All of lore.kernel.org
 help / color / mirror / Atom feed
* BUG: unable to handle page fault for address = ADDR
@ 2019-04-25 22:16 syzbot
  2019-04-25 23:13 ` Linus Torvalds
  0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2019-04-25 22:16 UTC (permalink / raw)
  To: davem, dvyukov, gnomes, gregkh, jslaby, linux-kernel, mhocko,
	netdev, penguin-kernel, penguin-kernel, peter, syzkaller-bugs,
	torvalds, vegard.nossum

Hello,

syzbot found the following crash on:

HEAD commit:    c392798a Add linux-next specific files for 20190424
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14772c42a00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=37a4076eb047eef5
dashboard link: https://syzkaller.appspot.com/bug?extid=45474c076a4927533d2e
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1369c242a00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12ee2e88a00000

The bug was bisected to:

commit bcdd0ca8cb8730573afebcaae4138f8f4c8eaa20
Author: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date:   Wed Apr 25 11:12:31 2018 +0000

     tty: Use __GFP_NOFAIL for tty_ldisc_get()

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=157d9014a00000
final crash:    https://syzkaller.appspot.com/x/report.txt?x=177d9014a00000
console output: https://syzkaller.appspot.com/x/log.txt?x=137d9014a00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+45474c076a4927533d2e@syzkaller.appspotmail.com
Fixes: bcdd0ca8cb87 ("tty: Use __GFP_NOFAIL for tty_ldisc_get()")

  do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441149
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffd8ae1c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441149
RDX: 0000000020000140 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007fffd8ae1c50 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
BUG: unable to handle page fault for address = fffffffffffffff4
#PF: supervisor-privileged read access from kernel code
#PF: error_code(0x0000) - not-present page
PGD 8870067 P4D 8870067 PUD 8872067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7949 Comm: syz-executor714 Not tainted 5.1.0-rc6-next-20190424  
#30
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
Code: 54 49 89 fc e8 c0 b3 15 fd 4d 85 e4 74 77 e8 b6 b3 15 fd 4c 89 e2 48  
b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24 4d  
85 ed 74 0d e8 91 b3 15 fd 4c 89 ef e8 09 5b 4e fd
RSP: 0018:ffff8880a3e7f9f0 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 1ffff1101426e1c6
RDX: 1ffffffffffffffe RSI: ffffffff845b7bea RDI: fffffffffffffff4
RBP: ffff8880a3e7fa00 R08: ffff8880a1370540 R09: ffff8880a1370e30
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
R13: ffff88809f531040 R14: 00000000ffffff97 R15: ffff8880a3dff2c0
FS:  0000555556f4d880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 000000008b56d000 CR4: 00000000001406e0
Call Trace:
  sl_alloc_bufs drivers/net/slip/slip.c:196 [inline]
  slip_open+0xe16/0x1138 drivers/net/slip/slip.c:821
  tty_ldisc_open.isra.0+0x8b/0xe0 drivers/tty/tty_ldisc.c:469
  tty_set_ldisc+0x2d7/0x690 drivers/tty/tty_ldisc.c:596
  tiocsetd drivers/tty/tty_io.c:2332 [inline]
  tty_ioctl+0x5dc/0x15c0 drivers/tty/tty_io.c:2592
  vfs_ioctl fs/ioctl.c:46 [inline]
  file_ioctl fs/ioctl.c:509 [inline]
  do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696
  ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
  __do_sys_ioctl fs/ioctl.c:720 [inline]
  __se_sys_ioctl fs/ioctl.c:718 [inline]
  __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
  do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441149
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffd8ae1c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441149
RDX: 0000000020000140 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007fffd8ae1c50 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: fffffffffffffff4
---[ end trace c314d2d667c67584 ]---
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
Code: 54 49 89 fc e8 c0 b3 15 fd 4d 85 e4 74 77 e8 b6 b3 15 fd 4c 89 e2 48  
b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24 4d  
85 ed 74 0d e8 91 b3 15 fd 4c 89 ef e8 09 5b 4e fd
RSP: 0018:ffff8880a3e7f9f0 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 1ffff1101426e1c6
RDX: 1ffffffffffffffe RSI: ffffffff845b7bea RDI: fffffffffffffff4
RBP: ffff8880a3e7fa00 R08: ffff8880a1370540 R09: ffff8880a1370e30
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
R13: ffff88809f531040 R14: 00000000ffffff97 R15: ffff8880a3dff2c0
FS:  0000555556f4d880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 000000008b56d000 CR4: 00000000001406e0


