general protection fault in pending_reads_dispatch_ioctl
5 views
Skip to first unread message
syzbot
Feb 11, 2021, 10:08:20 PM2/11/21
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 489e9c22 FROMGIT: kfence: show access type in report
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=10ad1098d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=5b365ba984b508e1
dashboard link: https://syzkaller.appspot.com/bug?extid=eb653645362b461ad3ab
compiler: Debian clang version 11.0.1-2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eb6536...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6847 Comm: syz-executor.1 Not tainted 5.4.97-syzkaller-00243-g489e9c226bb5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ioctl_permit_fill fs/incfs/pseudo_files.c:152 [inline]
RIP: 0010:pending_reads_dispatch_ioctl+0x5ec/0x2a60 fs/incfs/pseudo_files.c:906
Code: 45 89 ef 45 31 ed e9 ad 04 00 00 e8 1e 73 80 ff e9 0f 01 00 00 49 8d 5e 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 56 28 af ff 48 c7 c0 40 d9 fc 84 48
RSP: 0018:ffff8881dfb37940 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffff8881e9c03f00 RDI: ffff8881e9c042f4
RBP: ffff8881dfb37cb0 R08: ffffffff819eec57 R09: 0000000000000003
R10: ffffed103bf66f59 R11: 0000000000000004 R12: 1ffff1103bf66f58
R13: 1ffff1103c7ffe04 R14: 0000000000000000 R15: ffff8881e3fff020
FS: 00007fed56520700(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe33183cb8 CR3: 00000001ebc2d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x465b09
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fed56520188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
RDX: 0000000000400000 RSI: 0000000040046721 RDI: 0000000000000004
RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007fffc0d5302f R14: 00007fed56520300 R15: 0000000000022000
Modules linked in:
---[ end trace 759f57312370dc56 ]---
RIP: 0010:ioctl_permit_fill fs/incfs/pseudo_files.c:152 [inline]
RIP: 0010:pending_reads_dispatch_ioctl+0x5ec/0x2a60 fs/incfs/pseudo_files.c:906
Code: 45 89 ef 45 31 ed e9 ad 04 00 00 e8 1e 73 80 ff e9 0f 01 00 00 49 8d 5e 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 56 28 af ff 48 c7 c0 40 d9 fc 84 48
RSP: 0018:ffff8881dfb37940 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffff8881e9c03f00 RDI: ffff8881e9c042f4
RBP: ffff8881dfb37cb0 R08: ffffffff819eec57 R09: 0000000000000003
R10: ffffed103bf66f59 R11: 0000000000000004 R12: 1ffff1103bf66f58
R13: 1ffff1103c7ffe04 R14: 0000000000000000 R15: ffff8881e3fff020
FS: 00007fed56520700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1ab6418000 CR3: 00000001ebc2d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 489e9c22 FROMGIT: kfence: show access type in report
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=10ad1098d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=5b365ba984b508e1
dashboard link: https://syzkaller.appspot.com/bug?extid=eb653645362b461ad3ab
compiler: Debian clang version 11.0.1-2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eb6536...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6847 Comm: syz-executor.1 Not tainted 5.4.97-syzkaller-00243-g489e9c226bb5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ioctl_permit_fill fs/incfs/pseudo_files.c:152 [inline]
RIP: 0010:pending_reads_dispatch_ioctl+0x5ec/0x2a60 fs/incfs/pseudo_files.c:906
Code: 45 89 ef 45 31 ed e9 ad 04 00 00 e8 1e 73 80 ff e9 0f 01 00 00 49 8d 5e 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 56 28 af ff 48 c7 c0 40 d9 fc 84 48
RSP: 0018:ffff8881dfb37940 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffff8881e9c03f00 RDI: ffff8881e9c042f4
RBP: ffff8881dfb37cb0 R08: ffffffff819eec57 R09: 0000000000000003
R10: ffffed103bf66f59 R11: 0000000000000004 R12: 1ffff1103bf66f58
R13: 1ffff1103c7ffe04 R14: 0000000000000000 R15: ffff8881e3fff020
FS: 00007fed56520700(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe33183cb8 CR3: 00000001ebc2d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x465b09
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fed56520188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
RDX: 0000000000400000 RSI: 0000000040046721 RDI: 0000000000000004
RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007fffc0d5302f R14: 00007fed56520300 R15: 0000000000022000
Modules linked in:
---[ end trace 759f57312370dc56 ]---
RIP: 0010:ioctl_permit_fill fs/incfs/pseudo_files.c:152 [inline]
RIP: 0010:pending_reads_dispatch_ioctl+0x5ec/0x2a60 fs/incfs/pseudo_files.c:906
Code: 45 89 ef 45 31 ed e9 ad 04 00 00 e8 1e 73 80 ff e9 0f 01 00 00 49 8d 5e 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 56 28 af ff 48 c7 c0 40 d9 fc 84 48
RSP: 0018:ffff8881dfb37940 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffff8881e9c03f00 RDI: ffff8881e9c042f4
RBP: ffff8881dfb37cb0 R08: ffffffff819eec57 R09: 0000000000000003
R10: ffffed103bf66f59 R11: 0000000000000004 R12: 1ffff1103bf66f58
R13: 1ffff1103c7ffe04 R14: 0000000000000000 R15: ffff8881e3fff020
