BUG: unable to handle kernel NULL pointer dereference in do_syscall_64 (2)
16 views
Skip to first unread message
syzbot
Mar 6, 2020, 12:27:16 AM3/6/20
to b...@alien8.de, h...@zytor.com, linux-...@vger.kernel.org, lu...@kernel.org, mi...@redhat.com, syzkall...@googlegroups.com, tg...@linutronix.de, x...@kernel.org
Hello,
syzbot found the following crash on:
HEAD commit: 63623fd4 Merge tag 'for-linus' of git://git.kernel.org/pub..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11813529e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=9833e26bab355358
dashboard link: https://syzkaller.appspot.com/bug?extid=d6d57d324860c94d5836
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d6d57d...@syzkaller.appspotmail.com
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 464fa067 P4D 464fa067 PUD 94e6f067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 410 Comm: syz-executor.3 Not tainted 5.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:189 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_64+0x2c9/0x790 arch/x86/entry/common.c:304
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900073cff20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888054c1e200 RCX: ffffffff8100a857
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc900073cff48 R08: ffff888054c1e200 R09: ffffed100a983c41
R10: ffffed100a983c40 R11: ffff888054c1e207 R12: ffffc900073cff58
R13: 0000000000000000 R14: 0000000000004000 R15: 0000000000000000
FS: 000000000285a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000047f4e000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
entry_SYSCALL_64_after_hwframe+0x49/0xbe
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
CPU: 0 PID: 410 Comm: syz-executor.3 Not tainted 5.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc900073cf398 EFLAGS: 00010046
RAX: ffff888054c1e200 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a941
RBP: ffffc900073cf3d8 R08: ffff888054c1e200 R09: fffffbfff1708c62
R10: fffffbfff1708c61 R11: ffffffff8b846309 R12: 000000000045a941
R13: ffffc900073cf458 R14: ffffc900073cf538 R15: ffffc900073cf438
FS: 000000000285a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000047f4e000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
vprintk_store+0x44/0x4a0 kernel/printk/printk.c:1917
vprintk_emit+0x135/0x700 kernel/printk/printk.c:1978
vprintk_default+0x28/0x30 kernel/printk/printk.c:2023
vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_regs arch/x86/kernel/dumpstack.c:447 [inline]
show_regs.cold+0x1a/0x1f arch/x86/kernel/dumpstack.c:437
__die_body+0x1b/0x60 arch/x86/kernel/dumpstack.c:392
__die+0x26/0x37 arch/x86/kernel/dumpstack.c:406
no_context+0x596/0xa30 arch/x86/mm/fault.c:821
__bad_area_nosemaphore+0xae/0x420 arch/x86/mm/fault.c:913
__bad_area arch/x86/mm/fault.c:934 [inline]
bad_area+0x69/0x80 arch/x86/mm/fault.c:940
do_user_addr_fault arch/x86/mm/fault.c:1405 [inline]
do_page_fault+0xc17/0x12e1 arch/x86/mm/fault.c:1517
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:189 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_64+0x2c9/0x790 arch/x86/entry/common.c:304
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900073cff20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888054c1e200 RCX: ffffffff8100a857
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc900073cff48 R08: ffff888054c1e200 R09: ffffed100a983c41
R10: ffffed100a983c40 R11: ffff888054c1e207 R12: ffffc900073cff58
R13: 0000000000000000 R14: 0000000000004000 R15: 0000000000000000
entry_SYSCALL_64_after_hwframe+0x49/0xbe
invalid opcode: 0000 [#3] PREEMPT SMP KASAN
CPU: 0 PID: 410 Comm: syz-executor.3 Not tainted 5.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc900073ce920 EFLAGS: 00010046
