From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: * X-Spam-Status: No, score=1.3 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FSL_HELO_FAKE,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,USER_AGENT_MUTT autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 243AFC43381 for ; Tue, 12 Mar 2019 17:43:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E8441206DF for ; Tue, 12 Mar 2019 17:42:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="Av68uaRq" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728117AbfCLRm6 (ORCPT ); Tue, 12 Mar 2019 13:42:58 -0400 Received: from mail-pg1-f181.google.com ([209.85.215.181]:43228 "EHLO mail-pg1-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728908AbfCLRmz (ORCPT ); Tue, 12 Mar 2019 13:42:55 -0400 Received: by mail-pg1-f181.google.com with SMTP id l11so2347663pgq.10 for ; Tue, 12 Mar 2019 10:42:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=5N1LezfQEYEXl//voLDrJV3H5ByhOEuLTW0vyihi0ns=; b=Av68uaRqpAT+MU4kmt5J/yEREMHsUWhs+n6XkjOfFRcTvWTiQWBNQDZ54H2R4I87bk WXZsmV+Bt3cGp5TdptM60d6lmYn/JVeugF8Ms2HqMq5JwRbd4oI4QVEJMjiAwYNd1Lk1 StwWyQMup7RLaxKZ4m5N1E3EIqIvdm/zCRv3U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=5N1LezfQEYEXl//voLDrJV3H5ByhOEuLTW0vyihi0ns=; b=iKg99jYQioZr5L69GK/F3MafU8t++moBWCFhHiJliV8pnHDiU+jVnvEoPhqCkG/qkj aDN6i+2OXq7hYkbh129pbU7j1Wkl7PzPzchih2a0GRZMHM5QVGowbAZiz3T9yg08XWm6 Q3+lnoU+56yg2H/45avamoBr6zSFeSrbEKFWtqAjr3EiCxkEJdXZDhPG0IVN3SwUIL00 oK2z1rQsd7DRGlKXLgrQR7cXW2axcyLYAD+aSRy6lH+VyzGs0MhacYS16xmt/uLeYFUu ToPvTS3NonpFaoRPJsHPulA/NtfhDrANOGxGekFjr4ZLCCSZEo+p9LMdK4nUVvZvErl4 rEng== X-Gm-Message-State: APjAAAUKzV//4RZzkUjIqC7c0ivptIZ1267LfNmCxLrs8zvvesrQtzsH ZUGIRcQ7CTgZo9I0ApWMiMQnZd9tF/I= X-Google-Smtp-Source: APXvYqzDVMBn+Xi+n5isQ5jKbbEDML+Uu/or6DTQ79SRlwkt5e6PVidVlQkNcg/nprohCHVDeivozQ== X-Received: by 2002:a63:3541:: with SMTP id c62mr35657642pga.157.1552412574673; Tue, 12 Mar 2019 10:42:54 -0700 (PDT) Received: from google.com ([2620:15c:202:201:49ea:b78f:4f04:4d25]) by smtp.googlemail.com with ESMTPSA id g188sm20389076pfc.24.2019.03.12.10.42.53 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 12 Mar 2019 10:42:53 -0700 (PDT) Date: Tue, 12 Mar 2019 10:42:50 -0700 From: Zubin Mithra To: stable@vger.kernel.org Cc: gregkh@linuxfoundation.org, groeck@chromium.org, edumazet@google.com, davem@davemloft.net, kuznet@ms2.inr.ac.ru, herbert@gondor.apana.org.au Subject: 30c7be26fd35 ("udplite: call proper backlog handlers") Message-ID: <20190312174249.GA185472@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Hello, Syzkaller has triggered a GPF when fuzzing a 4.4 kernel with the following calltrace. Call Trace: [] sk_backlog_rcv include/net/sock.h:874 [inline] [] __release_sock net/core/sock.c:2059 [inline] [] release_sock+0x16b/0x520 net/core/sock.c:2507 [] udp_sendmsg+0x115b/0x1c70 net/ipv4/udp.c:1107 [] inet_sendmsg+0x20c/0x4d0 net/ipv4/af_inet.c:780 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xd1/0x110 net/socket.c:648 [] SYSC_sendto+0x21c/0x370 net/socket.c:1678 [] SyS_sendto+0x45/0x60 net/socket.c:1646 [] entry_SYSCALL_64_fastpath+0x1e/0xa0 Code: 74 24 58 41 f6 c6 01 0f 85 b2 08 00 00 e8 65 d2 c3 fe 49 83 e6 fe 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 60 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 01 0f 8e b9 0e 00 00 41 f6 46 60 04 RIP [] __xfrm_policy_check2 include/net/xfrm.h:1070 [inline] RIP [] xfrm_policy_check include/net/xfrm.h:1076 [inline] RIP [] xfrm4_policy_check include/net/xfrm.h:1081 [inline] RIP [] udp_queue_rcv_skb+0x194/0x1590 net/ipv4/udp.c:1520 RSP Could the following patch be applied to v4.4.y? It is present in v4.9.y. * 30c7be26fd35 ("udplite: call proper backlog handlers") Tests run: * Chrome OS tryjob tests * Syzkaller reproducer Thanks, - Zubin