BUG: unable to handle kernel paging request in slhc_free
13 views
Skip to first unread message
syzbot
Apr 16, 2019, 4:00:05 AM4/16/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16a3a267200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=12410819830704e2d4a1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+124108...@syzkaller.appspotmail.com
RAX: ffffffffffffffda RBX: 00007f514eda9c90 RCX: 0000000000458c29
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f514edaa6d4
R13: 00000000004c3082 R14: 00000000004d6428 R15: 0000000000000004
BUG: unable to handle kernel paging request at fffffffffffffff4
IP: slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
PGD 766d067 P4D 766d067 PUD 766f067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 25577 Comm: syz-executor.3 Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff888061e3c0c0 task.stack: ffff888062060000
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
RSP: 0018:ffff888062067ae8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90006e35000
RDX: 1ffffffffffffffe RSI: ffffffff83d4a0ea RDI: fffffffffffffff4
RBP: ffff888062067af8 R08: ffff888061e3c0c0 R09: ffff888061e3c9b0
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
R13: ffff8880a8e8d788 R14: ffff888094488340 R15: ffff8880a8e8ccc0
FS: 00007f514edaa700(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 00000000a0097000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
sl_alloc_bufs drivers/net/slip/slip.c:197 [inline]
slip_open+0xc96/0xfb5 drivers/net/slip/slip.c:826
tty_ldisc_open.isra.0+0x75/0xc0 drivers/tty/tty_ldisc.c:465
tty_set_ldisc+0x29a/0x610 drivers/tty/tty_ldisc.c:590
tiocsetd drivers/tty/tty_io.c:2349 [inline]
tty_ioctl+0x976/0x1340 drivers/tty/tty_io.c:2593
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7b9/0x1070 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x458c29
RSP: 002b:00007f514eda9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f514eda9c90 RCX: 0000000000458c29
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f514edaa6d4
R13: 00000000004c3082 R14: 00000000004d6428 R15: 0000000000000004
Code: 41 54 49 89 fc e8 70 36 88 fd 4d 85 e4 74 77 e8 66 36 88 fd 4c 89 e2
48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24
4d 85 ed 74 0d e8 41 36 88 fd 4c 89 ef e8 e9 73 b1
RIP: slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159 RSP: ffff888062067ae8
CR2: fffffffffffffff4
---[ end trace bbe3489d8ea48518 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 1ec8f1f0 Linux 4.14.111
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16a3a267200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fdadf290ea9fc6f9
dashboard link: https://syzkaller.appspot.com/bug?extid=12410819830704e2d4a1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+124108...@syzkaller.appspotmail.com
RAX: ffffffffffffffda RBX: 00007f514eda9c90 RCX: 0000000000458c29
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f514edaa6d4
R13: 00000000004c3082 R14: 00000000004d6428 R15: 0000000000000004
BUG: unable to handle kernel paging request at fffffffffffffff4
IP: slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
PGD 766d067 P4D 766d067 PUD 766f067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 25577 Comm: syz-executor.3 Not tainted 4.14.111 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff888061e3c0c0 task.stack: ffff888062060000
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
RSP: 0018:ffff888062067ae8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90006e35000
RDX: 1ffffffffffffffe RSI: ffffffff83d4a0ea RDI: fffffffffffffff4
RBP: ffff888062067af8 R08: ffff888061e3c0c0 R09: ffff888061e3c9b0
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
R13: ffff8880a8e8d788 R14: ffff888094488340 R15: ffff8880a8e8ccc0
FS: 00007f514edaa700(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 00000000a0097000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
sl_alloc_bufs drivers/net/slip/slip.c:197 [inline]
slip_open+0xc96/0xfb5 drivers/net/slip/slip.c:826
tty_ldisc_open.isra.0+0x75/0xc0 drivers/tty/tty_ldisc.c:465
tty_set_ldisc+0x29a/0x610 drivers/tty/tty_ldisc.c:590
tiocsetd drivers/tty/tty_io.c:2349 [inline]
tty_ioctl+0x976/0x1340 drivers/tty/tty_io.c:2593
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7b9/0x1070 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x458c29
RSP: 002b:00007f514eda9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f514eda9c90 RCX: 0000000000458c29
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f514edaa6d4
R13: 00000000004c3082 R14: 00000000004d6428 R15: 0000000000000004
Code: 41 54 49 89 fc e8 70 36 88 fd 4d 85 e4 74 77 e8 66 36 88 fd 4c 89 e2
48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24
4d 85 ed 74 0d e8 41 36 88 fd 4c 89 ef e8 e9 73 b1
RIP: slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159 RSP: ffff888062067ae8
CR2: fffffffffffffff4
---[ end trace bbe3489d8ea48518 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Apr 20, 2019, 4:07:05 PM4/20/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 68d7a45e Linux 4.14.113
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12fe1c57200000
kernel config: https://syzkaller.appspot.com/x/.config?x=dbf1fde4d7489e1c
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1764aea0a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+124108...@syzkaller.appspotmail.com
