general protection fault in try_to_wake_up
15 views
Skip to first unread message
syzbot
Mar 17, 2021, 4:10:18 PM3/17/21
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16975a4ed00000
kernel config: https://syzkaller.appspot.com/x/.config?x=124f4e6b89b71fac
dashboard link: https://syzkaller.appspot.com/bug?extid=a34f9da6d80289f86f4f
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a34f9d...@syzkaller.appspotmail.com
vhci_hcd: stop threads
vhci_hcd: release socket
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
vhci_hcd: disconnect device
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 9147 Comm: syz-executor.2 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff888092e2e180 task.stack: ffff88809d650000
RIP: 0010:__lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369
RSP: 0018:ffff88809d657868 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 00000000000007e0
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: ffff888092e2e180 R12: 00000000000007e0
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8beb5d40
FS: 00007f5e68f07700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e68ee6718 CR3: 00000000b30fb000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
try_to_wake_up+0x6a/0x1100 kernel/sched/core.c:1997
store_attach+0x577/0x990 drivers/usb/usbip/vhci_sysfs.c:435
dev_attr_store+0x56/0x80 drivers/base/core.c:738
sysfs_kf_write+0x106/0x160 fs/sysfs/file.c:142
kernfs_fop_write+0x289/0x440 fs/kernfs/file.c:316
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x41914f
RSP: 002b:00007f5e68f06b90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 000000000041914f
RDX: 0000000000000008 RSI: 00007f5e68f06be0 RDI: 0000000000000006
RBP: 0000000000000006 R08: 0000000000000000 R09: 00007f5e68f06b30
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000004afb38
R13: 00007f5e68f06be0 R14: 0000000000000000 R15: 0000000000022000
Code: 18 00 00 00 00 48 81 c4 80 01 00 00 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 67 2a 00 00 49 81 3c 24 a0 17 2e 8b 0f 84 5f
RIP: __lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369 RSP: ffff88809d657868
---[ end trace 80bf3389074fd8bf ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16975a4ed00000
kernel config: https://syzkaller.appspot.com/x/.config?x=124f4e6b89b71fac
dashboard link: https://syzkaller.appspot.com/bug?extid=a34f9da6d80289f86f4f
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a34f9d...@syzkaller.appspotmail.com
vhci_hcd: stop threads
vhci_hcd: release socket
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
vhci_hcd: disconnect device
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 9147 Comm: syz-executor.2 Not tainted 4.14.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff888092e2e180 task.stack: ffff88809d650000
RIP: 0010:__lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369
RSP: 0018:ffff88809d657868 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 00000000000007e0
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: ffff888092e2e180 R12: 00000000000007e0
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8beb5d40
FS: 00007f5e68f07700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e68ee6718 CR3: 00000000b30fb000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
try_to_wake_up+0x6a/0x1100 kernel/sched/core.c:1997
store_attach+0x577/0x990 drivers/usb/usbip/vhci_sysfs.c:435
dev_attr_store+0x56/0x80 drivers/base/core.c:738
sysfs_kf_write+0x106/0x160 fs/sysfs/file.c:142
kernfs_fop_write+0x289/0x440 fs/kernfs/file.c:316
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x41914f
RSP: 002b:00007f5e68f06b90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 000000000041914f
RDX: 0000000000000008 RSI: 00007f5e68f06be0 RDI: 0000000000000006
RBP: 0000000000000006 R08: 0000000000000000 R09: 00007f5e68f06b30
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000004afb38
R13: 00007f5e68f06be0 R14: 0000000000000000 R15: 0000000000022000
