Re: general protection fault in rds_ib_get_mr

From: Eric Biggers
Date: Sun May 13 2018 - 17:09:49 EST

On Wed, Mar 21, 2018 at 09:00:01AM -0700, syzbot wrote:
> Hello,
>
> syzbot hit the following crash on upstream commit
> 3215b9d57a2c75c4305a3956ca303d7004485200 (Wed Mar 21 00:44:27 2018 +0000)
> Merge tag 'clk-fixes-for-linus' of
> git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
> syzbot dashboard link:
> https://syzkaller.appspot.com/bug?extid=b51c77ef956678a65834
>
> So far this crash happened 4 times on net-next, upstream.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+b51c77ef956678a65834@xxxxxxxxxxxxxxxxxxxxxxxxx
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
>
> audit: type=1400 audit(1521615317.627:7): avc: denied { map } for
> pid=4240 comm="syzkaller468044" path="/root/syzkaller468044973" dev="sda1"
> ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 4244 Comm: syzkaller468044 Not tainted 4.16.0-rc6+ #361
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:rds_ib_get_mr+0x5c/0x230 net/rds/ib_rdma.c:544
> RSP: 0018:ffff8801b059f890 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: ffff8801b07e1300 RCX: ffffffff8562d96e
> RDX: 000000000000000d RSI: 0000000000000001 RDI: 0000000000000068
> RBP: ffff8801b059f8b8 R08: ffffed0036274244 R09: ffff8801b13a1200
> R10: 0000000000000004 R11: ffffed0036274243 R12: ffff8801b13a1200
> R13: 0000000000000001 R14: ffff8801ca09fa9c R15: 0000000000000000
> FS: 00007f4d050af700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f4d050aee78 CR3: 00000001b0d9b006 CR4: 00000000001606e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> __rds_rdma_map+0x710/0x1050 net/rds/rdma.c:271
> rds_get_mr_for_dest+0x1d4/0x2c0 net/rds/rdma.c:357
> rds_setsockopt+0x6cc/0x980 net/rds/af_rds.c:347
> SYSC_setsockopt net/socket.c:1849 [inline]
> SyS_setsockopt+0x189/0x360 net/socket.c:1828
> do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
> entry_SYSCALL_64_after_hwframe+0x42/0xb7
> RIP: 0033:0x4456d9
> RSP: 002b:00007f4d050aedb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
> RAX: ffffffffffffffda RBX: 00000000006dac3c RCX: 00000000004456d9
> RDX: 0000000000000007 RSI: 0000000000000114 RDI: 0000000000000004
> RBP: 00000000006dac38 R08: 00000000000000a0 R09: 0000000000000000
> R10: 0000000020000380 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fffbfb36d6f R14: 00007f4d050af9c0 R15: 0000000000000005
> Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 cc 01 00 00 4c 8b bb 80 04 00 00 48
> b8 00 00 00 00 00 fc ff df 49 8d 7f 68 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 9c 01 00 00 4d 8b 7f 68 48 b8 00 00 00 00 00
> RIP: rds_ib_get_mr+0x5c/0x230 net/rds/ib_rdma.c:544 RSP: ffff8801b059f890
> ---[ end trace 7e1cea13b85473b0 ]---
> Kernel panic - not syncing: Fatal exception
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..
>
>
> ---
> This bug is generated by a dumb bot. It may contain errors.
> See https://goo.gl/tpsmEJ for details.
> Direct all questions to syzkaller@xxxxxxxxxxxxxxxxx
>
> syzbot will keep track of this bug report.
> If you forgot to add the Reported-by tag, once the fix for this bug is
> merged
> into any tree, please reply to this email with:
> #syz fix: exact-commit-title
> If you want to test a patch for this bug, please reply with:
> #syz test: git://repo/address.git branch
> and provide the patch inline or as an attachment.
> To mark this as a duplicate of another syzbot report, please reply with:
> #syz dup: exact-subject-of-another-report
> If it's a one-off invalid bug report, please reply with:
> #syz invalid
> Note: if the crash happens again, it will cause creation of a new bug
> report.
> Note: all commands must start from beginning of the line in the email body.

