netdev - kernel BUG in unregister_vlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALcu4rY66VMDQ3ODR25Xu9AD3ef353=gVvPHSpMVz-1jLWDqQg@mail.gmail.com>
Date: Wed, 16 Aug 2023 10:17:20 +0800
From: Yikebaer Aizezi <yikebaer61@...il.com>
To: davem@...emloft.net, edumazet@...gle.com, Paolo Abeni <pabeni@...hat.com>, 
	kuba@...nel.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: kernel BUG in unregister_vlan_dev

Hello,

When using Healer to fuzz the Latest Linux-6.5-rc6,  the following crash
was triggered.

HEAD commit: 2ccdd1b13c591d306f0401d98dedc4bdcd02b421 (tag: v6.5-rc6）
git tree: upstream

console output:
https://drive.google.com/file/d/1Ff3neTmiyj4PdLk5JGTnEe-PbV47cZhL/view?usp=drive_link
kernel config:https://drive.google.com/file/d/1GMWQQWjECxVnH4Bfd6NpwWJ8t9jxyYVD/view?usp=drive_link
C reproducer:https://drive.google.com/file/d/1d5Bj0ampj1Gd6KaLI3nFfHEjP8horIXx/view?usp=drive_link
Syzlang reproducer:
https://drive.google.com/file/d/1p-CbhgHnkaQlHHlze3G8VzqV3B9iyuUx/view?usp=drive_link

If you fix this issue, please add the following tag to the commit:
Reported-by: Yikebaer Aizezi <yikebaer61@...il.com>

------------[ cut here ]------------
kernel BUG at net/8021q/vlan.c:100!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 13 Comm: kworker/u4:1 Not tainted 6.5.0-rc6 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:unregister_vlan_dev+0x4a5/0x580
home/smyl/workspace/linux-6.5-rc6/net/8021q/vlan.c:100
Code: 61 00 00 00 48 c7 c6 40 6a 15 8b 48 c7 c7 80 6a 15 8b c6 05 bb
6f 18 05 01 e8 57 db 60 f8 0f 0b e9 f4 fb ff ff e8 3b d7 98 f8 <0f> 0b
e8 74 a3 e8 f8 e9 c3 fb ff ff 4c 89 f7 e8 77 a3 e8 f8 e9 56
RSP: 0018:ffffc900000ffae8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8881117ae000 RCX: 0000000000000000
RDX: ffff888013e50000 RSI: ffffffff88e793b5 RDI: ffff888029992350
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 000000000008e001 R12: ffff888029992000
R13: 0000000000000000 R14: ffffffff88e78f10 R15: ffffc900000ffbd8
FS:  0000000000000000(0000) GS:ffff888135c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557f357e3680 CR3: 0000000029cce000 CR4: 0000000000750ee0
PKRU: 55555554
Call Trace:
 <TASK>
 default_device_exit_batch+0x377/0x5b0
home/smyl/workspace/linux-6.5-rc6/net/core/dev.c:11354
 ops_exit_list+0x125/0x170
home/smyl/workspace/linux-6.5-rc6/net/core/net_namespace.c:175
 cleanup_net+0x4ea/0xb10
home/smyl/workspace/linux-6.5-rc6/net/core/net_namespace.c:614
 process_one_work+0xa22/0x16e0
home/smyl/workspace/linux-6.5-rc6/kernel/workqueue.c:2600
 worker_thread+0x679/0x10c0
home/smyl/workspace/linux-6.5-rc6/kernel/workqueue.c:2751
 kthread+0x33a/0x430 home/smyl/workspace/linux-6.5-rc6/kernel/kthread.c:389
 ret_from_fork+0x28/0x60
home/smyl/workspace/linux-6.5-rc6/arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x11/0x20
home/smyl/workspace/linux-6.5-rc6/arch/x86/entry/entry_64.S:304
 </TASK>
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace 0000000000000000 ]---
RIP: 0010:unregister_vlan_dev+0x4a5/0x580
home/smyl/workspace/linux-6.5-rc6/net/8021q/vlan.c:100
Code: 61 00 00 00 48 c7 c6 40 6a 15 8b 48 c7 c7 80 6a 15 8b c6 05 bb
6f 18 05 01 e8 57 db 60 f8 0f 0b e9 f4 fb ff ff e8 3b d7 98 f8 <0f> 0b
e8 74 a3 e8 f8 e9 c3 fb ff ff 4c 89 f7 e8 77 a3 e8 f8 e9 56
RSP: 0018:ffffc900000ffae8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8881117ae000 RCX: 0000000000000000
RDX: ffff888013e50000 RSI: ffffffff88e793b5 RDI: ffff888029992350
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 000000000008e001 R12: ffff888029992000
R13: 0000000000000000 R14: ffffffff88e78f10 R15: ffffc900000ffbd8
FS:  0000000000000000(0000) GS:ffff888063c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555fce4b01a8 CR3: 000000010f878000 CR4: 0000000000750ef0
PKRU: 55555554