Re: kernel BUG at include/linux/skbuff.h:LINE! (2)
On Mon, Aug 19, 2019 at 10:44 PM Xin Long wrote: > > On Sun, Aug 18, 2019 at 10:13 PM Dmitry Vyukov wrote: > > > > On Sun, Aug 18, 2019 at 7:07 AM Xin Long wrote: > > > > > > On Sat, Aug 17, 2019 at 2:38 AM syzbot > > > wrote: > > > > > > > > Hello, > > > > > > > > syzbot found the following crash on: > > > > > > > > HEAD commit:459c5fb4 Merge branch 'mscc-PTP-support' > > > > git tree: net-next > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c60 > > > > kernel config: > > > > https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 > > > > dashboard link: > > > > https://syzkaller.appspot.com/bug?extid=eb349854e389c36d > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > syz repro: > > > > https://syzkaller.appspot.com/x/repro.syz?x=111849e260 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a60 > > > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the > > > > commit: > > > > Reported-by: syzbot+eb349854e389c...@syzkaller.appspotmail.com > > > > > > > > [ cut here ] > > > > kernel BUG at include/linux/skbuff.h:2225! > > > > invalid opcode: [#1] PREEMPT SMP KASAN > > > > CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 > > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > > Google 01/01/2011 > > > > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > > > > RIP: 0010:__skb_pull include/linux/skbuff.h: [inline] > > > > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > > > > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > > > > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 > > > > e0 > > > > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df > > > > 13 > > > > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > > > > RSP: 0018:88808ac96e10 EFLAGS: 00010293 > > > > RAX: 88809c546000 RBX: 0004 RCX: 8594a3a6 > > > > RDX: RSI: 8594a3fa RDI: 0004 > > > > RBP: 88808ac96e30 R08: 88809c546000 R09: fbfff14a8f4f > > > > R10: fbfff14a8f4e R11: 8a547a77 R12: 95e28bcc > > > > R13: 88808ac97478 R14: 8880 R15: 88808ac97478 > > > > FS: 56549880() GS:8880ae80() > > > > knlGS: > > > > CS: 0010 DS: ES: CR0: 80050033 > > > > CR2: 2100 CR3: 89c3c000 CR4: 001406f0 > > > > Call Trace: > > > > sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 > > > > sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 > > > > sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 > > > > sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 > > > > sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 > > > > ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 > > > > ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 > > > > NF_HOOK include/linux/netfilter.h:305 [inline] > > > > NF_HOOK include/linux/netfilter.h:299 [inline] > > > > ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 > > > > dst_input include/net/dst.h:442 [inline] > > > > ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 > > > Looks skb_list_del_init() should be called in ip6_sublist_rcv_finish, > > > as does in ip_sublist_rcv_finish(). > > > > This was recently introduced, right? Only in net-next and linux-next. > > Otherwise, is it a remote DoS? If so and if it's present in any > > releases, may need a CVE. > I need to reproduce and confirm it, will let you know. The panic could be triggered since the listified RX support for GRO_NORMAL skbs: https://patchwork.ozlabs.org/cover/1142808/ (it's only in net-next now, I will post a fix soon) But the bug itself is not really related with the patch series above. the issue here is pretty much like what this patch fixed: https://patchwork.ozlabs.org/patch/942541/ I didn't see a CVE for it, maybe because it was only on net-next too.
Re: kernel BUG at include/linux/skbuff.h:LINE! (2)
On Sun, Aug 18, 2019 at 10:13 PM Dmitry Vyukov wrote: > > On Sun, Aug 18, 2019 at 7:07 AM Xin Long wrote: > > > > On Sat, Aug 17, 2019 at 2:38 AM syzbot > > wrote: > > > > > > Hello, > > > > > > syzbot found the following crash on: > > > > > > HEAD commit:459c5fb4 Merge branch 'mscc-PTP-support' > > > git tree: net-next > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c60 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 > > > dashboard link: > > > https://syzkaller.appspot.com/bug?extid=eb349854e389c36d > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e260 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a60 > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+eb349854e389c...@syzkaller.appspotmail.com > > > > > > [ cut here ] > > > kernel BUG at include/linux/skbuff.h:2225! > > > invalid opcode: [#1] PREEMPT SMP KASAN > > > CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > Google 01/01/2011 > > > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > > > RIP: 0010:__skb_pull include/linux/skbuff.h: [inline] > > > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > > > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > > > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 > > > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 > > > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > > > RSP: 0018:88808ac96e10 EFLAGS: 00010293 > > > RAX: 88809c546000 RBX: 0004 RCX: 8594a3a6 > > > RDX: RSI: 8594a3fa RDI: 0004 > > > RBP: 88808ac96e30 R08: 88809c546000 R09: fbfff14a8f4f > > > R10: fbfff14a8f4e R11: 8a547a77 R12: 95e28bcc > > > R13: 88808ac97478 R14: 8880 R15: 88808ac97478 > > > FS: 56549880() GS:8880ae80() > > > knlGS: > > > CS: 0010 DS: ES: CR0: 80050033 > > > CR2: 2100 CR3: 89c3c000 CR4: 001406f0 > > > Call Trace: > > > sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 > > > sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 > > > sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 > > > sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 > > > sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 > > > ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 > > > ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 > > > NF_HOOK include/linux/netfilter.h:305 [inline] > > > NF_HOOK include/linux/netfilter.h:299 [inline] > > > ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 > > > dst_input include/net/dst.h:442 [inline] > > > ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 > > Looks skb_list_del_init() should be called in ip6_sublist_rcv_finish, > > as does in ip_sublist_rcv_finish(). > > This was recently introduced, right? Only in net-next and linux-next. > Otherwise, is it a remote DoS? If so and if it's present in any > releases, may need a CVE. I need to reproduce and confirm it, will let you know.
