:3829
dev_queue_xmit+0x18/0x20 net/core/dev.c:3862
br_dev_queue_push_xmit+0x405/0x5f0 net/bridge/br_forward.c:56
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
br_forward_finish+0xfa/0x400 net/bridge/br_forward.c:69
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
__br_forward+0x647/0xb30 net/bridge/br_forward.c:113
deliver_clone+0x61/0xc0 net/bridge/br_forward.c:129
maybe_deliver net/bridge/br_forward.c:184 [inline]
maybe_deliver net/bridge/br_forward.c:172 [inline]
br_flood+0x4da/0x710 net/bridge/br_forward.c:226
br_dev_xmit+0xe74/0x1490 net/bridge/br_device.c:107
__netdev_start_xmit include/linux/netdevice.h:4300 [inline]
netdev_start_xmit include/linux/netdevice.h:4309 [inline]
xmit_one net/core/dev.c:3243 [inline]
dev_hard_start_xmit+0x1aa/0x980 net/core/dev.c:3259
__dev_queue_xmit+0x2718/0x3020 net/core/dev.c:3829
dev_queue_xmit+0x18/0x20 net/core/dev.c:3862
pppoe_sendmsg+0x657/0x7e0 drivers/net/ppp/pppoe.c:904
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xdd/0x130 net/socket.c:632
___sys_sendmsg+0x3e2/0x930 net/socket.c:2115
__sys_sendmmsg+0x1bf/0x4e0 net/socket.c:2210
__do_sys_sendmmsg net/socket.c:2239 [inline]
__se_sys_sendmmsg net/socket.c:2236 [inline]
__x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2236
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458c29
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fb208d64c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458c29
RDX: 04000000000000eb RSI: 000000002000d180 RDI: 0000000000000005
RDX: 04000000000000eb RSI: 000000002000d180 RDI: 0000000000000005
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb208d656d4
syzbot
Apr 16, 2019, 12:09:06 PM4/16/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13c2026b200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b6795b200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+5e945d...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
hsr_addr_subst_dest: Unknown node
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6872 at net/hsr/hsr_framereg.c:313
RBP: ffff88807b6d76d8 R08: 0000000000000021 R09: ffff888075158960
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a84d2ce0
R13: 0000000000000000 R14: ffff8880a84d2ce0 R15: 0000000000000000
RSP: 002b:00007ffe6d71abb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441929
RDX: 0400000000000191 RSI: 000000002000d180 RDI: 0000000000000003
RBP: 00000000004a8fd0 R08: 0000000001bbbbbb R09: 0000000001bbbbbb
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402e70
R13: 0000000000402f00 R14: 0000000000000000 R15: 0000000000000000
HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=5e945d5336866aa7f96b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1133b5e3200000
dashboard link: https://syzkaller.appspot.com/bug?extid=5e945d5336866aa7f96b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b6795b200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+5e945d...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
hsr_addr_subst_dest: Unknown node
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6872 at net/hsr/hsr_framereg.c:313
hsr_addr_subst_dest.cold+0x45/0x4f net/hsr/hsr_framereg.c:313
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 6872 Comm: syz-executor680 Not tainted 4.14.111 #1
Kernel panic - not syncing: panic_on_warn set ...
