From: syzbot <syzbot+0b3ccd4f62dac2cf3a7d@syzkaller.appspotmail.com>
To: davem@davemloft.net, edumazet@google.com, kuznet@ms2.inr.ac.ru,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com, yoshfuji@linux-ipv6.org
Subject: Re: general protection fault in tcp_cleanup_ulp
Date: Wed, 12 Sep 2018 03:00:02 -0700 [thread overview]
Message-ID: <000000000000708fdd0575a9a74c@google.com> (raw)
In-Reply-To: <00000000000006602605752ffa1a@google.com>
syzbot has found a reproducer for the following crash on:
HEAD commit: 28619527b8a7 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: bpf
console output: https://syzkaller.appspot.com/x/log.txt?x=127f5b49400000
kernel config: https://syzkaller.appspot.com/x/.config?x=8f59875069d721b6
dashboard link: https://syzkaller.appspot.com/bug?extid=0b3ccd4f62dac2cf3a7d
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13537269400000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0b3ccd4f62dac2cf3a7d@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 18627 Comm: syz-executor0 Not tainted 4.19.0-rc2+ #51
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:tcp_cleanup_ulp+0xbe/0x140 net/ipv4/tcp_ulp.c:131
Code: 02 00 0f 85 8a 00 00 00 49 8b 9c 24 88 06 00 00 e8 b7 43 ec fa 48 8d
7b 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
51 48 8b 7b 38 e8 b3 a2 e0 fa 4c 89 ea 48 b8 00 00
RSP: 0018:ffff8801b92f76c0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff10037e84da6
RDX: 0000000000000007 RSI: ffffffff86928b79 RDI: 0000000000000038
RBP: ffff8801b92f76e0 R08: 0000000000000000 R09: ffffed003b5c4732
R10: ffffed003b5c4732 R11: ffff8801dae23993 R12: ffff8801be338f40
R13: ffff8801be3395c8 R14: ffffffff81938ae0 R15: ffff8801b92f7800
FS: 0000000001a06940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4d5d4b8db8 CR3: 00000001bc421000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
tcp_v4_destroy_sock+0x161/0x990 net/ipv4/tcp_ipv4.c:1978
tcp_v6_destroy_sock+0x15/0x20 net/ipv6/tcp_ipv6.c:1762
inet_csk_destroy_sock+0x19f/0x440 net/ipv4/inet_connection_sock.c:835
tcp_close+0xba7/0x1300 net/ipv4/tcp.c:2477
bpf_tcp_close+0x93c/0x10c0 kernel/bpf/sockmap.c:384
inet_release+0x104/0x1f0 net/ipv4/af_inet.c:428
inet6_release+0x50/0x70 net/ipv6/af_inet6.c:457
__sock_release+0xd7/0x250 net/socket.c:579
sock_close+0x19/0x20 net/socket.c:1139
__fput+0x385/0xa30 fs/file_table.c:278
____fput+0x15/0x20 fs/file_table.c:309
task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x410e91
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffd70bafde0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000410e91
RDX: 0000000000000000 RSI: 0000000000731160 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffffffffff
R10: 00000000009300a0 R11: 0000000000000293 R12: 0000000000000008
R13: 00000000000dc3fa R14: 0000000000000875 R15: badc0ffeebadface
Modules linked in:
Dumping ftrace buffer:
(ftrace buffer empty)
---[ end trace d9e209a7bdcaec58 ]---
RIP: 0010:tcp_cleanup_ulp+0xbe/0x140 net/ipv4/tcp_ulp.c:131
Code: 02 00 0f 85 8a 00 00 00 49 8b 9c 24 88 06 00 00 e8 b7 43 ec fa 48 8d
7b 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75
51 48 8b 7b 38 e8 b3 a2 e0 fa 4c 89 ea 48 b8 00 00
RSP: 0018:ffff8801b92f76c0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff10037e84da6
RDX: 0000000000000007 RSI: ffffffff86928b79 RDI: 0000000000000038
RBP: ffff8801b92f76e0 R08: 0000000000000000 R09: ffffed003b5c4732
R10: ffffed003b5c4732 R11: ffff8801dae23993 R12: ffff8801be338f40
R13: ffff8801be3395c8 R14: ffffffff81938ae0 R15: ffff8801b92f7800
FS: 0000000001a06940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4d5d4b8db8 CR3: 00000001bc421000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
next prev parent reply other threads:[~2018-09-12 10:00 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-06 8:50 general protection fault in tcp_cleanup_ulp syzbot
2018-09-12 10:00 ` syzbot [this message]
2019-03-30 5:17 ` syzbot
2019-11-07 13:42 ` syzbot
2019-11-13 16:50 ` John Fastabend
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000708fdd0575a9a74c@google.com \
--to=syzbot+0b3ccd4f62dac2cf3a7d@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.