Hello, syzbot found the following crash on: HEAD commit: 6fcf9b1d4d6c r8169: fix runtime suspend git tree: bpf-next console output: https://syzkaller.appspot.com/x/log.txt?x=174529b2400000 kernel config: https://syzkaller.appspot.com/x/.config?x=d264f2b04177ca7c dashboard link: https://syzkaller.appspot.com/bug?extid=7b269953d076326d7de0 compiler: gcc (GCC) 8.0.1 20180413 (experimental) syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1397e2c2400000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120e462c400000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+7b269953d076326d7de0 at syzkaller.appspotmail.com IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 =================================================================BUG: KASAN: stack-out-of-bounds in pgd_val arch/x86/include/asm/paravirt.h:412 [inline] BUG: KASAN: stack-out-of-bounds in p4d_pfn arch/x86/include/asm/pgtable.h:205 [inline] BUG: KASAN: stack-out-of-bounds in vmalloc_fault+0x743/0x760 arch/x86/mm/fault.c:462 Read of size 8 at addr ffff8801a936f160 by task ksoftirqd/0/9 CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.18.0-rc3+ #47 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 print_address_description+0x6c/0x20b mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 pgd_val arch/x86/include/asm/paravirt.h:412 [inline] p4d_pfn arch/x86/include/asm/pgtable.h:205 [inline] vmalloc_fault+0x743/0x760 arch/x86/mm/fault.c:462 __do_page_fault+0x829/0xe50 arch/x86/mm/fault.c:1245 do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160 RIP: 0010:ebt_do_table+0x1a7/0x2170 net/bridge/netfilter/ebtables.c:208 Code: 24 04 4d 8d ac 24 80 00 00 00 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 8f 1e 00 00 <41> 8b 44 24 04 49 8d 7c 24 38 65 8b 15 28 7f 39 79 48 c1 e0 04 48 RSP: 0018:ffff8801d9ab6ab8 EFLAGS: 00010246 RAX: 0000000000000007 RBX: 0000000000000005 RCX: ffffffff81601dff RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc90001e2c004 RBP: ffff8801d9ab6c88 R08: ffffed003a6f4e49 R09: ffffed003a6f4e48 R10: ffffed003a6f4e48 R11: ffff8801d37a7243 R12: ffffc90001e2c000 R13: ffffc90001e2c080 R14: ffff8801d9ab6cc0 R15: ffff8801d9394380 ebt_broute+0x200/0x340 net/bridge/netfilter/ebtable_broute.c:60 br_handle_frame+0x6d1/0x1a20 net/bridge/br_input.c:292 __netif_receive_skb_core.constprop.140+0x142d/0x3620 net/core/dev.c:4697 __netif_receive_skb_one_core+0xd0/0x200 net/core/dev.c:4766 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:4873 process_backlog+0x219/0x760 net/core/dev.c:5676 napi_poll net/core/dev.c:6088 [inline] net_rx_action+0x7a5/0x1950 net/core/dev.c:6154 __do_softirq+0x2e8/0xb17 kernel/softirq.c:288 run_ksoftirqd+0x86/0x100 kernel/softirq.c:649 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164 kthread+0x345/0x410 kernel/kthread.c:240 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412 The buggy address belongs to the page: page:ffffea0006a4dbc0 count:1 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x2fffc0000000000() raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801a936f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801a936f080: 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00> ffff8801a936f100: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 f8^ ffff8801a936f180: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 ffff8801a936f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================= --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller at googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches
Dmitry Vyukov
2018-Jul-07 07:00 UTC
[Bridge] KASAN: stack-out-of-bounds Read in vmalloc_fault