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
panic+0x1f2/0x438 kernel/panic.c:182
__warn.cold+0x2f/0x34 kernel/panic.c:546
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
RIP: 0010:hsr_addr_subst_dest.cold+0x45/0x4f net/hsr/hsr_framereg.c:313
RSP: 0018:ffff88807b6d7698 EFLAGS: 00010286
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
panic+0x1f2/0x438 kernel/panic.c:182
__warn.cold+0x2f/0x34 kernel/panic.c:546
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
RIP: 0010:hsr_addr_subst_dest.cold+0x45/0x4f net/hsr/hsr_framereg.c:313
RAX: 0000000000000021 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff866d0860 RDI: ffffed100f6daec9
RBP: ffff88807b6d76d8 R08: 0000000000000021 R09: ffff888075158960
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a84d2ce0
R13: 0000000000000000 R14: ffff8880a84d2ce0 R15: 0000000000000000
hsr_xmit net/hsr/hsr_forward.c:230 [inline]
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0x1025/0x1940 net/hsr/hsr_forward.c:373
hsr_dev_xmit+0x72/0xa0 net/hsr/hsr_device.c:242
__netdev_start_xmit include/linux/netdevice.h:4033 [inline]
netdev_start_xmit include/linux/netdevice.h:4042 [inline]
xmit_one net/core/dev.c:3009 [inline]
dev_hard_start_xmit+0x191/0x8c0 net/core/dev.c:3025
__dev_queue_xmit+0x1da3/0x25f0 net/core/dev.c:3525
dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0x1025/0x1940 net/hsr/hsr_forward.c:373
hsr_dev_xmit+0x72/0xa0 net/hsr/hsr_device.c:242
__netdev_start_xmit include/linux/netdevice.h:4033 [inline]
netdev_start_xmit include/linux/netdevice.h:4042 [inline]
xmit_one net/core/dev.c:3009 [inline]
dev_hard_start_xmit+0x191/0x8c0 net/core/dev.c:3025
__dev_queue_xmit+0x1da3/0x25f0 net/core/dev.c:3525
dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
pppoe_sendmsg+0x5cf/0x730 drivers/net/ppp/pppoe.c:906
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xd0/0x110 net/socket.c:656
___sys_sendmsg+0x349/0x850 net/socket.c:2062
__sys_sendmmsg+0x152/0x3a0 net/socket.c:2152
SYSC_sendmmsg net/socket.c:2183 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2178
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441929
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xd0/0x110 net/socket.c:656
___sys_sendmsg+0x349/0x850 net/socket.c:2062
__sys_sendmmsg+0x152/0x3a0 net/socket.c:2152
SYSC_sendmmsg net/socket.c:2183 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2178
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RSP: 002b:00007ffe6d71abb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441929
RDX: 0400000000000191 RSI: 000000002000d180 RDI: 0000000000000003
RBP: 00000000004a8fd0 R08: 0000000001bbbbbb R09: 0000000001bbbbbb
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402e70
R13: 0000000000402f00 R14: 0000000000000000 R15: 0000000000000000
syzbot
Apr 17, 2019, 3:58:05 PM4/17/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 4b0e041c Linux 4.19.35
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13395ca0a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=bb1bcac868b1655e
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10fe752d200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3f8f64...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
48 c7 c7 00 5f fa 87 c6 05 fb 99 50 02 01 e8 3c bb 59 fa <0f> 0b eb b0 e8
05 df 85 fa 0f b6 1d e7 99 50 02 31 ff 89 de e8 35
RSP: 0018:ffff888076caf600 EFLAGS: 00010282
RBP: ffff888076caf640 R08: ffff8880a3df2700 R09: ffffed1015d03ee3
R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: ffff888072d5b5a0
R13: 00000000aaaaaaaa R14: 0000000089027aae R15: 000000000000aaaa
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7
RSP: 002b:00007ffdbf3c1048 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441929
RDX: 04000000000000eb RSI: 000000002000d180 RDI: 0000000000000003
HEAD commit: 4b0e041c Linux 4.19.35
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13395ca0a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=bb1bcac868b1655e
dashboard link: https://syzkaller.appspot.com/bug?extid=3f8f642174b51d0113d0
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=131b2be3200000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10fe752d200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3f8f64...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
8021q: adding VLAN 0 to HW filter on device batadv0
------------[ cut here ]------------
hsr_addr_subst_dest: Unknown node
WARNING: CPU: 0 PID: 8196 at net/hsr/hsr_framereg.c:313
hsr_addr_subst_dest: Unknown node
hsr_addr_subst_dest+0x382/0x460 net/hsr/hsr_framereg.c:313
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 8196 Comm: syz-executor359 Not tainted 4.19.35 #3
Kernel panic - not syncing: panic_on_warn set ...
