kernel BUG in unregister_vlan_dev
From: Yikebaer Aizezi <hidden>
Date: 2023-08-16 02:18:55
Also in:
lkml
Hello, When using Healer to fuzz the Latest Linux-6.5-rc6, the following crash was triggered. HEAD commit: 2ccdd1b13c591d306f0401d98dedc4bdcd02b421 (tag: v6.5-rc6) git tree: upstream console output: https://drive.google.com/file/d/1Ff3neTmiyj4PdLk5JGTnEe-PbV47cZhL/view?usp=drive_link kernel config:https://drive.google.com/file/d/1GMWQQWjECxVnH4Bfd6NpwWJ8t9jxyYVD/view?usp=drive_link C reproducer:https://drive.google.com/file/d/1d5Bj0ampj1Gd6KaLI3nFfHEjP8horIXx/view?usp=drive_link Syzlang reproducer: https://drive.google.com/file/d/1p-CbhgHnkaQlHHlze3G8VzqV3B9iyuUx/view?usp=drive_link If you fix this issue, please add the following tag to the commit: Reported-by: Yikebaer Aizezi <redacted> ------------[ cut here ]------------ kernel BUG at net/8021q/vlan.c:100! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 13 Comm: kworker/u4:1 Not tainted 6.5.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:unregister_vlan_dev+0x4a5/0x580 home/smyl/workspace/linux-6.5-rc6/net/8021q/vlan.c:100 Code: 61 00 00 00 48 c7 c6 40 6a 15 8b 48 c7 c7 80 6a 15 8b c6 05 bb 6f 18 05 01 e8 57 db 60 f8 0f 0b e9 f4 fb ff ff e8 3b d7 98 f8 <0f> 0b e8 74 a3 e8 f8 e9 c3 fb ff ff 4c 89 f7 e8 77 a3 e8 f8 e9 56 RSP: 0018:ffffc900000ffae8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8881117ae000 RCX: 0000000000000000 RDX: ffff888013e50000 RSI: ffffffff88e793b5 RDI: ffff888029992350 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 000000000008e001 R12: ffff888029992000 R13: 0000000000000000 R14: ffffffff88e78f10 R15: ffffc900000ffbd8 FS: 0000000000000000(0000) GS:ffff888135c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000557f357e3680 CR3: 0000000029cce000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <TASK> default_device_exit_batch+0x377/0x5b0 home/smyl/workspace/linux-6.5-rc6/net/core/dev.c:11354 ops_exit_list+0x125/0x170 home/smyl/workspace/linux-6.5-rc6/net/core/net_namespace.c:175 cleanup_net+0x4ea/0xb10 home/smyl/workspace/linux-6.5-rc6/net/core/net_namespace.c:614 process_one_work+0xa22/0x16e0 home/smyl/workspace/linux-6.5-rc6/kernel/workqueue.c:2600 worker_thread+0x679/0x10c0 home/smyl/workspace/linux-6.5-rc6/kernel/workqueue.c:2751 kthread+0x33a/0x430 home/smyl/workspace/linux-6.5-rc6/kernel/kthread.c:389 ret_from_fork+0x28/0x60 home/smyl/workspace/linux-6.5-rc6/arch/x86/kernel/process.c:145 ret_from_fork_asm+0x11/0x20 home/smyl/workspace/linux-6.5-rc6/arch/x86/entry/entry_64.S:304 </TASK> Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) ---[ end trace 0000000000000000 ]--- RIP: 0010:unregister_vlan_dev+0x4a5/0x580 home/smyl/workspace/linux-6.5-rc6/net/8021q/vlan.c:100 Code: 61 00 00 00 48 c7 c6 40 6a 15 8b 48 c7 c7 80 6a 15 8b c6 05 bb 6f 18 05 01 e8 57 db 60 f8 0f 0b e9 f4 fb ff ff e8 3b d7 98 f8 <0f> 0b e8 74 a3 e8 f8 e9 c3 fb ff ff 4c 89 f7 e8 77 a3 e8 f8 e9 56 RSP: 0018:ffffc900000ffae8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8881117ae000 RCX: 0000000000000000 RDX: ffff888013e50000 RSI: ffffffff88e793b5 RDI: ffff888029992350 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 000000000008e001 R12: ffff888029992000 R13: 0000000000000000 R14: ffffffff88e78f10 R15: ffffc900000ffbd8 FS: 0000000000000000(0000) GS:ffff888063c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555fce4b01a8 CR3: 000000010f878000 CR4: 0000000000750ef0 PKRU: 55555554