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441129
RDX: 0000000020000100 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007ffe83f5f590 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 1ffff11012d2517e
RDX: 1ffffffffffffffe RSI: ffff888096928bd0 RDI: fffffffffffffff4
RBP: ffff888083527af8 R08: ffff888096928300 R09: ffff888096928bf0
FS: 0000000001f5d880(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
tty_set_ldisc+0x29a/0x610 drivers/tty/tty_ldisc.c:599
tiocsetd drivers/tty/tty_io.c:2351 [inline]
tty_ioctl+0x976/0x1340 drivers/tty/tty_io.c:2595
RSP: 002b:00007ffe83f5f578 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441129
RDX: 0000000020000100 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007ffe83f5f590 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
Code: 41 54 49 89 fc e8 30 ee 87 fd 4d 85 e4 74 77 e8 26 ee 87 fd 4c 89 e2
RIP: slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159 RSP: ffff888083527ae8
CR2: fffffffffffffff4
---[ end trace 7795915591f4987e ]---
HEAD commit: 68d7a45e Linux 4.14.113
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12fe1c57200000
kernel config: https://syzkaller.appspot.com/x/.config?x=dbf1fde4d7489e1c
dashboard link: https://syzkaller.appspot.com/bug?extid=12410819830704e2d4a1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13158647200000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1764aea0a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+124108...@syzkaller.appspotmail.com
RDX: 0000000020000100 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007ffe83f5f590 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
BUG: unable to handle kernel paging request at fffffffffffffff4
IP: slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
PGD 766d067 P4D 766d067 PUD 766f067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 7230 Comm: syz-executor671 Not tainted 4.14.113 #3
IP: slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
PGD 766d067 P4D 766d067 PUD 766f067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff888096928300 task.stack: ffff888083520000
Google 01/01/2011
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
RSP: 0018:ffff888083527ae8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 1ffff11012d2517e
RDX: 1ffffffffffffffe RSI: ffff888096928bd0 RDI: fffffffffffffff4
RBP: ffff888083527af8 R08: ffff888096928300 R09: ffff888096928bf0
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
R13: ffff888096f29408 R14: ffff88809b977740 R15: ffff888096f28940
FS: 0000000001f5d880(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 00000000a5e44000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
sl_alloc_bufs drivers/net/slip/slip.c:197 [inline]
slip_open+0xc96/0xfb5 drivers/net/slip/slip.c:826
tty_ldisc_open.isra.0+0x75/0xc0 drivers/tty/tty_ldisc.c:474
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
sl_alloc_bufs drivers/net/slip/slip.c:197 [inline]
slip_open+0xc96/0xfb5 drivers/net/slip/slip.c:826
tty_set_ldisc+0x29a/0x610 drivers/tty/tty_ldisc.c:599
tiocsetd drivers/tty/tty_io.c:2351 [inline]
tty_ioctl+0x976/0x1340 drivers/tty/tty_io.c:2595
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7b9/0x1070 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441129
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7b9/0x1070 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RSP: 002b:00007ffe83f5f578 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441129
RDX: 0000000020000100 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007ffe83f5f590 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
Code: 41 54 49 89 fc e8 30 ee 87 fd 4d 85 e4 74 77 e8 26 ee 87 fd 4c 89 e2
48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24
4d 85 ed 74 0d e8 01 ee 87 fd 4c 89 ef e8 69 69 b1
RIP: slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159 RSP: ffff888083527ae8
CR2: fffffffffffffff4
---[ end trace 7795915591f4987e ]---
syzbot
Apr 30, 2019, 2:48:08 PM4/30/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 19bb613a Linux 4.19.37
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=144bd048a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2f4f1677ff80cdff
dashboard link: https://syzkaller.appspot.com/bug?extid=80cc81f7f0f76803aae7
RAX: ffffffffffffffda RBX: 00007f8560711c90 RCX: 0000000000458da9
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f85607126d4
R13: 00000000004c3215 R14: 00000000004d65a8 R15: 0000000000000004
PGD 8670067 P4D 8670067 PUD 8672067 PMD 0
RSP: 0018:ffff8880887d7a48 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90008098000
RDX: 1ffffffffffffffe RSI: ffffffff844361ea RDI: fffffffffffffff4
RBP: ffff8880887d7a58 R08: ffff888051084440 R09: ffff888051084d30
R13: ffff8880521cb340 R14: 00000000ffffff97 R15: ffff8880820b4600
FS: 00007f8560712700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
Call Trace:
kobject: 'loop2' (000000002162cd81): fill_kobj_path: path
= '/devices/virtual/block/loop2'
sl_alloc_bufs drivers/net/slip/slip.c:197 [inline]
slip_open+0xe16/0x1138 drivers/net/slip/slip.c:822
tty_ldisc_open.isra.0+0x8b/0xe0 drivers/tty/tty_ldisc.c:462
tty_set_ldisc+0x2e3/0x6a0 drivers/tty/tty_ldisc.c:587
tiocsetd drivers/tty/tty_io.c:2359 [inline]
tty_ioctl+0x66a/0x1530 drivers/tty/tty_io.c:2603
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458da9
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8560711c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f8560711c90 RCX: 0000000000458da9
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f85607126d4
R13: 00000000004c3215 R14: 00000000004d65a8 R15: 0000000000000004
Modules linked in:
CR2: fffffffffffffff4
---[ end trace 164e269433f26a58 ]---
RSP: 0018:ffff8880887d7a48 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90008098000
RDX: 1ffffffffffffffe RSI: ffffffff844361ea RDI: fffffffffffffff4
RBP: ffff8880887d7a58 R08: ffff888051084440 R09: ffff888051084d30
FS: 00007f8560712700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
syzbot found the following crash on:
HEAD commit: 19bb613a Linux 4.19.37
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=144bd048a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2f4f1677ff80cdff
dashboard link: https://syzkaller.appspot.com/bug?extid=80cc81f7f0f76803aae7
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+80cc81...@syzkaller.appspotmail.com
RAX: ffffffffffffffda RBX: 00007f8560711c90 RCX: 0000000000458da9
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f85607126d4
R13: 00000000004c3215 R14: 00000000004d65a8 R15: 0000000000000004
BUG: unable to handle kernel paging request at fffffffffffffff4
kobject: 'loop2' (000000002162cd81): kobject_uevent_env
PGD 8670067 P4D 8670067 PUD 8672067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 2528 Comm: syz-executor.1 Not tainted 4.19.37 #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Google 01/01/2011
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
Code: 54 49 89 fc e8 a0 e5 27 fd 4d 85 e4 74 77 e8 96 e5 27 fd 4c 89 e2 48
b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24 4d
85 ed 74 0d e8 71 e5 27 fd 4c 89 ef e8 c9 1a 5e fd
RSP: 0018:ffff8880887d7a48 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90008098000
RDX: 1ffffffffffffffe RSI: ffffffff844361ea RDI: fffffffffffffff4
RBP: ffff8880887d7a58 R08: ffff888051084440 R09: ffff888051084d30
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
overlayfs: failed to resolve '0G�f': -2
R13: ffff8880521cb340 R14: 00000000ffffff97 R15: ffff8880820b4600
FS: 00007f8560712700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 00000000a83e8000 CR4: 00000000001406e0
Call Trace:
kobject: 'loop2' (000000002162cd81): fill_kobj_path: path
= '/devices/virtual/block/loop2'
sl_alloc_bufs drivers/net/slip/slip.c:197 [inline]
slip_open+0xe16/0x1138 drivers/net/slip/slip.c:822
tty_ldisc_open.isra.0+0x8b/0xe0 drivers/tty/tty_ldisc.c:462
tty_set_ldisc+0x2e3/0x6a0 drivers/tty/tty_ldisc.c:587
tiocsetd drivers/tty/tty_io.c:2359 [inline]
tty_ioctl+0x66a/0x1530 drivers/tty/tty_io.c:2603
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458da9
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8560711c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f8560711c90 RCX: 0000000000458da9
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f85607126d4
R13: 00000000004c3215 R14: 00000000004d65a8 R15: 0000000000000004
Modules linked in:
CR2: fffffffffffffff4
---[ end trace 164e269433f26a58 ]---
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
Code: 54 49 89 fc e8 a0 e5 27 fd 4d 85 e4 74 77 e8 96 e5 27 fd 4c 89 e2 48
b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24 4d
85 ed 74 0d e8 71 e5 27 fd 4c 89 ef e8 c9 1a 5e fd
RSP: 0018:ffff8880887d7a48 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90008098000
RDX: 1ffffffffffffffe RSI: ffffffff844361ea RDI: fffffffffffffff4
RBP: ffff8880887d7a58 R08: ffff888051084440 R09: ffff888051084d30
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
R13: ffff8880521cb340 R14: 00000000ffffff97 R15: ffff8880820b4600
FS: 00007f8560712700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 00000000a83e8000 CR4: 00000000001406e0
syzbot
Oct 25, 2019, 4:43:07 AM10/25/19
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
syzbot
Dec 29, 2019, 4:55:03 AM12/29/19
to syzkaller...@googlegroups.com
syzbot suspects this bug was fixed by commit:
commit da0bbf51bdcb043fad034b6ccabc0775bd5397bc
Author: Linus Torvalds <torv...@linux-foundation.org>
Date: Thu Apr 25 23:13:58 2019 +0000
slip: make slhc_free() silently accept an error pointer
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1134ce15e00000
start commit: 68d7a45e Linux 4.14.113
git tree: linux-4.14.y
#syz fix: slip: make slhc_free() silently accept an error pointer
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit da0bbf51bdcb043fad034b6ccabc0775bd5397bc
Author: Linus Torvalds <torv...@linux-foundation.org>
Date: Thu Apr 25 23:13:58 2019 +0000
slip: make slhc_free() silently accept an error pointer
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1134ce15e00000
start commit: 68d7a45e Linux 4.14.113
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=dbf1fde4d7489e1c
dashboard link: https://syzkaller.appspot.com/bug?extid=12410819830704e2d4a1
dashboard link: https://syzkaller.appspot.com/bug?extid=12410819830704e2d4a1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13158647200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1764aea0a00000
If the result looks correct, please mark the bug fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1764aea0a00000
#syz fix: slip: make slhc_free() silently accept an error pointer
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages