dvyukov
commented
5 years ago Is it a true bug in the driver? Is so, somebody needs to fix the bug.
Closed butterflyhack closed 5 years ago
dvyukov
commented
5 years ago Is it a true bug in the driver? Is so, somebody needs to fix the bug.
butterflyhack
commented
5 years ago the function eth_type_trans code is as below:
__be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
{
unsigned short _service_access_point;
const unsigned short *sap;
const struct ethhdr *eth;
skb->dev = dev;
skb_reset_mac_header(skb);
eth = (struct ethhdr *)skb->data; -----> the data is uninit?
skb_pull_inline(skb, ETH_HLEN);
ramosian-glider
commented
5 years ago May I ask you to symbolize this report? The easiest way to do so is to run it through scripts/decode_stacktrace.sh, just make sure CONFIG_DEBUG_INFO is on.
ramosian-glider
commented
5 years ago By the way, do you have panic_on_warn=1 in the boot parameters?
If so, the kernel won't proceed after the first warning.
butterflyhack
commented
5 years ago the cmd is right?
./scripts/decode_stacktrace.sh ./vmlinux net/ethernet/ ./drivers/net/ethernet/intel/e1000/I believe
$ ./scripts/decode_stacktrace.sh ./vmlinuxshould be enough.
butterflyhack
commented
5 years ago the cmd is that:
./scripts/decode_stacktrace.sh ./vmlinux net/ethernet/ ./drivers/net/ethernet/intel/e1000input:
eth_type_trans+0x356/0xa90output:
eth_type_trans (/home/adlab/Desktop/kernel-fuzz/kmsan/./include/linux/etherdevice.h:353 /home/adlab/Desktop/kernel-fuzz/kmsan/net/ethernet/eth.c:167) etherdevice.h:353:
static inline bool ether_addr_equal_64bits(const u8 addr1[6+2],
const u8 addr2[6+2])
{
#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
u64 fold = (*(const u64 *)addr1) ^ (*(const u64 *)addr2);
#ifdef __BIG_ENDIAN
return (fold >> 16) == 0;
#else
return (fold << 16) == 0; ------> line 353
#endif
#else
return ether_addr_equal(addr1, addr2);
#endif
}eth.c:167
__be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
{
unsigned short _service_access_point;
const unsigned short *sap;
const struct ethhdr *eth;
skb->dev = dev;
skb_reset_mac_header(skb);
eth = (struct ethhdr *)skb->data;
skb_pull_inline(skb, ETH_HLEN);
if (unlikely(!ether_addr_equal_64bits(eth->h_dest, ------> line 167
dev->dev_addr))) {
if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
skb->pkt_type = PACKET_BROADCAST;
else
skb->pkt_type = PACKET_MULTICAST;
} else {
skb->pkt_type = PACKET_OTHERHOST;
}
}ether_addr_equal_64bits have some problem. Maybe is a ture bug?
ramosian-glider
commented
5 years ago Sorry, I didn't have time to look into this issue. Is it still reproducible? Also, may I take a look at the whole symbolized report, not just a single line?
ramosian-glider
commented
5 years ago Closing for now, feel free to reopen if the bug is still reproducible.
I use cp .config.example instead of .config. and compile sucessfuly, but use syz-manager run the bzImage, the kernel also 0ops, and log is as below,
clang version:clang-10, kernel: 5.3.6-rc7, the error is caused by CONFIG_KMASN?