[syzbot] [usb?] general protection fault in status_show
12 views
Skip to first unread message
syzbot
Jan 17, 2025, 1:14:25 AM1/17/25
to gre...@linuxfoundation.org, i...@zenithal.me, linux-...@vger.kernel.org, linu...@vger.kernel.org, sh...@kernel.org, syzkall...@googlegroups.com, valentin...@gmail.com
Hello,
syzbot found the following issue on:
HEAD commit: be548645527a Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=105adbc4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad08f7f48e13abcd
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=179bbef8580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d51cb0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/68edb33a6611/disk-be548645.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9c748ff58068/vmlinux-be548645.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6ae2859fc0e3/bzImage-be548645.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83976e...@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000081: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000408-0x000000000000040f]
CPU: 0 UID: 0 PID: 5830 Comm: syz-executor351 Not tainted 6.13.0-rc6-syzkaller-00290-gbe548645527a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:status_show_vhci drivers/usb/usbip/vhci_sysfs.c:80 [inline]
RIP: 0010:status_show+0x306/0x5a0 drivers/usb/usbip/vhci_sysfs.c:160
Code: 03 80 3c 02 00 0f 85 9c 02 00 00 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 08 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7d 02 00 00 4c 8b ab 08 04 00 00 c1 e5 04 41 bf
RSP: 0018:ffffc90003cbfad8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87534bb9
RDX: 0000000000000081 RSI: ffffffff87534d75 RDI: 0000000000000408
RBP: 000000000000000f R08: 0000000000000005 R09: 0000000000000000
R10: 000000000000000f R11: 64666b636f732020 R12: ffffc90003cbfb28
R13: ffff888034b8c02d R14: ffffffff87534ab0 R15: ffff888034b8c000
FS: 0000555582a4a380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 0000000035336000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
dev_attr_show+0x53/0xe0 drivers/base/core.c:2423
sysfs_kf_seq_show+0x223/0x3e0 fs/sysfs/file.c:59
seq_read_iter+0x4f4/0x12b0 fs/seq_file.c:230
kernfs_fop_read_iter+0x414/0x580 fs/kernfs/file.c:279
new_sync_read fs/read_write.c:484 [inline]
vfs_read+0x87f/0xbe0 fs/read_write.c:565
ksys_read+0x12b/0x250 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5c749f72e9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffd7fbd308 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fffd7fbd4d8 RCX: 00007f5c749f72e9
RDX: 0000000000000062 RSI: 0000000020001080 RDI: 0000000000000003
RBP: 00007f5c74a6a610 R08: 0000000000000000 R09: 00007fffd7fbd4d8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fffd7fbd4c8 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:status_show_vhci drivers/usb/usbip/vhci_sysfs.c:80 [inline]
RIP: 0010:status_show+0x306/0x5a0 drivers/usb/usbip/vhci_sysfs.c:160
Code: 03 80 3c 02 00 0f 85 9c 02 00 00 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 08 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7d 02 00 00 4c 8b ab 08 04 00 00 c1 e5 04 41 bf
RSP: 0018:ffffc90003cbfad8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87534bb9
RDX: 0000000000000081 RSI: ffffffff87534d75 RDI: 0000000000000408
RBP: 000000000000000f R08: 0000000000000005 R09: 0000000000000000
R10: 000000000000000f R11: 64666b636f732020 R12: ffffc90003cbfb28
R13: ffff888034b8c02d R14: ffffffff87534ab0 R15: ffff888034b8c000
FS: 0000555582a4a380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 0000000035336000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax
6: 85 9c 02 00 00 48 8b test %ebx,-0x74b80000(%rdx,%rax,1)
d: 9b fwait
e: 88 00 mov %al,(%rax)
10: 00 00 add %al,(%rax)
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 48 8d bb 08 04 00 00 lea 0x408(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 7d 02 00 00 jne 0x2b1
34: 4c 8b ab 08 04 00 00 mov 0x408(%rbx),%r13
3b: c1 e5 04 shl $0x4,%ebp
3e: 41 rex.B
3f: bf .byte 0xbf
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: be548645527a Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=105adbc4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad08f7f48e13abcd
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=179bbef8580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d51cb0580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/68edb33a6611/disk-be548645.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9c748ff58068/vmlinux-be548645.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6ae2859fc0e3/bzImage-be548645.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83976e...@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000081: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000408-0x000000000000040f]
CPU: 0 UID: 0 PID: 5830 Comm: syz-executor351 Not tainted 6.13.0-rc6-syzkaller-00290-gbe548645527a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:status_show_vhci drivers/usb/usbip/vhci_sysfs.c:80 [inline]
RIP: 0010:status_show+0x306/0x5a0 drivers/usb/usbip/vhci_sysfs.c:160
Code: 03 80 3c 02 00 0f 85 9c 02 00 00 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 08 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7d 02 00 00 4c 8b ab 08 04 00 00 c1 e5 04 41 bf
RSP: 0018:ffffc90003cbfad8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87534bb9
RDX: 0000000000000081 RSI: ffffffff87534d75 RDI: 0000000000000408
RBP: 000000000000000f R08: 0000000000000005 R09: 0000000000000000
R10: 000000000000000f R11: 64666b636f732020 R12: ffffc90003cbfb28
R13: ffff888034b8c02d R14: ffffffff87534ab0 R15: ffff888034b8c000
FS: 0000555582a4a380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 0000000035336000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
dev_attr_show+0x53/0xe0 drivers/base/core.c:2423
sysfs_kf_seq_show+0x223/0x3e0 fs/sysfs/file.c:59
seq_read_iter+0x4f4/0x12b0 fs/seq_file.c:230
kernfs_fop_read_iter+0x414/0x580 fs/kernfs/file.c:279
new_sync_read fs/read_write.c:484 [inline]
vfs_read+0x87f/0xbe0 fs/read_write.c:565
ksys_read+0x12b/0x250 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5c749f72e9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffd7fbd308 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fffd7fbd4d8 RCX: 00007f5c749f72e9
RDX: 0000000000000062 RSI: 0000000020001080 RDI: 0000000000000003
RBP: 00007f5c74a6a610 R08: 0000000000000000 R09: 00007fffd7fbd4d8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fffd7fbd4c8 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:status_show_vhci drivers/usb/usbip/vhci_sysfs.c:80 [inline]
RIP: 0010:status_show+0x306/0x5a0 drivers/usb/usbip/vhci_sysfs.c:160
Code: 03 80 3c 02 00 0f 85 9c 02 00 00 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 08 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7d 02 00 00 4c 8b ab 08 04 00 00 c1 e5 04 41 bf
