KASAN: use-after-free Read in tcp_init_tso_segs
14 views
Skip to first unread message
syzbot
Apr 14, 2019, 5:28:30 AM4/14/19
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 62872f95 Merge 4.4.174 into android-4.4
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=16a77213200000
kernel config: https://syzkaller.appspot.com/x/.config?x=47bc4dd423780c4a
dashboard link: https://syzkaller.appspot.com/bug?extid=0ec3ec50aa4472409bb8
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0ec3ec...@syzkaller.appspotmail.com
binder: 14890:14895 transaction failed 29201/-28, size 24-8 line 3137
binder: 14909:14913 unknown command 536871488
binder: 14909:14913 ioctl c0306201 200001c0 returned -22
binder: undelivered TRANSACTION_ERROR: 29201
==================================================================
BUG: KASAN: use-after-free in tcp_skb_pcount include/net/tcp.h:798 [inline]
BUG: KASAN: use-after-free in tcp_init_tso_segs+0x1b9/0x200
net/ipv4/tcp_output.c:1631
Read of size 2 at addr ffff88009a0882b0 by task syz-executor.0/14924
CPU: 1 PID: 14924 Comm: syz-executor.0 Not tainted 4.4.174+ #4
0000000000000000 14e825704970b683 ffff8800a5317678 ffffffff81aad1a1
0000000000000000 ffffea0002682200 ffff88009a0882b0 0000000000000002
ffff88009a088280 ffff8800a53176b0 ffffffff81490120 0000000000000000
Call Trace:
[<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<ffffffff81490120>] print_address_description+0x6f/0x21b
mm/kasan/report.c:252
[<ffffffff81490358>] kasan_report_error mm/kasan/report.c:351 [inline]
[<ffffffff81490358>] kasan_report mm/kasan/report.c:408 [inline]
[<ffffffff81490358>] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393
[<ffffffff81484e94>] __asan_report_load2_noabort+0x14/0x20
mm/kasan/report.c:427
[<ffffffff82429649>] tcp_skb_pcount include/net/tcp.h:798 [inline]
[<ffffffff82429649>] tcp_init_tso_segs+0x1b9/0x200
net/ipv4/tcp_output.c:1631
[<ffffffff8243336e>] tcp_write_xmit+0x1ae/0x4570 net/ipv4/tcp_output.c:2068
[<ffffffff82437fcb>] __tcp_push_pending_frames+0xab/0x2b0
net/ipv4/tcp_output.c:2323
[<ffffffff8243eeab>] tcp_send_fin+0x15b/0xa90 net/ipv4/tcp_output.c:2899
[<ffffffff823fe9a8>] tcp_close+0xcc8/0xfa0 net/ipv4/tcp.c:2112
[<ffffffff824a6a3f>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435
[<ffffffff821d36a5>] __sock_release+0xd5/0x260 net/socket.c:592
[<ffffffff821d384b>] sock_close+0x1b/0x30 net/socket.c:1050
[<ffffffff8149c8c6>] __fput+0x246/0x710 fs/file_table.c:208
[<ffffffff8149ce16>] ____fput+0x16/0x20 fs/file_table.c:244
[<ffffffff8112f352>] task_work_run+0x202/0x2b0 kernel/task_work.c:115
[<ffffffff810d8b2a>] exit_task_work include/linux/task_work.h:21 [inline]
[<ffffffff810d8b2a>] do_exit+0x8ea/0x2c60 kernel/exit.c:763
[<ffffffff810df091>] do_group_exit+0x111/0x300 kernel/exit.c:893
[<ffffffff81100a97>] get_signal+0x517/0x1570 kernel/signal.c:2321
[<ffffffff8100bd4c>] do_signal+0x9c/0x1840 arch/x86/kernel/signal.c:712
[<ffffffff81003da7>] exit_to_usermode_loop+0x127/0x170
arch/x86/entry/common.c:184