RAX: ffff888054c1e200 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a941
RBP: ffffc900073ce960 R08: ffff888054c1e200 R09: ffffed1015d04b78
R10: ffffed1015d04b77 R11: ffff8880ae825bb9 R12: 000000000045a941
R13: ffffc900073ce9e0 R14: ffffc900073ceac0 R15: ffffc900073ce9c0
FS: 000000000285a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000047f4e000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
printk_safe_log_store+0x106/0x270 kernel/printk/printk_safe.c:93
vprintk_safe kernel/printk/printk_safe.c:346 [inline]
vprintk_func+0x131/0x189 kernel/printk/printk_safe.c:383
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_regs arch/x86/kernel/dumpstack.c:447 [inline]
show_regs.cold+0x1a/0x1f arch/x86/kernel/dumpstack.c:437
__die_body+0x1b/0x60 arch/x86/kernel/dumpstack.c:392
__die+0x26/0x37 arch/x86/kernel/dumpstack.c:406
die+0x2b/0x50 arch/x86/kernel/dumpstack.c:419
do_trap_no_signal arch/x86/kernel/traps.c:207 [inline]
do_trap+0x101/0x230 arch/x86/kernel/traps.c:246
do_error_trap+0xd6/0x200 arch/x86/kernel/traps.c:273
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc900073cf398 EFLAGS: 00010046
RAX: ffff888054c1e200 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a941
RBP: ffffc900073cf3d8 R08: ffff888054c1e200 R09: fffffbfff1708c62
R10: fffffbfff1708c61 R11: ffffffff8b846309 R12: 000000000045a941
R13: ffffc900073cf458 R14: ffffc900073cf538 R15: ffffc900073cf438
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
vprintk_store+0x44/0x4a0 kernel/printk/printk.c:1917
vprintk_emit+0x135/0x700 kernel/printk/printk.c:1978
vprintk_default+0x28/0x30 kernel/printk/printk.c:2023
vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_regs arch/x86/kernel/dumpstack.c:447 [inline]
show_regs.cold+0x1a/0x1f arch/x86/kernel/dumpstack.c:437
__die_body+0x1b/0x60 arch/x86/kernel/dumpstack.c:392
__die+0x26/0x37 arch/x86/kernel/dumpstack.c:406
no_context+0x596/0xa30 arch/x86/mm/fault.c:821
__bad_area_nosemaphore+0xae/0x420 arch/x86/mm/fault.c:913
bad_a
Lost 42 message(s)!
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 63623fd4 Merge tag 'for-linus' of git://git.kernel.org/pub..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11813529e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=9833e26bab355358
dashboard link: https://syzkaller.appspot.com/bug?extid=d6d57d324860c94d5836
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d6d57d...@syzkaller.appspotmail.com
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 464fa067 P4D 464fa067 PUD 94e6f067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 410 Comm: syz-executor.3 Not tainted 5.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:189 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_64+0x2c9/0x790 arch/x86/entry/common.c:304
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900073cff20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888054c1e200 RCX: ffffffff8100a857
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc900073cff48 R08: ffff888054c1e200 R09: ffffed100a983c41
R10: ffffed100a983c40 R11: ffff888054c1e207 R12: ffffc900073cff58
R13: 0000000000000000 R14: 0000000000004000 R15: 0000000000000000
FS: 000000000285a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000047f4e000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
entry_SYSCALL_64_after_hwframe+0x49/0xbe
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
CPU: 0 PID: 410 Comm: syz-executor.3 Not tainted 5.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc900073cf398 EFLAGS: 00010046
RAX: ffff888054c1e200 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a941
RBP: ffffc900073cf3d8 R08: ffff888054c1e200 R09: fffffbfff1708c62
R10: fffffbfff1708c61 R11: ffffffff8b846309 R12: 000000000045a941
R13: ffffc900073cf458 R14: ffffc900073cf538 R15: ffffc900073cf438
FS: 000000000285a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000047f4e000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
vprintk_store+0x44/0x4a0 kernel/printk/printk.c:1917
vprintk_emit+0x135/0x700 kernel/printk/printk.c:1978
vprintk_default+0x28/0x30 kernel/printk/printk.c:2023
vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_regs arch/x86/kernel/dumpstack.c:447 [inline]
show_regs.cold+0x1a/0x1f arch/x86/kernel/dumpstack.c:437
__die_body+0x1b/0x60 arch/x86/kernel/dumpstack.c:392
__die+0x26/0x37 arch/x86/kernel/dumpstack.c:406
no_context+0x596/0xa30 arch/x86/mm/fault.c:821
__bad_area_nosemaphore+0xae/0x420 arch/x86/mm/fault.c:913
__bad_area arch/x86/mm/fault.c:934 [inline]
bad_area+0x69/0x80 arch/x86/mm/fault.c:940
do_user_addr_fault arch/x86/mm/fault.c:1405 [inline]
do_page_fault+0xc17/0x12e1 arch/x86/mm/fault.c:1517
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:189 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_64+0x2c9/0x790 arch/x86/entry/common.c:304
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900073cff20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888054c1e200 RCX: ffffffff8100a857
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc900073cff48 R08: ffff888054c1e200 R09: ffffed100a983c41
R10: ffffed100a983c40 R11: ffff888054c1e207 R12: ffffc900073cff58
R13: 0000000000000000 R14: 0000000000004000 R15: 0000000000000000
entry_SYSCALL_64_after_hwframe+0x49/0xbe
invalid opcode: 0000 [#3] PREEMPT SMP KASAN
CPU: 0 PID: 410 Comm: syz-executor.3 Not tainted 5.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc900073ce920 EFLAGS: 00010046
RAX: ffff888054c1e200 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a941
RBP: ffffc900073ce960 R08: ffff888054c1e200 R09: ffffed1015d04b78
R10: ffffed1015d04b77 R11: ffff8880ae825bb9 R12: 000000000045a941
R13: ffffc900073ce9e0 R14: ffffc900073ceac0 R15: ffffc900073ce9c0
FS: 000000000285a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000047f4e000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
printk_safe_log_store+0x106/0x270 kernel/printk/printk_safe.c:93
vprintk_safe kernel/printk/printk_safe.c:346 [inline]
vprintk_func+0x131/0x189 kernel/printk/printk_safe.c:383
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_regs arch/x86/kernel/dumpstack.c:447 [inline]
show_regs.cold+0x1a/0x1f arch/x86/kernel/dumpstack.c:437
__die_body+0x1b/0x60 arch/x86/kernel/dumpstack.c:392
__die+0x26/0x37 arch/x86/kernel/dumpstack.c:406
die+0x2b/0x50 arch/x86/kernel/dumpstack.c:419
do_trap_no_signal arch/x86/kernel/traps.c:207 [inline]
do_trap+0x101/0x230 arch/x86/kernel/traps.c:246
do_error_trap+0xd6/0x200 arch/x86/kernel/traps.c:273
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc900073cf398 EFLAGS: 00010046
RAX: ffff888054c1e200 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a941
RBP: ffffc900073cf3d8 R08: ffff888054c1e200 R09: fffffbfff1708c62
R10: fffffbfff1708c61 R11: ffffffff8b846309 R12: 000000000045a941
R13: ffffc900073cf458 R14: ffffc900073cf538 R15: ffffc900073cf438
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
vprintk_store+0x44/0x4a0 kernel/printk/printk.c:1917
vprintk_emit+0x135/0x700 kernel/printk/printk.c:1978
vprintk_default+0x28/0x30 kernel/printk/printk.c:2023
vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_regs arch/x86/kernel/dumpstack.c:447 [inline]
show_regs.cold+0x1a/0x1f arch/x86/kernel/dumpstack.c:437
__die_body+0x1b/0x60 arch/x86/kernel/dumpstack.c:392
__die+0x26/0x37 arch/x86/kernel/dumpstack.c:406
no_context+0x596/0xa30 arch/x86/mm/fault.c:821
__bad_area_nosemaphore+0xae/0x420 arch/x86/mm/fault.c:913
bad_a
Lost 42 message(s)!
