* kernel BUG at include/linux/skbuff.h:LINE! (2) @ 2019-08-16 18:38 syzbot 2019-08-17 15:28 ` syzbot 2019-08-18 14:06 ` Xin Long 0 siblings, 2 replies; 6+ messages in thread From: syzbot @ 2019-08-16 18:38 UTC (permalink / raw) To: davem, linux-kernel, linux-sctp, marcelo.leitner, netdev, nhorman, syzkaller-bugs, vyasevich Hello, syzbot found the following crash on: HEAD commit: 459c5fb4 Merge branch 'mscc-PTP-support' git tree: net-next console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c600000 kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 dashboard link: https://syzkaller.appspot.com/bug?extid=eb349eeee854e389c36d compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e2600000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a600000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com ------------[ cut here ]------------ kernel BUG at include/linux/skbuff.h:2225! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] RIP: 0010:__skb_pull include/linux/skbuff.h:2222 [inline] RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 RSP: 0018:ffff88808ac96e10 EFLAGS: 00010293 RAX: ffff88809c546000 RBX: 0000000000000004 RCX: ffffffff8594a3a6 RDX: 0000000000000000 RSI: ffffffff8594a3fa RDI: 0000000000000004 RBP: ffff88808ac96e30 R08: ffff88809c546000 R09: fffffbfff14a8f4f R10: fffffbfff14a8f4e R11: ffffffff8a547a77 R12: 0000000095e28bcc R13: ffff88808ac97478 R14: 00000000ffff8880 R15: ffff88808ac97478 FS: 0000555556549880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000089c3c000 CR4: 00000000001406f0 Call Trace: sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 dst_input include/net/dst.h:442 [inline] ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 ip6_list_rcv_finish net/ipv6/ip6_input.c:118 [inline] ip6_sublist_rcv+0x80c/0xcf0 net/ipv6/ip6_input.c:282 ipv6_list_rcv+0x373/0x4b0 net/ipv6/ip6_input.c:316 __netif_receive_skb_list_ptype net/core/dev.c:5049 [inline] __netif_receive_skb_list_core+0x5fc/0x9d0 net/core/dev.c:5097 __netif_receive_skb_list net/core/dev.c:5149 [inline] netif_receive_skb_list_internal+0x7eb/0xe60 net/core/dev.c:5244 gro_normal_list.part.0+0x1e/0xb0 net/core/dev.c:5757 gro_normal_list net/core/dev.c:5755 [inline] gro_normal_one net/core/dev.c:5769 [inline] napi_frags_finish net/core/dev.c:5782 [inline] napi_gro_frags+0xa6a/0xea0 net/core/dev.c:5855 tun_get_user+0x2e98/0x3fa0 drivers/net/tun.c:1974 tun_chr_write_iter+0xbd/0x156 drivers/net/tun.c:2020 call_write_iter include/linux/fs.h:1870 [inline] do_iter_readv_writev+0x5f8/0x8f0 fs/read_write.c:693 do_iter_write fs/read_write.c:970 [inline] do_iter_write+0x184/0x610 fs/read_write.c:951 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1015 do_writev+0x15b/0x330 fs/read_write.c:1058 __do_sys_writev fs/read_write.c:1131 [inline] __se_sys_writev fs/read_write.c:1128 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1128 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x441b10 Code: 05 48 3d 01 f0 ff ff 0f 83 5d 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 01 95 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 34 09 fc ff c3 48 83 ec 08 e8 ba 2b 00 00 RSP: 002b:00007ffe63706b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007ffe63706ba0 RCX: 0000000000441b10 RDX: 0000000000000001 RSI: 00007ffe63706bd0 RDI: 00000000000000f0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000004 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000122cb R13: 0000000000402960 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace c37566c1c02066db ]--- RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] RIP: 0010:__skb_pull include/linux/skbuff.h:2222 [inline] RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 RSP: 0018:ffff88808ac96e10 EFLAGS: 00010293 RAX: ffff88809c546000 RBX: 0000000000000004 RCX: ffffffff8594a3a6 RDX: 0000000000000000 RSI: ffffffff8594a3fa RDI: 0000000000000004 RBP: ffff88808ac96e30 R08: ffff88809c546000 R09: fffffbfff14a8f4f R10: fffffbfff14a8f4e R11: ffffffff8a547a77 R12: 0000000095e28bcc R13: ffff88808ac97478 R14: 00000000ffff8880 R15: ffff88808ac97478 FS: 0000555556549880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000089c3c000 CR4: 00000000001406f0 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: kernel BUG at include/linux/skbuff.h:LINE! (2) 2019-08-16 18:38 kernel BUG at include/linux/skbuff.h:LINE! (2) syzbot @ 2019-08-17 15:28 ` syzbot 2019-08-18 14:06 ` Xin Long 1 sibling, 0 replies; 6+ messages in thread From: syzbot @ 2019-08-17 15:28 UTC (permalink / raw) To: andriy.shevchenko, davem, edumazet, f.fainelli, idosch, kimbrownkd, linux-kernel, linux-sctp, marcelo.leitner, netdev, nhorman, syzkaller-bugs, tglx, vyasevich, wanghai26, yuehaibing syzbot has bisected this bug to: commit bc389fd101e57b36aacfaec2df8fe479eabb44ea Author: David S. Miller <davem@davemloft.net> Date: Tue Jul 2 21:12:30 2019 +0000 Merge branch 'macsec-fix-some-bugs-in-the-receive-path' bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=125c5c4c600000 start commit: 459c5fb4 Merge branch 'mscc-PTP-support' git tree: net-next final crash: https://syzkaller.appspot.com/x/report.txt?x=115c5c4c600000 console output: https://syzkaller.appspot.com/x/log.txt?x=165c5c4c600000 kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 dashboard link: https://syzkaller.appspot.com/bug?extid=eb349eeee854e389c36d syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e2600000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a600000 Reported-by: syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com Fixes: bc389fd101e5 ("Merge branch 'macsec-fix-some-bugs-in-the-receive-path'") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: kernel BUG at include/linux/skbuff.h:LINE! (2) 2019-08-16 18:38 kernel BUG at include/linux/skbuff.h:LINE! (2) syzbot 2019-08-17 15:28 ` syzbot @ 2019-08-18 14:06 ` Xin Long 2019-08-18 14:13 ` Dmitry Vyukov 1 sibling, 1 reply; 6+ messages in thread From: Xin Long @ 2019-08-18 14:06 UTC (permalink / raw) To: syzbot Cc: davem, LKML, linux-sctp, Marcelo Ricardo Leitner, network dev, Neil Horman, syzkaller-bugs, Vlad Yasevich On Sat, Aug 17, 2019 at 2:38 AM syzbot <syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com> wrote: > > Hello, > > syzbot found the following crash on: > > HEAD commit: 459c5fb4 Merge branch 'mscc-PTP-support' > git tree: net-next > console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 > dashboard link: https://syzkaller.appspot.com/bug?extid=eb349eeee854e389c36d > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e2600000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a600000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com > > ------------[ cut here ]------------ > kernel BUG at include/linux/skbuff.h:2225! > invalid opcode: 0000 [#1] PREEMPT SMP KASAN > CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > RIP: 0010:__skb_pull include/linux/skbuff.h:2222 [inline] > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > RSP: 0018:ffff88808ac96e10 EFLAGS: 00010293 > RAX: ffff88809c546000 RBX: 0000000000000004 RCX: ffffffff8594a3a6 > RDX: 0000000000000000 RSI: ffffffff8594a3fa RDI: 0000000000000004 > RBP: ffff88808ac96e30 R08: ffff88809c546000 R09: fffffbfff14a8f4f > R10: fffffbfff14a8f4e R11: ffffffff8a547a77 R12: 0000000095e28bcc > R13: ffff88808ac97478 R14: 00000000ffff8880 R15: ffff88808ac97478 > FS: 0000555556549880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020000100 CR3: 0000000089c3c000 CR4: 00000000001406f0 > Call Trace: > sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 > sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 > sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 > sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 > sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 > ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 > ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 > NF_HOOK include/linux/netfilter.h:305 [inline] > NF_HOOK include/linux/netfilter.h:299 [inline] > ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 > dst_input include/net/dst.h:442 [inline] > ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 Looks skb_list_del_init() should be called in ip6_sublist_rcv_finish, as does in ip_sublist_rcv_finish(). > ip6_list_rcv_finish net/ipv6/ip6_input.c:118 [inline] > ip6_sublist_rcv+0x80c/0xcf0 net/ipv6/ip6_input.c:282 > ipv6_list_rcv+0x373/0x4b0 net/ipv6/ip6_input.c:316 > __netif_receive_skb_list_ptype net/core/dev.c:5049 [inline] > __netif_receive_skb_list_core+0x5fc/0x9d0 net/core/dev.c:5097 > __netif_receive_skb_list net/core/dev.c:5149 [inline] > netif_receive_skb_list_internal+0x7eb/0xe60 net/core/dev.c:5244 > gro_normal_list.part.0+0x1e/0xb0 net/core/dev.c:5757 > gro_normal_list net/core/dev.c:5755 [inline] > gro_normal_one net/core/dev.c:5769 [inline] > napi_frags_finish net/core/dev.c:5782 [inline] > napi_gro_frags+0xa6a/0xea0 