[<ffffffff8100569b>] prepare_exit_to_usermode arch/x86/entry/common.c:221
[inline]
[<ffffffff8100569b>] syscall_return_slowpath+0x25b/0x2e0
arch/x86/entry/common.c:286
[<ffffffff82718ce1>] int_ret_from_sys_call+0x25/0xa3
Allocated by task 14922:
[<ffffffff8102e3c6>] save_stack_trace+0x26/0x50
arch/x86/kernel/stacktrace.c:63
[<ffffffff81483f22>] save_stack mm/kasan/kasan.c:512 [inline]
[<ffffffff81483f22>] set_track mm/kasan/kasan.c:524 [inline]
[<ffffffff81483f22>] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
[<ffffffff81484197>] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
[<ffffffff8148475f>] kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:554
[<ffffffff8147fe9c>] slab_post_alloc_hook mm/slub.c:1349 [inline]
[<ffffffff8147fe9c>] slab_alloc_node mm/slub.c:2615 [inline]
[<ffffffff8147fe9c>] slab_alloc mm/slub.c:2623 [inline]
[<ffffffff8147fe9c>] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628
[<ffffffff821f7b1c>] kmem_cache_alloc_node include/linux/slab.h:350
[inline]
[<ffffffff821f7b1c>] __alloc_skb+0xec/0x5d0 net/core/skbuff.c:218
[<ffffffff823f9043>] alloc_skb_fclone include/linux/skbuff.h:861 [inline]
[<ffffffff823f9043>] sk_stream_alloc_skb+0xa3/0x5d0 net/ipv4/tcp.c:833
[<ffffffff823fbcba>] tcp_sendmsg+0xf8a/0x2ab0 net/ipv4/tcp.c:1178
[<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
[<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
[<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
[<ffffffff821dc4f1>] SYSC_sendto net/socket.c:1678 [inline]
[<ffffffff821dc4f1>] SyS_sendto+0x201/0x340 net/socket.c:1646
[<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Freed by task 14923:
[<ffffffff8102e3c6>] save_stack_trace+0x26/0x50
arch/x86/kernel/stacktrace.c:63
[<ffffffff81484820>] save_stack mm/kasan/kasan.c:512 [inline]
[<ffffffff81484820>] set_track mm/kasan/kasan.c:524 [inline]
[<ffffffff81484820>] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
[<ffffffff8148157e>] slab_free_hook mm/slub.c:1383 [inline]
[<ffffffff8148157e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
[<ffffffff8148157e>] slab_free mm/slub.c:2859 [inline]
[<ffffffff8148157e>] kmem_cache_free+0xbe/0x350 mm/slub.c:2881
[<ffffffff821ef749>] kfree_skbmem+0xd9/0x110 net/core/skbuff.c:635
[<ffffffff821fd14e>] __kfree_skb+0x1e/0x30 net/core/skbuff.c:676
[<ffffffff82438daa>] sk_wmem_free_skb include/net/sock.h:1451 [inline]
[<ffffffff82438daa>] tcp_write_queue_purge include/net/tcp.h:1460 [inline]
[<ffffffff82438daa>] tcp_connect_init net/ipv4/tcp_output.c:3138 [inline]
[<ffffffff82438daa>] tcp_connect+0xafa/0x31b0 net/ipv4/tcp_output.c:3277
[<ffffffff82446ec0>] tcp_v4_connect+0x1060/0x1930 net/ipv4/tcp_ipv4.c:246
[<ffffffff824a7a2f>] __inet_stream_connect+0x2cf/0xc70
net/ipv4/af_inet.c:615
[<ffffffff824a8425>] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:676
[<ffffffff821dbd05>] SYSC_connect net/socket.c:1570 [inline]
[<ffffffff821dbd05>] SyS_connect+0x1a5/0x2e0 net/socket.c:1551
[<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
