Linux-WPAN Archive on lore.kernel.org
 help / color / Atom feed
* BUG: unable to handle kernel paging request in nl802154_del_llsec_key
@ 2021-02-18 19:24 syzbot
  2021-02-18 20:04 ` syzbot
  0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2021-02-18 19:24 UTC (permalink / raw)
  To: alex.aring, davem, kuba, linux-kernel, linux-wpan, netdev,
	stefan, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    f40ddce8 Linux 5.11
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11261a4cd00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=67894355b1dbeb07
dashboard link: https://syzkaller.appspot.com/bug?extid=ac5c11d2959a8b3c4806
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ac5c11d2959a8b3c4806@syzkaller.appspotmail.com

netlink: 164 bytes leftover after parsing attributes in process `syz-executor.1'.
Unable to handle kernel paging request at virtual address dfff800000000000
Mem abort info:
  ESR = 0x96000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 5366 Comm: syz-executor.1 Not tainted 5.11.0-syzkaller #0
Hardware name: linux,dummy-virt (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
pc : nla_len include/net/netlink.h:1148 [inline]
pc : nla_parse_nested_deprecated include/net/netlink.h:1231 [inline]
pc : nl802154_del_llsec_key+0x138/0x2c0 net/ieee802154/nl802154.c:1595
lr : genl_family_rcv_msg_doit+0x1b8/0x2a0 net/netlink/genetlink.c:739
sp : ffff000019c57280
x29: ffff000019c57280 x28: ffff80001aa29cc0 
x27: ffff000019c576d0 x26: ffff000012280000 
x25: 1fffe0000338aeb2 x24: 1fffe0000338ae84 
x23: ffff800018380c80 x22: ffff000016174c10 
x21: ffff00000fca8000 x20: 0000000000000000 
x19: 1fffe0000338ae5a x18: 0000000000000001 
x17: 0000000000000000 x16: 0000000000000000 
x15: 0000000000000000 x14: 1fffe0000338adf4 
x13: 0000000000000000 x12: ffff60000338ae55 
x11: 1fffe0000338ae54 x10: ffff60000338ae54 
x9 : 000000000000f1f1 x8 : 000000000000f2f2 
x7 : 00000000f3000000 x6 : 1fffe0000338ae90 
x5 : 00000000f3f3f3f3 x4 : 0000000000000000 
x3 : dfff800000000000 x2 : 0000000000000004 
x1 : ffff000019c57450 x0 : 0000000000000001 
Call trace:
 nla_data include/net/netlink.h:1139 [inline]
 nla_parse_nested_deprecated include/net/netlink.h:1231 [inline]
 nl802154_del_llsec_key+0x138/0x2c0 net/ieee802154/nl802154.c:1595
 genl_family_rcv_msg_doit+0x1b8/0x2a0 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x24c/0x430 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x198/0x34c net/netlink/af_netlink.c:2494
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x3e0/0x670 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x610/0xa20 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xc0/0xf4 net/socket.c:672
 ____sys_sendmsg+0x548/0x6d0 net/socket.c:2345
 ___sys_sendmsg+0xf4/0x170 net/socket.c:2399
 __sys_sendmsg+0xbc/0x14c net/socket.c:2432
 __do_sys_sendmsg net/socket.c:2441 [inline]
 __se_sys_sendmsg net/socket.c:2439 [inline]
 __arm64_sys_sendmsg+0x70/0xa0 net/socket.c:2439
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
 el0_svc_common.constprop.0+0x110/0x3c0 arch/arm64/kernel/syscall.c:159
 do_el0_svc+0xa4/0xd0 arch/arm64/kernel/syscall.c:198
 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:365
 el0_sync_handler+0x1a4/0x1ac arch/arm64/kernel/entry-common.c:381
 el0_sync+0x174/0x180 arch/arm64/kernel/entry.S:699
Code: f2fbffe3 92400a80 11000400 91001282 (38e36883) 
---[ end trace dde92eef2b40d315 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: BUG: unable to handle kernel paging request in nl802154_del_llsec_key
  2021-02-18 19:24 BUG: unable to handle kernel paging request in nl802154_del_llsec_key syzbot
@ 2021-02-18 20:04 ` syzbot
  0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2021-02-18 20:04 UTC (permalink / raw)
  To: alex.aring, davem, kuba, linux-kernel, linux-wpan, netdev,
	stefan, syzkaller-bugs

syzbot has found a reproducer for the following issue on:

HEAD commit:    3af409ca net: enetc: fix destroyed phylink dereference dur..
git tree:       net
console output: https://syzkaller.appspot.com/x/log.txt?x=12ee9f72d00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8cb23303ddb9411f
dashboard link: https://syzkaller.appspot.com/bug?extid=ac5c11d2959a8b3c4806
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1201ac0cd00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1307734ad00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ac5c11d2959a8b3c4806@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 8434 Comm: syz-executor691 Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:nla_len include/net/netlink.h:1148 [inline]
RIP: 0010:nla_parse_nested_deprecated include/net/netlink.h:1231 [inline]
RIP: 0010:nl802154_del_llsec_key+0x16d/0x320 net/ieee802154/nl802154.c:1595
Code: 00 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ab 01 00 00 48 8b 93 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 d1 48 c1 e9 03 <0f> b6 0c 01 48 89 d0 83 e0 07 83 c0 01 38 c8 7c 08 84 c9 0f 85 16
RSP: 0018:ffffc90001abf528 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88801847fc00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff88892647 RDI: ffff88801847fd28
RBP: 1ffff92000357ea6 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8731625a R11: 0000000000000000 R12: ffff888144a80000
R13: ffff8881448fcbd0 R14: ffffc90001abf8b0 R15: 0000000000000000
FS:  0000000001d99300(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000048 CR3: 0000000015550000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x43f909
Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd3305ef28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004004a0 RCX: 000000000043f909
RDX: 0000000020000000 RSI: 0000000020000140 RDI: 0000000000000003
RBP: 0000000000403370 R08: 000000000000000c R09: 00000000004004a0
R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000403400
R13: 0000000000000000 R14: 00000000004ad018 R15: 00000000004004a0
Modules linked in:
---[ end trace e812501a57df1749 ]---
RIP: 0010:nla_len include/net/netlink.h:1148 [inline]
RIP: 0010:nla_parse_nested_deprecated include/net/netlink.h:1231 [inline]
RIP: 0010:nl802154_del_llsec_key+0x16d/0x320 net/ieee802154/nl802154.c:1595
Code: 00 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ab 01 00 00 48 8b 93 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 d1 48 c1 e9 03 <0f> b6 0c 01 48 89 d0 83 e0 07 83 c0 01 38 c8 7c 08 84 c9 0f 85 16
RSP: 0018:ffffc90001abf528 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88801847fc00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff88892647 RDI: ffff88801847fd28
RBP: 1ffff92000357ea6 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8731625a R11: 0000000000000000 R12: ffff888144a80000
R13: ffff8881448fcbd0 R14: ffffc90001abf8b0 R15: 0000000000000000
FS:  0000000001d99300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f152c03e068 CR3: 0000000015550000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-18 19:24 BUG: unable to handle kernel paging request in nl802154_del_llsec_key syzbot
2021-02-18 20:04 ` syzbot

Linux-WPAN Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-wpan/0 linux-wpan/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-wpan linux-wpan/ https://lore.kernel.org/linux-wpan \
		linux-wpan@vger.kernel.org
	public-inbox-index linux-wpan

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-wpan


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git