B.A.T.M.A.N

b.a.t.m.a.n@lists.open-mesh.org

15 participants
4308 discussions

WARNING in ext4_da_update_reserve_space
by syzbot 02 Apr '20

02 Apr '20

Hello, syzbot found the following crash on: HEAD commit: 1a147b74 Merge branch 'DSA-mtu' git tree: net-next console output: https://syzkaller.appspot.com/x/log.txt?x=14237713e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=46ee14d4915944bc dashboard link: https://syzkaller.appspot.com/bug?extid=67e4f16db666b1c8253c compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12237713e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10ec7c97e00000 The bug was bisected to: commit 658b0f92bc7003bc734471f61bf7cd56339eb8c3 Author: Murilo Opsfelder Araujo <muriloo(a)linux.ibm.com> Date: Wed Aug 1 21:33:15 2018 +0000 powerpc/traps: Print unhandled signals in a separate function bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15979f5be00000 final crash: https://syzkaller.appspot.com/x/report.txt?x=17979f5be00000 console output: https://syzkaller.appspot.com/x/log.txt?x=13979f5be00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+67e4f16db666b1c8253c(a)syzkaller.appspotmail.com Fixes: 658b0f92bc70 ("powerpc/traps: Print unhandled signals in a separate function") EXT4-fs warning (device sda1): ext4_da_update_reserve_space:344: ext4_da_update_reserve_space: ino 15722, used 1 with only 0 reserved data blocks ------------[ cut here ]------------ WARNING: CPU: 1 PID: 359 at fs/ext4/inode.c:348 ext4_da_update_reserve_space+0x622/0x7d0 fs/ext4/inode.c:344 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 359 Comm: kworker/u4:5 Not tainted 5.6.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: writeback wb_workfn (flush-8:0) Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x35 kernel/panic.c:582 report_bug+0x27b/0x2f0 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x12b/0x220 arch/x86/kernel/traps.c:267 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:ext4_da_update_reserve_space+0x622/0x7d0 fs/ext4/inode.c:348 Code: 02 00 0f 85 94 01 00 00 48 8b 7d 28 49 c7 c0 20 72 3c 88 41 56 48 c7 c1 80 60 3c 88 53 ba 58 01 00 00 4c 89 c6 e8 1e 6d 0d 00 <0f> 0b 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 0f b6 04 RSP: 0018:ffffc90002197288 EFLAGS: 00010296 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff820bf066 RDI: fffff52000432e21 RBP: ffff888086b744c8 R08: 0000000000000091 R09: ffffed1015ce6659 R10: ffffed1015ce6658 R11: ffff8880ae7332c7 R12: 0000000000000001 R13: ffff888086b74990 R14: 0000000000000000 R15: ffff888086b74a40 ext4_ext_map_blocks+0x24aa/0x37d0 fs/ext4/extents.c:4500 ext4_map_blocks+0x4cb/0x1650 fs/ext4/inode.c:622 mpage_map_one_extent fs/ext4/inode.c:2365 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2418 [inline] ext4_writepages+0x19eb/0x3080 fs/ext4/inode.c:2772 do_writepages+0xfa/0x2a0 mm/page-writeback.c:2344 __writeback_single_inode+0x12a/0x1410 fs/fs-writeback.c:1452 writeback_sb_inodes+0x515/0xdd0 fs/fs-writeback.c:1716 wb_writeback+0x2a5/0xd90 fs/fs-writeback.c:1892 wb_do_writeback fs/fs-writeback.c:2037 [inline] wb_workfn+0x339/0x11c0 fs/fs-writeback.c:2078 process_one_work+0x94b/0x1690 kernel/workqueue.c:2266 worker_thread+0x96/0xe20 kernel/workqueue.c:2412 kthread+0x357/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

3 2

kernel panic: smack: Failed to initialize cipso DOI.
by syzbot 30 Mar '20

30 Mar '20

Hello, syzbot found the following crash on: HEAD commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14957099e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=4ac76c43beddbd9 dashboard link: https://syzkaller.appspot.com/bug?extid=89731ccb6fec15ce1c22 compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1202c375e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1390bb03e00000 The bug was bisected to: commit a9d2d53a788a9c5bc8a7d1b4ea7857b68e221357 Author: Ken Cox <jkc(a)redhat.com> Date: Tue Nov 15 19:00:37 2016 +0000 ixgbe: test for trust in macvlan adjustments for VF bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13cb06f3e00000 final crash: https://syzkaller.appspot.com/x/report.txt?x=102b06f3e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=17cb06f3e00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+89731ccb6fec15ce1c22(a)syzkaller.appspotmail.com Fixes: a9d2d53a788a ("ixgbe: test for trust in macvlan adjustments for VF") RSP: 002b:00007ffebd499a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007ffebd499a40 RCX: 00000000004404e9 RDX: 0000000000000014 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 0000000000000004 R08: 0000000000000001 R09: 00007ffebd490031 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401dd0 R13: 0000000000401e60 R14: 0000000000000000 R15: 0000000000000000 Kernel panic - not syncing: smack: Failed to initialize cipso DOI. CPU: 1 PID: 7197 Comm: syz-executor480 Not tainted 5.6.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1e9/0x30e lib/dump_stack.c:118 panic+0x264/0x7a0 kernel/panic.c:221 smk_cipso_doi+0x4d8/0x4e0 security/smack/smackfs.c:698 smk_write_doi+0x123/0x190 security/smack/smackfs.c:1595 __vfs_write+0xa7/0x710 fs/read_write.c:494 vfs_write+0x271/0x570 fs/read_write.c:558 ksys_write+0x115/0x220 fs/read_write.c:611 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4404e9 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffebd499a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007ffebd499a40 RCX: 00000000004404e9 RDX: 0000000000000014 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 0000000000000004 R08: 0000000000000001 R09: 00007ffebd490031 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401dd0 R13: 0000000000401e60 R14: 0000000000000000 R15: 0000000000000000 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