The buggy address belongs to the object at ffff88009a088280
which belongs to the cache skbuff_fclone_cache of size 456
The buggy address is located 48 bytes inside of
456-byte region [ffff88009a088280, ffff88009a088448)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.174+ #4
task: ffffffff82e151c0 task.stack: ffffffff82e00000
RIP: 0010:[<ffffffff81b0c66f>] [<ffffffff81b0c66f>] lookup_object
lib/debugobjects.c:120 [inline]
RIP: 0010:[<ffffffff81b0c66f>] [<ffffffff81b0c66f>]
debug_object_deactivate+0x16f/0x360 lib/debugobjects.c:468
RSP: 0018:ffff8801db607ce0 EFLAGS: 00010006
RAX: 1ffffffff0817848 RBX: 0000000000000003 RCX: 0000000000006c6a
RDX: 05ccd86baba82b8b RSI: ffffffff82eafea0 RDI: 2e66c35d5d415c59
RBP: ffff8801db607dd0 R08: 0000000000000001 R09: ffffffff840bc248
R10: 0000000000000096 R11: 0000000000000000 R12: 2e66c35d5d415c41
R13: dffffc0000000000 R14: 1ffff1003b6c0fa0 R15: ffff8801d6a97df8
FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002001f13f CR3: 00000001c1c6f000 CR4: 00000000001606b0
Stack:
ffff880100000002 ffffffff83a80a10 ffffffff840bc248 ffffffff82eafea0
0000000041b58ab3 ffffffff82c76921 ffffffff81b0c500 ffffffff82c4d560
ffffffff811ff5b0 ffffffff00000001 ffffffff00000000 ffffffff83a821b0
Call Trace:
<IRQ>
[<ffffffff8125f8cd>] debug_hrtimer_deactivate kernel/time/hrtimer.c:415
[inline]
[<ffffffff8125f8cd>] debug_deactivate kernel/time/hrtimer.c:462 [inline]
[<ffffffff8125f8cd>] __run_hrtimer kernel/time/hrtimer.c:1230 [inline]
[<ffffffff8125f8cd>] __hrtimer_run_queues+0x1bd/0xfc0
kernel/time/hrtimer.c:1325
[<ffffffff81262756>] hrtimer_interrupt+0x1b6/0x450
kernel/time/hrtimer.c:1359
[<ffffffff8108a9d6>] local_apic_timer_interrupt+0x76/0xa0
arch/x86/kernel/apic/apic.c:901
[<ffffffff8271b249>] smp_apic_timer_interrupt+0x79/0xb0
arch/x86/kernel/apic/apic.c:925
[<ffffffff8271a59d>] apic_timer_interrupt+0x9d/0xb0
arch/x86/entry/entry_64.S:768
<EOI>
[<ffffffff81022d50>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:423
[<ffffffff811eb4c8>] default_idle_call+0x48/0x70 kernel/sched/idle.c:93
[<ffffffff811ebca1>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
[<ffffffff811ebca1>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
[<ffffffff811ebca1>] cpu_startup_entry+0x6d1/0x810 kernel/sched/idle.c:301
[<ffffffff827055f9>] rest_init+0x190/0x199 init/main.c:410
[<ffffffff831d58a0>] start_kernel+0x64a/0x67e init/main.c:682
[<ffffffff831d430a>] x86_64_start_reservations+0x29/0x2b
arch/x86/kernel/head64.c:196
[<ffffffff831d4443>] x86_64_start_kernel+0x137/0x15a
arch/x86/kernel/head64.c:185
Code: 48 c1 ea 03 42 80 3c 2a 00 0f 85 8e 01 00 00 4d 8b 24 24 4d 85 e4 0f
84 e9 00 00 00 49 8d 7c 24 18 83 c3 01 48 89 fa 48 c1 ea 03 <42> 80 3c 2a
00 0f 85 3f 01 00 00 4d 3b 7c 24 18 75 c0 49 8d 7c
RIP [<ffffffff81b0c66f>] lookup_object lib/debugobjects.c:120 [inline]
RIP [<ffffffff81b0c66f>] debug_object_deactivate+0x16f/0x360
lib/debugobjects.c:468
RSP <ffff8801db607ce0>
---[ end trace d508202cda250343 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 62872f95 Merge 4.4.174 into android-4.4
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=16a77213200000
kernel config: https://syzkaller.appspot.com/x/.config?x=47bc4dd423780c4a
dashboard link: https://syzkaller.appspot.com/bug?extid=0ec3ec50aa4472409bb8
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0ec3ec...@syzkaller.appspotmail.com
binder: 14890:14895 transaction failed 29201/-28, size 24-8 line 3137
binder: 14909:14913 unknown command 536871488
binder: 14909:14913 ioctl c0306201 200001c0 returned -22
binder: undelivered TRANSACTION_ERROR: 29201
==================================================================
BUG: KASAN: use-after-free in tcp_skb_pcount include/net/tcp.h:798 [inline]
BUG: KASAN: use-after-free in tcp_init_tso_segs+0x1b9/0x200
net/ipv4/tcp_output.c:1631
Read of size 2 at addr ffff88009a0882b0 by task syz-executor.0/14924
CPU: 1 PID: 14924 Comm: syz-executor.0 Not tainted 4.4.174+ #4
0000000000000000 14e825704970b683 ffff8800a5317678 ffffffff81aad1a1
0000000000000000 ffffea0002682200 ffff88009a0882b0 0000000000000002
ffff88009a088280 ffff8800a53176b0 ffffffff81490120 0000000000000000
Call Trace:
[<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<ffffffff81490120>] print_address_description+0x6f/0x21b
mm/kasan/report.c:252
[<ffffffff81490358>] kasan_report_error mm/kasan/report.c:351 [inline]
[<ffffffff81490358>] kasan_report mm/kasan/report.c:408 [inline]
[<ffffffff81490358>] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393
[<ffffffff81484e94>] __asan_report_load2_noabort+0x14/0x20
mm/kasan/report.c:427
[<ffffffff82429649>] tcp_skb_pcount include/net/tcp.h:798 [inline]
[<ffffffff82429649>] tcp_init_tso_segs+0x1b9/0x200
net/ipv4/tcp_output.c:1631
[<ffffffff8243336e>] tcp_write_xmit+0x1ae/0x4570 net/ipv4/tcp_output.c:2068
[<ffffffff82437fcb>] __tcp_push_pending_frames+0xab/0x2b0
net/ipv4/tcp_output.c:2323
[<ffffffff8243eeab>] tcp_send_fin+0x15b/0xa90 net/ipv4/tcp_output.c:2899
[<ffffffff823fe9a8>] tcp_close+0xcc8/0xfa0 net/ipv4/tcp.c:2112
[<ffffffff824a6a3f>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435
[<ffffffff821d36a5>] __sock_release+0xd5/0x260 net/socket.c:592
[<ffffffff821d384b>] sock_close+0x1b/0x30 net/socket.c:1050
[<ffffffff8149c8c6>] __fput+0x246/0x710 fs/file_table.c:208
[<ffffffff8149ce16>] ____fput+0x16/0x20 fs/file_table.c:244
[<ffffffff8112f352>] task_work_run+0x202/0x2b0 kernel/task_work.c:115
[<ffffffff810d8b2a>] exit_task_work include/linux/task_work.h:21 [inline]
[<ffffffff810d8b2a>] do_exit+0x8ea/0x2c60 kernel/exit.c:763
[<ffffffff810df091>] do_group_exit+0x111/0x300 kernel/exit.c:893
[<ffffffff81100a97>] get_signal+0x517/0x1570 kernel/signal.c:2321
[<ffffffff8100bd4c>] do_signal+0x9c/0x1840 arch/x86/kernel/signal.c:712
[<ffffffff81003da7>] exit_to_usermode_loop+0x127/0x170
arch/x86/entry/common.c:184
[<ffffffff8100569b>] prepare_exit_to_usermode arch/x86/entry/common.c:221
[inline]
[<ffffffff8100569b>] syscall_return_slowpath+0x25b/0x2e0
