From: syzbot <syzbot+7bc2817ec0ed18de9079@syzkaller.appspotmail.com>
To: davem@davemloft.net, jon.maloy@ericsson.com,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com,
tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
Subject: BUG: corrupted list in proto_register
Date: Fri, 17 May 2019 23:52:05 -0700 [thread overview]
Message-ID: <000000000000e76a90058923eff3@google.com> (raw)
Hello,
syzbot found the following crash on:
HEAD commit: 532b0f7e tipc: fix modprobe tipc failed after switch order..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=12665fe8a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=82f0809e8f0a8c87
dashboard link: https://syzkaller.appspot.com/bug?extid=7bc2817ec0ed18de9079
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7bc2817ec0ed18de9079@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:29!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9479 Comm: syz-executor.2 Not tainted 5.1.0+ #18
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
Code: 56 ff ff ff 4c 89 e1 48 c7 c7 20 4c a3 87 e8 00 60 25 fe 0f 0b 48 89
f2 4c 89 e1 4c 89 ee 48 c7 c7 60 4d a3 87 e8 e9 5f 25 fe <0f> 0b 48 89 f1
48 c7 c7 e0 4c a3 87 4c 89 e6 e8 d5 5f 25 fe 0f 0b
RSP: 0018:ffff8880747afb88 EFLAGS: 00010282
RAX: 0000000000000058 RBX: ffffffff89544920 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815afbe6 RDI: ffffed100e8f5f63
RBP: ffff8880747afba0 R08: 0000000000000058 R09: ffffed1015d26011
R10: ffffed1015d26010 R11: ffff8880ae930087 R12: ffffffff89544ab0
R13: ffffffff89544ab0 R14: ffffffff89544ab0 R15: ffffffff89544a50
FS: 00000000018b2940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f88f7dac000 CR3: 0000000072fc7000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_add include/linux/list.h:60 [inline]
list_add include/linux/list.h:79 [inline]
proto_register+0x459/0x8e0 net/core/sock.c:3385
tipc_socket_init+0x1c/0x70 net/tipc/socket.c:3241
tipc_init_net+0x32a/0x5b0 net/tipc/core.c:71
ops_init+0xb6/0x410 net/core/net_namespace.c:129
setup_net+0x2d3/0x740 net/core/net_namespace.c:315
copy_net_ns+0x1df/0x340 net/core/net_namespace.c:438
create_new_namespaces+0x400/0x7b0 kernel/nsproxy.c:107
unshare_nsproxy_namespaces+0xc2/0x200 kernel/nsproxy.c:206
ksys_unshare+0x440/0x980 kernel/fork.c:2664
__do_sys_unshare kernel/fork.c:2732 [inline]
__se_sys_unshare kernel/fork.c:2730 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:2730
do_syscall_64+0x103/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b897
Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ad 8d fb ff c3
66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff
ff 0f 83 8d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc2b108368 EFLAGS: 00000206 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 000000000073c988 RCX: 000000000045b897
RDX: 0000000000000000 RSI: 00007ffc2b108310 RDI: 0000000040000000
RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000005
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000414ab0
R13: 0000000000414b40 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace e4cbbfc7878b1973 ]---
RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
Code: 56 ff ff ff 4c 89 e1 48 c7 c7 20 4c a3 87 e8 00 60 25 fe 0f 0b 48 89
f2 4c 89 e1 4c 89 ee 48 c7 c7 60 4d a3 87 e8 e9 5f 25 fe <0f> 0b 48 89 f1
48 c7 c7 e0 4c a3 87 4c 89 e6 e8 d5 5f 25 fe 0f 0b
RSP: 0018:ffff8880747afb88 EFLAGS: 00010282
RAX: 0000000000000058 RBX: ffffffff89544920 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815afbe6 RDI: ffffed100e8f5f63
RBP: ffff8880747afba0 R08: 0000000000000058 R09: ffffed1015d26011
R10: ffffed1015d26010 R11: ffff8880ae930087 R12: ffffffff89544ab0
R13: ffffffff89544ab0 R14: ffffffff89544ab0 R15: ffffffff89544a50
FS: 00000000018b2940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe45a0c89b8 CR3: 0000000072fc7000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
reply other threads:[~2019-05-18 6:52 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000e76a90058923eff3@google.com \
--to=syzbot+7bc2817ec0ed18de9079@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=jon.maloy@ericsson.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tipc-discussion@lists.sourceforge.net \
--cc=ying.xue@windriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.