net/core/dev.c:5855 > tun_get_user+0x2e98/0x3fa0 drivers/net/tun.c:1974 > tun_chr_write_iter+0xbd/0x156 drivers/net/tun.c:2020 > call_write_iter include/linux/fs.h:1870 [inline] > do_iter_readv_writev+0x5f8/0x8f0 fs/read_write.c:693 > do_iter_write fs/read_write.c:970 [inline] > do_iter_write+0x184/0x610 fs/read_write.c:951 > vfs_writev+0x1b3/0x2f0 fs/read_write.c:1015 > do_writev+0x15b/0x330 fs/read_write.c:1058 > __do_sys_writev fs/read_write.c:1131 [inline] > __se_sys_writev fs/read_write.c:1128 [inline] > __x64_sys_writev+0x75/0xb0 fs/read_write.c:1128 > do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x441b10 > Code: 05 48 3d 01 f0 ff ff 0f 83 5d 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 > 00 66 90 83 3d 01 95 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff > ff 0f 83 34 09 fc ff c3 48 83 ec 08 e8 ba 2b 00 00 > RSP: 002b:00007ffe63706b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 > RAX: ffffffffffffffda RBX: 00007ffe63706ba0 RCX: 0000000000441b10 > RDX: 0000000000000001 RSI: 00007ffe63706bd0 RDI: 00000000000000f0 > RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000004 > R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000122cb > R13: 0000000000402960 R14: 0000000000000000 R15: 0000000000000000 > Modules linked in: > ---[ end trace c37566c1c02066db ]--- > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > RIP: 0010:__skb_pull include/linux/skbuff.h:2222 [inline] > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > RSP: 0018:ffff88808ac96e10 EFLAGS: 00010293 > RAX: ffff88809c546000 RBX: 0000000000000004 RCX: ffffffff8594a3a6 > RDX: 0000000000000000 RSI: ffffffff8594a3fa RDI: 0000000000000004 > RBP: ffff88808ac96e30 R08: ffff88809c546000 R09: fffffbfff14a8f4f > R10: fffffbfff14a8f4e R11: ffffffff8a547a77 R12: 0000000095e28bcc > R13: ffff88808ac97478 R14: 00000000ffff8880 R15: ffff88808ac97478 > FS: 0000555556549880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020000100 CR3: 0000000089c3c000 CR4: 00000000001406f0 > > > --- > This bug is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this bug report. See: > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > syzbot can test patches for this bug, for details see: > https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: kernel BUG at include/linux/skbuff.h:LINE! (2) 2019-08-18 14:06 ` Xin Long @ 2019-08-18 14:13 ` Dmitry Vyukov 2019-08-19 14:44 ` Xin Long 0 siblings, 1 reply; 6+ messages in thread From: Dmitry Vyukov @ 2019-08-18 14:13 UTC (permalink / raw) To: Xin Long Cc: syzbot, davem, LKML, linux-sctp, Marcelo Ricardo Leitner, network dev, Neil Horman, syzkaller-bugs, Vlad Yasevich On Sun, Aug 18, 2019 at 7:07 AM Xin Long <lucien.xin@gmail.com> wrote: > > On Sat, Aug 17, 2019 at 2:38 AM syzbot > <syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com> wrote: > > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: 459c5fb4 Merge branch 'mscc-PTP-support' > > git tree: net-next > > console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c600000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 > > dashboard link: https://syzkaller.appspot.com/bug?extid=eb349eeee854e389c36d > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e2600000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a600000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com > > > > ------------[ cut here ]------------ > > kernel BUG at include/linux/skbuff.h:2225! > > invalid opcode: 0000 [#1] PREEMPT SMP KASAN > > CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > Google 01/01/2011 > > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > > RIP: 0010:__skb_pull include/linux/skbuff.h:2222 [inline] > > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 > > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 > > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > > RSP: 0018:ffff88808ac96e10 EFLAGS: 00010293 > > RAX: ffff88809c546000 RBX: 0000000000000004 RCX: ffffffff8594a3a6 > > RDX: 0000000000000000 RSI: ffffffff8594a3fa RDI: 0000000000000004 > > RBP: ffff88808ac96e30 R08: ffff88809c546000 R09: fffffbfff14a8f4f > > R10: fffffbfff14a8f4e R11: ffffffff8a547a77 R12: 0000000095e28bcc > > R13: ffff88808ac97478 R14: 00000000ffff8880 R15: ffff88808ac97478 > > FS: 0000555556549880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 0000000020000100 CR3: 0000000089c3c000 CR4: 00000000001406f0 > > Call Trace: > > sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 > > sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 > > sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 > > sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 > > sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 > > ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 > > ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 > > NF_HOOK include/linux/netfilter.h:305 [inline] > > NF_HOOK include/linux/netfilter.h:299 [inline] > > ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 > > dst_input include/net/dst.h:442 [inline] > > ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 > Looks skb_list_del_init() should be called in ip6_sublist_rcv_finish, > as does in ip_sublist_rcv_finish(). This was recently introduced, right? Only in net-next and linux-next. Otherwise, is it a remote DoS? If so and if it's present in any releases, may need a CVE. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: kernel BUG at include/linux/skbuff.h:LINE! (2) 2019-08-18 14:13 ` Dmitry Vyukov @ 2019-08-19 14:44 ` Xin Long 2019-08-23 10:26 ` Xin Long 0 siblings, 1 reply; 6+ messages in thread From: Xin Long @ 2019-08-19 14:44 UTC (permalink / raw) To: Dmitry Vyukov Cc: syzbot, davem, LKML, linux-sctp, Marcelo Ricardo Leitner, network dev, Neil Horman, syzkaller-bugs, Vlad Yasevich On Sun, Aug 18, 2019 at 10:13 PM Dmitry Vyukov <dvyukov@google.com> wrote: > > On Sun, Aug 18, 2019 at 7:07 AM Xin Long <lucien.xin@gmail.com> wrote: > > > > On Sat, Aug 17, 2019 at 2:38 AM syzbot > > <syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com> wrote: > > > > > > Hello, > > > > > > syzbot found the following crash on: > > > > > > HEAD commit: 459c5fb4 Merge branch 'mscc-PTP-support' > > > git tree: net-next > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c600000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 > > > dashboard link: https://syzkaller.appspot.com/bug?extid=eb349eeee854e389c36d > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e2600000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a600000 > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com > > > > > > ------------[ cut here ]------------ > > > kernel BUG at include/linux/skbuff.h:2225! > > > invalid opcode: 0000 [#1] PREEMPT SMP KASAN > > > CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > Google 01/01/2011 > > > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > > > RIP: 0010:__skb_pull include/linux/skbuff.h:2222 [inline] > > > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > > > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > > > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 > > > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 > > > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > > > RSP: 0018:ffff88808ac96e10 EFLAGS: 00010293 > > > RAX: ffff88809c546000 RBX: 0000000000000004 RCX: ffffffff8594a3a6 > > > RDX: 0000000000000000 RSI: ffffffff8594a3fa RDI: 0000000000000004 > > > RBP: ffff88808ac96e30 R08: ffff88809c546000 R09: fffffbfff14a8f4f > > > R10: fffffbfff14a8f4e R11: ffffffff8a547a77 R12: 0000000095e28bcc > > > R13: ffff88808ac97478 R14: 00000000ffff8880 R15: ffff88808ac97478 > > > FS: 0000555556549880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > CR2: 0000000020000100 CR3: 0000000089c3c000 CR4: 00000000001406f0 > > > Call Trace: > > > sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 > > > sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 > > > sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 > > > sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 > > > sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 > > > ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 > > > ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 > > > NF_HOOK include/linux/netfilter.h:305 [inline] > > > NF_HOOK include/linux/netfilter.h:299 [inline] > > > ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 > > > dst_input include/net/dst.h:442 [inline] > > > ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 > > Looks skb_list_del_init() should be called in ip6_sublist_rcv_finish, > > as does in ip_sublist_rcv_finish(). > > This was recently introduced, right? Only in net-next and linux-next. > Otherwise, is it a remote DoS? If so and if it's present in any > releases, may need a CVE. I need to reproduce and confirm it, will let you know. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: kernel BUG at include/linux/skbuff.h:LINE! (2) 2019-08-19 14:44 ` Xin Long @ 2019-08-23 10:26 ` Xin Long 0 siblings, 0 replies; 6+ messages in thread From: Xin Long @ 2019-08-23 10:26 UTC (permalink / raw) To: Dmitry Vyukov Cc: syzbot, davem, LKML, linux-sctp, Marcelo Ricardo Leitner, network dev, Neil Horman, syzkaller-bugs, Vlad Yasevich On Mon, Aug 19, 2019 at 10:44 PM Xin Long <lucien.xin@gmail.com> wrote: > > On Sun, Aug 18, 2019 at 10:13 PM Dmitry Vyukov <dvyukov@google.com> wrote: > > > > On Sun, Aug 18, 2019 at 7:07 AM Xin Long <lucien.xin@gmail.com> wrote: > > > > > > On Sat, Aug 17, 2019 at 2:38 AM syzbot > > > <syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com> wrote: > > > > > > > > Hello, > > > > > > > > syzbot found the following crash on: > > > > > > > > HEAD commit: 459c5fb4 Merge branch 'mscc-PTP-support' > > > > git tree: net-next > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c600000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=eb349eeee854e389c36d > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e2600000 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a600000 > > > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > > Reported-by: syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com > > > > > > > > ------------[ cut here ]------------ > > > > kernel BUG at include/linux/skbuff.h:2225! > > > > invalid opcode: 0000 [#1] PREEMPT SMP KASAN > > > > CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 > > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > > Google 01/01/2011 > > > > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > > > > RIP: 0010:__skb_pull include/linux/skbuff.h:2222 [inline] > > > > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > > > > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > > > > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 > > > > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 > > > > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > > > > RSP: 0018:ffff88808ac96e10 EFLAGS: 00010293 > > > > RAX: ffff88809c546000 RBX: 0000000000000004 RCX: ffffffff8594a3a6 > > > > RDX: 0000000000000000 RSI: ffffffff8594a3fa RDI: 0000000000000004 > > > > RBP: ffff88808ac96e30 R08: ffff88809c546000 R09: fffffbfff14a8f4f > > > > R10: fffffbfff14a8f4e R11: ffffffff8a547a77 R12: 0000000095e28bcc > > > > R13: ffff88808ac97478 R14: 00000000ffff8880 R15: ffff88808ac97478 > > > > FS: 0000555556549880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > > CR2: 0000000020000100 CR3: 0000000089c3c000 CR4: 00000000001406f0 > > > > Call Trace: > > > > sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 > > > > sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 > > > > sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 > > > > sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 > > > > sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 > > > > ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 > > > > ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 > > > > NF_HOOK include/linux/netfilter.h:305 [inline] > > > > NF_HOOK include/linux/netfilter.h:299 [inline] > > > > ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 > > > > dst_input include/net/dst.h:442 [inline] > > > > ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 > > > Looks skb_list_del_init() should be called in ip6_sublist_rcv_finish, > > > as does in ip_sublist_rcv_finish(). > > > > This was recently introduced, right? Only in net-next and linux-next. > > Otherwise, is it a remote DoS? If so and if it's present in any > > releases, may need a CVE. > I need to reproduce and confirm it, will let you know. The panic could be triggered since the listified RX support for GRO_NORMAL skbs: https://patchwork.ozlabs.org/cover/1142808/ (it's only in net-next now, I will post a fix soon) But the bug itself is not really related with the patch series above. the issue here is pretty much like what this patch fixed: https://patchwork.ozlabs.org/patch/942541/ I didn't see a CVE for it, maybe because it was only on net-next too. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-08-23 10:27 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-08-16 18:38 kernel BUG at include/linux/skbuff.h:LINE! (2) syzbot 2019-08-17 15:28 ` syzbot 2019-08-18 14:06 ` Xin Long 2019-08-18 14:13 ` Dmitry Vyukov 2019-08-19 14:44 ` Xin Long 2019-08-23 10:26 ` Xin Long
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).