Syzkaller hit 'general protection fault in fib_dump_info' bug on commit 4.13-rc5..

Guilty file: net/ipv4/fib_semantics.c

Maintainers: []

kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 2808 Comm: syz-executor0 Not tainted 4.13.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff880078562700 task.stack: ffff880078110000
RIP: 0010:fib_dump_info+0x388/0x1170 net/ipv4/fib_semantics.c:1314
RSP: 0018:ffff880078117010 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 00000000000000fe RCX: 0000000000000002
RDX: 0000000000000006 RSI: ffff880078117084 RDI: 0000000000000030
RBP: ffff880078117268 R08: 000000000000000c R09: ffff8800780d80c8
R10: 0000000058d629b4 R11: 0000000067fce681 R12: 0000000000000000
R13: ffff8800784bd540 R14: ffff8800780d80b5 R15: ffff8800780d80a4
FS:  00000000022fa940(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004387d0 CR3: 0000000079135000 CR4: 00000000000006f0
Call Trace:
 inet_rtm_getroute+0xc89/0x1f50 net/ipv4/route.c:2766
 rtnetlink_rcv_msg+0x288/0x680 net/core/rtnetlink.c:4217
 netlink_rcv_skb+0x340/0x470 net/netlink/af_netlink.c:2397
 rtnetlink_rcv+0x28/0x30 net/core/rtnetlink.c:4223
 netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]
 netlink_unicast+0x4c4/0x6e0 net/netlink/af_netlink.c:1291
 netlink_sendmsg+0x8c4/0xca0 net/netlink/af_netlink.c:1854
 sock_sendmsg_nosec net/socket.c:633 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:643
 ___sys_sendmsg+0x779/0x8d0 net/socket.c:2035
 __sys_sendmsg+0xd1/0x170 net/socket.c:2069
 SYSC_sendmsg net/socket.c:2080 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2076
 entry_SYSCALL_64_fastpath+0x1a/0xa5
RIP: 0033:0x4512e9
RSP: 002b:00007ffc75584cc8 EFLAGS: 00000216 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00000000004512e9
RDX: 0000000000000000 RSI: 0000000020f2cfc8 RDI: 0000000000000003
RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: fffffffffffffffe
R13: 0000000000718000 R14: 0000000020c44ff0 R15: 0000000000000000
Code: 00 0f b6 8d ec fd ff ff 48 8b 85 f0 fd ff ff 88 48 17 48 8b 45 28 48 8d 78 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e cb 0c 00 00 48 8b 45 28 44 
RIP: fib_dump_info+0x388/0x1170 net/ipv4/fib_semantics.c:1314 RSP: ffff880078117010
---[ end trace 254a7af28348f88b ]---
Kernel panic - not syncing: Fatal exception
Kernel Offset: disabled
Rebooting in 86400 seconds..


Syzkaller reproducer:
# {Threaded:false Collide:false Repeat:false Procs:1 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:false}
mmap(&(0x7f0000000000/0xf2d000)=nil, 0xf2d000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000f2d000-0x38)={&(0x7f00008ad000)={0x8000000000000010, 0x0, 0x0, 0x6}, 0xc, &(0x7f00000e2000)=[{&(0x7f0000c45000-0x20)=[{0x20, 0x1a, 0x20000001, 0x1, 0x4d7, "020000000000000004e5fffffdc1"}], 0x20}], 0x1, &(0x7f000000d000)=[], 0x0, 0x0}, 0x0)


Reproducing stats:
Extracting prog: 33.928246901s
Minimizing prog: 1m32.60387909s
Simplifying prog options: 43.951331078s
Extracting C: 6.719779382s
Simplifying C: 0s


