syzbot

 sign-in | mailing list | source | docs
🐞 Open [139]
🐞 Fixed [69]
🐞 Invalid [295]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in ipv6_rcv

Status: auto-closed as invalid on 2022/08/30 17:09
Reported-by: syzbot+aff2098763b0ea65e83f@syzkaller.appspotmail.com
First crash: 1534d, last: 1534d
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in ipv6_rcv (3) net 10 2 750d 753d 0/29 closed as invalid on 2024/06/27 12:46
upstream BUG: unable to handle kernel NULL pointer dereference in ipv6_rcv net 10 1 2695d 2695d 0/29 closed as invalid on 2019/03/10 18:51
upstream BUG: unable to handle kernel NULL pointer dereference in ipv6_rcv (2) net 10 1 2583d 2583d 0/29 closed as invalid on 2019/06/14 19:45
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2022/08/30 16:27 16m retest repro android12-5.10-lts OK log

Sample crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 10c9c5067 P4D 10c9c5067 
PUD 120843067 
PMD 0 

Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 426 Comm: kworker/0:4 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work

RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90000007ab8 EFLAGS: 00010246

RAX: 1ffff11020000005 RBX: ffff888100000028 RCX: ffff88810b81e2c0
RDX: 0000000080000101 RSI: 0000000000000000 RDI: ffff88810e922640
RBP: ffffc90000007bb0 R08: ffffffff8433ff05 R09: ffff88810e922640
R10: ffffc90000007500 R11: 1ffff92000000ece R12: 1ffff92000000f5c
R13: dffffc0000000000 R14: 1ffff11021d244d3 R15: ffff88810e922698
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000012084b000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 dst_input include/net/dst.h:449 [inline]
 ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]
 NF_HOOK include/linux/netfilter.h:304 [inline]
 ipv6_rcv+0x297/0x550 net/ipv6/ip6_input.c:297
 __netif_receive_skb_one_core net/core/dev.c:5361 [inline]
 __netif_receive_skb+0x1c5/0x500 net/core/dev.c:5475
 process_backlog+0x352/0x690 net/core/dev.c:6381
 napi_poll+0x1a3/0x650 net/core/dev.c:6832
 net_rx_action+0x387/0x970 net/core/dev.c:6902
 __do_softirq+0x27e/0x596 kernel/softirq.c:305
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 do_softirq+0xca/0x110 kernel/softirq.c:355
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:190
 local_bh_enable+0x1f/0x30 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:740 [inline]
 ip6_finish_output2+0x1094/0x1950 net/ipv6/ip6_output.c:146
 __ip6_finish_output+0x653/0x810 net/ipv6/ip6_output.c:210
 ip6_finish_output+0x1c9/0x1e0 net/ipv6/ip6_output.c:220
 NF_HOOK_COND include/linux/netfilter.h:293 [inline]
 ip6_output+0x211/0x4c0 net/ipv6/ip6_output.c:243
 dst_output include/net/dst.h:443 [inline]
 NF_HOOK include/linux/netfilter.h:304 [inline]
 ndisc_send_skb+0x6fe/0xc10 net/ipv6/ndisc.c:508
 ndisc_send_ns+0x629/0x810 net/ipv6/ndisc.c:650
 addrconf_dad_work+0xba6/0x15d0 net/ipv6/addrconf.c:4165
 process_one_work+0x726/0xc10 kernel/workqueue.c:2296
 worker_thread+0xb27/0x1550 kernel/workqueue.c:2442
 kthread+0x349/0x3d0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Modules linked in:

CR2: 0000000000000000
---[ end trace 34857169a7571141 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90000007ab8 EFLAGS: 00010246

RAX: 1ffff11020000005 RBX: ffff888100000028 RCX: ffff88810b81e2c0
RDX: 0000000080000101 RSI: 0000000000000000 RDI: ffff88810e922640
RBP: ffffc90000007bb0 R08: ffffffff8433ff05 R09: ffff88810e922640
R10: ffffc90000007500 R11: 1ffff92000000ece R12: 1ffff92000000f5c
R13: dffffc0000000000 R14: 1ffff11021d244d3 R15: ffff88810e922698
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000012084b000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/04/10 05:03 android12-5.10-lts 414e6c8e941c e22c3da3 .config console log report syz ci2-android-5-10-perf BUG: unable to handle kernel NULL pointer dereference in ipv6_rcv
* Struck through repros no longer work on HEAD.