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Apr 6, 2020, 8:25:14 PM4/6/20
to b...@alien8.de, h...@zytor.com, linux-...@vger.kernel.org, lu...@kernel.org, mi...@redhat.com, syzkall...@googlegroups.com, tg...@linutronix.de, x...@kernel.org
syzbot has found a reproducer for the following crash on:
HEAD commit: b2e2a818 Add linux-next specific files for 20200406
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14022a57e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=595413e7170f444b
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13ea05cde00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d6d57d...@syzkaller.appspotmail.com
IPVS: ftp: loaded support on port[0] = 21
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 7d 50 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80
RSP: 0018:ffffc90001657f28 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000023 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8163ea3d RDI: 0000000000000282
RBP: ffffc90001657f58 R08: ffff8880a9156440 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff89949570 R14: 0000000000000000 R15: 0000000000000000
FS: 00000000015f5940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
RIP: 0033:0x4464b0
Code: c0 5b 5d c3 66 0f 1f 44 00 00 8b 04 24 48 83 c4 18 5b 5d c3 66 0f 1f 44 00 00 83 3d 61 cb 29 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 84 20 fc ff c3 48 83 ec 08 e8 5a 43 00 00
RSP: 002b:00007fffeb3290d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: ffffffffffffffda RBX: 00007fffeb329140 RCX: 00000000004464b0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fffeb3290e0
RBP: 0000000000000002 R08: 0000000000000001 R09: 00000000015f5940
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000fb38
R13: 0000000000408a50 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000000
---[ end trace 07b78701f72ec477 ]---
RIP: 0010:do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 7d 50 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80
RSP: 0018:ffffc90001657f28 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000023 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8163ea3d RDI: 0000000000000282
RBP: ffffc90001657f58 R08: ffff8880a9156440 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff89949570 R14: 0000000000000000 R15: 0000000000000000
FS: 00000000015f5940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
HEAD commit: b2e2a818 Add linux-next specific files for 20200406
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14022a57e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=595413e7170f444b
dashboard link: https://syzkaller.appspot.com/bug?extid=d6d57d324860c94d5836
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14873543e00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13ea05cde00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d6d57d...@syzkaller.appspotmail.com
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 962b6067 P4D 962b6067 PUD 9441e067 PMD 0
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7058 Comm: syz-executor367 Not tainted 5.6.0-next-20200406-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 7d 50 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80
RSP: 0018:ffffc90001657f28 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000023 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8163ea3d RDI: 0000000000000282
RBP: ffffc90001657f58 R08: ffff8880a9156440 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff89949570 R14: 0000000000000000 R15: 0000000000000000
FS: 00000000015f5940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000962b7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
entry_SYSCALL_64_after_hwframe+0x49/0xb3
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
RIP: 0033:0x4464b0
Code: c0 5b 5d c3 66 0f 1f 44 00 00 8b 04 24 48 83 c4 18 5b 5d c3 66 0f 1f 44 00 00 83 3d 61 cb 29 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 84 20 fc ff c3 48 83 ec 08 e8 5a 43 00 00
RSP: 002b:00007fffeb3290d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: ffffffffffffffda RBX: 00007fffeb329140 RCX: 00000000004464b0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fffeb3290e0
RBP: 0000000000000002 R08: 0000000000000001 R09: 00000000015f5940
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000fb38
R13: 0000000000408a50 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000000
---[ end trace 07b78701f72ec477 ]---
RIP: 0010:do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 7d 50 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80
RSP: 0018:ffffc90001657f28 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000023 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8163ea3d RDI: 0000000000000282
RBP: ffffc90001657f58 R08: ffff8880a9156440 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff89949570 R14: 0000000000000000 R15: 0000000000000000
FS: 00000000015f5940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000962b7000 CR4: 00000000001406f0
Reply all
Reply to author
Forward
0 new messages