Reproducing log:
186 programs, 4 VMs
extracting reproducer from 186 programs
single: executing 8 programs separately with timeout 10s
testing program (duration=10s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$inet_udp-mmap-setsockopt$inet_int-mmap-setsockopt$SO_TIMESTAMPING-mmap-mmap-bind$inet-mmap-setsockopt$sock_int-mmap-socket$inet_udp-mmap-bind$inet-sendto$inet-sendto$inet-dup-mmap-dup2-mmap-recvmsg-mmap-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_int-ioctl$SNDRV_CTL_IOCTL_PVERSION-mmap-mmap-creat-close
program did not crash
testing program (duration=10s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-mmap-mmap-readv-mmap-epoll_create-epoll_wait-socketpair-mmap-fcntl$getownex-perf_event_open-getsockopt$inet_mreqsrc-mmap-epoll_ctl$EPOLL_CTL_ADD-openat$ptmx-mmap-ioctl$TIOCPKT-msgget$private-msgrcv-mmap-readv-msgctl$MSG_INFO-dup2-mmap-mmap-mmap-mmap-mmap-mmap-mmap-fstatfs-mmap-mmap-readv-sendmsg$netlink
program did not crash
testing program (duration=10s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-mmap-accept$unix-mmap-mmap-syz_open_dev$vcsn-ioctl$TIOCNOTTY-mmap-mmap-mmap-ioctl$DRM_IOCTL_RES_CTX-mmap-mmap-ioctl$DRM_IOCTL_DMA-mmap-getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF-mmap-sendmsg$unix-ioctl$sock_inet_SIOCGIFNETMASK-mmap-socketpair$inet6_sctp-socket$netlink-mmap-mmap-mmap-mmap-mmap-mmap-mmap-sendmmsg$nfc_llcp-mmap-mmap-mmap-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
single: successfully extracted reproducer
found reproducer with 34 syscalls
minimizing guilty program
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-ioctl$DRM_IOCTL_DMA-getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF-sendmsg$unix-ioctl$sock_inet_SIOCGIFNETMASK-socketpair$inet6_sctp-socket$netlink-sendmmsg$nfc_llcp-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-ioctl$DRM_IOCTL_DMA-getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF-sendmsg$unix-ioctl$sock_inet_SIOCGIFNETMASK-socketpair$inet6_sctp-socket$netlink-sendmmsg$nfc_llcp
program did not crash
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-ioctl$DRM_IOCTL_DMA-getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF-sendmsg$unix-ioctl$sock_inet_SIOCGIFNETMASK-socketpair$inet6_sctp-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-ioctl$DRM_IOCTL_DMA-getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF-sendmsg$unix-ioctl$sock_inet_SIOCGIFNETMASK-socketpair$inet6_sctp-sendmsg$netlink
program did not crash
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-ioctl$DRM_IOCTL_DMA-getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF-sendmsg$unix-ioctl$sock_inet_SIOCGIFNETMASK-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-ioctl$DRM_IOCTL_DMA-getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF-sendmsg$unix-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-ioctl$DRM_IOCTL_DMA-getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-ioctl$DRM_IOCTL_DMA-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-ioctl$DRM_IOCTL_RES_CTX-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-ioctl$TIOCNOTTY-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-syz_open_dev$vcsn-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-accept$unix-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): socket$netlink-sendmsg$netlink
program did not crash
testing program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program did not crash
extracting C reproducer
testing compiled C program (duration=15s, {Threaded:true Collide:true Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program did not crash
simplifying guilty program
testing program (duration=15s, {Threaded:true Collide:false Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
extracting C reproducer
testing compiled C program (duration=15s, {Threaded:true Collide:false Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program did not crash
testing program (duration=15s, {Threaded:false Collide:false Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
extracting C reproducer
testing compiled C program (duration=15s, {Threaded:false Collide:false Repeat:true Procs:8 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program did not crash
testing program (duration=15s, {Threaded:false Collide:false Repeat:false Procs:1 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
extracting C reproducer
testing compiled C program (duration=15s, {Threaded:false Collide:false Repeat:false Procs:1 Sandbox:namespace Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program did not crash
testing program (duration=15s, {Threaded:false Collide:false Repeat:false Procs:1 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program crashed: general protection fault in fib_dump_info
extracting C reproducer
testing compiled C program (duration=15s, {Threaded:false Collide:false Repeat:false Procs:1 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:true}): mmap-socket$netlink-sendmsg$netlink
program did not crash
reproducing took 3m5.828331208s
repro crashed as:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 2808 Comm: syz-executor0 Not tainted 4.13.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff880078562700 task.stack: ffff880078110000
RIP: 0010:fib_dump_info+0x388/0x1170
RSP: 0018:ffff880078117010 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 00000000000000fe RCX: 0000000000000002
RDX: 0000000000000006 RSI: ffff880078117084 RDI: 0000000000000030
RBP: ffff880078117268 R08: 000000000000000c R09: ffff8800780d80c8
R10: 0000000058d629b4 R11: 0000000067fce681 R12: 0000000000000000
R13: ffff8800784bd540 R14: ffff8800780d80b5 R15: ffff8800780d80a4
FS:  00000000022fa940(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004387d0 CR3: 0000000079135000 CR4: 00000000000006f0
Call Trace:
 inet_rtm_getroute+0xc89/0x1f50
 rtnetlink_rcv_msg+0x288/0x680
 netlink_rcv_skb+0x340/0x470
 rtnetlink_rcv+0x28/0x30
 netlink_unicast+0x4c4/0x6e0
 netlink_sendmsg+0x8c4/0xca0
 sock_sendmsg+0xca/0x110
 ___sys_sendmsg+0x779/0x8d0
 __sys_sendmsg+0xd1/0x170
 SyS_sendmsg+0x2d/0x50
 entry_SYSCALL_64_fastpath+0x1a/0xa5
RIP: 0033:0x4512e9
RSP: 002b:00007ffc75584cc8 EFLAGS: 00000216 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00000000004512e9
RDX: 0000000000000000 RSI: 0000000020f2cfc8 RDI: 0000000000000003
RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: fffffffffffffffe
R13: 0000000000718000 R14: 0000000020c44ff0 R15: 0000000000000000
Code: 00 0f b6 8d ec fd ff ff 48 8b 85 f0 fd ff ff 88 48 17 48 8b 45 28 48 8d 78 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e cb 0c 00 00 48 8b 45 28 44 
RIP: fib_dump_info+0x388/0x1170 RSP: ffff880078117010
---[ end trace 254a7af28348f88b ]---
Kernel panic - not syncing: Fatal exception
Kernel Offset: disabled
Rebooting in 86400 seconds..