divide error in tabledist (2)

Status: closed as invalid on 2021/10/06 02:59
First crash: 2494d, last: 2253d
Cause bisection: introduced by (bisect log) :
commit 9b0ed89172efec1d9f214d173ad6046f10f6b742
Author: Stephen Hemminger <stephen@networkplumber.org>
Date: Tue Nov 14 19:27:02 2017 +0000

  netem: remove unnecessary 64 bit modulus

Crash: divide error in netem_enqueue (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 divide error in tabledist 2 syz, C done 3 2131d 2488d 1/1 fixed on 2020/11/17 09:23
upstream divide error in tabledist net 2 3 2517d 2526d 13/29 fixed on 2019/10/15 23:40

Sample crash report:
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 2781 Comm: kworker/1:12 Not tainted 5.7.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:tabledist.part.0+0x134/0x160 net/sched/sch_netem.c:333
Code: 4c 89 e0 48 83 c4 08 5b 5d 41 5c 41 5d c3 e8 83 1d 2b fb 48 81 eb 00 10 00 00 eb aa e8 75 1d 2b fb 8d 4c 2d 00 44 89 e8 31 d2 <f7> f1 49 29 ec 49 01 d4 eb c7 48 89 df e8 8a e9 68 fb e9 13 ff ff
RSP: 0018:ffffc9000822f458 EFLAGS: 00010246
RAX: 00000000602af428 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8648112b RDI: 0000000000000005
RBP: ffffffff80000000 R08: ffff88809faa81c0 R09: ffffed10125a4866
R10: ffff888092d2432f R11: ffffed10125a4865 R12: 0000003e42c00000
R13: 00000000602af428 R14: ffff8880a6f76330 R15: ffff8880a6f76000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fa3deb1890 CR3: 0000000099dc9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 tabledist net/sched/sch_netem.c:536 [inline]
 netem_enqueue+0x412/0x2da0 net/sched/sch_netem.c:536
 __dev_xmit_skb net/core/dev.c:3710 [inline]
 __dev_queue_xmit+0x154a/0x30a0 net/core/dev.c:4021
 neigh_resolve_output net/core/neighbour.c:1489 [inline]
 neigh_resolve_output+0x566/0x930 net/core/neighbour.c:1469
 neigh_output include/net/neighbour.h:510 [inline]
 ip6_finish_output2+0x1091/0x25b0 net/ipv6/ip6_output.c:117
 __ip6_finish_output+0x442/0xab0 net/ipv6/ip6_output.c:143
 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x239/0x810 net/ipv6/ip6_output.c:176
 dst_output include/net/dst.h:435 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ndisc_send_skb+0xf40/0x14b0 net/ipv6/ndisc.c:506
 ndisc_send_ns+0x3b0/0x860 net/ipv6/ndisc.c:648
 addrconf_dad_work+0xc4a/0x1280 net/ipv6/addrconf.c:4131
 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace a568a417cb2cbbd3 ]---
RIP: 0010:tabledist.part.0+0x134/0x160 net/sched/sch_netem.c:333
Code: 4c 89 e0 48 83 c4 08 5b 5d 41 5c 41 5d c3 e8 83 1d 2b fb 48 81 eb 00 10 00 00 eb aa e8 75 1d 2b fb 8d 4c 2d 00 44 89 e8 31 d2 <f7> f1 49 29 ec 49 01 d4 eb c7 48 89 df e8 8a e9 68 fb e9 13 ff ff
RSP: 0018:ffffc9000822f458 EFLAGS: 00010246
RAX: 00000000602af428 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8648112b RDI: 0000000000000005
RBP: ffffffff80000000 R08: ffff88809faa81c0 R09: ffffed10125a4866
R10: ffff888092d2432f R11: ffffed10125a4865 R12: 0000003e42c00000
R13: 00000000602af428 R14: ffff8880a6f76330 R15: ffff8880a6f76000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fa3deb1890 CR3: 0000000099dc9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (39):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/03 07:34 upstream f66ed1ebbfde 5457883a .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/05/01 16:22 upstream c45e8bccecaf a4d01b80 .config console log report syz C ci-upstream-kasan-gce-root
2020/04/13 06:43 upstream 4f8a3cc1183c 36b0b050 .config console log report syz C ci-upstream-kasan-gce
2020/01/07 17:08 upstream ae6088216ce4 1bcd407e .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/01/06 22:34 upstream c79f46a28239 53430d97 .config console log report syz C ci-upstream-kasan-gce-root