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: BUG: unable to handle page fault for address = ADDR
  2019-04-25 22:16 BUG: unable to handle page fault for address = ADDR syzbot
@ 2019-04-25 23:13 ` Linus Torvalds
  2019-04-26 11:36   ` Ben Hutchings
  0 siblings, 1 reply; 6+ messages in thread
From: Linus Torvalds @ 2019-04-25 23:13 UTC (permalink / raw)
  To: syzbot, Ben Hutchings
  Cc: David Miller, Dmitry Vyukov, Alan Cox, Greg Kroah-Hartman,
	Jiri Slaby, Linux List Kernel Mailing, Michal Hocko, Netdev,
	Tetsuo Handa, peter, syzkaller-bugs, vegard.nossum

On Thu, Apr 25, 2019 at 3:16 PM syzbot
<syzbot+45474c076a4927533d2e@syzkaller.appspotmail.com> wrote:
>
> The bug was bisected to:
>
> commit bcdd0ca8cb8730573afebcaae4138f8f4c8eaa20
> Author: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Date:   Wed Apr 25 11:12:31 2018 +0000
>
>      tty: Use __GFP_NOFAIL for tty_ldisc_get()

I think this just makes slhc_init() fail more easily, but the bug was
pre-existing.

The *real* source of the bug seems to be

    4ab42d78e37a ("ppp, slip: Validate VJ compression slot parameters
completely")

from back in 2015.

We have (in drivers/net/slip/slip.c: sl_alloc_bufs())

        slcomp = slhc_init(16, 16);
        if (IS_ERR(slcomp))
                goto err_exit;
....
err_exit:
#ifdef SL_INCLUDE_CSLIP
        kfree(cbuff);
        slhc_free(slcomp);
#endif

so we do "slhc_free()" on an error pointer, which results in

    BUG: unable to handle page fault for address = fffffffffffffff4

and the fix might be something like the appended whitespace-damaged
trivial one-liner: just make slhc_free() silently ignore an error
pointer, to match the slhc_init() return behavior.

Ben? David?

                       Linus

diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index f4e93f5fc204..ea90db3c7705 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -153,7 +153,7 @@ slhc_init(int rslots, int tslots)
 void
 slhc_free(struct slcompress *comp)
 {
-       if ( comp == NULLSLCOMPR )
+       if ( IS_ERR_OR_NULL(comp) )
                return;

        if ( comp->tstate != NULLSLSTATE )

^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: BUG: unable to handle page fault for address = ADDR
  2019-04-25 23:13 ` Linus Torvalds
@ 2019-04-26 11:36   ` Ben Hutchings
  2019-04-27  1:27     ` Linus Torvalds
  0 siblings, 1 reply; 6+ messages in thread
From: Ben Hutchings @ 2019-04-26 11:36 UTC (permalink / raw)
  To: Linus Torvalds, syzbot
  Cc: David Miller, Dmitry Vyukov, Alan Cox, Greg Kroah-Hartman,
	Jiri Slaby, Linux List Kernel Mailing, Michal Hocko, Netdev,
	Tetsuo Handa, peter, syzkaller-bugs, vegard.nossum

[-- Attachment #1: Type: text/plain, Size: 1037 bytes --]

On Thu, 2019-04-25 at 16:13 -0700, Linus Torvalds wrote:
[...]
> so we do "slhc_free()" on an error pointer, which results in
> 
>     BUG: unable to handle page fault for address = fffffffffffffff4
> 
> and the fix might be something like the appended whitespace-damaged
> trivial one-liner: just make slhc_free() silently ignore an error
> pointer, to match the slhc_init() return behavior.
> 
> Ben? David?

This looks sensible to me.

Ben.

>                        Linus
> 
> diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
> index f4e93f5fc204..ea90db3c7705 100644
> --- a/drivers/net/slip/slhc.c
> +++ b/drivers/net/slip/slhc.c
> @@ -153,7 +153,7 @@ slhc_init(int rslots, int tslots)
>  void
>  slhc_free(struct slcompress *comp)
>  {
> -       if ( comp == NULLSLCOMPR )
> +       if ( IS_ERR_OR_NULL(comp) )
>                 return;
> 
>         if ( comp->tstate != NULLSLSTATE )
-- 
Ben Hutchings
It is impossible to make anything foolproof
because fools are so ingenious.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: BUG: unable to handle page fault for address = ADDR
  2019-04-26 11:36   ` Ben Hutchings
@ 2019-04-27  1:27     ` Linus Torvalds
  0 siblings, 0 replies; 6+ messages in thread
From: Linus Torvalds @ 2019-04-27  1:27 UTC (permalink / raw)
  To: Ben Hutchings
  Cc: syzbot, David Miller, Dmitry Vyukov, Alan Cox,
	Greg Kroah-Hartman, Jiri Slaby, Linux List Kernel Mailing,
	Michal Hocko, Netdev, Tetsuo Handa, peter, syzkaller-bugs,
	vegard.nossum

On Fri, Apr 26, 2019 at 4:36 AM Ben Hutchings <ben@decadent.org.uk> wrote:
>
> This looks sensible to me.

I've just applied it directly to my tree. It looks like slip is
largely a thing of the past, there have been no slip-specific patches
for the last year (all changes in the last year have been due to
treewide changes that weren't slip-specific).

                   Linus

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: BUG: unable to handle page fault for address: ADDR
  2019-05-09 12:40 BUG: unable to handle page fault for address: ADDR syzbot
@ 2019-05-09 12:52 ` Dmitry Vyukov
  0 siblings, 0 replies; 6+ messages in thread
From: Dmitry Vyukov @ 2019-05-09 12:52 UTC (permalink / raw)
  To: syzbot
  Cc: David Miller, Alexey Kuznetsov, LKML, netdev, syzkaller-bugs,
	Hideaki YOSHIFUJI

From: syzbot <syzbot+208b9694ae6aee1c7197@syzkaller.appspotmail.com>
Date: Thu, May 9, 2019 at 2:40 PM
To: <davem@davemloft.net>, <kuznet@ms2.inr.ac.ru>,
<linux-kernel@vger.kernel.org>, <netdev@vger.kernel.org>,
<syzkaller-bugs@googlegroups.com>, <yoshfuji@linux-ipv6.org>

> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit:    80f23212 Merge git://git.kernel.org/pub/scm/linux/kernel/g..
> git tree:       net
> console output: https://syzkaller.appspot.com/x/log.txt?x=112de0d8a00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=40a58b399941db7e
> dashboard link: https://syzkaller.appspot.com/bug?extid=208b9694ae6aee1c7197
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+208b9694ae6aee1c7197@syzkaller.appspotmail.com

Kernel has changed format of crash messages, but otherwise this is

#syz dup: BUG: unable to handle kernel paging request in iptunnel_xmit

https://syzkaller.appspot.com/bug?extid=61816a2458fec4918227
https://groups.google.com/forum/#!msg/syzkaller-bugs/dOzIJi3RjfY/buHkKqxgEgAJ

Reported in December, still happens.


