Hello,
syzbot found the following crash on:
HEAD commit: 596cf45c Merge branch 'akpm' (patches from Andrew)
git tree: net-next
console output:
https://syzkaller.appspot.com/x/log.txt?x=150aeca6e00000
kernel config:
https://syzkaller.appspot.com/x/.config?x=da7be58727ceb6f7
dashboard link:
https://syzkaller.appspot.com/bug?extid=589fed0baead6b45dfbe
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [
bri...@lists.linux-foundation.org core...@netfilter.org
da...@davemloft.net f...@strlen.de kad...@netfilter.org
linux-...@vger.kernel.org net...@vger.kernel.org
netfilt...@vger.kernel.org nik...@cumulusnetworks.com
pa...@netfilter.org ro...@cumulusnetworks.com net...@vger.kernel.org]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by:
syzbot+589fed...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:br_nf_pre_routing_finish+0x232/0x1790
net/bridge/br_netfilter_hooks.c:360
Code: 83 c0 01 38 d0 7c 08 84 d2 0f 85 bb 0f 00 00 48 8d 7b 02 45 0f b7 7c
24 3e 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48
89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 9b
RSP: 0018:ffffc90000cff640 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff86e2b627
RDX: 0000000000000000 RSI: ffffffff86e2b698 RDI: 0000000000000002
RBP: ffffc90000cff798 R08: ffff8880a99fa240 R09: ffff8880a99faad0
R10: fffffbfff14b1b88 R11: ffffffff8a58dc47 R12: ffff8880950610c0
R13: 0000000000000010 R14: 0000000000000002 R15: 00000000000005dc
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f60dbdcb000 CR3: 000000007081d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
br_nf_pre_routing+0xc7d/0x22b3 net/bridge/br_netfilter_hooks.c:531
nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:224 [inline]
br_handle_frame+0x806/0x1340 net/bridge/br_input.c:349
__netif_receive_skb_core+0xfbc/0x30b0 net/core/dev.c:5051
__netif_receive_skb_one_core+0xa8/0x1a0 net/core/dev.c:5148
__netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5264
process_backlog+0x206/0x750 net/core/dev.c:6095
napi_poll net/core/dev.c:6532 [inline]
net_rx_action+0x508/0x1120 net/core/dev.c:6600
__do_softirq+0x262/0x98c kernel/softirq.c:292
run_ksoftirqd kernel/softirq.c:603 [inline]
run_ksoftirqd+0x8e/0x110 kernel/softirq.c:595
smpboot_thread_fn+0x6a3/0xa40 kernel/smpboot.c:165
kthread+0x361/0x430 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 9 at kernel/locking/mutex.c:1419
mutex_trylock+0x279/0x2f0 kernel/locking/mutex.c:1427
---
This bug is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.