Hello Greg,
During Syzkaller reproducer testing on 5.4.y (5.4.118-rc1) the following
crash occurred:
WARNING: in hsr_addr_subst_dest
https://syzkaller.appspot.com/bug?id=924b5574f42ebeddc94fad06f2fa329b199d58d3
We cherry-pick'd upstream commit 4b793acd to 5.4.y and the crash no
longer occurs (rebooted 10 times with the fix commit - no failures).
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4b793acdca0050739b99ace6a8b9e7f717f57c6b
The cherry-pick of upstream commit 4b793acd was clean.
[ 63.452196] ------------[ cut here ]------------
[ 63.453371] hsr_addr_subst_dest: Unknown node
[ 63.454993] WARNING: CPU: 2 PID: 16155 at net/hsr/hsr_framereg.c:321
hsr_addr_subst_dest+0x456/0x510
[ 63.457170] Kernel panic - not syncing: panic_on_warn set ...
[ 63.458557] CPU: 2 PID: 16155 Comm: 924b5574f42ebed Not tainted
5.4.118-rc1-syzk #1
[ 63.460377] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS ?-20190213_084539-x86-ol7-builder-03.us.oracle.com-1.oci.el7
04/01/2014
[ 63.463426] Call Trace:
[ 63.464038] dump_stack+0xd4/0x119
[ 63.464873] panic+0x28f/0x6ad
[ 63.465643] ? add_taint.cold.9+0x16/0x16
[ 63.466624] ? __probe_kernel_read+0x194/0x1e0
[ 63.467700] ? __warn.cold.12+0x14/0x2f
[ 63.468636] ? __warn+0xdf/0x1d0
[ 63.469430] ? hsr_addr_subst_dest+0x456/0x510
[ 63.470509] __warn.cold.12+0x2f/0x2f
[ 63.471407] ? hsr_addr_subst_dest+0x456/0x510
[ 63.472486] report_bug+0x279/0x300
[ 63.473339] do_error_trap+0x105/0x170
[ 63.474263] do_invalid_op+0x3b/0x50
[ 63.475142] ? hsr_addr_subst_dest+0x456/0x510
[ 63.476223] invalid_op+0x28/0x30
[ 63.477040] RIP: 0010:hsr_addr_subst_dest+0x456/0x510
[ 63.478368] Code: fb db 07 00 0f 0b e9 a0 fe ff ff e8 84 f6 72 f4 48
c7 c6 60 9a f9 8f 48 c7 c7 20 9a f9 8f c6 05 c6 e5 d4 05 01 e8 d5 db 07
00 <0f> 0b e9 7a fe ff ff 4c 89 e7 e8 4b 44 b2 f4 e9 65 fc ff ff e8 21
[ 63.482793] RSP: 0018:ffff888100527648 EFLAGS: 00010286
[ 63.484054] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
ffffffff81882886
[ 63.485753] RDX: 0000000000000000 RSI: ffffffff815ff026 RDI:
0000000000000001
[ 63.487454] RBP: ffff888100527688 R08: ffff8880b2c6ae80 R09:
ffffed10216660c9
[ 63.489150] R10: ffffed10216660c8 R11: ffff88810b330647 R12:
ffff8880b2e1a8e0
[ 63.490853] R13: 00000000e3ffe048 R14: ffff8880b2e1a8e0 R15:
00000000ff39fffd
[ 63.492568] ? __irq_work_queue_local+0xa6/0xe0
[ 63.493667] ? vprintk_func+0x86/0x120
[ 63.494585] ? hsr_addr_subst_dest+0x456/0x510
[ 63.495660] hsr_forward_skb+0x1329/0x1cb0
[ 63.496655] hsr_dev_xmit+0x115/0x190
[ 63.497560] dev_hard_start_xmit+0x13f/0x630
[ 63.498592] ? __sanitizer_cov_trace_cmp4+0x20/0x20
[ 63.499760] __dev_queue_xmit+0x1e4a/0x2860
[ 63.500769] ? __kmalloc_reserve.isra.54+0xf0/0xf0
[ 63.501917] ? netdev_core_pick_tx+0x300/0x300
[ 63.502988] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 63.504278] ? alloc_skb_with_frags+0x38e/0x540
[ 63.505367] ? prep_new_page+0x13d/0x330
[ 63.506317] ? __kasan_check_write+0x14/0x20
[ 63.507355] ? __mod_zone_page_state+0xa5/0xd0
[ 63.508430] ? __kasan_check_write+0x14/0x20
[ 63.509459] ? copyin+0x85/0xd0
[ 63.510223] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 63.511391] ? _copy_from_iter+0x2dc/0xb20
[ 63.512390] ? __virt_addr_valid+0x247/0x310
[ 63.513432] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 63.514740] ? packet_parse_headers.isra.64+0x347/0x490
[ 63.515995] ? packet_parse_headers.isra.64+0x12a/0x490
[ 63.517242] ? tpacket_destruct_skb+0x570/0x570
[ 63.518336] ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 63.519513] dev_queue_xmit+0x1c/0x20
[ 63.520403] packet_sendmsg+0x198f/0x2ee0
[ 63.521368] ? tpacket_snd+0x4050/0x4050
[ 63.522319] ? selinux_secmark_relabel_packet+0xe0/0xe0
[ 63.523577] ? selinux_socket_bind+0x163/0x980
[ 63.524650] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 63.525821] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 63.527114] ? security_socket_sendmsg+0x99/0xc0
[ 63.528227] ? tpacket_snd+0x4050/0x4050
[ 63.529180] sock_sendmsg+0x155/0x190
[ 63.530068] __sys_sendto+0x27f/0x3b0
[ 63.530959] ? __ia32_sys_getpeername+0xb0/0xb0
[ 63.532048] ? packet_do_bind+0x470/0x990
[ 63.533018] ? packet_bind+0x169/0x1c0
[ 63.533933] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 63.535228] ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 63.536406] ? __audit_syscall_entry+0x43c/0x580
