BUG: unable to handle kernel paging request in socket_file_ops
flat view
From: syzbot <hidden>
Date: 2017-12-20 20:51:04
Also in:
lkml
Hello, syzkaller hit the following crash on 6084b576dca2e898f5c101baef151f7bfdbb606d git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master compiler: gcc (GCC) 7.1.1 20170620 .config is attached Raw console output is attached. C reproducer is attached syzkaller reproducer is attached. See https://goo.gl/kgGztJ for information about syzkaller reproducers alloc_fd: slot 80 not NULL! BUG: unable to handle kernel paging request at ffffffffffffffff alloc_fd: slot 81 not NULL! alloc_fd: slot 82 not NULL! alloc_fd: slot 83 not NULL! alloc_fd: slot 84 not NULL! alloc_fd: slot 86 not NULL! alloc_fd: slot 87 not NULL! IP: socket_file_ops+0x22/0x4d0 PGD 3021067 P4D 3021067 PUD 3023067 PMD 0 Oops: 0002 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 3358 Comm: cryptomgr_test Not tainted 4.15.0-rc3-next-20171214+ #67 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:socket_file_ops+0x22/0x4d0 RSP: 0018:ffffc900017fbdf0 EFLAGS: 00010246 RAX: ffff880214e4ca00 RBX: ffff8802156c74a0 RCX: ffffffff81678ac3 RDX: 0000000000000000 RSI: ffff8802156c74a0 RDI: ffff8802156c74a0 RBP: ffffc900017fbe18 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffffc900017fbeb0 R14: ffffc900017fbeb0 R15: ffffc900017fbeb0 FS: 0000000000000000(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffff CR3: 000000000301e002 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: crypto_free_instance+0x2a/0x50 crypto/algapi.c:77 crypto_destroy_instance+0x1e/0x30 crypto/algapi.c:85 crypto_alg_put crypto/internal.h:116 [inline] crypto_remove_final+0x73/0xa0 crypto/algapi.c:331 crypto_alg_tested+0x194/0x260 crypto/algapi.c:320 cryptomgr_test+0x17/0x30 crypto/algboss.c:226 kthread+0x149/0x170 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:524 Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 51 40 81 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 <09> 82 ff ff ff ff 00 26 0a 82 ff ff ff ff 00 00 00 00 00 00 00 RIP: socket_file_ops+0x22/0x4d0 RSP: ffffc900017fbdf0 CR2: ffffffffffffffff ---[ end trace 52c47d77c1a058d5 ]--- BUG: unable to handle kernel NULL pointer dereference at 0000000000000064 IP: __neigh_event_send+0xa8/0x400 net/core/neighbour.c:1006 PGD 0 P4D 0 Oops: 0000 [#2] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 3122 Comm: sshd Tainted: G D 4.15.0-rc3-next-20171214+ #67 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__neigh_event_send+0xa8/0x400 net/core/neighbour.c:1006 RSP: 0018:ffffc90000efb8b8 EFLAGS: 00010293 RAX: ffff880214dba640 RBX: ffff8802156c4c00 RCX: ffffffff820e6fa4 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8802156c4c28 RBP: ffffc90000efb8f8 R08: 0000000000000001 R09: ffffffff820e6f28 R10: ffffc90000efb828 R11: 0000000000000000 R12: ffff8802156c4c28 R13: ffff8802115896e0 R14: 0000000000000000 R15: ffffffff82e2eaf8 FS: 00007f838bacb7c0(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000064 CR3: 0000000213530006 CR4: 00000000001606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: neigh_event_send include/net/neighbour.h:435 [inline] neigh_resolve_output+0x24a/0x340 net/core/neighbour.c:1334 neigh_output include/net/neighbour.h:482 [inline] ip_finish_output2+0x2cf/0x7b0 net/ipv4/ip_output.c:229 ip_finish_output+0x2e6/0x490 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:270 [inline] ip_output+0x73/0x2b0 net/ipv4/ip_output.c:405 dst_output include/net/dst.h:443 [inline] ip_local_out+0x54/0xb0 net/ipv4/ip_output.c:124 ip_queue_xmit+0x27d/0x740 net/ipv4/ip_output.c:504 tcp_transmit_skb+0x66a/0xd70 net/ipv4/tcp_output.c:1176 tcp_write_xmit+0x262/0x13a0 net/ipv4/tcp_output.c:2367 __tcp_push_pending_frames+0x49/0xe0 net/ipv4/tcp_output.c:2540 tcp_push+0x14e/0x190 net/ipv4/tcp.c:730 tcp_sendmsg_locked+0x899/0x11a0 net/ipv4/tcp.c:1424 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1461 inet_sendmsg+0x54/0x250 net/ipv4/af_inet.c:763 sock_sendmsg_nosec net/socket.c:636 [inline] sock_sendmsg+0x51/0x70 net/socket.c:646 sock_write_iter+0xa4/0x100 net/socket.c:915 call_write_iter include/linux/fs.h:1776 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x15b/0x1e0 fs/read_write.c:482 vfs_write+0xf0/0x230 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0x57/0xd0 fs/read_write.c:581 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x7f8389e66370 RSP: 002b:00007ffe535b0318 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8389e66370 RDX: 0000000000000038 RSI: 0000562088cb2460 RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000001 R09: 0101010101010101 R10: 0000000000000008 R11: 0000000000000246 R12: 0000562088cbe590 R13: 0000562088167fb4 R14: 0000000000000028 R15: 0000562088169ca0 Code: ff 48 83 c4 18 44 89 e8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 ab 33 1d ff 41 f6 c6 05 0f 85 68 01 00 00 e8 9c 33 1d ff 4c 8b 73 10 <41> 8b 46 64 41 03 46 5c 0f 84 a8 01 00 00 e8 85 33 1d ff 48 8b RIP: __neigh_event_send+0xa8/0x400 net/core/neighbour.c:1006 RSP: ffffc90000efb8b8 CR2: 0000000000000064 ---[ end trace 52c47d77c1a058d6 ]--- --- This bug is generated by a dumb bot. It may contain errors. See https://goo.gl/tpsmEJ for details. Direct all questions to syzkaller@googlegroups.com. Please credit me with: Reported-by: syzbot [off-list ref] syzbot will keep track of this bug report. Once a fix for this bug is merged into any tree, reply to this email with: #syz fix: exact-commit-title If you want to test a patch for this bug, please reply with: #syz test: git://repo/address.git branch and provide the patch inline or as an attachment. To mark this as a duplicate of another syzbot report, please reply with: #syz dup: exact-subject-of-another-report If it's a one-off invalid bug report, please reply with: #syz invalid Note: if the crash happens again, it will cause creation of a new bug report. Note: all commands must start from beginning of the line in the email body.