From: Eduard Zingerman <eddyz87@gmail.com>
To: syzbot <syzbot+a36aac327960ff474804@syzkaller.appspotmail.com>,
andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, haoluo@google.com,
john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org,
linux-kernel@vger.kernel.org, martin.lau@linux.dev,
netdev@vger.kernel.org, sdf@fomichev.me, song@kernel.org,
syzkaller-bugs@googlegroups.com, yonghong.song@linux.dev
Subject: Re: [syzbot] [bpf?] WARNING in do_check
Date: Fri, 13 Jun 2025 00:56:39 -0700 [thread overview]
Message-ID: <3c89e1105e611812ae86fb6aafd346be4445e055.camel@gmail.com> (raw)
In-Reply-To: <684bcf65.050a0220.be214.029b.GAE@google.com>
On Fri, 2025-06-13 at 00:12 -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 1c66f4a3612c bpf: Fix state use-after-free on push_stack()..
> git tree: bpf-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1346ed70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=73696606574e3967
> dashboard link: https://syzkaller.appspot.com/bug?extid=a36aac327960ff474804
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1392610c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11a9ee0c580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/2ddb1df1c757/disk-1c66f4a3.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6a318fc92af0/vmlinux-1c66f4a3.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/76c58dddcb6c/bzImage-1c66f4a3.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+a36aac327960ff474804@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
Fwiw, here is a repro converted to selftest.
I'll take detailed look on Friday:
SEC("socket")
__naked void syzbot_repro(void)
{
asm volatile (
"r8 = 0xff80;"
"r1 = 0xff110001085a0800 ll;"
"r2 = 20;"
"r3 = 0;"
"call %[bpf_ktime_get_ns];"
"1:"
"w9 = w10;"
"if r9 >= 0xff4ad400 goto 2f;"
"may_goto +13;"
"r2 = 0;"
"*(u8 *)(r10 -16) = r9;"
"2:"
"if r9 s< 0x1004 goto 3f;"
"lock *(u32 *)(r10 -16) += r10;"
"r6 = r8;"
"r8 += -8;"
"r4 = r10;"
"3:"
"r6 += -16;"
"r2 = 8;"
"r2 = 0xff110001085a05d8 ll;"
"r5 = 8;"
"if w8 & 0x76 goto 1b;"
"r8 = r9;"
"if w8 != 0x0 goto +0;"
"call %[bpf_get_prandom_u32];"
"r0 = 0;"
"exit;"
:
: __imm(bpf_get_prandom_u32),
__imm(bpf_ktime_get_ns)
: __clobber_all);
}
[...]
next prev parent reply other threads:[~2025-06-13 7:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-13 7:12 [syzbot] [bpf?] WARNING in do_check syzbot
2025-06-13 7:56 ` Eduard Zingerman [this message]
2025-06-13 16:10 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3c89e1105e611812ae86fb6aafd346be4445e055.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=netdev@vger.kernel.org \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=syzbot+a36aac327960ff474804@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).