Re: [syzbot] [net?] general protection fault in rtnl_create_link

Kuniyuki Iwashima
2025-04-14T02:31:08Z

From: syzbot <syzbot+de1c7d68a10e3f123bdd@syzkaller.appspotmail.com>
Date: Sun, 13 Apr 2025 19:14:29 -0700
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: eaa517b77e63 ethtool: cmis_cdb: Fix incorrect read / write..
> git tree: net
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1541f23f980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f2054704dd53fb80
> dashboard link: https://syzkaller.appspot.com/bug?extid=de1c7d68a10e3f123bdd
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1429874c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1353f74c580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/8ff6a34dbd2f/disk-eaa517b7.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/80dc0689a89b/vmlinux-eaa517b7.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/093b749f228d/bzImage-eaa517b7.xz
>
> The issue was bisected to:
>
> commit 04efcee6ef8d0f01eef495db047e7216d6e6e38f
> Author: Stanislav Fomichev <sdf@fomichev.me>
> Date: Fri Apr 4 16:11:22 2025 +0000
>
> net: hold instance lock during NETDEV_CHANGE
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=151db7e4580000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=171db7e4580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=131db7e4580000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+de1c7d68a10e3f123bdd@syzkaller.appspotmail.com
> Fixes: 04efcee6ef8d ("net: hold instance lock during NETDEV_CHANGE")
>
> netlink: 4 bytes leftover after parsing attributes in process `syz-executor402'.
> netlink: 'syz-executor402': attribute type 15 has an invalid length.
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000055: 0000 [#1] SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x00000000000002a8-0x00000000000002af]
> CPU: 0 UID: 0 PID: 5841 Comm: syz-executor402 Not tainted 6.14.0-syzkaller-13348-geaa517b77e63 #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> RIP: 0010:netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]
> RIP: 0010:netdev_lock_ops include/net/netdev_lock.h:41 [inline]
> RIP: 0010:rtnl_create_link+0x6af/0xea0 net/core/rtnetlink.c:3680

#syz test

diff --git a/include/net/netdev_lock.h b/include/net/netdev_lock.h
index 5706835a660c..270e157a4a79 100644
--- a/include/net/netdev_lock.h
+++ b/include/net/netdev_lock.h
@@ -30,7 +30,8 @@ static inline bool netdev_need_ops_lock(const struct net_device *dev)
bool ret = dev->request_ops_lock || !!dev->queue_mgmt_ops;

#if IS_ENABLED(CONFIG_NET_SHAPER)
- ret |= !!dev->netdev_ops->net_shaper_ops;
+ if (dev->netdev_ops)
+ ret |= !!dev->netdev_ops->net_shaper_ops;
#endif

return ret;