> New replicast peer: 172.20.20.187
> BUG: unable to handle page fault for address: ffffde202758ca0b
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 0 P4D 0
> Oops: 0000 [#1] PREEMPT SMP KASAN
> CPU: 0 PID: 17591 Comm: syz-executor.3 Not tainted 5.1.0+ #3
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline]
> RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94
> Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6e 88 48 b8
> 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00
> RSP: 0018:ffff8880a0fb7008 EFLAGS: 00010a02
> RAX: dffffc0000000000 RBX: ffff11013ac65040 RCX: 1ffffffff10dce0c
> RDX: 1fffe2202758ca0b RSI: ffffffff83344b4c RDI: ffff11013ac65058
> RBP: ffff8880a0fb7068 R08: ffff888059df8140 R09: ffffed1015d06be0
> R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc
> R13: ffff88806bbfec40 R14: ffff88806a6a3714 R15: ffff8880a097a8c0
> FS:  00007fcf84ffc700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffde202758ca0b CR3: 00000000970bb000 CR4: 00000000001406f0
> Call Trace:
>   udp_tunnel_xmit_skb+0x236/0x310 net/ipv4/udp_tunnel.c:191
>   tipc_udp_xmit.isra.0+0x805/0xcc0 net/tipc/udp_media.c:181
>   tipc_udp_send_msg+0x295/0x4a0 net/tipc/udp_media.c:247
>   tipc_bearer_xmit_skb+0x172/0x360 net/tipc/bearer.c:503
>   tipc_enable_bearer+0xac4/0xd20 net/tipc/bearer.c:328
>   __tipc_nl_bearer_enable+0x2de/0x3a0 net/tipc/bearer.c:899
>   tipc_nl_bearer_enable+0x23/0x40 net/tipc/bearer.c:907
>   genl_family_rcv_msg+0x753/0xf90 net/netlink/genetlink.c:629
>   genl_rcv_msg+0xca/0x16c net/netlink/genetlink.c:654
>   netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2486
>   genl_rcv+0x29/0x40 net/netlink/genetlink.c:665
>   netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
>   netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1337
>   netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1926
>   sock_sendmsg_nosec net/socket.c:660 [inline]
>   sock_sendmsg+0x12e/0x170 net/socket.c:671
>   ___sys_sendmsg+0x81d/0x960 net/socket.c:2292
>   __sys_sendmsg+0x105/0x1d0 net/socket.c:2330
>   __do_sys_sendmsg net/socket.c:2339 [inline]
>   __se_sys_sendmsg net/socket.c:2337 [inline]
>   __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337
>   do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
>   entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x458da9
> Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
> ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007fcf84ffbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458da9
> RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
> RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf84ffc6d4
> R13: 00000000004c6449 R14: 00000000004dad18 R15: 00000000ffffffff
> Modules linked in:
> CR2: ffffde202758ca0b
> ---[ end trace 7b8973c639719d58 ]---
> RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline]
> RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94
> Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6e 88 48 b8
> 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00
> RSP: 0018:ffff8880a0fb7008 EFLAGS: 00010a02
> RAX: dffffc0000000000 RBX: ffff11013ac65040 RCX: 1ffffffff10dce0c
> RDX: 1fffe2202758ca0b RSI: ffffffff83344b4c RDI: ffff11013ac65058
> RBP: ffff8880a0fb7068 R08: ffff888059df8140 R09: ffffed1015d06be0
> R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc
> R13: ffff88806bbfec40 R14: ffff88806a6a3714 R15: ffff8880a097a8c0
> FS:  00007fcf84ffc700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffde202758ca0b CR3: 00000000970bb000 CR4: 00000000001406f0
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000f10885058873bf83%40google.com.
> For more options, visit https://groups.google.com/d/optout.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* BUG: unable to handle page fault for address: ADDR
@ 2019-05-09 12:40 syzbot
  2019-05-09 12:52 ` Dmitry Vyukov
  0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2019-05-09 12:40 UTC (permalink / raw)
  To: davem, kuznet, linux-kernel, netdev, syzkaller-bugs, yoshfuji

Hello,

syzbot found the following crash on:

HEAD commit:    80f23212 Merge git://git.kernel.org/pub/scm/linux/kernel/g..
git tree:       net
console output: https://syzkaller.appspot.com/x/log.txt?x=112de0d8a00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=40a58b399941db7e
dashboard link: https://syzkaller.appspot.com/bug?extid=208b9694ae6aee1c7197
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+208b9694ae6aee1c7197@syzkaller.appspotmail.com