RSP: 0018:ffffc90003cbfad8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87534bb9
RDX: 0000000000000081 RSI: ffffffff87534d75 RDI: 0000000000000408
RBP: 000000000000000f R08: 0000000000000005 R09: 0000000000000000
R10: 000000000000000f R11: 64666b636f732020 R12: ffffc90003cbfb28
R13: ffff888034b8c02d R14: ffffffff87534ab0 R15: ffff888034b8c000
FS: 0000555582a4a380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 0000000035336000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax
6: 85 9c 02 00 00 48 8b test %ebx,-0x74b80000(%rdx,%rax,1)
d: 9b fwait
e: 88 00 mov %al,(%rax)
10: 00 00 add %al,(%rax)
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 48 8d bb 08 04 00 00 lea 0x408(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 7d 02 00 00 jne 0x2b1
34: 4c 8b ab 08 04 00 00 mov 0x408(%rbx),%r13
3b: c1 e5 04 shl $0x4,%ebp
3e: 41 rex.B
3f: bf .byte 0xbf
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jan 17, 2025, 10:41:06 AM1/17/25
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject:
Author: qasd...@gmail.com
#syz test
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject:
Author: qasd...@gmail.com
#syz test
syzbot
Jan 17, 2025, 11:01:07 AM1/17/25
to linux-...@vger.kernel.org, qasd...@gmail.com, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+83976e...@syzkaller.appspotmail.com
Tested-by: syzbot+83976e...@syzkaller.appspotmail.com
Tested on:
commit: 9bffa1ad Merge tag 'drm-fixes-2025-01-17' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=113fda18580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5e182416a4b418f
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+83976e...@syzkaller.appspotmail.com
Tested-by: syzbot+83976e...@syzkaller.appspotmail.com
Tested on:
commit: 9bffa1ad Merge tag 'drm-fixes-2025-01-17' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=113fda18580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5e182416a4b418f
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10bc69df980000
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: testing is done by a robot and is best-effort only.
syzbot
Jan 22, 2025, 5:19:09 PM1/22/25
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: Re: [syzbot] [usb?] general protection fault in status_show
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Author: sk...@linuxfoundation.org
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux.git usbip_test
syzbot
Jan 22, 2025, 5:34:04 PM1/22/25
to linux-...@vger.kernel.org, sk...@linuxfoundation.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Code: 03 80 3c 02 00 0f 85 d8 02 00 00 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 08 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 8a 02 00 00 4c 8b b3 08 04 00 00 41 c1 e7 04 31
RSP: 0018:ffffc90003437ad8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8753624b
RDX: 0000000000000081 RSI: ffffffff875363fb RDI: 0000000000000408
RBP: ffff888060944000 R08: 0000000000000004 R09: 0000000000000010
R10: 000000000000000f R11: 64666b636f732020 R12: 1ffff92000686f61
R13: ffffc90003437b28 R14: ffff88806094402d R15: 000000000000000f
FS: 00007f7f21b996c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7f21b99038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f7f20f75fa0 RCX: 00007f7f20d85d29
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f7f20f75fa0 R15: 00007ffe7ae1a108
Code: 03 80 3c 02 00 0f 85 d8 02 00 00 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 08 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 8a 02 00 00 4c 8b b3 08 04 00 00 41 c1 e7 04 31
RSP: 0018:ffffc90003437ad8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8753624b
RDX: 0000000000000081 RSI: ffffffff875363fb RDI: 0000000000000408
RBP: ffff888060944000 R08: 0000000000000004 R09: 0000000000000010
R10: 000000000000000f R11: 64666b636f732020 R12: 1ffff92000686f61
R13: ffffc90003437b28 R14: ffff88806094402d R15: 000000000000000f
FS: 00007f7f21b996c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
8: 02 00 add (%rax),%al
a: 00 48 8b add %cl,-0x75(%rax)
34: 4c 8b b3 08 04 00 00 mov 0x408(%rbx),%r14
3b: 41 c1 e7 04 shl $0x4,%r15d
3f: 31 .byte 0x31
Tested on:
commit: 70ef2d3a usbip/vhci: Fix general protection error
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux.git usbip_test
console output: https://syzkaller.appspot.com/x/log.txt?x=149325df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdfc8dd0ccb1401a
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in status_show
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000081: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000408-0x000000000000040f]
CPU: 1 UID: 0 PID: 6590 Comm: syz.0.16 Not tainted 6.13.0-syzkaller-g70ef2d3a2cfe #0
KASAN: null-ptr-deref in range [0x0000000000000408-0x000000000000040f]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:status_show_vhci drivers/usb/usbip/vhci_sysfs.c:80 [inline]
RIP: 0010:status_show+0x33c/0x610 drivers/usb/usbip/vhci_sysfs.c:160
Code: 03 80 3c 02 00 0f 85 d8 02 00 00 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 08 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 8a 02 00 00 4c 8b b3 08 04 00 00 41 c1 e7 04 31
RSP: 0018:ffffc90003437ad8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8753624b
RDX: 0000000000000081 RSI: ffffffff875363fb RDI: 0000000000000408
RBP: ffff888060944000 R08: 0000000000000004 R09: 0000000000000010
R10: 000000000000000f R11: 64666b636f732020 R12: 1ffff92000686f61
R13: ffffc90003437b28 R14: ffff88806094402d R15: 000000000000000f
FS: 00007f7f21b996c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f25ffff CR3: 00000000274d2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
dev_attr_show+0x53/0xe0 drivers/base/core.c:2423
sysfs_kf_seq_show+0x223/0x3e0 fs/sysfs/file.c:59
seq_read_iter+0x4f4/0x12b0 fs/seq_file.c:230
kernfs_fop_read_iter+0x414/0x580 fs/kernfs/file.c:279
new_sync_read fs/read_write.c:484 [inline]
vfs_read+0x87f/0xbe0 fs/read_write.c:565
ksys_read+0x12b/0x250 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7f20d85d29
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
dev_attr_show+0x53/0xe0 drivers/base/core.c:2423
sysfs_kf_seq_show+0x223/0x3e0 fs/sysfs/file.c:59
seq_read_iter+0x4f4/0x12b0 fs/seq_file.c:230
kernfs_fop_read_iter+0x414/0x580 fs/kernfs/file.c:279
new_sync_read fs/read_write.c:484 [inline]
vfs_read+0x87f/0xbe0 fs/read_write.c:565
ksys_read+0x12b/0x250 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7f21b99038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f7f20f75fa0 RCX: 00007f7f20d85d29
RDX: 0000000000000062 RSI: 0000000020001080 RDI: 0000000000000003
RBP: 00007f7f20e01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f7f20f75fa0 R15: 00007ffe7ae1a108