2019/10/30 19:36 upstream 320000e72ec0 5ea87a66 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/10/25 23:42 upstream 39a38bcba4ab c2e837da .config console log report syz C ci-upstream-kasan-gce-root
2019/10/21 22:52 upstream 7d194c2100ad b24d2b8a .config console log report syz C ci-upstream-kasan-gce
2020/04/15 21:17 upstream 8632e9b5645b 3f3c5574 .config console log report syz C ci-upstream-kasan-gce-386
2020/01/06 18:15 upstream c79f46a28239 438e1227 .config console log report syz C ci-upstream-kasan-gce-386
2019/10/21 22:51 upstream 7d194c2100ad b24d2b8a .config console log report syz C ci-upstream-kasan-gce-386
2020/04/11 00:35 net-old 40fc7ad2c886 a8c6a3f8 .config console log report syz C ci-upstream-net-this-kasan-gce
2020/01/06 08:23 net-old f11421ba4af7 438e1227 .config console log report syz C ci-upstream-net-this-kasan-gce
2019/10/21 22:54 net-old 40c5b2bd2473 b24d2b8a .config console log report syz C ci-upstream-net-this-kasan-gce
2020/04/11 00:37 net-next-old 63bef48fd6c9 a8c6a3f8 .config console log report syz C ci-upstream-net-kasan-gce
2020/01/06 08:15 net-next-old 704a0afb4963 438e1227 .config console log report syz C ci-upstream-net-kasan-gce
2019/10/21 22:52 net-next-old 13faf7718522 b24d2b8a .config console log report syz C ci-upstream-net-kasan-gce
2020/05/03 12:56 linux-next ac935d227366 5457883a .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/01/11 15:55 linux-next 6c09d7dbb7d3 4c04afaa .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/01/06 17:53 upstream c79f46a28239 438e1227 .config console log report syz ci-upstream-kasan-gce
2020/05/23 21:08 upstream 444565650a5f 9682898d .config console log report ci-upstream-kasan-gce
2020/02/04 04:59 upstream 754beeec1d90 93e5e335 .config console log report ci-upstream-kasan-gce
2019/10/31 06:05 upstream 320000e72ec0 a41ca8fa .config console log report ci-upstream-kasan-gce
2020/06/06 12:19 upstream 7ae77150d94d e6b89e4e .config console log report ci-upstream-kasan-gce-386
2020/06/18 19:48 net-old 4d3da2d8d91f d45a4d69 .config console log report ci-upstream-net-this-kasan-gce
2020/05/31 23:37 net-old bdc48fa11e46 a0331e89 .config console log report ci-upstream-net-this-kasan-gce
2020/05/22 20:36 net-old 57ebc8f08504 9682898d .config console log report ci-upstream-net-this-kasan-gce
2020/02/28 04:12 net-old 6132c1d9033d 59b57593 .config console log report ci-upstream-net-this-kasan-gce
2020/06/17 17:40 net-next-old cb8e59cc8720 b9f3810b .config console log report ci-upstream-net-kasan-gce
2020/06/17 10:43 net-next-old cb8e59cc8720 b9f3810b .config console log report ci-upstream-net-kasan-gce
2020/06/15 03:50 net-next-old cb8e59cc8720 2a22c77a .config console log report ci-upstream-net-kasan-gce
2020/06/14 06:56 net-next-old cb8e59cc8720 a61674a5 .config console log report ci-upstream-net-kasan-gce
2020/06/11 14:42 net-next-old cb8e59cc8720 3ab7a05a .config console log report ci-upstream-net-kasan-gce
2020/06/08 05:49 net-next-old cb8e59cc8720 7751efd0 .config console log report ci-upstream-net-kasan-gce
2020/06/01 02:09 net-next-old 1079a34c56c5 a0331e89 .config console log report ci-upstream-net-kasan-gce
2020/02/13 06:30 net-next-old fdfa3a6778b1 84f4fc8a .config console log report ci-upstream-net-kasan-gce
2020/01/08 08:47 net-next-old 1ece2fbe9b42 6738e0b3 .config console log report ci-upstream-net-kasan-gce
2019/11/18 09:51 net-next-old 19b7e21c55c8 d5696d51 .config console log report ci-upstream-net-kasan-gce
2020/05/13 05:31 linux-next ac935d227366 a44eb8f7 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.