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x263/0x51d kernel/panic.c:185
__warn.cold+0x20/0x54 kernel/panic.c:540
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:997
RIP: 0010:hsr_addr_subst_dest+0x382/0x460 net/hsr/hsr_framereg.c:313
Code: 89 de e8 71 e0 85 fa 84 db 75 d3 e8 28 df 85 fa 48 c7 c6 40 5f fa 87
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x263/0x51d kernel/panic.c:185
__warn.cold+0x20/0x54 kernel/panic.c:540
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:997
RIP: 0010:hsr_addr_subst_dest+0x382/0x460 net/hsr/hsr_framereg.c:313
48 c7 c7 00 5f fa 87 c6 05 fb 99 50 02 01 e8 3c bb 59 fa <0f> 0b eb b0 e8
05 df 85 fa 0f b6 1d e7 99 50 02 31 ff 89 de e8 35
RSP: 0018:ffff888076caf600 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8155cf26 RDI: ffffed100ed95eb2
RBP: ffff888076caf640 R08: ffff8880a3df2700 R09: ffffed1015d03ee3
R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: ffff888072d5b5a0
R13: 00000000aaaaaaaa R14: 0000000089027aae R15: 000000000000aaaa
hsr_xmit net/hsr/hsr_forward.c:230 [inline]
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0x1276/0x1c10 net/hsr/hsr_forward.c:373
hsr_dev_xmit+0x72/0xa0 net/hsr/hsr_device.c:242
__netdev_start_xmit include/linux/netdevice.h:4300 [inline]
netdev_start_xmit include/linux/netdevice.h:4309 [inline]
xmit_one net/core/dev.c:3243 [inline]
dev_hard_start_xmit+0x1aa/0x980 net/core/dev.c:3259
__dev_queue_xmit+0x2718/0x3020 net/core/dev.c:3829
dev_queue_xmit+0x18/0x20 net/core/dev.c:3862
hsr_forward_do net/hsr/hsr_forward.c:295 [inline]
hsr_forward_skb+0x1276/0x1c10 net/hsr/hsr_forward.c:373
hsr_dev_xmit+0x72/0xa0 net/hsr/hsr_device.c:242
__netdev_start_xmit include/linux/netdevice.h:4300 [inline]
netdev_start_xmit include/linux/netdevice.h:4309 [inline]
xmit_one net/core/dev.c:3243 [inline]
dev_hard_start_xmit+0x1aa/0x980 net/core/dev.c:3259
__dev_queue_xmit+0x2718/0x3020 net/core/dev.c:3829
dev_queue_xmit+0x18/0x20 net/core/dev.c:3862
pppoe_sendmsg+0x657/0x7e0 drivers/net/ppp/pppoe.c:904
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xdd/0x130 net/socket.c:632
___sys_sendmsg+0x3e2/0x930 net/socket.c:2115
__sys_sendmmsg+0x1bf/0x4e0 net/socket.c:2210
__do_sys_sendmmsg net/socket.c:2239 [inline]
__se_sys_sendmmsg net/socket.c:2236 [inline]
__x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2236
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441929
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xdd/0x130 net/socket.c:632
___sys_sendmsg+0x3e2/0x930 net/socket.c:2115
__sys_sendmmsg+0x1bf/0x4e0 net/socket.c:2210
__do_sys_sendmmsg net/socket.c:2239 [inline]
__se_sys_sendmmsg net/socket.c:2236 [inline]
__x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2236
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 bb 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffdbf3c1048 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441929
RDX: 04000000000000eb RSI: 000000002000d180 RDI: 0000000000000003
RBP: 00000000004a8fd0 R08: 0000000001bbbbbb R09: 0000000001bbbbbb
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402e70
R13: 0000000000402f00 R14: 0000000000000000 R15: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402e70
R13: 0000000000402f00 R14: 0000000000000000 R15: 0000000000000000
syzbot
Jun 21, 2021, 11:35:10 AM6/21/21
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 40fa36443db3ddb570e5e5f27c44d23d680f9d1b
Author: Taehee Yoo <ap42...@gmail.com>
Date: Fri Feb 28 18:01:46 2020 +0000
hsr: use netdev_err() instead of WARN_ONCE()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14eda82c300000
start commit: 3c8c2309 Linux 4.19.190
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=d3c2572d41264a3d
dashboard link: https://syzkaller.appspot.com/bug?extid=3f8f642174b51d0113d0
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15e6118bd00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f84223d00000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: hsr: use netdev_err() instead of WARN_ONCE()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 40fa36443db3ddb570e5e5f27c44d23d680f9d1b
Author: Taehee Yoo <ap42...@gmail.com>
Date: Fri Feb 28 18:01:46 2020 +0000
hsr: use netdev_err() instead of WARN_ONCE()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14eda82c300000
start commit: 3c8c2309 Linux 4.19.190
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=d3c2572d41264a3d
dashboard link: https://syzkaller.appspot.com/bug?extid=3f8f642174b51d0113d0
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15e6118bd00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f84223d00000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: hsr: use netdev_err() instead of WARN_ONCE()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages