[lkml]   [2017]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: lost connection to test machine (3)
On Wed, Dec 27, 2017 at 7:18 PM, syzbot
<> wrote:
> Hello,
> syzkaller hit the following crash on
> beacbc68ac3e23821a681adb30b45dc55b17488d
> git://
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> C reproducer is attached
> syzkaller reproducer is attached. See
> for information about syzkaller reproducers
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: <>
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.

+netfilter maintainers

Here is cleaned reproducer:

// autogenerated by syzkaller (
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <linux/if.h>
#include <linux/netfilter_ipv4/ip_tables.h>

int main()
int fd;

struct ipt_replace opt = {};
opt.num_counters = 1;
opt.size = -1;
setsockopt(fd, SOL_IP, 0x40, &opt, 0x4);
return 0;

What happens there is that here:

struct xt_table_info *xt_alloc_table_info(unsigned int size)
if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
return NULL;

size = -1 and SMP_ALIGN(size) = 0, so this still tries to allocate
4GB+delta bytes.

I don't understand why this uses SMP_ALIGN since we add 2 pages on
top, it seems that we could just drop SMP_ALIGN and local SMP_ALIGN
definition altogether.

> ---
> This bug is generated by a dumb bot. It may contain errors.
> See for details.
> Direct all questions to
> syzbot will keep track of this bug report.
> If you forgot to add the Reported-by tag, once the fix for this bug is
> merged
> into any tree, please reply to this email with:
> #syz fix: exact-commit-title
> If you want to test a patch for this bug, please reply with:
> #syz test: git://repo/address.git branch
> and provide the patch inline or as an attachment.
> To mark this as a duplicate of another syzbot report, please reply with:
> #syz dup: exact-subject-of-another-report
> If it's a one-off invalid bug report, please reply with:
> #syz invalid
> Note: if the crash happens again, it will cause creation of a new bug
> report.
> Note: all commands must start from beginning of the line in the email body.
> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to
> To view this discussion on the web visit
> For more options, visit

 \ /
  Last update: 2017-12-27 19:23    [W:0.046 / U:11.180 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site