2 1

Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
by syzbot 27 Mar '20

27 Mar '20

syzbot has bisected this bug to: commit 768134d4f48109b90f4248feecbeeb7d684e410c Author: Jens Axboe <axboe(a)kernel.dk> Date: Mon Nov 11 03:30:53 2019 +0000 io_uring: don't do flush cancel under inflight_lock bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14233ef5e00000 start commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g.. git tree: upstream final crash: https://syzkaller.appspot.com/x/report.txt?x=16233ef5e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=12233ef5e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692 dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000 Reported-by: syzbot+313d95e8a7a49263f88d(a)syzkaller.appspotmail.com Fixes: 768134d4f481 ("io_uring: don't do flush cancel under inflight_lock") For information about bisection process see: https://goo.gl/tpsmEJ#bisection

3 2

[PATCH] batman-adv: Fix spelling error in term buffer
by Sven Eckelmann 26 Mar '20

26 Mar '20

checkpatch warns about a typo in the word bufFer which was introduced in commit 2191c1bcbc64 ("batman-adv: kernel doc for types.h"). Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index 6854cb2b..d8f754d1 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -711,7 +711,7 @@ struct batadv_priv_bla { /** * struct batadv_priv_debug_log - debug logging data - * @log_buff: buffer holding the logs (ring bufer) + * @log_buff: buffer holding the logs (ring buffer) * @log_start: index of next character to read * @log_end: index of next character to write * @lock: lock protecting log_buff, log_start & log_end -- 2.20.1

1 0

Re: KASAN: use-after-free Write in hci_sock_bind (2)
by syzbot 23 Mar '20

23 Mar '20

syzbot has bisected this bug to: commit 7d13eca09ed5e477f6ecfd97a35058762228b5e4 Author: Florian Fainelli <f.fainelli(a)gmail.com> Date: Sat Aug 27 22:34:20 2016 +0000 Documentation: networking: dsa: Remove platform device TODO bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1746f3f9e00000 start commit: 770fbb32 Add linux-next specific files for 20200228 git tree: linux-next final crash: https://syzkaller.appspot.com/x/report.txt?x=14c6f3f9e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=10c6f3f9e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=576314276bce4ad5 dashboard link: https://syzkaller.appspot.com/bug?extid=04e804c8c2224b6a9497 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11fc5e75e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10707013e00000 Reported-by: syzbot+04e804c8c2224b6a9497(a)syzkaller.appspotmail.com Fixes: 7d13eca09ed5 ("Documentation: networking: dsa: Remove platform device TODO") For information about bisection process see: https://goo.gl/tpsmEJ#bisection

1 0

Re: general protection fault in sctp_ulpevent_nofity_peer_addr_change
by syzbot 20 Mar '20

20 Mar '20

syzbot has bisected this bug to: commit da2648390ce3d409218b6bbbf2386d8ddeec2265 Author: Lubomir Rintel <lkundrak(a)v3.sk> Date: Thu Dec 20 18:13:09 2018 +0000 pxa168fb: trivial typo fix bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1361e139e00000 start commit: 5076190d mm: slub: be more careful about the double cmpxch.. git tree: upstream final crash: https://syzkaller.appspot.com/x/report.txt?x=10e1e139e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=1761e139e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=9f894bd92023de02 dashboard link: https://syzkaller.appspot.com/bug?extid=3950016bd95c2ca0377b userspace arch: i386 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1162bbe3e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13c93b45e00000 Reported-by: syzbot+3950016bd95c2ca0377b(a)syzkaller.appspotmail.com Fixes: da2648390ce3 ("pxa168fb: trivial typo fix") For information about bisection process see: https://goo.gl/tpsmEJ#bisection

2 1

[PATCH AUTOSEL 4.9 01/15] batman-adv: Don't schedule OGM for disabled interface
by Sasha Levin 18 Mar '20

18 Mar '20

From: Sven Eckelmann <sven(a)narfation.org> [ Upstream commit 8e8ce08198de193e3d21d42e96945216e3d9ac7f ] A transmission scheduling for an interface which is currently dropped by batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V is simply cancelling the workqueue item in an synchronous way but this is not possible with B.A.T.M.A.N. IV because the OGM submissions are intertwined. Instead it has to stop submitting the OGM when it detect that the buffer pointer is set to NULL. Reported-by: syzbot+a98f2016f40b9cd3818a(a)syzkaller.appspotmail.com Reported-by: syzbot+ac36b6a33c28a491e929(a)syzkaller.appspotmail.com Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Cc: Hillf Danton <hdanton(a)sina.com> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/batman-adv/bat_iv_ogm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index 780700fcbe63e..b08e3b331c503 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -934,6 +934,10 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) (hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)) return; + /* interface already disabled by batadv_iv_ogm_iface_disable */ + if (!*ogm_buff) + return; + /* the interface gets activated here to avoid race conditions between * the moment of activating the interface in * hardif_activate_interface() where the originator mac is set and -- 2.20.1

1 0

[PATCH AUTOSEL 4.14 03/28] batman-adv: Don't schedule OGM for disabled interface
by Sasha Levin 18 Mar '20

18 Mar '20

From: Sven Eckelmann <sven(a)narfation.org> [ Upstream commit 8e8ce08198de193e3d21d42e96945216e3d9ac7f ] A transmission scheduling for an interface which is currently dropped by batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V is simply cancelling the workqueue item in an synchronous way but this is not possible with B.A.T.M.A.N. IV because the OGM submissions are intertwined. Instead it has to stop submitting the OGM when it detect that the buffer pointer is set to NULL. Reported-by: syzbot+a98f2016f40b9cd3818a(a)syzkaller.appspotmail.com Reported-by: syzbot+ac36b6a33c28a491e929(a)syzkaller.appspotmail.com Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Cc: Hillf Danton <hdanton(a)sina.com> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/batman-adv/bat_iv_ogm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index 8b3f9441b3a01..5d5e5401a9ea2 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -926,6 +926,10 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) (hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)) return; + /* interface already disabled by batadv_iv_ogm_iface_disable */ + if (!*ogm_buff) + return; + /* the interface gets activated here to avoid race conditions between * the moment of activating the interface in * hardif_activate_interface() where the originator mac is set and -- 2.20.1

1 0

[PATCH AUTOSEL 4.19 03/37] batman-adv: Don't schedule OGM for disabled interface
by Sasha Levin 18 Mar '20

18 Mar '20

From: Sven Eckelmann <sven(a)narfation.org> [ Upstream commit 8e8ce08198de193e3d21d42e96945216e3d9ac7f ] A transmission scheduling for an interface which is currently dropped by batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V is simply cancelling the workqueue item in an synchronous way but this is not possible with B.A.T.M.A.N. IV because the OGM submissions are intertwined. Instead it has to stop submitting the OGM when it detect that the buffer pointer is set to NULL. Reported-by: syzbot+a98f2016f40b9cd3818a(a)syzkaller.appspotmail.com Reported-by: syzbot+ac36b6a33c28a491e929(a)syzkaller.appspotmail.com Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Cc: Hillf Danton <hdanton(a)sina.com> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/batman-adv/bat_iv_ogm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index f5941837c3ad4..0b052ff51bdeb 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -970,6 +970,10 @@ static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface) lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex); + /* interface already disabled by batadv_iv_ogm_iface_disable */ + if (!*ogm_buff) + return; + /* the interface gets activated here to avoid race conditions between * the moment of activating the interface in * hardif_activate_interface() where the originator mac is set and -- 2.20.1

1 0

[PATCH AUTOSEL 5.4 04/73] batman-adv: Don't schedule OGM for disabled interface
by Sasha Levin 18 Mar '20

18 Mar '20

From: Sven Eckelmann <sven(a)narfation.org> [ Upstream commit 8e8ce08198de193e3d21d42e96945216e3d9ac7f ] A transmission scheduling for an interface which is currently dropped by batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V is simply cancelling the workqueue item in an synchronous way but this is not possible with B.A.T.M.A.N. IV because the OGM submissions are intertwined. Instead it has to stop submitting the OGM when it detect that the buffer pointer is set to NULL. Reported-by: syzbot+a98f2016f40b9cd3818a(a)syzkaller.appspotmail.com Reported-by: syzbot+ac36b6a33c28a491e929(a)syzkaller.appspotmail.com Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Cc: Hillf Danton <hdanton(a)sina.com> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/batman-adv/bat_iv_ogm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index 5b0b20e6da956..d88a4de022372 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -789,6 +789,10 @@ static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface) lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex); + /* interface already disabled by batadv_iv_ogm_iface_disable */ + if (!*ogm_buff) + return; + /* the interface gets activated here to avoid race conditions between * the moment of activating the interface in * hardif_activate_interface() where the originator mac is set and -- 2.20.1

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N