linux-kernel - Re: [Linux kernel bug] general protection fault in nexthop_is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANn89iLFvGd+=YCbzm==fA3Q0dj=FC-gTZy3kVJ0DTpZ5hZC8w@mail.gmail.com>
Date: Tue, 7 May 2024 09:31:03 +0200
From: Eric Dumazet <edumazet@...gle.com>
To: Sam Sun <samsun1006219@...il.com>
Cc: linux-kernel@...r.kernel.org, netdev@...r.kernel.org, davem@...emloft.net, 
	dsahern@...nel.org, kuba@...nel.org, pabeni@...hat.com, 
	syzkaller-bugs@...glegroups.com, xrivendell7@...il.com
Subject: Re: [Linux kernel bug] general protection fault in nexthop_is_blackhole

On Tue, May 7, 2024 at 9:00 AM Sam Sun <samsun1006219@...il.com> wrote:
>
> Dear developers and maintainers,
>
> We encountered a general protection fault in function
> nexthop_is_blackhole. It was tested against the latest upstream linux
> (tag 6.9-rc7). C repro and kernel config are attached to this email.
> Kernel crash log is listed below.

This is another reiserfs bug, please let's not be mistaken.

We have dozens of syzbot reports about reiserfs.

Thank you.

> ```
> general protection fault, probably for non-canonical address
> 0xdffffc0080008015: 0000 [#1] PREEMPT SMP KASAN NOPTI
> KASAN: probably user-memory-access in range
> [0x00000004000400a8-0x00000004000400af]
> CPU: 1 PID: 7959 Comm: kworker/u8:2 Not tainted 6.9.0-rc6 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Workqueue: ipv6_addrconf addrconf_dad_work
> RIP: 0010:nexthop_is_blackhole+0x23/0x2a0 include/net/nexthop.h:370
> Code: 00 00 00 0f 1f 40 00 55 41 57 41 56 53 48 89 fb 49 bf 00 00 00
> 00 00 fc ff df e8 58 c1 b6 f7 4c 8d 73 66 4c 89 f0 48 c1 e8 03 <42> 8a
> 04 38 84 c0 0f 85 17 02 00 00 41 0f b6 2e 31 ff 89 ee e8 44
> RSP: 0018:ffffc900001d81f8 EFLAGS: 00010203
> RAX: 0000000080008015 RBX: 0000000400040048 RCX: ffff88801cbfa500
> RDX: 0000000080000101 RSI: 0000000000000000 RDI: 0000000400040048
> RBP: ffffc900001d8398 R08: ffffffff89d8fd23 R09: 0000000000000021
> R10: ffffc900001d84c0 R11: fffffbfff2273299 R12: ffff88807857e800
> R13: 1ffff1100f0afd0c R14: 00000004000400ae R15: dffffc0000000000
> FS:  0000000000000000(0000) GS:ffff8880be400000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fa8a2420630 CR3: 00000000264f6000 CR4: 0000000000750ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> PKRU: 55555554
> Call Trace:
>  <IRQ>
>  __find_rr_leaf+0x521/0x890 net/ipv6/route.c:817
>  find_rr_leaf net/ipv6/route.c:861 [inline]
>  rt6_select net/ipv6/route.c:896 [inline]
>  fib6_table_lookup+0x56f/0xbb0 net/ipv6/route.c:2193
>  ip6_pol_route+0x272/0x1580 net/ipv6/route.c:2229
>  pol_lookup_func include/net/ip6_fib.h:614 [inline]
>  fib6_rule_lookup+0x571/0x780 net/ipv6/fib6_rules.c:116
>  ip6_route_input_lookup net/ipv6/route.c:2298 [inline]
>  ip6_route_input+0x839/0xd10 net/ipv6/route.c:2594
>  ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
>  NF_HOOK include/linux/netfilter.h:314 [inline]
>  ipv6_rcv+0x1dc/0x200 net/ipv6/ip6_input.c:310
>  __netif_receive_skb_one_core net/core/dev.c:5544 [inline]
>  __netif_receive_skb+0x1dc/0x640 net/core/dev.c:5658
>  process_backlog+0x361/0x790 net/core/dev.c:5987
>  __napi_poll+0xca/0x480 net/core/dev.c:6638
>  napi_poll net/core/dev.c:6707 [inline]
>  net_rx_action+0x7c0/0x10a0 net/core/dev.c:6822
>  __do_softirq+0x272/0x734 kernel/softirq.c:554
>  do_softirq+0xfe/0x1b0 kernel/softirq.c:455
>  </IRQ>
>  <TASK>
>  __local_bh_enable_ip+0x18a/0x1c0 kernel/softirq.c:382
>  local_bh_enable include/linux/bottom_half.h:33 [inline]
>  rcu_read_unlock_bh include/linux/rcupdate.h:851 [inline]
>  __dev_queue_xmit+0x1d13/0x3a60 net/core/dev.c:4368
>  neigh_output include/net/neighbour.h:542 [inline]
>  ip6_finish_output2+0xfcf/0x1600 net/ipv6/ip6_output.c:137
>  ip6_finish_output+0x3c8/0x7f0 net/ipv6/ip6_output.c:222
>  NF_HOOK include/linux/netfilter.h:314 [inline]
>  ndisc_send_skb+0xa39/0xf40 net/ipv6/ndisc.c:509
>  addrconf_dad_completed+0x734/0xc60 net/ipv6/addrconf.c:4358
>  addrconf_dad_work+0xd82/0x16b0
>  process_one_work kernel/workqueue.c:3254 [inline]
>  process_scheduled_works+0x9c9/0x14a0 kernel/workqueue.c:3335
>  worker_thread+0x85c/0xd50 kernel/workqueue.c:3416
>  kthread+0x2ed/0x390 kernel/kthread.c:388
>  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244
>  </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:nexthop_is_blackhole+0x23/0x2a0 include/net/nexthop.h:370
> Code: 00 00 00 0f 1f 40 00 55 41 57 41 56 53 48 89 fb 49 bf 00 00 00
> 00 00 fc ff df e8 58 c1 b6 f7 4c 8d 73 66 4c 89 f0 48 c1 e8 03 <42> 8a
> 04 38 84 c0 0f 85 17 02 00 00 41 0f b6 2e 31 ff 89 ee e8 44
> RSP: 0018:ffffc900001d81f8 EFLAGS: 00010203
>
> RAX: 0000000080008015 RBX: 0000000400040048 RCX: ffff88801cbfa500
> RDX: 0000000080000101 RSI: 0000000000000000 RDI: 0000000400040048
> RBP: ffffc900001d8398 R08: ffffffff89d8fd23 R09: 0000000000000021
> R10: ffffc900001d84c0 R11: fffffbfff2273299 R12: ffff88807857e800
> R13: 1ffff1100f0afd0c R14: 00000004000400ae R15: dffffc0000000000
> FS:  0000000000000000(0000) GS:ffff8880be400000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fa8a2420630 CR3: 00000000264f6000 CR4: 0000000000750ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> PKRU: 55555554
> ----------------
> Code disassembly (best guess), 1 bytes skipped:
>    0: 00 00                 add    %al,(%rax)
>    2: 0f 1f 40 00           nopl   0x0(%rax)
>    6: 55                   push   %rbp
>    7: 41 57                 push   %r15
>    9: 41 56                 push   %r14
>    b: 53                   push   %rbx
>    c: 48 89 fb             mov    %rdi,%rbx
>    f: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
>   16: fc ff df
>   19: e8 58 c1 b6 f7       callq  0xf7b6c176
>   1e: 4c 8d 73 66           lea    0x66(%rbx),%r14
>   22: 4c 89 f0             mov    %r14,%rax
>   25: 48 c1 e8 03           shr    $0x3,%rax
> * 29: 42 8a 04 38           mov    (%rax,%r15,1),%al <-- trapping instruction
>   2d: 84 c0                 test   %al,%al
>   2f: 0f 85 17 02 00 00     jne    0x24c
>   35: 41 0f b6 2e           movzbl (%r14),%ebp
>   39: 31 ff                 xor    %edi,%edi
>   3b: 89 ee                 mov    %ebp,%esi
>   3d: e8                   .byte 0xe8
>   3e: 44                   rex.R
> ```
> If you have any questions, please contact us.
>
> Reported by Yue Sun <samsun1006219@...il.com>
> Reported by xingwei lee <xrivendell7@...il.com>
>
> Best Regards,
> Yue