[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CALAgD-77-2pS6L2=xCKBLDpvQejExZ2jWLnOWRsd1whwRXKn_A@mail.gmail.com>
Date: Sat, 24 Aug 2024 21:42:59 -0700
From: Xingyu Li <xli399@....edu>
To: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
pabeni@...hat.com, dsahern@...nel.org, shaozhengchao@...wei.com,
horms@...nel.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: BUG: general protection fault in fib_rules_event
Hi,
We found a bug in Linux 6.10. It seems like a null pointer dereference bug.
The bug report is as follow:
Bug report:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 PID: 19006 Comm: syz-executor Not tainted 6.10.0 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:detach_rules net/core/fib_rules.c:1231 [inline]
RIP: 0010:fib_rules_event+0x998/0xc00 net/core/fib_rules.c:1263
Code: 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 e0 8b 0a f9 4d 8b 27
4d 39 fc 0f 84 d1 01 00 00 4d 8d 74 24 10 4d 89 f5 49 c1 ed 03 <41> 0f
b6 44 1d 00 84 c0 0f 85 fe 00 00 00 41 8b 2e 48 8b 04 24 0f
RSP: 0000:ffffc90002e17548 EFLAGS: 00010202
RAX: ffffffff88e9d1bf RBX: dffffc0000000000 RCX: ffff88801c229e00
RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff88e9d15f R09: ffffffff88e9c7c7
R10: 0000000000000003 R11: ffff88801c229e00 R12: 0000000000000000
R13: 0000000000000002 R14: 0000000000000010 R15: ffff888135ce6080
FS: 0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555597f281c0 CR3: 0000000026ad2000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
notifier_call_chain kernel/notifier.c:93 [inline]
raw_notifier_call_chain+0xe0/0x180 kernel/notifier.c:461
call_netdevice_notifiers_extack net/core/dev.c:2030 [inline]
call_netdevice_notifiers net/core/dev.c:2044 [inline]
unregister_netdevice_many_notify+0xd65/0x16d0 net/core/dev.c:11219
unregister_netdevice_many net/core/dev.c:11277 [inline]
unregister_netdevice_queue+0x2ff/0x370 net/core/dev.c:11156
unregister_netdevice include/linux/netdevice.h:3119 [inline]
__tun_detach+0x6ad/0x15e0 drivers/net/tun.c:685
tun_detach drivers/net/tun.c:701 [inline]
tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3500
__fput+0x24a/0x8a0 fs/file_table.c:422
task_work_run+0x239/0x2f0 kernel/task_work.c:180
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xa13/0x2560 kernel/exit.c:876
do_group_exit+0x1fd/0x2b0 kernel/exit.c:1025
get_signal+0x1697/0x1730 kernel/signal.c:2909
arch_do_signal_or_restart+0x92/0x7f0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x95/0x280 kernel/entry/common.c:218
do_syscall_64+0x8a/0x150 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7f1dd437f3fc
Code: Unable to access opcode bytes at 0x7f1dd437f3d2.
RSP: 002b:00007ffded2aa8f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007f1dd437f3fc
RDX: 0000000000000028 RSI: 00007ffded2aa9a0 RDI: 00000000000000f9
RBP: 00007ffded2aa94c R08: 0000000000000000 R09: 0079746972756365
R10: 00007f1dd45147e0 R11: 0000000000000246 R12: 0000555579f775eb
R13: 0000555579f77590 R14: 000000000008620e R15: 00007ffded2aa9a0
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:detach_rules net/core/fib_rules.c:1231 [inline]
RIP: 0010:fib_rules_event+0x998/0xc00 net/core/fib_rules.c:1263
Code: 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 e0 8b 0a f9 4d 8b 27
4d 39 fc 0f 84 d1 01 00 00 4d 8d 74 24 10 4d 89 f5 49 c1 ed 03 <41> 0f
b6 44 1d 00 84 c0 0f 85 fe 00 00 00 41 8b 2e 48 8b 04 24 0f
RSP: 0000:ffffc90002e17548 EFLAGS: 00010202
RAX: ffffffff88e9d1bf RBX: dffffc0000000000 RCX: ffff88801c229e00
RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff88e9d15f R09: ffffffff88e9c7c7
R10: 0000000000000003 R11: ffff88801c229e00 R12: 0000000000000000
R13: 0000000000000002 R14: 0000000000000010 R15: ffff888135ce6080
FS: 0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc95549118 CR3: 000000000d932000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 c1 e8 03 shr $0x3,%rax
4: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
8: 74 08 je 0x12
a: 4c 89 ff mov %r15,%rdi
d: e8 e0 8b 0a f9 call 0xf90a8bf2
12: 4d 8b 27 mov (%r15),%r12
15: 4d 39 fc cmp %r15,%r12
18: 0f 84 d1 01 00 00 je 0x1ef
1e: 4d 8d 74 24 10 lea 0x10(%r12),%r14
23: 4d 89 f5 mov %r14,%r13
26: 49 c1 ed 03 shr $0x3,%r13
* 2a: 41 0f b6 44 1d 00 movzbl 0x0(%r13,%rbx,1),%eax <-- trapping
instruction
30: 84 c0 test %al,%al
32: 0f 85 fe 00 00 00 jne 0x136
38: 41 8b 2e mov (%r14),%ebp
3b: 48 8b 04 24 mov (%rsp),%rax
3f: 0f .byte 0xf
--
Yours sincerely,
Xingyu
Powered by blists - more mailing lists