On Sat, Jul 7, 2018 at 3:19 AM, syzbot <syzbot+7b269953d076326d7de0 at syzkaller.appspotmail.com> wrote:> Hello, > > syzbot found the following crash on: > > HEAD commit: 6fcf9b1d4d6c r8169: fix runtime suspend > git tree: bpf-next > console output: https://syzkaller.appspot.com/x/log.txt?x=174529b2400000 > kernel config: https://syzkaller.appspot.com/x/.config?x=d264f2b04177ca7c > dashboard link: https://syzkaller.appspot.com/bug?extid=7b269953d076326d7de0 > compiler: gcc (GCC) 8.0.1 20180413 (experimental) > syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1397e2c2400000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120e462c400000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+7b269953d076326d7de0 at syzkaller.appspotmail.comThis looks like the bpf map bug which leads to random bugs on stack: #syz dup: KASAN: stack-out-of-bounds Read in timerqueue_add> IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready > IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready > IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready > 8021q: adding VLAN 0 to HW filter on device team0 > =================================================================> BUG: KASAN: stack-out-of-bounds in pgd_val > arch/x86/include/asm/paravirt.h:412 [inline] > BUG: KASAN: stack-out-of-bounds in p4d_pfn > arch/x86/include/asm/pgtable.h:205 [inline] > BUG: KASAN: stack-out-of-bounds in vmalloc_fault+0x743/0x760 > arch/x86/mm/fault.c:462 > Read of size 8 at addr ffff8801a936f160 by task ksoftirqd/0/9 > > CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.18.0-rc3+ #47 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 > print_address_description+0x6c/0x20b mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 > pgd_val arch/x86/include/asm/paravirt.h:412 [inline] > p4d_pfn arch/x86/include/asm/pgtable.h:205 [inline] > vmalloc_fault+0x743/0x760 arch/x86/mm/fault.c:462 > __do_page_fault+0x829/0xe50 arch/x86/mm/fault.c:1245 > do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471 > page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160 > RIP: 0010:ebt_do_table+0x1a7/0x2170 net/bridge/netfilter/ebtables.c:208 > Code: 24 04 4d 8d ac 24 80 00 00 00 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 > f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 8f 1e 00 00 <41> 8b 44 24 04 49 > 8d 7c 24 38 65 8b 15 28 7f 39 79 48 c1 e0 04 48 > RSP: 0018:ffff8801d9ab6ab8 EFLAGS: 00010246 > RAX: 0000000000000007 RBX: 0000000000000005 RCX: ffffffff81601dff > RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc90001e2c004 > RBP: ffff8801d9ab6c88 R08: ffffed003a6f4e49 R09: ffffed003a6f4e48 > R10: ffffed003a6f4e48 R11: ffff8801d37a7243 R12: ffffc90001e2c000 > R13: ffffc90001e2c080 R14: ffff8801d9ab6cc0 R15: ffff8801d9394380 > ebt_broute+0x200/0x340 net/bridge/netfilter/ebtable_broute.c:60 > br_handle_frame+0x6d1/0x1a20 net/bridge/br_input.c:292 > __netif_receive_skb_core.constprop.140+0x142d/0x3620 net/core/dev.c:4697 > __netif_receive_skb_one_core+0xd0/0x200 net/core/dev.c:4766 > __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:4873 > process_backlog+0x219/0x760 net/core/dev.c:5676 > napi_poll net/core/dev.c:6088 [inline] > net_rx_action+0x7a5/0x1950 net/core/dev.c:6154 > __do_softirq+0x2e8/0xb17 kernel/softirq.c:288 > run_ksoftirqd+0x86/0x100 kernel/softirq.c:649 > smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164 > kthread+0x345/0x410 kernel/kthread.c:240 > ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412 > > The buggy address belongs to the page: > page:ffffea0006a4dbc0 count:1 mapcount:0 mapping:0000000000000000 index:0x0 > flags: 0x2fffc0000000000() > raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000 > raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff8801a936f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff8801a936f080: 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 >> >> ffff8801a936f100: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 f8 > > ^ > ffff8801a936f180: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 > ffff8801a936f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > =================================================================> > > --- > This bug is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller at googlegroups.com. > > syzbot will keep track of this bug report. See: > https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with > syzbot. > syzbot can test patches for this bug, for details see: > https://goo.gl/tpsmEJ#testing-patches > > -- > You received this message because you are subscribed to the Google Groups > "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to syzkaller-bugs+unsubscribe at googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/syzkaller-bugs/000000000000d8e31b05705e901b%40google.com. > For more options, visit https://groups.google.com/d/optout.