Re: kernel BUG at include/linux/skbuff.h:LINE! (2)
On Sun, Aug 18, 2019 at 7:07 AM Xin Long wrote: > > On Sat, Aug 17, 2019 at 2:38 AM syzbot > wrote: > > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit:459c5fb4 Merge branch 'mscc-PTP-support' > > git tree: net-next > > console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c60 > > kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 > > dashboard link: https://syzkaller.appspot.com/bug?extid=eb349854e389c36d > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e260 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a60 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+eb349854e389c...@syzkaller.appspotmail.com > > > > [ cut here ] > > kernel BUG at include/linux/skbuff.h:2225! > > invalid opcode: [#1] PREEMPT SMP KASAN > > CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > Google 01/01/2011 > > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > > RIP: 0010:__skb_pull include/linux/skbuff.h: [inline] > > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 > > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 > > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > > RSP: 0018:88808ac96e10 EFLAGS: 00010293 > > RAX: 88809c546000 RBX: 0004 RCX: 8594a3a6 > > RDX: RSI: 8594a3fa RDI: 0004 > > RBP: 88808ac96e30 R08: 88809c546000 R09: fbfff14a8f4f > > R10: fbfff14a8f4e R11: 8a547a77 R12: 95e28bcc > > R13: 88808ac97478 R14: 8880 R15: 88808ac97478 > > FS: 56549880() GS:8880ae80() knlGS: > > CS: 0010 DS: ES: CR0: 80050033 > > CR2: 2100 CR3: 89c3c000 CR4: 001406f0 > > Call Trace: > > sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 > > sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 > > sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 > > sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 > > sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 > > ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 > > ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 > > NF_HOOK include/linux/netfilter.h:305 [inline] > > NF_HOOK include/linux/netfilter.h:299 [inline] > > ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 > > dst_input include/net/dst.h:442 [inline] > > ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 > Looks skb_list_del_init() should be called in ip6_sublist_rcv_finish, > as does in ip_sublist_rcv_finish(). This was recently introduced, right? Only in net-next and linux-next. Otherwise, is it a remote DoS? If so and if it's present in any releases, may need a CVE.
Re: kernel BUG at include/linux/skbuff.h:LINE! (2)
On Sat, Aug 17, 2019 at 2:38 AM syzbot wrote: > > Hello, > > syzbot found the following crash on: > > HEAD commit:459c5fb4 Merge branch 'mscc-PTP-support' > git tree: net-next > console output: https://syzkaller.appspot.com/x/log.txt?x=13f2d33c60 > kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7 > dashboard link: https://syzkaller.appspot.com/bug?extid=eb349854e389c36d > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e260 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a60 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+eb349854e389c...@syzkaller.appspotmail.com > > [ cut here ] > kernel BUG at include/linux/skbuff.h:2225! > invalid opcode: [#1] PREEMPT SMP KASAN > CPU: 0 PID: 9030 Comm: syz-executor649 Not tainted 5.3.0-rc3+ #134 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > RIP: 0010:__skb_pull include/linux/skbuff.h: [inline] > RIP: 0010:skb_pull_inline include/linux/skbuff.h:2231 [inline] > RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902 > Code: 9d c8 00 00 00 49 89 dc 49 89 9d c8 00 00 00 e8 9c e5 dd fb 4c 89 e0 > 5b 41 5c 41 5d 41 5e 5d c3 45 31 e4 eb ea e8 86 e5 dd fb <0f> 0b e8 df 13 > 18 fc e9 44 ff ff ff e8 d5 13 18 fc eb 8a e8 ee 13 > RSP: 0018:88808ac96e10 EFLAGS: 00010293 > RAX: 88809c546000 RBX: 0004 RCX: 8594a3a6 > RDX: RSI: 8594a3fa RDI: 