Hello, syzkaller hit the following crash on 6084b576dca2e898f5c101baef151f7bfdbb606d git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master compiler: gcc (GCC) 7.1.1 20170620 .config is attached Raw console output is attached. Unfortunately, I don't have any reproducer for this bug yet. netlink: 29 bytes leftover after parsing attributes in process `syz-executor2'. device eql entered promiscuous mode BUG: unable to handle kernel NULL pointer dereference at 0000000000000578 IP: read_pnet include/net/net_namespace.h:270 [inline] IP: dev_net include/linux/netdevice.h:2041 [inline] IP: ip_mc_up+0x15/0x170 net/ipv4/igmp.c:1736 PGD 1df61f067 P4D 1df61f067 PUD 1de8fc067 PMD 0 Oops: 0000 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 23740 Comm: syz-executor6 Not tainted 4.15.0-rc3-next-20171214+ #67 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 netlink: 29 bytes leftover after parsing attributes in process `syz-executor2'. RIP: 0010:read_pnet include/net/net_namespace.h:270 [inline] RIP: 0010:dev_net include/linux/netdevice.h:2041 [inline] RIP: 0010:ip_mc_up+0x15/0x170 net/ipv4/igmp.c:1736 RSP: 0018:ffffc900010abb88 EFLAGS: 00010212 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff821dd421 RDX: 000000000000235e RSI: ffffc900035dd000 RDI: ffff8801df56d000 RBP: ffffc900010abba0 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc900010abc20 R11: 0000000000000000 R12: ffff8801df56d000 R13: ffff8801df652000 R14: 0000000000000000 R15: ffff8801df56d000 FS: 00007f4c60214700(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000578 CR3: 00000001dc7f1000 CR4: 00000000001426f0 Call Trace: inetdev_event+0x224/0x5c0 net/ipv4/devinet.c:1504 notifier_call_chain+0x41/0xc0 kernel/notifier.c:93
BUG: unable to handle kernel NULL pointer dereference in ip_mc_up
Started by syzbot on Dec 19, 2017 · 2 messages from 2 authors · Last reply Jan 30, 2018
open the first message on its own page
On Tue, Dec 19, 2017 at 12:40:01AM -0800, syzbot wrote:
Hello, syzkaller hit the following crash on 6084b576dca2e898f5c101baef151f7bfdbb606d git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master compiler: gcc (GCC) 7.1.1 20170620 .config is attached Raw console output is attached. Unfortunately, I don't have any reproducer for this bug yet. netlink: 29 bytes leftover after parsing attributes in process `syz-executor2'. device eql entered promiscuous mode BUG: unable to handle kernel NULL pointer dereference at 0000000000000578 IP: read_pnet include/net/net_namespace.h:270 [inline] IP: dev_net include/linux/netdevice.h:2041 [inline] IP: ip_mc_up+0x15/0x170 net/ipv4/igmp.c:1736 PGD 1df61f067 P4D 1df61f067 PUD 1de8fc067 PMD 0 Oops: 0000 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 23740 Comm: syz-executor6 Not tainted 4.15.0-rc3-next-20171214+ #67 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 netlink: 29 bytes leftover after parsing attributes in process `syz-executor2'. RIP: 0010:read_pnet include/net/net_namespace.h:270 [inline] RIP: 0010:dev_net include/linux/netdevice.h:2041 [inline] RIP: 0010:ip_mc_up+0x15/0x170 net/ipv4/igmp.c:1736 RSP: 0018:ffffc900010abb88 EFLAGS: 00010212 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff821dd421 RDX: 000000000000235e RSI: ffffc900035dd000 RDI: ffff8801df56d000 RBP: ffffc900010abba0 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc900010abc20 R11: 0000000000000000 R12: ffff8801df56d000 R13: ffff8801df652000 R14: 0000000000000000 R15: ffff8801df56d000 FS: 00007f4c60214700(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000
Invalidating this bug since it hasn't been seen again, and it was reported while
KASAN was accidentally disabled in the syzbot kconfig due to a change to the
kconfig menus in linux-next (so this crash was possibly caused by slab
corruption elsewhere).
#syz invalid