Code: 18 00 00 00 00 48 81 c4 80 01 00 00 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 67 2a 00 00 49 81 3c 24 a0 17 2e 8b 0f 84 5f
RIP: __lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369 RSP: ffff88809d657868
---[ end trace 80bf3389074fd8bf ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Mar 17, 2021, 4:45:17 PM3/17/21
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16ad424ed00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a34f9d...@syzkaller.appspotmail.com
vhci_hcd: connection closed
vhci_hcd: stop threads
kasan: CONFIG_KASAN_INLINE enabled
batman_adv: batadv0: Interface activated: batadv_slave_1
vhci_hcd: release socket
RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000041914f
RDX: 0000000000000007 RSI: 00007f73e4e13be0 RDI: 0000000000000006
RBP: 0000000000000006 R08: 0000000000000000 R09: 00007f73e4e13b30
---[ end trace 4325a690c6285987 ]---
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=124f4e6b89b71fac
dashboard link: https://syzkaller.appspot.com/bug?extid=a34f9da6d80289f86f4f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10521c62d00000
dashboard link: https://syzkaller.appspot.com/bug?extid=a34f9da6d80289f86f4f
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a34f9d...@syzkaller.appspotmail.com
vhci_hcd: stop threads
kasan: CONFIG_KASAN_INLINE enabled
batman_adv: batadv0: Interface activated: batadv_slave_1
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 9355 Comm: syz-executor.0 Not tainted 4.14.226-syzkaller #0
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880a077e640 task.stack: ffff88809f308000
RIP: 0010:__lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369
RSP: 0018:ffff88809f30f868 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 00000000000007e0
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: ffff8880a077e640 R12: 00000000000007e0
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 00000000000007e0
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8beb5d40
FS: 00007f73e4e14700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1c55cf4000 CR3: 000000009f9d7000 CR4: 00000000001406f0
vhci_hcd: release socket
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
vhci_hcd: disconnect device
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
try_to_wake_up+0x6a/0x1100 kernel/sched/core.c:1997
store_attach+0x577/0x990 drivers/usb/usbip/vhci_sysfs.c:435
dev_attr_store+0x56/0x80 drivers/base/core.c:738
sysfs_kf_write+0x106/0x160 fs/sysfs/file.c:142
kernfs_fop_write+0x289/0x440 fs/kernfs/file.c:316
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x41914f
RSP: 002b:00007f73e4e13b90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
try_to_wake_up+0x6a/0x1100 kernel/sched/core.c:1997
store_attach+0x577/0x990 drivers/usb/usbip/vhci_sysfs.c:435
dev_attr_store+0x56/0x80 drivers/base/core.c:738
sysfs_kf_write+0x106/0x160 fs/sysfs/file.c:142
kernfs_fop_write+0x289/0x440 fs/kernfs/file.c:316
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x41914f
RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000041914f
RDX: 0000000000000007 RSI: 00007f73e4e13be0 RDI: 0000000000000006
RBP: 0000000000000006 R08: 0000000000000000 R09: 00007f73e4e13b30
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000004afb38
R13: 00007f73e4e13be0 R14: 0000000000000000 R15: 0000000000022000
Code: 18 00 00 00 00 48 81 c4 80 01 00 00 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 67 2a 00 00 49 81 3c 24 a0 17 2e 8b 0f 84 5f
RIP: __lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369 RSP: ffff88809f30f868
---[ end trace 4325a690c6285987 ]---
syzbot
Mar 17, 2021, 8:54:21 PM3/17/21
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: ac3af4be Linux 4.19.181
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=145da6c2d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=4f09908a6dd5ae5f
dashboard link: https://syzkaller.appspot.com/bug?extid=3e7e8c857b28e3a7ed4d
Unfortunately, I don't have any reproducer for this issue yet.