[ 63.537516] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 63.538810] ? syscall_trace_enter+0x498/0xdb0
[ 63.539886] ? trace_event_raw_event_sys_exit+0x280/0x280
[ 63.541180] ? __audit_syscall_exit+0x791/0xc30
[ 63.542273] __x64_sys_sendto+0xe6/0x1a0
[ 63.543226] do_syscall_64+0xe6/0x4d0
[ 63.544118] ? prepare_exit_to_usermode+0x1bf/0x280
[ 63.545291] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 63.546515] RIP: 0033:0x4332a9
[ 63.547263] Code: fd ff 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00
48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f
05 <48> 3d 01 f0 ff ff 0f 83 bb ad fd ff c3 66 2e 0f 1f 84 00 00 00 00
[ 63.551678] RSP: 002b:00007fff7655df08 EFLAGS: 00000216 ORIG_RAX:
000000000000002c
[ 63.553473] RAX: ffffffffffffffda RBX: 0000000000400328 RCX:
00000000004332a9
[ 63.555172] RDX: 0000000000000011 RSI: 0000000020000140 RDI:
0000000000000003
[ 63.556872] RBP: 00007fff7655df30 R08: 0000000000000000 R09:
0000000000000000
[ 63.558575] R10: 0000000000000004 R11: 0000000000000216 R12:
0000000000000000
[ 63.560267] R13: 000000000040e3b0 R14: 000000000040e440 R15:
0000000000000006
[ 63.562771] Dumping ftrace buffer:
[ 63.563604] ---------------------------------
[ 63.564685] rb_produ-210 2.... 7283224us :
ring_buffer_producer_thread: Starting ring buffer hammer
[ 63.566936] rb_produ-210 2.... 17283292us :
ring_buffer_producer_thread: End ring buffer hammer
[ 63.569115] rb_produ-210 2.... 17365464us :
ring_buffer_producer_thread: Running Consumer at nice: 19
[ 63.571415] rb_produ-210 2.... 17365467us :
ring_buffer_producer_thread: Running Producer at nice: 19
[ 63.573721] rb_produ-210 2.... 17365468us :
ring_buffer_producer_thread: WARNING!!! This test is running at lowest
priority.
[ 63.576489] rb_produ-210 2.... 17365470us :
ring_buffer_producer_thread: Time: 10000059 (usecs)
[ 63.578750] rb_produ-210 2.... 17365472us :
ring_buffer_producer_thread: Overruns: 3881100
[ 63.580827] rb_produ-210 2.... 17365475us :
ring_buffer_producer_thread: Read: 3590700 (by events)
[ 63.583167] rb_produ-210 2.... 17365477us :
ring_buffer_producer_thread: Entries: 0
[ 63.585128] rb_produ-210 2.... 17365479us :
ring_buffer_producer_thread: Total: 7471800
[ 63.587213] rb_produ-210 2.... 17365481us :
ring_buffer_producer_thread: Missed: 0
[ 63.589173] rb_produ-210 2.... 17365482us :
ring_buffer_producer_thread: Hit: 7471800
[ 63.591256] rb_produ-210 2.... 17365484us :
ring_buffer_producer_thread: Entries per millisec: 747
[ 63.593506] rb_produ-210 2.... 17365486us :
ring_buffer_producer_thread: 1338 ns per entry
[ 63.595587] rb_produ-210 2.... 17365487us :
ring_buffer_producer_thread: Sleeping for 10 secs
[ 63.597728] rb_produ-210 2.... 37929811us :
ring_buffer_producer_thread: End ring buffer hammer
[ 63.599913] rb_produ-210 2.... 37951467us :
ring_buffer_producer_thread: Running Consumer at nice: 19
[ 63.602208] rb_produ-210 2.... 37951471us :
ring_buffer_producer_thread: Running Producer at nice: 19
[ 63.604506] rb_produ-210 2.... 37951472us :
ring_buffer_producer_thread: WARNING!!! This test is running at lowest
priority.
[ 63.607272] rb_produ-210 2.... 37951474us :
ring_buffer_producer_thread: Time: 10092798 (usecs)
[ 63.609540] rb_produ-210 2.... 37951476us :
ring_buffer_producer_thread: Overruns: 195330
[ 63.611593] rb_produ-210 2.... 37951479us :
ring_buffer_producer_thread: Read: 1469527 (by pages)
[ 63.613901] rb_produ-210 2.... 37951481us :
ring_buffer_producer_thread: Entries: 4193
[ 63.615917] rb_produ-210 2.... 37951482us :
ring_buffer_producer_thread: Total: 1669050
[ 63.617991] rb_produ-210 2.... 37951484us :
ring_buffer_producer_thread: Missed: 0
[ 63.619945] rb_produ-210 2.... 37951486us :
ring_buffer_producer_thread: Hit: 1669050
[ 63.622016] rb_produ-210 2.... 37951488us :
ring_buffer_producer_thread: Entries per millisec: 165
[ 63.624245] rb_produ-210 2.... 37951489us :
ring_buffer_producer_thread: 6060 ns per entry
[ 63.626315] rb_produ-210 2.... 37951490us :
ring_buffer_producer_thread: Sleeping for 10 secs
[ 63.628448] rb_produ-210 2.... 48317537us :
ring_buffer_producer_thread: Starting ring buffer hammer
[ 63.630703] ---------------------------------
Thank you,
George