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:status_show_vhci drivers/usb/usbip/vhci_sysfs.c:80 [inline]
RIP: 0010:status_show+0x33c/0x610 drivers/usb/usbip/vhci_sysfs.c:160
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:status_show_vhci drivers/usb/usbip/vhci_sysfs.c:80 [inline]
Code: 03 80 3c 02 00 0f 85 d8 02 00 00 48 8b 9b 88 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 08 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 8a 02 00 00 4c 8b b3 08 04 00 00 41 c1 e7 04 31
RSP: 0018:ffffc90003437ad8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8753624b
RDX: 0000000000000081 RSI: ffffffff875363fb RDI: 0000000000000408
RBP: ffff888060944000 R08: 0000000000000004 R09: 0000000000000010
R10: 000000000000000f R11: 64666b636f732020 R12: 1ffff92000686f61
R13: ffffc90003437b28 R14: ffff88806094402d R15: 000000000000000f
FS: 00007f7f21b996c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0053c575e8 CR3: 00000000274d2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax
6: 85 d8 test %ebx,%eax
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax
8: 02 00 add (%rax),%al
a: 00 48 8b add %cl,-0x75(%rax)
d: 9b fwait
e: 88 00 mov %al,(%rax)
10: 00 00 add %al,(%rax)
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 48 8d bb 08 04 00 00 lea 0x408(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 8a 02 00 00 jne 0x2be
e: 88 00 mov %al,(%rax)
10: 00 00 add %al,(%rax)
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 48 8d bb 08 04 00 00 lea 0x408(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
34: 4c 8b b3 08 04 00 00 mov 0x408(%rbx),%r14
3b: 41 c1 e7 04 shl $0x4,%r15d
3f: 31 .byte 0x31
Tested on:
commit: 70ef2d3a usbip/vhci: Fix general protection error
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux.git usbip_test
console output: https://syzkaller.appspot.com/x/log.txt?x=149325df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdfc8dd0ccb1401a
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Hillf Danton
Jan 23, 2025, 6:31:39 AM1/23/25
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Thu, 16 Jan 2025 22:14:23 -0800
#syz test
--- x/drivers/usb/usbip/vhci_sysfs.c
+++ y/drivers/usb/usbip/vhci_sysfs.c
@@ -76,6 +76,8 @@ static ssize_t status_show_vhci(int pdev
}
hcd = platform_get_drvdata(pdev);
+ if (!usb_hcd_is_primary_hcd(hcd))
+ return 0;
vhci_hcd = hcd_to_vhci_hcd(hcd);
vhci = vhci_hcd->vhci;
--
> syzbot found the following issue on:
>
> HEAD commit: be548645527a Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d51cb0580000
>
> HEAD commit: be548645527a Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
#syz test
--- x/drivers/usb/usbip/vhci_sysfs.c
+++ y/drivers/usb/usbip/vhci_sysfs.c
@@ -76,6 +76,8 @@ static ssize_t status_show_vhci(int pdev
}
hcd = platform_get_drvdata(pdev);
+ if (!usb_hcd_is_primary_hcd(hcd))
+ return 0;
vhci_hcd = hcd_to_vhci_hcd(hcd);
vhci = vhci_hcd->vhci;
--
syzbot
Jan 23, 2025, 6:45:06 AM1/23/25
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
slave bond_slave_0): Enslaving as an active interface with an up link
[ 77.012704][ T5924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 77.039135][ T5924] team0: Port device team_slave_0 added
[ 77.046395][ T5924] team0: Port device team_slave_1 added
[ 77.067282][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 77.074614][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.101175][ T5924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 77.114964][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 77.122115][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.148711][ T5924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 77.184083][ T5924] hsr_slave_0: entered promiscuous mode
[ 77.190764][ T5924] hsr_slave_1: entered promiscuous mode
[ 77.196800][ T5924] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 77.204798][ T5924] Cannot create hsr debugfs directory
[ 78.828818][ T5146] Bluetooth: hci0: command tx timeout
[ 79.385430][ T768] bridge_slave_1: left allmulticast mode
[ 79.392966][ T768] bridge_slave_1: left promiscuous mode
[ 79.399801][ T768] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.414825][ T768] bridge_slave_0: left allmulticast mode
[ 79.420618][ T768] bridge_slave_0: left promiscuous mode
[ 79.426300][ T768] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.729628][ T768] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 79.742640][ T768] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 79.753017][ T768] bond0 (unregistering): Released all slaves
[ 79.892147][ T768] hsr_slave_0: left promiscuous mode
[ 79.899634][ T768] hsr_slave_1: left promiscuous mode
[ 79.905619][ T768] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 79.913870][ T768] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 79.922730][ T768] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 79.934653][ T768] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 79.952787][ T768] veth1_macvtap: left promiscuous mode
[ 79.959105][ T768] veth0_macvtap: left promiscuous mode
[ 79.964762][ T768] veth1_vlan: left promiscuous mode
[ 79.970637][ T768] veth0_vlan: left promiscuous mode
[ 80.369761][ T768] team0 (unregistering): Port device team_slave_1 removed
[ 80.404676][ T768] team0 (unregistering): Port device team_slave_0 removed
[ 80.813050][ T5924] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 80.846314][ T5924] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 80.867147][ T5924] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 80.877104][ T5924] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 80.910976][ T5146] Bluetooth: hci0: command tx timeout
[ 81.003190][ T5924] 8021q: adding VLAN 0 to HW filter on device bond0
[ 81.037204][ T5924] 8021q: adding VLAN 0 to HW filter on device team0
[ 81.059292][ T11] bridge0: port 1(bridge_slave_0) entered blocking state
[ 81.066421][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 81.083510][ T3581] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.090678][ T3581] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.292195][ T768]
[ 81.294581][ T768] ======================================================
[ 81.301707][ T768] WARNING: possible circular locking dependency detected
[ 81.308856][ T768] 6.13.0-syzkaller-g21266b8df522-dirty #0 Not tainted
[ 81.315640][ T768] ------------------------------------------------------
[ 81.322674][ T768] kworker/u8:5/768 is trying to acquire lock:
[ 81.328756][ T768] ffffffff8fed5628 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.339251][ T768]
[ 81.339251][ T768] but task is already holding lock:
[ 81.339480][ T5924] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 81.346611][ T768] ffff888071950768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720
[ 81.363937][ T768]
[ 81.363937][ T768] which lock already depends on the new lock.