FS: 00007fed56520700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1ab6418000 CR3: 00000001ebc2d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Feb 11, 2021, 10:21:17 PM2/11/21
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 489e9c22 FROMGIT: kfence: show access type in report
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=109c3804d00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17e42124d00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eb6536...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 348 Comm: syz-executor848 Not tainted 5.4.97-syzkaller-00243-g489e9c226bb5 #0
RBP: ffff8881dfd37cb0 R08: ffffffff819eec57 R09: 0000000000000003
R10: ffffed103bfa6f59 R11: 0000000000000004 R12: 1ffff1103bfa6f58
R13: 1ffff1103d323744 R14: 0000000000000000 R15: ffff8881e991ba20
FS: 00000000013c03c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c4 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe16e9e218 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffe16e9e228 RCX: 0000000000443aa9
R10: 0000000000402010 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000004b1018 R15: 00000000004004a0
Modules linked in:
---[ end trace f0b20371ad7406e7 ]---
RBP: ffff8881dfd37cb0 R08: ffffffff819eec57 R09: 0000000000000003
R10: ffffed103bfa6f59 R11: 0000000000000004 R12: 1ffff1103bfa6f58
R13: 1ffff1103d323744 R14: 0000000000000000 R15: ffff8881e991ba20
FS: 00000000013c03c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
HEAD commit: 489e9c22 FROMGIT: kfence: show access type in report
git tree: android12-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=5b365ba984b508e1
dashboard link: https://syzkaller.appspot.com/bug?extid=eb653645362b461ad3ab
compiler: Debian clang version 11.0.1-2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a4d93cd00000
dashboard link: https://syzkaller.appspot.com/bug?extid=eb653645362b461ad3ab
compiler: Debian clang version 11.0.1-2
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17e42124d00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eb6536...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ioctl_permit_fill fs/incfs/pseudo_files.c:152 [inline]
RIP: 0010:pending_reads_dispatch_ioctl+0x5ec/0x2a60 fs/incfs/pseudo_files.c:906
Code: 45 89 ef 45 31 ed e9 ad 04 00 00 e8 1e 73 80 ff e9 0f 01 00 00 49 8d 5e 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 56 28 af ff 48 c7 c0 40 d9 fc 84 48
RSP: 0018:ffff8881dfd37940 EFLAGS: 00010206
RIP: 0010:ioctl_permit_fill fs/incfs/pseudo_files.c:152 [inline]
RIP: 0010:pending_reads_dispatch_ioctl+0x5ec/0x2a60 fs/incfs/pseudo_files.c:906
Code: 45 89 ef 45 31 ed e9 ad 04 00 00 e8 1e 73 80 ff e9 0f 01 00 00 49 8d 5e 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 56 28 af ff 48 c7 c0 40 d9 fc 84 48
RAX: 0000000000000005 RBX: 0000000000000028 RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffff8881ec8f0fc0 RDI: ffff8881ec8f13b4
RBP: ffff8881dfd37cb0 R08: ffffffff819eec57 R09: 0000000000000003
R10: ffffed103bfa6f59 R11: 0000000000000004 R12: 1ffff1103bfa6f58
R13: 1ffff1103d323744 R14: 0000000000000000 R15: ffff8881e991ba20
FS: 00000000013c03c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020004280 CR3: 00000001e9e47000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x443aa9
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_vfs_ioctl+0x76a/0x1720 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c4 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe16e9e218 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffe16e9e228 RCX: 0000000000443aa9
RDX: 0000000000400000 RSI: 0000000040046721 RDI: 0000000000000004
RBP: 00007ffe16e9e220 R08: 0000000000402010 R09: 0000000000402010
R10: 0000000000402010 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000004b1018 R15: 00000000004004a0
Modules linked in:
---[ end trace f0b20371ad7406e7 ]---
RIP: 0010:ioctl_permit_fill fs/incfs/pseudo_files.c:152 [inline]
RIP: 0010:pending_reads_dispatch_ioctl+0x5ec/0x2a60 fs/incfs/pseudo_files.c:906
Code: 45 89 ef 45 31 ed e9 ad 04 00 00 e8 1e 73 80 ff e9 0f 01 00 00 49 8d 5e 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 56 28 af ff 48 c7 c0 40 d9 fc 84 48
RSP: 0018:ffff8881dfd37940 EFLAGS: 00010206
RIP: 0010:pending_reads_dispatch_ioctl+0x5ec/0x2a60 fs/incfs/pseudo_files.c:906
Code: 45 89 ef 45 31 ed e9 ad 04 00 00 e8 1e 73 80 ff e9 0f 01 00 00 49 8d 5e 28 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 56 28 af ff 48 c7 c0 40 d9 fc 84 48
RAX: 0000000000000005 RBX: 0000000000000028 RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffff8881ec8f0fc0 RDI: ffff8881ec8f13b4
RBP: ffff8881dfd37cb0 R08: ffffffff819eec57 R09: 0000000000000003
R10: ffffed103bfa6f59 R11: 0000000000000004 R12: 1ffff1103bfa6f58
R13: 1ffff1103d323744 R14: 0000000000000000 R15: ffff8881e991ba20
FS: 00000000013c03c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020004280 CR3: 00000001e9e47000 CR4: 00000000001406f0
syzbot
Apr 21, 2023, 9:38:31 PM4/21/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages