From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.6 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77BCCC3A59C for ; Fri, 16 Aug 2019 04:17:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 457AC2077C for ; Fri, 16 Aug 2019 04:17:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1565929065; bh=KYggdZKTQhxo4mb/TpGgNFnb1ZKhLbE8Lv0eb5oYZHc=; h=Date:From:To:Cc:Subject:List-ID:From; b=J5KDogu57pdnXbJcO+mqUA8e/9hX2O0l1lILHygxt8N9QCfJbwW95J20D1v/sjsr2 CnUnSmngY/ctKMzTY66WajR/FKj+PdBjGhw6qy7EOEyFs0b7IJqWEVzURH9740GJd3 BZz5EF91kHKdZu+I2D+y5uWHlirkziC58FBhc4e8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726240AbfHPERo (ORCPT ); Fri, 16 Aug 2019 00:17:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:58072 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725897AbfHPERo (ORCPT ); Fri, 16 Aug 2019 00:17:44 -0400 Received: from sol.localdomain (c-24-5-143-220.hsd1.ca.comcast.net [24.5.143.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9D3E32089E; Fri, 16 Aug 2019 04:17:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1565929062; bh=KYggdZKTQhxo4mb/TpGgNFnb1ZKhLbE8Lv0eb5oYZHc=; h=Date:From:To:Cc:Subject:From; b=CNUuS57m8qR9bcPLyGv0IChQJFq86b55QOc9ff5dfhXHt1uaYVZ2O1sU4NbVVzQOK BwzLIEBxNqtXuAs6VCbG+/B6U+pLZVYC7GfN8NgiG2J0Amo62/vBFrhKJkNGmhyhce VVefDC8k1VAdxRHCSh70sY/9yWxrsxZE7ODdnEU4= Date: Thu, 15 Aug 2019 21:17:41 -0700 From: Eric Biggers To: netdev@vger.kernel.org, bpf@vger.kernel.org, "David S. Miller" , Alexei Starovoitov , Daniel Borkmann Cc: Martin KaFai Lau , Song Liu , Yonghong Song , syzkaller-bugs@googlegroups.com Subject: Reminder: 8 active syzbot reports in "net/bpf" subsystem Message-ID: <20190816041741.GB12185@sol.localdomain> Mail-Followup-To: netdev@vger.kernel.org, bpf@vger.kernel.org, "David S. Miller" , Alexei Starovoitov , Daniel Borkmann , Martin KaFai Lau , Song Liu , Yonghong Song , syzkaller-bugs@googlegroups.com MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.12.1 (2019-06-15) Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org [This email was generated by a script. Let me know if you have any suggestions to make it better, or if you want it re-generated with the latest status.] Of the distinct crashes that syzbot has seen in the last week, I've manually marked 8 of them as possibly being bugs in the "net/bpf" subsystem. I've listed these bug reports below. Of these 8 reports, 1 was bisected to a commit from the following person: Alexei Starovoitov I've manually checked that this bisection result looks plausible. If you believe a bug report is no longer valid, please close it by sending a '#syz fix', '#syz dup', or '#syz invalid' command in reply to the original thread, as explained at https://goo.gl/tpsmEJ#status If you believe I misattributed a bug report to the "net/bpf" subsystem, please let me know and (if possible) forward it to the correct place. Note: in total, I've actually assigned 42 open syzbot reports to this subsystem. But to help focus people's efforts, I've only listed the 8 that have (re-)occurred in the last week. Let me know if you want the full list. Here are the bug reports: -------------------------------------------------------------------------------- Title: WARNING in bpf_jit_free Last occurred: 0 days ago Reported: 395 days ago Branches: Mainline and others Dashboard link: https://syzkaller.appspot.com/bug?id=d04f9c2ec11ab2678f7427795ff5170cb9eb2220 Original thread: https://lore.kernel.org/lkml/000000000000e92d1805711f5552@google.com/T/#u This bug has a C reproducer. syzbot has bisected this bug, but I think the bisection result is incorrect. The original thread for this bug received 5 replies; the last was 65 days ago. If you fix this bug, please add the following tag to the commit: Reported-by: syzbot+2ff1e7cb738fd3c41113@syzkaller.appspotmail.com If you send any email or patch for this bug, please consider replying to the original thread. For the git send-email command to use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply instructions" at https://lore.kernel.org/r/000000000000e92d1805711f5552@google.com -------------------------------------------------------------------------------- Title: WARNING: kernel stack frame pointer has bad value (2) Last occurred: 1 day ago Reported: 395 days ago Branches: Mainline and others Dashboard link: https://syzkaller.appspot.com/bug?id=02a32f98a4e3b5a2ed6929aabdd28dd1618b9c03 Original thread: https://lore.kernel.org/lkml/0000000000000956640571197f98@google.com/T/#u This bug has a C reproducer. The original thread for this bug received 1 reply, 395 days ago. If you fix this bug, please add the following tag to the commit: Reported-by: syzbot+903cdd6bce9a6eb832a4@syzkaller.appspotmail.com If you send any email or patch for this bug, please consider replying to the original thread. For the git send-email command to use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply instructions" at https://lore.kernel.org/r/0000000000000956640571197f98@google.com -------------------------------------------------------------------------------- Title: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_add Last occurred: 0 days ago Reported: 339 days ago Branches: Mainline and others Dashboard link: https://syzkaller.appspot.com/bug?id=97f89d84d528e4f5150dcfbdeb97347bc8471e96 Original thread: https://lore.kernel.org/lkml/0000000000009417ef0575802d44@google.com/T/#u This bug has a syzkaller reproducer only. The original thread for this bug received 2 replies; the last was 164 days ago. If you fix this bug, please add the following tag to the commit: Reported-by: syzbot+c827a78260579449ad39@syzkaller.appspotmail.com If you send any email or patch for this bug, please consider replying to the original thread. For the git send-email command to use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply instructions" at https://lore.kernel.org/r/0000000000009417ef0575802d44@google.com -------------------------------------------------------------------------------- Title: WARNING in bpf_prog_kallsyms_find Last occurred: 0 days ago Reported: 100 days ago Branches: Mainline and others Dashboard link: https://syzkaller.appspot.com/bug?id=40b0c218e639f1d882b86abff2549cfe11c5101e Original thread: https://lore.kernel.org/lkml/000000000000a8fa360588580820@google.com/T/#u This bug has a C reproducer. No one replied to the original thread for this bug. If you fix this bug, please add the following tag to the commit: Reported-by: syzbot+89d1ce6e80218a6192d8@syzkaller.appspotmail.com If you send any email or patch for this bug, please consider replying to the original thread. For the git send-email command to use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply instructions" at https://lore.kernel.org/r/000000000000a8fa360588580820@google.com -------------------------------------------------------------------------------- Title: KASAN: use-after-free Read in sk_psock_unlink Last occurred: 5 days ago Reported: 293 days ago Branches: Mainline and others Dashboard link: https://syzkaller.appspot.com/bug?id=d691981726208716cc7aec231fb915e27763d662 Original thread: https://lore.kernel.org/lkml/000000000000fd342e05791cc86f@google.com/T/#u This bug has a syzkaller reproducer only. syzbot has bisected this bug, but I think the bisection result is incorrect. The original thread for this bug received 1 reply, 85 days ago. If you fix this bug, please add the following tag to the commit: Reported-by: syzbot+3acd9f67a6a15766686e@syzkaller.appspotmail.com If you send any email or patch for this bug, please consider replying to the original thread. For the git send-email command to use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply instructions" at https://lore.kernel.org/r/000000000000fd342e05791cc86f@google.com -------------------------------------------------------------------------------- Title: KASAN: slab-out-of-bounds Read in do_jit Last occurred: 0 days ago Reported: 23 days ago Branches: Mainline and others Dashboard link: https://syzkaller.appspot.com/bug?id=3aacade388873fa82bd6d2efb6aaa9ab85964020 Original thread: https://lore.kernel.org/lkml/000000000000a6ab6b058e5b899b@google.com/T/#u This bug has a C reproducer. This bug was bisected to: commit 2589726d12a1b12eaaa93c7f1ea64287e383c7a5 Author: Alexei Starovoitov Date: Sat Jun 15 19:12:20 2019 +0000   bpf: introduce bounded loops No one has replied to the original thread for this bug yet. If you fix this bug, please add the following tag to the commit: Reported-by: syzbot+6b40f58c6d280fa23b40@syzkaller.appspotmail.com If you send any email or patch for this bug, please consider replying to the original thread. For the git send-email command to use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply instructions" at https://lore.kernel.org/r/000000000000a6ab6b058e5b899b@google.com -------------------------------------------------------------------------------- Title: WARNING in is_bpf_text_address Last occurred: 0 days ago Reported: 55 days ago Branches: Mainline Dashboard link: https://syzkaller.appspot.com/bug?id=2386340f7a641010bb1e17228d1e9319592c01ba Original thread: https://lore.kernel.org/lkml/00000000000000ac4f058bd50039@google.com/T/#u This bug has a C reproducer. The original thread for this bug has received 5 replies; the last was 2 hours ago. If you fix this bug, please add the following tag to the commit: Reported-by: syzbot+bd3bba6ff3fcea7a6ec6@syzkaller.appspotmail.com If you send any email or patch for this bug, please reply to the original thread, which had activity only 2 hours ago. For the git send-email command to use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply instructions" at https://lore.kernel.org/r/00000000000000ac4f058bd50039@google.com -------------------------------------------------------------------------------- Title: memory leak in sock_hash_update_common Last occurred: 7 days ago Reported: 85 days ago Branches: Mainline Dashboard link: https://syzkaller.appspot.com/bug?id=9992588b3bbe2617f62f41b1162af9fc8ea4829c Original thread: https://lore.kernel.org/lkml/000000000000fa662405897c0774@google.com/T/#u This bug has a syzkaller reproducer only. No one has replied to the original thread for this bug yet. If you fix this bug, please add the following tag to the commit: Reported-by: syzbot+30c7a1fc662026545124@syzkaller.appspotmail.com If you send any email or patch for this bug, please consider replying to the original thread. For the git send-email command to use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply instructions" at https://lore.kernel.org/r/000000000000fa662405897c0774@google.com