All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stefano Brivio <sbrivio@redhat.com>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: syzbot <syzbot+4ad25edc7a33e4ab91e0@syzkaller.appspotmail.com>,
	davem@davemloft.net, kuznet@ms2.inr.ac.ru,
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
	syzkaller-bugs@googlegroups.com, yoshfuji@linux-ipv6.org,
	Willem de Bruijn <willemb@google.com>
Subject: Re: kernel panic: stack is corrupted in udp4_lib_lookup2
Date: Thu, 3 Jan 2019 21:07:43 +0100	[thread overview]
Message-ID: <20190103210743.6518841e@redhat.com> (raw)
In-Reply-To: <f2e566ac-5c4c-11ae-d436-ebb3522a2195@gmail.com>

On Thu, 3 Jan 2019 12:01:29 -0800
Eric Dumazet <eric.dumazet@gmail.com> wrote:

> On 01/03/2019 05:07 AM, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following crash on:
> > 
> > HEAD commit:    195303136f19 Merge tag 'kconfig-v4.21-2' of git://git.kern..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=12245d8f400000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=5e7dc790609552d7
> > dashboard link: https://syzkaller.appspot.com/bug?extid=4ad25edc7a33e4ab91e0
> > compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
> > 
> > Unfortunately, I don't have any reproducer for this crash yet.
> > 
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+4ad25edc7a33e4ab91e0@syzkaller.appspotmail.com
> > 
> > protocol 88fb is buggy, dev hsr_slave_1
> > protocol 88fb is buggy, dev hsr_slave_0
> > protocol 88fb is buggy, dev hsr_slave_1
> > FAT-fs (loop0): invalid media value (0x00)
> > FAT-fs (loop0): Can't find a valid FAT filesystem
> > Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: udp4_lib_lookup2+0x7ea/0x7f0 net/ipv4/udp.c:455
> > CPU: 1 PID: 17960 Comm: syz-executor2 Not tainted 4.20.0+ #176
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > Call Trace:
> > Kernel Offset: disabled
> > Rebooting in 86400 seconds..
> > 
> > 
> > ---
> > This bug is generated by a bot. It may contain errors.
> > See https://goo.gl/tpsmEJ for more information about syzbot.
> > syzbot engineers can be reached at syzkaller@googlegroups.com.
> > 
> > syzbot will keep track of this bug report. See:
> > https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot.  
> 
> Maybe commit 11789039da536fea96c98a40c2b441decf2e7323
> Author: Stefano Brivio <sbrivio@redhat.com>
> Date:   Tue Dec 18 00:13:17 2018 +0100
> 
>     fou: Prevent unbounded recursion in GUE error handler
> 
> Forgot to deal with IPv6 ?

Damn, yes. :( Thanks both for pointing that out, patch coming.

Still, I can't be sure this is the same issue.

-- 
Stefano

  reply	other threads:[~2019-01-03 20:07 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-01-03 13:07 kernel panic: stack is corrupted in udp4_lib_lookup2 syzbot
2019-01-03 19:39 ` Willem de Bruijn
2019-01-03 19:41   ` Willem de Bruijn
2019-01-03 20:00     ` Stefano Brivio
2019-01-03 20:01 ` Eric Dumazet
2019-01-03 20:07   ` Stefano Brivio [this message]
2019-01-03 21:15     ` Willem de Bruijn
2019-01-03 21:54       ` Stefano Brivio
2019-01-04 10:32         ` Dmitry Vyukov
2019-01-04 10:34           ` Dmitry Vyukov
2019-01-04 10:54           ` Stefano Brivio
2019-01-04 11:05             ` Dmitry Vyukov
2019-01-04 17:14               ` Stefano Brivio
2019-01-04 17:24                 ` Willem de Bruijn
2019-01-04 17:50                   ` Stefano Brivio
2019-01-04 17:26                 ` Dmitry Vyukov
2019-01-04 18:05                   ` Stefano Brivio
2019-01-07  9:04                     ` Dmitry Vyukov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190103210743.6518841e@redhat.com \
    --to=sbrivio@redhat.com \
    --cc=davem@davemloft.net \
    --cc=eric.dumazet@gmail.com \
    --cc=kuznet@ms2.inr.ac.ru \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=syzbot+4ad25edc7a33e4ab91e0@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=willemb@google.com \
    --cc=yoshfuji@linux-ipv6.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.