vhci_hcd: connection closed
vhci_hcd: stop threads
kasan: CONFIG_KASAN_INLINE enabled
vhci_hcd: release socket
RIP: 0010:__lock_acquire+0x1eb/0x3ff0 kernel/locking/lockdep.c:3294
Code: 2b 29 00 00 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 2a 00 00 49 81 3e 20 82 66 8c 0f 84 65 ff ff
RSP: 0018:ffff88809e1277d0 EFLAGS: 00010006
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880a89ec480 R14: 00000000000007e0 R15: 0000000000000001
FS: 00007f354952b700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152
try_to_wake_up+0x7b/0x1050 kernel/sched/core.c:1961
attach_store+0x65b/0xaa0 drivers/usb/usbip/vhci_sysfs.c:421
dev_attr_store+0x56/0x80 drivers/base/core.c:966
sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:140
kernfs_fop_write+0x2b0/0x470 fs/kernfs/file.c:316
__vfs_write+0xf7/0x770 fs/read_write.c:485
vfs_write+0x1f3/0x540 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x41914f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f354952ab90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RBP: 0000000000000006 R08: 0000000000000000 R09: 00007f354952ab30
Modules linked in:
---[ end trace a155525277dd69ec ]---
RIP: 0010:__lock_acquire+0x1eb/0x3ff0 kernel/locking/lockdep.c:3294
Code: 2b 29 00 00 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 2a 00 00 49 81 3e 20 82 66 8c 0f 84 65 ff ff
RSP: 0018:ffff88809e1277d0 EFLAGS: 00010006
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880a89ec480 R14: 00000000000007e0 R15: 0000000000000001
FS: 00007f354952b700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
syzbot found the following issue on:
HEAD commit: ac3af4be Linux 4.19.181
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=145da6c2d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=4f09908a6dd5ae5f
dashboard link: https://syzkaller.appspot.com/bug?extid=3e7e8c857b28e3a7ed4d
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3e7e8c...@syzkaller.appspotmail.com
vhci_hcd: connection closed
vhci_hcd: stop threads
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5610 Comm: syz-executor.4 Not tainted 4.19.181-syzkaller #0
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
vhci_hcd: disconnect device
RIP: 0010:__lock_acquire+0x1eb/0x3ff0 kernel/locking/lockdep.c:3294
Code: 2b 29 00 00 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 2a 00 00 49 81 3e 20 82 66 8c 0f 84 65 ff ff
RSP: 0018:ffff88809e1277d0 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880a89ec480 R14: 00000000000007e0 R15: 0000000000000001
FS: 00007f354952b700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f354952aff8 CR3: 000000006ae3e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3907
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152
try_to_wake_up+0x7b/0x1050 kernel/sched/core.c:1961
attach_store+0x65b/0xaa0 drivers/usb/usbip/vhci_sysfs.c:421
dev_attr_store+0x56/0x80 drivers/base/core.c:966
sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:140
kernfs_fop_write+0x2b0/0x470 fs/kernfs/file.c:316
__vfs_write+0xf7/0x770 fs/read_write.c:485
vfs_write+0x1f3/0x540 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x41914f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f354952ab90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 000000000041914f
RDX: 0000000000000008 RSI: 00007f354952abe0 RDI: 0000000000000006
RBP: 0000000000000006 R08: 0000000000000000 R09: 00007f354952ab30
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000004afb38
R13: 00007f354952abe0 R14: 0000000000000000 R15: 0000000000022000
Modules linked in:
---[ end trace a155525277dd69ec ]---
RIP: 0010:__lock_acquire+0x1eb/0x3ff0 kernel/locking/lockdep.c:3294
Code: 2b 29 00 00 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 2a 00 00 49 81 3e 20 82 66 8c 0f 84 65 ff ff
RSP: 0018:ffff88809e1277d0 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880a89ec480 R14: 00000000000007e0 R15: 0000000000000001
FS: 00007f354952b700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f354952aff8 CR3: 000000006ae3e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
syzbot
Mar 17, 2021, 10:05:19 PM3/17/21
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: ac3af4be Linux 4.19.181
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14bf269ed00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3e7e8c...@syzkaller.appspotmail.com
vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed)
FS: 00007f868cceb700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f868cceab30
Modules linked in:
---[ end trace 5dfecfbb9777dd0c ]---
FS: 00007f868cceb700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