arch/x86/entry/common.c:286
[<ffffffff82718ce1>] int_ret_from_sys_call+0x25/0xa3
Allocated by task 14922:
[<ffffffff8102e3c6>] save_stack_trace+0x26/0x50
arch/x86/kernel/stacktrace.c:63
[<ffffffff81483f22>] save_stack mm/kasan/kasan.c:512 [inline]
[<ffffffff81483f22>] set_track mm/kasan/kasan.c:524 [inline]
[<ffffffff81483f22>] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
[<ffffffff81484197>] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
[<ffffffff8148475f>] kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:554
[<ffffffff8147fe9c>] slab_post_alloc_hook mm/slub.c:1349 [inline]
[<ffffffff8147fe9c>] slab_alloc_node mm/slub.c:2615 [inline]
[<ffffffff8147fe9c>] slab_alloc mm/slub.c:2623 [inline]
[<ffffffff8147fe9c>] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628
[<ffffffff821f7b1c>] kmem_cache_alloc_node include/linux/slab.h:350
[inline]
[<ffffffff821f7b1c>] __alloc_skb+0xec/0x5d0 net/core/skbuff.c:218
[<ffffffff823f9043>] alloc_skb_fclone include/linux/skbuff.h:861 [inline]
[<ffffffff823f9043>] sk_stream_alloc_skb+0xa3/0x5d0 net/ipv4/tcp.c:833
[<ffffffff823fbcba>] tcp_sendmsg+0xf8a/0x2ab0 net/ipv4/tcp.c:1178
[<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
[<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
[<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
[<ffffffff821dc4f1>] SYSC_sendto net/socket.c:1678 [inline]
[<ffffffff821dc4f1>] SyS_sendto+0x201/0x340 net/socket.c:1646
[<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Freed by task 14923:
[<ffffffff8102e3c6>] save_stack_trace+0x26/0x50
arch/x86/kernel/stacktrace.c:63
[<ffffffff81484820>] save_stack mm/kasan/kasan.c:512 [inline]
[<ffffffff81484820>] set_track mm/kasan/kasan.c:524 [inline]
[<ffffffff81484820>] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
[<ffffffff8148157e>] slab_free_hook mm/slub.c:1383 [inline]
[<ffffffff8148157e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
[<ffffffff8148157e>] slab_free mm/slub.c:2859 [inline]
[<ffffffff8148157e>] kmem_cache_free+0xbe/0x350 mm/slub.c:2881
[<ffffffff821ef749>] kfree_skbmem+0xd9/0x110 net/core/skbuff.c:635
[<ffffffff821fd14e>] __kfree_skb+0x1e/0x30 net/core/skbuff.c:676
[<ffffffff82438daa>] sk_wmem_free_skb include/net/sock.h:1451 [inline]
[<ffffffff82438daa>] tcp_write_queue_purge include/net/tcp.h:1460 [inline]
[<ffffffff82438daa>] tcp_connect_init net/ipv4/tcp_output.c:3138 [inline]
[<ffffffff82438daa>] tcp_connect+0xafa/0x31b0 net/ipv4/tcp_output.c:3277
[<ffffffff82446ec0>] tcp_v4_connect+0x1060/0x1930 net/ipv4/tcp_ipv4.c:246
[<ffffffff824a7a2f>] __inet_stream_connect+0x2cf/0xc70
net/ipv4/af_inet.c:615
[<ffffffff824a8425>] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:676
[<ffffffff821dbd05>] SYSC_connect net/socket.c:1570 [inline]
[<ffffffff821dbd05>] SyS_connect+0x1a5/0x2e0 net/socket.c:1551
[<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
The buggy address belongs to the object at ffff88009a088280
which belongs to the cache skbuff_fclone_cache of size 456