Still reproducible on Linus' tree (commit 66e1c94db3cd4) and linux-next
(next-20180511). Here's a simplified reproducer:

#include <linux/rds.h>
#include <netinet/in.h>
#include <unistd.h>

int main()
{
int transport = RDS_TRANS_IB;
int fd;

fd = socket(AF_RDS, SOCK_SEQPACKET, 0);
setsockopt(fd, SOL_RDS, SO_RDS_TRANSPORT, &transport, sizeof(transport));

if (fork()) {
for (;;) {
struct sockaddr_in addr = {
.sin_family = AF_INET,
.sin_port = 0,
.sin_addr = { htobe32(0x7f000001) },
};
bind(fd, (struct sockaddr *)&addr, sizeof(addr));
}
} else {
for (;;) {
char buf[128] = { 0 };
struct rds_get_mr_for_dest_args args = {
.vec = {
.addr = (unsigned long)buf,
.bytes = sizeof(buf),
},
};

setsockopt(fd, SOL_RDS, RDS_GET_MR_FOR_DEST, &args, sizeof(args));
}
}
}

BUG: unable to handle kernel NULL pointer dereference at 0000000000000068
PGD 0 P4D 0
Oops: 0000 [#1] SMP
CPU: 4 PID: 224 Comm: syz_rdma Not tainted 4.17.0-rc4-next-20180511 #40
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
RIP: 0010:rds_ib_get_mr+0x23/0xb0 net/rds/ib_rdma.c:547
Code: 93 5a a6 ff 5b 5d c3 55 48 89 e5 41 57 49 89 cf 41 56 41 55 49 89 f5 41 54 49 89 fc 53 48 8b 82 68 04 00 00 8b ba 50 04 00 00 <48> 8b 40 68 4c 8b b0 98 00 00 00 e8 fd ef ff ff 48 85 c0 0f 84 a6
RSP: 0018:ffffb39f4088fd10 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8c69f8f05a80 RCX: ffff8c69f986f49c
RDX: ffff8c69f8d75840 RSI: 0000000000000002 RDI: 000000000100007f
RBP: ffffb39f4088fd38 R08: ffff8c69f9a1a980 R09: 0000000000000002
R10: 0000000087654321 R11: 0000000000000000 R12: ffff8c69f8f05a80
R13: 0000000000000002 R14: ffff8c69f986f480 R15: ffff8c69f986f49c
FS: 00007f140caf4740(0000) GS:ffff8c69ffd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000068 CR3: 0000000078c2d000 CR4: 00000000003406e0
Call Trace:
__rds_rdma_map+0x36f/0x4c0 net/rds/rdma.c:271
rds_get_mr_for_dest+0x84/0xb0 net/rds/rdma.c:357
rds_setsockopt+0x176/0x360 net/rds/af_rds.c:350
__sys_setsockopt+0x6d/0xd0 net/socket.c:1910
__do_sys_setsockopt net/socket.c:1921 [inline]
__se_sys_setsockopt net/socket.c:1918 [inline]
__x64_sys_setsockopt+0x1f/0x30 net/socket.c:1918
do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f140c1fd20a
Code: 9c 2b 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e6 9b 2b 00 f7 d8 64 89 01 48
RSP: 002b:00007fffcaa06f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007fffcaa06f30 RCX: 00007f140c1fd20a
RDX: 0000000000000007 RSI: 0000000000000114 RDI: 0000000000000003
RBP: 00007fffcaa06fd0 R08: 00000000000000a0 R09: 00007f140c8da010
R10: 00007fffcaa06f30 R11: 0000000000000246 R12: 0000000000000003
R13: 00007fffcaa06f30 R14: 0000000000000000 R15: 0000000000000000
CR2: 0000000000000068
---[ end trace fd75e4e4e9b87576 ]---