Date:   Mon, 08 Jan 2018 02:58:01 -0800
From:   syzbot <syzbot+fa99e24f3c29d269a7d5@...kaller.appspotmail.com>
To:     ast@...nel.org, daniel@...earbox.net, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: general protection fault in free_verifier_state (2)

Hello,

syzkaller hit the following crash on  
895c0dde398510a5b5ded60e5064c11b94bd30ca
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fa99e24f3c29d269a7d5@...kaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for  
details.
If you forward the report, please keep this part and the footer.

RBP: 0000000000000006 R08: 0000000000000002 R09: 00007ffd20003032
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: ffffffffffffffff R14: 656c6c616b7a7973 R15: 0000000000000004
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
    (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3468 Comm: syzkaller619543 Not tainted  
4.15.0-rc6-next-20180108+ #90
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:free_func_state kernel/bpf/verifier.c:378 [inline]
RIP: 0010:free_verifier_state+0x6d/0x130 kernel/bpf/verifier.c:388
RSP: 0018:ffff8801d48f77b8 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff1003b6384a0
RDX: 0000000000000000 RSI: 0000000000000071 RDI: 0000000000000388
RBP: ffff8801d48f7800 R08: ffff8801db427d00 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801db1c2500
R13: dffffc0000000000 R14: ffff8801db1c2500 R15: ffff8801db1c2500
FS:  000000000254e880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020386000 CR3: 00000001cb32e002 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  is_state_visited kernel/bpf/verifier.c:4414 [inline]
  do_check+0x2442/0x9760 kernel/bpf/verifier.c:4488
  bpf_check+0x3087/0x5580 kernel/bpf/verifier.c:5483
  bpf_prog_load+0xbb2/0x1260 kernel/bpf/syscall.c:1205
  SYSC_bpf kernel/bpf/syscall.c:1820 [inline]
  SyS_bpf+0x861/0x32e0 kernel/bpf/syscall.c:1782
  entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x4406e9
RSP: 002b:00007ffd20275c18 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004406e9
RDX: 0000000000000048 RSI: 0000000020000000 RDI: 0000000000000005
RBP: 0000000000000006 R08: 0000000000000002 R09: 00007ffd20003032
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: ffffffffffffffff R14: 656c6c616b7a7973 R15: 0000000000000004
Code: 1a 36 f4 ff 4c 89 f1 48 c1 e9 03 42 80 3c 29 00 0f 85 c1 00 00 00 4f  
8d 3c fc 49 8b 07 48 8d b8 88 03 00 00 48 89 fe 48 c1 ee 03 <42> 80 3c 2e  
00 0f 85 8f 00 00 00 48 8b b8 88 03 00 00 48 89 45
RIP: free_func_state kernel/bpf/verifier.c:378 [inline] RSP:  
ffff8801d48f77b8
RIP: free_verifier_state+0x6d/0x130 kernel/bpf/verifier.c:388 RSP:  
ffff8801d48f77b8
---[ end trace 4b8783cb068d7042 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
    (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@...glegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is  
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug  
report.
Note: all commands must start from beginning of the line in the email body.

View attachment "config.txt" of type "text/plain" (134059 bytes)

Download attachment "raw.log" of type "application/octet-stream" (10608 bytes)

View attachment "repro.txt" of type "text/plain" (1269 bytes)

Download attachment "repro.c" of type "application/octet-stream" (7134 bytes)

Powered by blists - more mailing lists