[ 81.363937][ T768]
[ 81.374536][ T768]
[ 81.374536][ T768] the existing dependency chain (in reverse order) is:
[ 81.376998][ T5924] veth0_vlan: entered promiscuous mode
[ 81.383716][ T768]
[ 81.383716][ T768] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}:
[ 81.383747][ T768] __mutex_lock+0x19b/0xb10
[ 81.383769][ T768] wiphy_register+0x1c6b/0x2860
[ 81.394705][ T5924] veth1_vlan: entered promiscuous mode
[ 81.396991][ T768] ieee80211_register_hw+0x23ff/0x3ff0
[ 81.418951][ T768] mac80211_hwsim_new_radio+0x2c47/0x56c0
[ 81.419880][ T5924] veth0_macvtap: entered promiscuous mode
[ 81.425209][ T768] init_mac80211_hwsim+0x432/0x8c0
[ 81.433965][ T5924] veth1_macvtap: entered promiscuous mode
[ 81.436970][ T768] do_one_initcall+0x128/0x630
[ 81.447996][ T768] kernel_init_freeable+0x58f/0x8b0
[ 81.452139][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 81.453824][ T768] kernel_init+0x1c/0x2b0
[ 81.465598][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 81.465866][ T768] ret_from_fork+0x45/0x80
[ 81.477299][ T5924] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.477980][ T768] ret_from_fork_asm+0x1a/0x30
[ 81.478015][ T768]
[ 81.478015][ T768] -> #0 (rtnl_mutex
[ 81.486868][ T5924] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.491954][ T768] ){+.+.}-{4:4}:
[ 81.491975][ T768] __lock_acquire+0x249e/0x3c40
[ 81.491998][ T768] lock_acquire.part.0+0x11b/0x380
[ 81.492015][ T768] __mutex_lock+0x19b/0xb10
[ 81.492032][ T768] unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.492056][ T768] unregister_netdevice_queue+0x307/0x3f0
[ 81.492079][ T768] _cfg80211_unregister_wdev+0x64b/0x830
[ 81.492106][ T768] ieee80211_remove_interfaces+0x34f/0x720
[ 81.500780][ T5924] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.506721][ T768] ieee80211_unregister_hw+0x55/0x3a0
[ 81.510591][ T5924] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.515698][ T768] mac80211_hwsim_del_radio+0x268/0x370
[ 81.581363][ T768] hwsim_exit_net+0x33f/0x6d0
[ 81.586575][ T768] ops_exit_list+0xb0/0x180
[ 81.591689][ T768] cleanup_net+0x5c6/0xbf0
[ 81.596654][ T768] process_one_work+0x958/0x1b30
[ 81.602212][ T768] worker_thread+0x6c8/0xf00
[ 81.607334][ T768] kthread+0x3af/0x750
[ 81.611929][ T768] ret_from_fork+0x45/0x80
[ 81.616869][ T768] ret_from_fork_asm+0x1a/0x30
[ 81.622168][ T768]
[ 81.622168][ T768] other info that might help us debug this:
[ 81.622168][ T768]
[ 81.632518][ T768] Possible unsafe locking scenario:
[ 81.632518][ T768]
[ 81.639986][ T768] CPU0 CPU1
[ 81.645346][ T768] ---- ----
[ 81.650747][ T768] lock(&rdev->wiphy.mtx);
[ 81.655351][ T768] lock(rtnl_mutex);
[ 81.662043][ T768] lock(&rdev->wiphy.mtx);
[ 81.669183][ T768] lock(rtnl_mutex);
[ 81.673173][ T768]
[ 81.673173][ T768] *** DEADLOCK ***
[ 81.673173][ T768]
[ 81.681394][ T768] 4 locks held by kworker/u8:5/768:
[ 81.686582][ T768] #0: ffff88801bef5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30
[ 81.696991][ T768] #1: ffffc900034b7d18 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30
[ 81.706948][ T768] #2: ffffffff8febf610 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xbf0
[ 81.716358][ T768] #3: ffff888071950768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720
[ 81.727169][ T768]
[ 81.727169][ T768] stack backtrace:
[ 81.733068][ T768] CPU: 1 UID: 0 PID: 768 Comm: kworker/u8:5 Not tainted 6.13.0-syzkaller-g21266b8df522-dirty #0
[ 81.733091][ T768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 81.733106][ T768] Workqueue: netns cleanup_net
[ 81.733138][ T768] Call Trace:
[ 81.733144][ T768] <TASK>
[ 81.733152][ T768] dump_stack_lvl+0x116/0x1f0
[ 81.733185][ T768] print_circular_bug+0x490/0x760
[ 81.733216][ T768] check_noncircular+0x31a/0x400
[ 81.733243][ T768] ? __pfx_check_noncircular+0x10/0x10
[ 81.733272][ T768] ? lockdep_lock+0x1b8/0x200
[ 81.733295][ T768] ? __pfx_lockdep_lock+0x10/0x10
[ 81.733317][ T768] ? lockdep_hardirqs_on+0x7c/0x110
[ 81.733344][ T768] __lock_acquire+0x249e/0x3c40
[ 81.733365][ T768] ? __pfx___lock_acquire+0x10/0x10
[ 81.733382][ T768] ? synchronize_rcu_expedited+0x426/0x450
[ 81.733400][ T768] ? __pfx_lock_release+0x10/0x10
[ 81.733418][ T768] lock_acquire.part.0+0x11b/0x380
[ 81.733435][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733457][ T768] ? __pfx_lock_acquire.part.0+0x10/0x10
[ 81.733475][ T768] ? rcu_is_watching+0x12/0xc0
[ 81.733497][ T768] ? trace_lock_acquire+0x14e/0x1f0
[ 81.733520][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733541][ T768] ? lock_acquire+0x2f/0xb0
[ 81.733556][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733577][ T768] __mutex_lock+0x19b/0xb10
[ 81.733604][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733625][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733646][ T768] ? __pfx___mutex_lock+0x10/0x10
[ 81.733662][ T768] ? __pfx_synchronize_rcu_expedited+0x10/0x10
[ 81.733683][ T768] ? __pfx_wait_rcu_exp_gp+0x10/0x10
[ 81.733700][ T768] ? __pfx___might_resched+0x10/0x10
[ 81.733718][ T768] ? unregister_netdevice_many_notify+0x959/0x21a0
[ 81.733740][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733759][ T768] ? rtnl_lock+0x9/0x20
[ 81.733778][ T768] unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733802][ T768] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 81.733824][ T768] ? find_held_lock+0x2d/0x110
[ 81.733848][ T768] ? kernfs_remove_by_name_ns+0xc4/0x130
[ 81.733873][ T768] ? __pfx_lock_release+0x10/0x10
[ 81.733889][ T768] ? __call_rcu_common.constprop.0+0x3ea/0x870
[ 81.733911][ T768] unregister_netdevice_queue+0x307/0x3f0
[ 81.733931][ T768] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 81.733954][ T768] _cfg80211_unregister_wdev+0x64b/0x830
[ 81.733980][ T768] ieee80211_remove_interfaces+0x34f/0x720
[ 81.734010][ T768] ? __pfx_ieee80211_remove_interfaces+0x10/0x10
[ 81.734041][ T768] ieee80211_unregister_hw+0x55/0x3a0
[ 81.734062][ T768] mac80211_hwsim_del_radio+0x268/0x370
[ 81.734088][ T768] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10
[ 81.734115][ T768] ? __local_bh_enable_ip+0xa4/0x120
[ 81.734136][ T768] hwsim_exit_net+0x33f/0x6d0
[ 81.734163][ T768] ? __pfx_hwsim_exit_net+0x10/0x10
[ 81.734189][ T768] ? __pfx___might_resched+0x10/0x10
[ 81.734207][ T768] ? ip_vs_sync_net_cleanup+0x72/0xb0
[ 81.734228][ T768] ? __ip_vs_dev_cleanup_batch+0xb1/0x290
[ 81.734246][ T768] ? __pfx_hwsim_exit_net+0x10/0x10
[ 81.734272][ T768] ops_exit_list+0xb0/0x180
[ 81.734290][ T768] cleanup_net+0x5c6/0xbf0
[ 81.734310][ T768] ? __pfx_cleanup_net+0x10/0x10
[ 81.734331][ T768] ? lock_acquire+0x2f/0xb0
[ 81.734346][ T768] ? process_one_work+0x8bb/0x1b30
[ 81.734374][ T768] process_one_work+0x958/0x1b30
[ 81.734404][ T768] ? __pfx_cleanup_net+0x10/0x10
[ 81.734422][ T768] ? __pfx_process_one_work+0x10/0x10
[ 81.734448][ T768] ? rcu_is_watching+0x12/0xc0
[ 81.734472][ T768] ? assign_work+0x1a0/0x250
[ 81.734498][ T768] worker_thread+0x6c8/0xf00
[ 81.734527][ T768] ? __kthread_parkme+0x148/0x220
[ 81.734550][ T768] ? __pfx_worker_thread+0x10/0x10
[ 81.734576][ T768] kthread+0x3af/0x750
[ 81.734606][ T768] ? __pfx_kthread+0x10/0x10
[ 81.734630][ T768] ? lock_acquire+0x2f/0xb0
[ 81.734648][ T768] ? __pfx_kthread+0x10/0x10
[ 81.734672][ T768] ret_from_fork+0x45/0x80
[ 81.734690][ T768] ? __pfx_kthread+0x10/0x10
[ 81.734715][ T768] ret_from_fork_asm+0x1a/0x30
[ 81.734746][ T768] </TASK>
[ 82.205328][ T5924] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[ 82.988060][ T5146] Bluetooth: hci0: command tx timeout
[ 85.068171][ T5146] Bluetooth: hci0: command tx timeout
[ 87.233907][ T974] cfg80211: failed to load regulatory.db
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build744164607=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 6dbc6a9bc7
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=6dbc6a9bc76e06852841ed5c5bdbb78409b17f53 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250110-142744'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"6dbc6a9bc76e06852841ed5c5bdbb78409b17f53\"
/usr/bin/ld: /tmp/ccJVchnk.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1733f964580000
Tested on:
commit: 21266b8d Merge tag 'AT_EXECVE_CHECK-v6.14-rc1' of git:..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=77593a73383cac88
syzbot tried to test the proposed patch but the build/boot failed:
slave bond_slave_0): Enslaving as an active interface with an up link
[ 77.012704][ T5924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 77.039135][ T5924] team0: Port device team_slave_0 added
[ 77.046395][ T5924] team0: Port device team_slave_1 added
[ 77.067282][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 77.074614][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.101175][ T5924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 77.114964][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 77.122115][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.148711][ T5924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 77.184083][ T5924] hsr_slave_0: entered promiscuous mode
[ 77.190764][ T5924] hsr_slave_1: entered promiscuous mode
[ 77.196800][ T5924] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 77.204798][ T5924] Cannot create hsr debugfs directory
[ 78.828818][ T5146] Bluetooth: hci0: command tx timeout
[ 79.385430][ T768] bridge_slave_1: left allmulticast mode
[ 79.392966][ T768] bridge_slave_1: left promiscuous mode
[ 79.399801][ T768] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.414825][ T768] bridge_slave_0: left allmulticast mode
[ 79.420618][ T768] bridge_slave_0: left promiscuous mode
[ 79.426300][ T768] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.729628][ T768] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 79.742640][ T768] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 79.753017][ T768] bond0 (unregistering): Released all slaves
[ 79.892147][ T768] hsr_slave_0: left promiscuous mode
[ 79.899634][ T768] hsr_slave_1: left promiscuous mode
[ 79.905619][ T768] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 79.913870][ T768] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 79.922730][ T768] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 79.934653][ T768] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 79.952787][ T768] veth1_macvtap: left promiscuous mode
[ 79.959105][ T768] veth0_macvtap: left promiscuous mode
[ 79.964762][ T768] veth1_vlan: left promiscuous mode
[ 79.970637][ T768] veth0_vlan: left promiscuous mode
[ 80.369761][ T768] team0 (unregistering): Port device team_slave_1 removed
[ 80.404676][ T768] team0 (unregistering): Port device team_slave_0 removed
[ 80.813050][ T5924] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 80.846314][ T5924] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 80.867147][ T5924] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 80.877104][ T5924] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 80.910976][ T5146] Bluetooth: hci0: command tx timeout
[ 81.003190][ T5924] 8021q: adding VLAN 0 to HW filter on device bond0
[ 81.037204][ T5924] 8021q: adding VLAN 0 to HW filter on device team0
[ 81.059292][ T11] bridge0: port 1(bridge_slave_0) entered blocking state
[ 81.066421][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 81.083510][ T3581] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.090678][ T3581] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.292195][ T768]
[ 81.294581][ T768] ======================================================
[ 81.301707][ T768] WARNING: possible circular locking dependency detected
[ 81.308856][ T768] 6.13.0-syzkaller-g21266b8df522-dirty #0 Not tainted
[ 81.315640][ T768] ------------------------------------------------------
[ 81.322674][ T768] kworker/u8:5/768 is trying to acquire lock:
[ 81.328756][ T768] ffffffff8fed5628 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.339251][ T768]
[ 81.339251][ T768] but task is already holding lock:
[ 81.339480][ T5924] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 81.346611][ T768] ffff888071950768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720
[ 81.363937][ T768]
[ 81.363937][ T768] which lock already depends on the new lock.
[ 81.363937][ T768]
[ 81.374536][ T768]
[ 81.374536][ T768] the existing dependency chain (in reverse order) is:
[ 81.376998][ T5924] veth0_vlan: entered promiscuous mode
[ 81.383716][ T768]
[ 81.383716][ T768] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}:
[ 81.383747][ T768] __mutex_lock+0x19b/0xb10
[ 81.383769][ T768] wiphy_register+0x1c6b/0x2860
[ 81.394705][ T5924] veth1_vlan: entered promiscuous mode
[ 81.396991][ T768] ieee80211_register_hw+0x23ff/0x3ff0
[ 81.418951][ T768] mac80211_hwsim_new_radio+0x2c47/0x56c0
[ 81.419880][ T5924] veth0_macvtap: entered promiscuous mode
[ 81.425209][ T768] init_mac80211_hwsim+0x432/0x8c0
[ 81.433965][ T5924] veth1_macvtap: entered promiscuous mode
[ 81.436970][ T768] do_one_initcall+0x128/0x630
[ 81.447996][ T768] kernel_init_freeable+0x58f/0x8b0
[ 81.452139][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 81.453824][ T768] kernel_init+0x1c/0x2b0
[ 81.465598][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 81.465866][ T768] ret_from_fork+0x45/0x80
[ 81.477299][ T5924] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.477980][ T768] ret_from_fork_asm+0x1a/0x30
[ 81.478015][ T768]
[ 81.478015][ T768] -> #0 (rtnl_mutex
[ 81.486868][ T5924] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.491954][ T768] ){+.+.}-{4:4}:
[ 81.491975][ T768] __lock_acquire+0x249e/0x3c40
[ 81.491998][ T768] lock_acquire.part.0+0x11b/0x380
[ 81.492015][ T768] __mutex_lock+0x19b/0xb10
[ 81.492032][ T768] unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.492056][ T768] unregister_netdevice_queue+0x307/0x3f0
[ 81.492079][ T768] _cfg80211_unregister_wdev+0x64b/0x830
[ 81.492106][ T768] ieee80211_remove_interfaces+0x34f/0x720
[ 81.500780][ T5924] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.506721][ T768] ieee80211_unregister_hw+0x55/0x3a0
[ 81.510591][ T5924] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.515698][ T768] mac80211_hwsim_del_radio+0x268/0x370
[ 81.581363][ T768] hwsim_exit_net+0x33f/0x6d0
[ 81.586575][ T768] ops_exit_list+0xb0/0x180
[ 81.591689][ T768] cleanup_net+0x5c6/0xbf0
[ 81.596654][ T768] process_one_work+0x958/0x1b30
[ 81.602212][ T768] worker_thread+0x6c8/0xf00
[ 81.607334][ T768] kthread+0x3af/0x750
[ 81.611929][ T768] ret_from_fork+0x45/0x80
[ 81.616869][ T768] ret_from_fork_asm+0x1a/0x30
[ 81.622168][ T768]
[ 81.622168][ T768] other info that might help us debug this:
[ 81.622168][ T768]
[ 81.632518][ T768] Possible unsafe locking scenario:
[ 81.632518][ T768]
[ 81.639986][ T768] CPU0 CPU1
[ 81.645346][ T768] ---- ----
[ 81.650747][ T768] lock(&rdev->wiphy.mtx);
[ 81.655351][ T768] lock(rtnl_mutex);
[ 81.662043][ T768] lock(&rdev->wiphy.mtx);
[ 81.669183][ T768] lock(rtnl_mutex);
[ 81.673173][ T768]
[ 81.673173][ T768] *** DEADLOCK ***
[ 81.673173][ T768]
[ 81.681394][ T768] 4 locks held by kworker/u8:5/768:
[ 81.686582][ T768] #0: ffff88801bef5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30
[ 81.696991][ T768] #1: ffffc900034b7d18 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30
[ 81.706948][ T768] #2: ffffffff8febf610 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xbf0
[ 81.716358][ T768] #3: ffff888071950768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720
[ 81.727169][ T768]
[ 81.727169][ T768] stack backtrace:
[ 81.733068][ T768] CPU: 1 UID: 0 PID: 768 Comm: kworker/u8:5 Not tainted 6.13.0-syzkaller-g21266b8df522-dirty #0
[ 81.733091][ T768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 81.733106][ T768] Workqueue: netns cleanup_net
[ 81.733138][ T768] Call Trace:
[ 81.733144][ T768] <TASK>
[ 81.733152][ T768] dump_stack_lvl+0x116/0x1f0
[ 81.733185][ T768] print_circular_bug+0x490/0x760
[ 81.733216][ T768] check_noncircular+0x31a/0x400
[ 81.733243][ T768] ? __pfx_check_noncircular+0x10/0x10
[ 81.733272][ T768] ? lockdep_lock+0x1b8/0x200
[ 81.733295][ T768] ? __pfx_lockdep_lock+0x10/0x10
[ 81.733317][ T768] ? lockdep_hardirqs_on+0x7c/0x110
[ 81.733344][ T768] __lock_acquire+0x249e/0x3c40
[ 81.733365][ T768] ? __pfx___lock_acquire+0x10/0x10
[ 81.733382][ T768] ? synchronize_rcu_expedited+0x426/0x450
[ 81.733400][ T768] ? __pfx_lock_release+0x10/0x10
[ 81.733418][ T768] lock_acquire.part.0+0x11b/0x380
[ 81.733435][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733457][ T768] ? __pfx_lock_acquire.part.0+0x10/0x10
[ 81.733475][ T768] ? rcu_is_watching+0x12/0xc0
[ 81.733497][ T768] ? trace_lock_acquire+0x14e/0x1f0
[ 81.733520][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733541][ T768] ? lock_acquire+0x2f/0xb0
[ 81.733556][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733577][ T768] __mutex_lock+0x19b/0xb10
[ 81.733604][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733625][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733646][ T768] ? __pfx___mutex_lock+0x10/0x10
[ 81.733662][ T768] ? __pfx_synchronize_rcu_expedited+0x10/0x10
[ 81.733683][ T768] ? __pfx_wait_rcu_exp_gp+0x10/0x10