The buggy address is located 48 bytes inside of
456-byte region [ffff88009a088280, ffff88009a088448)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.174+ #4
task: ffffffff82e151c0 task.stack: ffffffff82e00000
RIP: 0010:[<ffffffff81b0c66f>] [<ffffffff81b0c66f>] lookup_object
lib/debugobjects.c:120 [inline]
RIP: 0010:[<ffffffff81b0c66f>] [<ffffffff81b0c66f>]
debug_object_deactivate+0x16f/0x360 lib/debugobjects.c:468
RSP: 0018:ffff8801db607ce0 EFLAGS: 00010006
RAX: 1ffffffff0817848 RBX: 0000000000000003 RCX: 0000000000006c6a
RDX: 05ccd86baba82b8b RSI: ffffffff82eafea0 RDI: 2e66c35d5d415c59
RBP: ffff8801db607dd0 R08: 0000000000000001 R09: ffffffff840bc248
R10: 0000000000000096 R11: 0000000000000000 R12: 2e66c35d5d415c41
R13: dffffc0000000000 R14: 1ffff1003b6c0fa0 R15: ffff8801d6a97df8
FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002001f13f CR3: 00000001c1c6f000 CR4: 00000000001606b0
Stack:
ffff880100000002 ffffffff83a80a10 ffffffff840bc248 ffffffff82eafea0
0000000041b58ab3 ffffffff82c76921 ffffffff81b0c500 ffffffff82c4d560
ffffffff811ff5b0 ffffffff00000001 ffffffff00000000 ffffffff83a821b0
Call Trace:
<IRQ>
[<ffffffff8125f8cd>] debug_hrtimer_deactivate kernel/time/hrtimer.c:415
[inline]
[<ffffffff8125f8cd>] debug_deactivate kernel/time/hrtimer.c:462 [inline]
[<ffffffff8125f8cd>] __run_hrtimer kernel/time/hrtimer.c:1230 [inline]
[<ffffffff8125f8cd>] __hrtimer_run_queues+0x1bd/0xfc0
kernel/time/hrtimer.c:1325
[<ffffffff81262756>] hrtimer_interrupt+0x1b6/0x450
kernel/time/hrtimer.c:1359
[<ffffffff8108a9d6>] local_apic_timer_interrupt+0x76/0xa0
arch/x86/kernel/apic/apic.c:901
[<ffffffff8271b249>] smp_apic_timer_interrupt+0x79/0xb0
arch/x86/kernel/apic/apic.c:925
[<ffffffff8271a59d>] apic_timer_interrupt+0x9d/0xb0
arch/x86/entry/entry_64.S:768
<EOI>
[<ffffffff81022d50>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:423
[<ffffffff811eb4c8>] default_idle_call+0x48/0x70 kernel/sched/idle.c:93
[<ffffffff811ebca1>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
[<ffffffff811ebca1>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
[<ffffffff811ebca1>] cpu_startup_entry+0x6d1/0x810 kernel/sched/idle.c:301
[<ffffffff827055f9>] rest_init+0x190/0x199 init/main.c:410
[<ffffffff831d58a0>] start_kernel+0x64a/0x67e init/main.c:682
[<ffffffff831d430a>] x86_64_start_reservations+0x29/0x2b
arch/x86/kernel/head64.c:196
[<ffffffff831d4443>] x86_64_start_kernel+0x137/0x15a
arch/x86/kernel/head64.c:185
Code: 48 c1 ea 03 42 80 3c 2a 00 0f 85 8e 01 00 00 4d 8b 24 24 4d 85 e4 0f
84 e9 00 00 00 49 8d 7c 24 18 83 c3 01 48 89 fa 48 c1 ea 03 <42> 80 3c 2a
00 0f 85 3f 01 00 00 4d 3b 7c 24 18 75 c0 49 8d 7c
RIP [<ffffffff81b0c66f>] lookup_object lib/debugobjects.c:120 [inline]
RIP [<ffffffff81b0c66f>] debug_object_deactivate+0x16f/0x360
lib/debugobjects.c:468
RSP <ffff8801db607ce0>
---[ end trace d508202cda250343 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Aug 29, 2019, 4:15:04 AM8/29/19
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages