BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy

Status: upstream: reported C repro on 2020/10/22 08:03
Reported-by: syzbot+1d2f03fe5a7eb2aa966c@syzkaller.appspotmail.com
First crash: 2101d, last: 1252d
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in rhashtable_free_and_destroy 10 C error 31 1514d 2103d 0/1 upstream: reported C repro on 2020/10/21 05:32
▶ ▼ Fix bisection attempts (25)
Created Duration User Patch Repo Result
2023/02/19 04:16 33m bisect fix linux-4.14.y OK (0) job log log
2023/01/19 22:02 24m bisect fix linux-4.14.y OK (0) job log log
2022/10/26 19:16 31m bisect fix linux-4.14.y OK (0) job log log
2022/09/17 07:59 22m bisect fix linux-4.14.y OK (0) job log log
2022/08/18 06:36 26m bisect fix linux-4.14.y OK (0) job log log
2022/07/19 06:02 24m bisect fix linux-4.14.y OK (0) job log log
2022/06/19 05:25 21m bisect fix linux-4.14.y OK (0) job log log
2022/05/20 04:52 21m bisect fix linux-4.14.y OK (0) job log log
2022/04/20 04:25 21m bisect fix linux-4.14.y OK (0) job log log
2022/03/20 20:31 24m bisect fix linux-4.14.y OK (0) job log log
2022/02/18 17:39 24m bisect fix linux-4.14.y OK (0) job log log
2022/01/19 17:14 25m bisect fix linux-4.14.y OK (0) job log log
2021/12/20 16:48 24m bisect fix linux-4.14.y OK (0) job log log
2021/11/20 16:22 26m bisect fix linux-4.14.y OK (0) job log log
2021/10/21 15:53 22m bisect fix linux-4.14.y OK (0) job log log
2021/09/21 15:26 26m bisect fix linux-4.14.y OK (0) job log log
2021/08/22 07:47 27m bisect fix linux-4.14.y OK (0) job log log
2021/07/23 06:23 26m bisect fix linux-4.14.y OK (0) job log log
2021/06/23 05:52 20m bisect fix linux-4.14.y OK (0) job log log
2021/05/24 05:26 25m bisect fix linux-4.14.y OK (0) job log log
2021/04/23 19:37 22m bisect fix linux-4.14.y OK (0) job log log
2021/03/24 19:16 21m bisect fix linux-4.14.y OK (0) job log log
2021/02/22 18:53 21m bisect fix linux-4.14.y OK (0) job log log
2021/02/18 23:30 18m bisect fix linux-4.14.y error job log
2021/02/15 16:18 0m bisect fix linux-4.14.y error job log

Sample crash report:
RBP: 00007ffd3f94cdf0 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
BUG: unable to handle kernel NULL pointer dereference at 0000000000000088
IP: test_and_set_bit arch/x86/include/asm/bitops.h:220 [inline]
IP: try_to_grab_pending+0xc3/0x610 kernel/workqueue.c:1230
PGD 0 P4D 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 23 Comm: kworker/1:1 Not tainted 4.14.202-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events cfg80211_destroy_iface_wk
task: ffff8880b55fa600 task.stack: ffff8880b5608000
RIP: 0010:test_and_set_bit arch/x86/include/asm/bitops.h:220 [inline]
RIP: 0010:try_to_grab_pending+0xc3/0x610 kernel/workqueue.c:1230
RSP: 0018:ffff8880b560f960 EFLAGS: 00010097
RAX: ffff8880b55fa600 RBX: 0000000000000088 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880b55fae4c
RBP: ffff8880b560f9d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000297 R14: dffffc0000000011 R15: ffff8880b55fa600
FS:  0000000000000000(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000088 CR3: 0000000008e6a000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __cancel_work_timer+0x90/0x460 kernel/workqueue.c:2923
 rhashtable_free_and_destroy+0x26/0x710 lib/rhashtable.c:1073
 mesh_table_free net/mac80211/mesh_pathtbl.c:70 [inline]
 mesh_pathtbl_unregister+0x42/0xa0 net/mac80211/mesh_pathtbl.c:906
 ieee80211_teardown_sdata+0x1e2/0x290 net/mac80211/iface.c:1142
 rollback_registered_many+0x83f/0xba0 net/core/dev.c:7217
 rollback_registered+0xca/0x170 net/core/dev.c:7245
 unregister_netdevice_queue+0x1b4/0x360 net/core/dev.c:8266
 unregister_netdevice include/linux/netdevice.h:2442 [inline]
 ieee80211_if_remove+0x1fc/0x2b0 net/mac80211/iface.c:1933
 ieee80211_del_iface+0x12/0x20 net/mac80211/cfg.c:143
 rdev_del_virtual_intf net/wireless/rdev-ops.h:57 [inline]
 cfg80211_destroy_ifaces+0xee/0x690 net/wireless/core.c:317
 cfg80211_destroy_iface_wk+0x1a/0x20 net/wireless/core.c:329
 process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
 process_scheduled_works kernel/workqueue.c:2176 [inline]
 worker_thread+0x7d3/0xff0 kernel/workqueue.c:2252
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: fc ff df 48 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 4b 04 00 00 4c 89 6d 00 e8 db 1b 0b 00 45 84 e4 0f 85 71 01 00 00 e8 dd 3e 20 00 <f0> 48 0f ba 2b 00 72 1a 45 31 e4 e8 cd 3e 20 00 44 89 e0 48 83 
RIP: test_and_set_bit arch/x86/include/asm/bitops.h:220 [inline] RSP: ffff8880b560f960
RIP: try_to_grab_pending+0xc3/0x610 kernel/workqueue.c:1230 RSP: ffff8880b560f960
CR2: 0000000000000088
---[ end trace 860b29d85a4047e3 ]---

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/10/22 08:17 linux-4.14.y 5b7a52cd2eef be6b1582 .config console log report syz C ci2-linux-4-14
2020/11/17 15:15 linux-4.14.y 27ce4f2a6817 bd2a760b .config console log report info ci2-linux-4-14
2020/10/30 01:32 linux-4.14.y 2b7915014161 a0c7169a .config console log report info ci2-linux-4-14
2020/10/22 08:03 linux-4.14.y 5b7a52cd2eef be6b1582 .config console log report info ci2-linux-4-14
* Struck through repros no longer work on HEAD.