New replicast peer: 172.20.20.187
BUG: unable to handle page fault for address: ffffde202758ca0b
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 17591 Comm: syz-executor.3 Not tainted 5.1.0+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline]
RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94
Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6e 88 48 b8  
00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f  
85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00
RSP: 0018:ffff8880a0fb7008 EFLAGS: 00010a02
RAX: dffffc0000000000 RBX: ffff11013ac65040 RCX: 1ffffffff10dce0c
RDX: 1fffe2202758ca0b RSI: ffffffff83344b4c RDI: ffff11013ac65058
RBP: ffff8880a0fb7068 R08: ffff888059df8140 R09: ffffed1015d06be0
R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc
R13: ffff88806bbfec40 R14: ffff88806a6a3714 R15: ffff8880a097a8c0
FS:  00007fcf84ffc700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffde202758ca0b CR3: 00000000970bb000 CR4: 00000000001406f0
Call Trace:
  udp_tunnel_xmit_skb+0x236/0x310 net/ipv4/udp_tunnel.c:191
  tipc_udp_xmit.isra.0+0x805/0xcc0 net/tipc/udp_media.c:181
  tipc_udp_send_msg+0x295/0x4a0 net/tipc/udp_media.c:247
  tipc_bearer_xmit_skb+0x172/0x360 net/tipc/bearer.c:503
  tipc_enable_bearer+0xac4/0xd20 net/tipc/bearer.c:328
  __tipc_nl_bearer_enable+0x2de/0x3a0 net/tipc/bearer.c:899
  tipc_nl_bearer_enable+0x23/0x40 net/tipc/bearer.c:907
  genl_family_rcv_msg+0x753/0xf90 net/netlink/genetlink.c:629
  genl_rcv_msg+0xca/0x16c net/netlink/genetlink.c:654
  netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2486
  genl_rcv+0x29/0x40 net/netlink/genetlink.c:665
  netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
  netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1337
  netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1926
  sock_sendmsg_nosec net/socket.c:660 [inline]
  sock_sendmsg+0x12e/0x170 net/socket.c:671
  ___sys_sendmsg+0x81d/0x960 net/socket.c:2292
  __sys_sendmsg+0x105/0x1d0 net/socket.c:2330
  __do_sys_sendmsg net/socket.c:2339 [inline]
  __se_sys_sendmsg net/socket.c:2337 [inline]
  __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337
  do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458da9
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fcf84ffbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458da9
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf84ffc6d4
R13: 00000000004c6449 R14: 00000000004dad18 R15: 00000000ffffffff
Modules linked in:
CR2: ffffde202758ca0b
---[ end trace 7b8973c639719d58 ]---
RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline]
RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94
Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6e 88 48 b8  
00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f  
85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00
RSP: 0018:ffff8880a0fb7008 EFLAGS: 00010a02
RAX: dffffc0000000000 RBX: ffff11013ac65040 RCX: 1ffffffff10dce0c
RDX: 1fffe2202758ca0b RSI: ffffffff83344b4c RDI: ffff11013ac65058
RBP: ffff8880a0fb7068 R08: ffff888059df8140 R09: ffffed1015d06be0
R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc
R13: ffff88806bbfec40 R14: ffff88806a6a3714 R15: ffff8880a097a8c0
FS:  00007fcf84ffc700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffde202758ca0b CR3: 00000000970bb000 CR4: 00000000001406f0


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2019-05-09 12:52 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-25 22:16 BUG: unable to handle page fault for address = ADDR syzbot
2019-04-25 23:13 ` Linus Torvalds
2019-04-26 11:36   ` Ben Hutchings
2019-04-27  1:27     ` Linus Torvalds
2019-05-09 12:40 BUG: unable to handle page fault for address: ADDR syzbot
2019-05-09 12:52 ` Dmitry Vyukov

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.