From: syzbot <syzbot+af9492708df9797198d6@syzkaller.appspotmail.com>
To: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, davem@davemloft.net, eadavis@qq.com,
eddyz87@gmail.com, haoluo@google.com, hawk@kernel.org,
john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org,
kuba@kernel.org, linux-kernel@vger.kernel.org,
martin.lau@linux.dev, netdev@vger.kernel.org, sdf@google.com,
song@kernel.org, syzkaller-bugs@googlegroups.com,
toke@kernel.org, yonghong.song@linux.dev
Subject: Re: [syzbot] [bpf?] [net?] general protection fault in dev_map_enqueue
Date: Mon, 08 Apr 2024 15:03:03 -0700 [thread overview]
Message-ID: <0000000000003a924406159cf8ee@google.com> (raw)
In-Reply-To: <877ch7hnxf.fsf@toke.dk>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in dev_map_enqueue
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 8787 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-05236-g443574b03387-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:dev_map_enqueue+0x31/0x3e0 kernel/bpf/devmap.c:539
Code: 41 56 41 55 41 54 53 48 83 ec 18 49 89 d4 49 89 f5 48 89 fd 49 be 00 00 00 00 00 fc ff df e8 a6 42 d8 ff 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 10 8a 3b 00 4c 8b 7d 00 48 83 c5
RSP: 0018:ffffc9000bc1f688 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888011815a00
RDX: 0000000000000000 RSI: ffff88802bed7070 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff894ff90e
R10: 0000000000000004 R11: ffff888011815a00 R12: ffff888022f4a000
R13: ffff88802bed7070 R14: dffffc0000000000 R15: ffff8880b943c088
FS: 00007f0b6b2916c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0b6a5a80c0 CR3: 000000002dad2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__xdp_do_redirect_frame net/core/filter.c:4384 [inline]
xdp_do_redirect_frame+0x20d/0x4d0 net/core/filter.c:4438
xdp_test_run_batch net/bpf/test_run.c:337 [inline]
bpf_test_run_xdp_live+0xf0b/0x1f10 net/bpf/test_run.c:385
bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1268
bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240
__sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649
__do_sys_bpf kernel/bpf/syscall.c:5738 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5736 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f0b6a47dda9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0b6b2910c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f0b6a5abf80 RCX: 00007f0b6a47dda9
RDX: 0000000000000050 RSI: 0000000020000240 RDI: 000000000000000a
RBP: 00007f0b6a4ca47a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f0b6a5abf80 R15: 00007ffe8c70ed58
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dev_map_enqueue+0x31/0x3e0 kernel/bpf/devmap.c:539
Code: 41 56 41 55 41 54 53 48 83 ec 18 49 89 d4 49 89 f5 48 89 fd 49 be 00 00 00 00 00 fc ff df e8 a6 42 d8 ff 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 10 8a 3b 00 4c 8b 7d 00 48 83 c5
RSP: 0018:ffffc9000bc1f688 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888011815a00
RDX: 0000000000000000 RSI: ffff88802bed7070 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff894ff90e
R10: 0000000000000004 R11: ffff888011815a00 R12: ffff888022f4a000
R13: ffff88802bed7070 R14: dffffc0000000000 R15: ffff8880b943c088
FS: 00007f0b6b2916c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0b6a5a80c0 CR3: 000000002dad2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 41 56 push %r14
2: 41 55 push %r13
4: 41 54 push %r12
6: 53 push %rbx
7: 48 83 ec 18 sub $0x18,%rsp
b: 49 89 d4 mov %rdx,%r12
e: 49 89 f5 mov %rsi,%r13
11: 48 89 fd mov %rdi,%rbp
14: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
1b: fc ff df
1e: e8 a6 42 d8 ff call 0xffd842c9
23: 48 89 e8 mov %rbp,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 ef mov %rbp,%rdi
34: e8 10 8a 3b 00 call 0x3b8a49
39: 4c 8b 7d 00 mov 0x0(%rbp),%r15
3d: 48 rex.W
3e: 83 .byte 0x83
3f: c5 .byte 0xc5
Tested on:
commit: 443574b0 riscv, bpf: Fix kfunc parameters incompatibil..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11ac5323180000
kernel config: https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440
dashboard link: https://syzkaller.appspot.com/bug?extid=af9492708df9797198d6
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=154653d3180000
next prev parent reply other threads:[~2024-04-08 22:03 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-26 19:00 [syzbot] [bpf?] [net?] general protection fault in dev_map_enqueue syzbot
2024-03-27 8:10 ` syzbot
2024-03-27 14:18 ` Edward Adam Davis
2024-03-27 14:58 ` syzbot
2024-03-27 15:19 ` Alexei Starovoitov
2024-03-28 8:58 ` Jesper Dangaard Brouer
2024-03-28 20:39 ` Toke Høiland-Jørgensen
2024-03-27 22:55 ` Edward Adam Davis
2024-03-28 18:44 ` syzbot
2024-03-30 5:53 ` Edward Adam Davis
2024-03-30 16:11 ` syzbot
2024-03-31 1:31 ` Edward Adam Davis
2024-03-31 6:52 ` syzbot
2024-03-31 9:08 ` [PATCH] bpf: fix null ptr deref " Edward Adam Davis
2024-04-01 11:00 ` Jesper Dangaard Brouer
2024-04-02 3:03 ` Edward Adam Davis
2024-04-04 11:03 ` Jesper Dangaard Brouer
2024-04-04 21:02 ` Toke Høiland-Jørgensen
2024-04-05 3:55 ` [syzbot] [bpf?] [net?] general protection fault " syzbot
2024-04-08 15:30 ` Toke Høiland-Jørgensen
2024-04-08 22:03 ` syzbot [this message]
2024-04-16 20:55 ` Toke Høiland-Jørgensen
2024-04-17 14:49 ` syzbot
2024-04-17 19:18 ` Toke Høiland-Jørgensen
2024-04-18 2:51 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000003a924406159cf8ee@google.com \
--to=syzbot+af9492708df9797198d6@syzkaller.appspotmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eadavis@qq.com \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=hawk@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=netdev@vger.kernel.org \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=toke@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.