[ 81.733700][ T768] ? __pfx___might_resched+0x10/0x10
[ 81.733718][ T768] ? unregister_netdevice_many_notify+0x959/0x21a0
[ 81.733740][ T768] ? unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733759][ T768] ? rtnl_lock+0x9/0x20
[ 81.733778][ T768] unregister_netdevice_many_notify+0x1a51/0x21a0
[ 81.733802][ T768] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 81.733824][ T768] ? find_held_lock+0x2d/0x110
[ 81.733848][ T768] ? kernfs_remove_by_name_ns+0xc4/0x130
[ 81.733873][ T768] ? __pfx_lock_release+0x10/0x10
[ 81.733889][ T768] ? __call_rcu_common.constprop.0+0x3ea/0x870
[ 81.733911][ T768] unregister_netdevice_queue+0x307/0x3f0
[ 81.733931][ T768] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 81.733954][ T768] _cfg80211_unregister_wdev+0x64b/0x830
[ 81.733980][ T768] ieee80211_remove_interfaces+0x34f/0x720
[ 81.734010][ T768] ? __pfx_ieee80211_remove_interfaces+0x10/0x10
[ 81.734041][ T768] ieee80211_unregister_hw+0x55/0x3a0
[ 81.734062][ T768] mac80211_hwsim_del_radio+0x268/0x370
[ 81.734088][ T768] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10
[ 81.734115][ T768] ? __local_bh_enable_ip+0xa4/0x120
[ 81.734136][ T768] hwsim_exit_net+0x33f/0x6d0
[ 81.734163][ T768] ? __pfx_hwsim_exit_net+0x10/0x10
[ 81.734189][ T768] ? __pfx___might_resched+0x10/0x10
[ 81.734207][ T768] ? ip_vs_sync_net_cleanup+0x72/0xb0
[ 81.734228][ T768] ? __ip_vs_dev_cleanup_batch+0xb1/0x290
[ 81.734246][ T768] ? __pfx_hwsim_exit_net+0x10/0x10
[ 81.734272][ T768] ops_exit_list+0xb0/0x180
[ 81.734290][ T768] cleanup_net+0x5c6/0xbf0
[ 81.734310][ T768] ? __pfx_cleanup_net+0x10/0x10
[ 81.734331][ T768] ? lock_acquire+0x2f/0xb0
[ 81.734346][ T768] ? process_one_work+0x8bb/0x1b30
[ 81.734374][ T768] process_one_work+0x958/0x1b30
[ 81.734404][ T768] ? __pfx_cleanup_net+0x10/0x10
[ 81.734422][ T768] ? __pfx_process_one_work+0x10/0x10
[ 81.734448][ T768] ? rcu_is_watching+0x12/0xc0
[ 81.734472][ T768] ? assign_work+0x1a0/0x250
[ 81.734498][ T768] worker_thread+0x6c8/0xf00
[ 81.734527][ T768] ? __kthread_parkme+0x148/0x220
[ 81.734550][ T768] ? __pfx_worker_thread+0x10/0x10
[ 81.734576][ T768] kthread+0x3af/0x750
[ 81.734606][ T768] ? __pfx_kthread+0x10/0x10
[ 81.734630][ T768] ? lock_acquire+0x2f/0xb0
[ 81.734648][ T768] ? __pfx_kthread+0x10/0x10
[ 81.734672][ T768] ret_from_fork+0x45/0x80
[ 81.734690][ T768] ? __pfx_kthread+0x10/0x10
[ 81.734715][ T768] ret_from_fork_asm+0x1a/0x30
[ 81.734746][ T768] </TASK>
[ 82.205328][ T5924] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[ 82.988060][ T5146] Bluetooth: hci0: command tx timeout
[ 85.068171][ T5146] Bluetooth: hci0: command tx timeout
[ 87.233907][ T974] cfg80211: failed to load regulatory.db
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build744164607=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 6dbc6a9bc7
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=6dbc6a9bc76e06852841ed5c5bdbb78409b17f53 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250110-142744'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"6dbc6a9bc76e06852841ed5c5bdbb78409b17f53\"
/usr/bin/ld: /tmp/ccJVchnk.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1733f964580000
Tested on:
commit: 21266b8d Merge tag 'AT_EXECVE_CHECK-v6.14-rc1' of git:..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=77593a73383cac88
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=15b85ab0580000
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Hillf Danton
Jan 24, 2025, 6:17:59 AM1/24/25
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Thu, 16 Jan 2025 22:14:23 -0800
> syzbot found the following issue on:
>
> HEAD commit: be548645527a Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d51cb0580000
>
> HEAD commit: be548645527a Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
#syz test upstream master
--- x/drivers/usb/usbip/vhci_sysfs.c
+++ y/drivers/usb/usbip/vhci_sysfs.c
@@ -76,6 +76,8 @@ static ssize_t status_show_vhci(int pdev
}
hcd = platform_get_drvdata(pdev);
+ if (!usb_hcd_is_primary_hcd(hcd))
+ return 0;
vhci_hcd = hcd_to_vhci_hcd(hcd);
vhci = vhci_hcd->vhci;
+++ y/net/core/dev.c
@@ -10260,14 +10260,19 @@ static bool from_cleanup_net(void)
#endif
}
+static unsigned long extra_netdev_locks = 1;
static void rtnl_drop_if_cleanup_net(void)
{
+ if (extra_netdev_locks)
+ return;
if (from_cleanup_net())
__rtnl_unlock();
}
static void rtnl_acquire_if_cleanup_net(void)
{
+ if (extra_netdev_locks)
+ return;
if (from_cleanup_net())
rtnl_lock();
}
--
syzbot
Jan 24, 2025, 6:32:05 AM1/24/25
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_hcd_is_primary_hcd
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
Oops: general protection fault, probably for non-canonical address 0xdffffc000000007a: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x00000000000003d0-0x00000000000003d7]
CPU: 0 UID: 0 PID: 6619 Comm: syz.0.16 Not tainted 6.13.0-syzkaller-gbc8198dc7ebc-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:usb_hcd_is_primary_hcd+0x26/0x70 drivers/usb/core/hcd.c:2699
Code: 90 90 90 90 f3 0f 1e fa 55 53 48 89 fb e8 72 77 b0 fa 48 8d bb d0 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 3b 48 8b ab d0 03 00 00 48 85 ed 74 1c e8 43 77 b0
RSP: 0018:ffffc90003257ac0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff875ac534
RDX: 000000000000007a RSI: ffffffff86e896be RDI: 00000000000003d0
RBP: ffff888033124000 R08: 0000000000000005 R09: 0000000000000000
R10: 000000000000000f R11: 64666b636f732020 R12: 1ffff9200064af61
R13: 0000000000000000 R14: ffff88803312402d R15: 000000000000000f
FS: 00007f4de32746c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ee5ffff CR3: 000000001e2cc000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
status_show_vhci drivers/usb/usbip/vhci_sysfs.c:79 [inline]
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
status_show+0x2e1/0x5e0 drivers/usb/usbip/vhci_sysfs.c:162
dev_attr_show+0x53/0xe0 drivers/base/core.c:2423
sysfs_kf_seq_show+0x223/0x3e0 fs/sysfs/file.c:59
seq_read_iter+0x4f4/0x12b0 fs/seq_file.c:230
kernfs_fop_read_iter+0x414/0x580 fs/kernfs/file.c:279
new_sync_read fs/read_write.c:484 [inline]
vfs_read+0x886/0xbf0 fs/read_write.c:565
sysfs_kf_seq_show+0x223/0x3e0 fs/sysfs/file.c:59
seq_read_iter+0x4f4/0x12b0 fs/seq_file.c:230
kernfs_fop_read_iter+0x414/0x580 fs/kernfs/file.c:279
new_sync_read fs/read_write.c:484 [inline]
ksys_read+0x12b/0x250 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4de2385d29
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4de3274038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f4de2575fa0 RCX: 00007f4de2385d29
RDX: 0000000000000062 RSI: 0000000020001080 RDI: 0000000000000003
RBP: 00007f4de2401b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f4de2575fa0 R15: 00007ffe71b07568
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_hcd_is_primary_hcd+0x26/0x70 drivers/usb/core/hcd.c:2699
Modules linked in:
---[ end trace 0000000000000000 ]---
Code: 90 90 90 90 f3 0f 1e fa 55 53 48 89 fb e8 72 77 b0 fa 48 8d bb d0 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 3b 48 8b ab d0 03 00 00 48 85 ed 74 1c e8 43 77 b0
RSP: 0018:ffffc90003257ac0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff875ac534
RDX: 000000000000007a RSI: ffffffff86e896be RDI: 00000000000003d0
RBP: ffff888033124000 R08: 0000000000000005 R09: 0000000000000000
R10: 000000000000000f R11: 64666b636f732020 R12: 1ffff9200064af61
R13: 0000000000000000 R14: ffff88803312402d R15: 000000000000000f
FS: 00007f4de32746c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e99d20440 CR3: 000000001e2cc000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 90 nop
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
1: 90 nop
2: 90 nop
3: 90 nop
4: f3 0f 1e fa endbr64
8: 55 push %rbp
9: 53 push %rbx
a: 48 89 fb mov %rdi,%rbx
d: e8 72 77 b0 fa call 0xfab07784
12: 48 8d bb d0 03 00 00 lea 0x3d0(%rbx),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 75 3b jne 0x6b
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
30: 48 8b ab d0 03 00 00 mov 0x3d0(%rbx),%rbp
37: 48 85 ed test %rbp,%rbp
3a: 74 1c je 0x58
3c: e8 .byte 0xe8
3d: 43 77 b0 rex.XB ja 0xfffffff0
Tested on:
commit: bc8198dc Merge tag 'sched_ext-for-6.14' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=132315df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=77593a73383cac88
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1041e9f8580000
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Hillf Danton
Jan 25, 2025, 5:23:36 AM1/25/25
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Thu, 16 Jan 2025 22:14:23 -0800
> syzbot found the following issue on:
>
> HEAD commit: be548645527a Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
>
> HEAD commit: be548645527a Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d51cb0580000
#syz test upstream master
--- x/drivers/usb/usbip/vhci_sysfs.c
+++ y/drivers/usb/usbip/vhci_sysfs.c
@@ -76,6 +76,8 @@ static ssize_t status_show_vhci(int pdev
}
hcd = platform_get_drvdata(pdev);
+ if (!hcd || !usb_hcd_is_primary_hcd(hcd))
#syz test upstream master
--- x/drivers/usb/usbip/vhci_sysfs.c
+++ y/drivers/usb/usbip/vhci_sysfs.c
@@ -76,6 +76,8 @@ static ssize_t status_show_vhci(int pdev
}
hcd = platform_get_drvdata(pdev);
syzbot
Jan 25, 2025, 5:44:06 AM1/25/25
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
Tested on:
commit: b46c89c0 Merge tag 'spi-fix-v6.14-merge-window' of git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1292d5df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d00941da012c109
dashboard link: https://syzkaller.appspot.com/bug?extid=83976e47ec1ef91e66f1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13b799f8580000
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Reply all
Reply to author
Forward
0 new messages