0004 > RBP: 88808ac96e30 R08: 88809c546000 R09: fbfff14a8f4f > R10: fbfff14a8f4e R11: 8a547a77 R12: 95e28bcc > R13: 88808ac97478 R14: 8880 R15: 88808ac97478 > FS: 56549880() GS:8880ae80() knlGS: > CS: 0010 DS: ES: CR0: 80050033 > CR2: 2100 CR3: 89c3c000 CR4: 001406f0 > Call Trace: > sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202 > sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385 > sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80 > sctp_rcv+0x2807/0x3590 net/sctp/input.c:256 > sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049 > ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397 > ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438 > NF_HOOK include/linux/netfilter.h:305 [inline] > NF_HOOK include/linux/netfilter.h:299 [inline] > ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447 > dst_input include/net/dst.h:442 [inline] > ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84 Looks skb_list_del_init() should be called in ip6_sublist_rcv_finish, as does in ip_sublist_rcv_finish(). > ip6_list_rcv_finish net/ipv6/ip6_input.c:118 [inline] > ip6_sublist_rcv+0x80c/0xcf0 net/ipv6/ip6_input.c:282 > ipv6_list_rcv+0x373/0x4b0 net/ipv6/ip6_input.c:316 > __netif_receive_skb_list_ptype net/core/dev.c:5049 [inline] > __netif_receive_skb_list_core+0x5fc/0x9d0 net/core/dev.c:5097 > __netif_receive_skb_list net/core/dev.c:5149 [inline] > netif_receive_skb_list_internal+0x7eb/0xe60 net/core/dev.c:5244 > gro_normal_list.part.0+0x1e/0xb0 net/core/dev.c:5757 > gro_normal_list net/core/dev.c:5755 [inline] > gro_normal_one net/core/dev.c:5769 [inline] > napi_frags_finish net/core/dev.c:5782 [inline] > napi_gro_frags+0xa6a/0xea0 net/core/dev.c:5855 > tun_get_user+0x2e98/0x3fa0 drivers/net/tun.c:1974 > tun_chr_write_iter+0xbd/0x156 drivers/net/tun.c:2020 > call_write_iter include/linux/fs.h:1870 [inline] > do_iter_readv_writev+0x5f8/0x8f0 fs/read_write.c:693 > do_iter_write fs/read_write.c:970 [inline] > do_iter_write+0x184/0x610 fs/read_write.c:951 > vfs_writev+0x1b3/0x2f0 fs/read_write.c:1015 > do_writev+0x15b/0x330 fs/read_write.c:1058 > __do_sys_writev fs/read_write.c:1131 [inline] > __se_sys_writev fs/read_write.c:1128 [inline] > __x64_sys_writev+0x75/0xb0 fs/read_write.c:1128 > do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x441b10 > Code: 05 48 3d 01 f0 ff ff 0f 83 5d 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 > 00 66 90 83 3d 01 95 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff > ff 0f 83 34 09 fc ff c3 48 83 ec 08 e8 ba 2b 00 00 > RSP: 002b:7ffe63706b88 EFLAGS: 0246 ORIG_RAX: 0014 > RAX: ffda RBX: 7ffe63706ba0 RCX: 00441b10 > RDX: 0001 RSI: 7ffe63706bd0 RDI: 00f0 > RBP: R08: R09: 0004 > R10: R11: 0246 R12: 000122cb > R13: 00402960 R14: R15: > Modules linked in: > ---[ end trace c37566c1c02066db ]--- > RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline] > RIP: 0010:__skb_pull
Re: kernel BUG at include/linux/skbuff.h:LINE! (2)
syzbot has bisected this bug to:
commit bc389fd101e57b36aacfaec2df8fe479eabb44ea
Author: David S. Miller
Date: Tue Jul 2 21:12:30 2019 +
Merge branch 'macsec-fix-some-bugs-in-the-receive-path'
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=125c5c4c60
start commit: 459c5fb4 Merge branch 'mscc-PTP-support'
git tree: net-next
final crash:https://syzkaller.appspot.com/x/report.txt?x=115c5c4c60
console output: https://syzkaller.appspot.com/x/log.txt?x=165c5c4c60
kernel config: https://syzkaller.appspot.com/x/.config?x=d4cf1ffb87d590d7
dashboard link: https://syzkaller.appspot.com/bug?extid=eb349854e389c36d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111849e260
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1442c25a60
Reported-by: syzbot+eb349854e389c...@syzkaller.appspotmail.com
Fixes: bc389fd101e5 ("Merge
branch 'macsec-fix-some-bugs-in-the-receive-path'")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