HEAD commit: ac3af4be Linux 4.19.181
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=4f09908a6dd5ae5f
dashboard link: https://syzkaller.appspot.com/bug?extid=3e7e8c857b28e3a7ed4d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10458de6d00000
dashboard link: https://syzkaller.appspot.com/bug?extid=3e7e8c857b28e3a7ed4d
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3e7e8c...@syzkaller.appspotmail.com
vhci_hcd: connection closed
vhci_hcd: stop threads
kasan: CONFIG_KASAN_INLINE enabled
vhci_hcd: stop threads
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 10031 Comm: syz-executor.3 Not tainted 4.19.181-syzkaller #0
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__lock_acquire+0x1eb/0x3ff0 kernel/locking/lockdep.c:3294
Code: 2b 29 00 00 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 2a 00 00 49 81 3e 20 82 66 8c 0f 84 65 ff ff
RSP: 0018:ffff88808db6f7d0 EFLAGS: 00010006
Code: 2b 29 00 00 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 2a 00 00 49 81 3e 20 82 66 8c 0f 84 65 ff ff
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880946d02c0 R14: 00000000000007e0 R15: 0000000000000001
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
FS: 00007f868cceb700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcbadbca718 CR3: 0000000097c99000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3907
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152
try_to_wake_up+0x7b/0x1050 kernel/sched/core.c:1961
attach_store+0x65b/0xaa0 drivers/usb/usbip/vhci_sysfs.c:421
dev_attr_store+0x56/0x80 drivers/base/core.c:966
sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:140
kernfs_fop_write+0x2b0/0x470 fs/kernfs/file.c:316
__vfs_write+0xf7/0x770 fs/read_write.c:485
vfs_write+0x1f3/0x540 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x41914f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f868cceab90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3907
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152
try_to_wake_up+0x7b/0x1050 kernel/sched/core.c:1961
attach_store+0x65b/0xaa0 drivers/usb/usbip/vhci_sysfs.c:421
dev_attr_store+0x56/0x80 drivers/base/core.c:966
sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:140
kernfs_fop_write+0x2b0/0x470 fs/kernfs/file.c:316
__vfs_write+0xf7/0x770 fs/read_write.c:485
vfs_write+0x1f3/0x540 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x41914f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 000000000041914f
RDX: 0000000000000008 RSI: 00007f868cceabe0 RDI: 0000000000000005
RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f868cceab30
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000004afb38
R13: 00007f868cceabe0 R14: 0000000000000000 R15: 0000000000022000
Modules linked in:
---[ end trace 5dfecfbb9777dd0c ]---
RIP: 0010:__lock_acquire+0x1eb/0x3ff0 kernel/locking/lockdep.c:3294
Code: 2b 29 00 00 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 2a 00 00 49 81 3e 20 82 66 8c 0f 84 65 ff ff
RSP: 0018:ffff88808db6f7d0 EFLAGS: 00010006
Code: 2b 29 00 00 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 2a 00 00 49 81 3e 20 82 66 8c 0f 84 65 ff ff
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880946d02c0 R14: 00000000000007e0 R15: 0000000000000001
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
FS: 00007f868cceb700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcbadbca718 CR3: 0000000097c99000 CR4: 00000000001406f0
syzbot
Mar 18, 2021, 4:23:13 AM3/18/21
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=130a2e8ad00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1588e63ad00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a34f9d...@syzkaller.appspotmail.com
vhci_hcd: disconnect device
RSP: 002b:00007f8daf55ad60 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000040684f
RDX: 0000000000000007 RSI: 00007f8daf55adb0 RDI: 0000000000000005
RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f8daf55ad00
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f8daf55adb0
R13: 0000000000000000 R14: 00007f8daf55b400 R15: 0000000000022000
---[ end trace d85b11c131318e26 ]---
HEAD commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=124f4e6b89b71fac
dashboard link: https://syzkaller.appspot.com/bug?extid=a34f9da6d80289f86f4f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1210069ed00000
dashboard link: https://syzkaller.appspot.com/bug?extid=a34f9da6d80289f86f4f
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1588e63ad00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a34f9d...@syzkaller.appspotmail.com
vhci_hcd: connection closed
vhci_hcd: stop threads
kasan: CONFIG_KASAN_INLINE enabled
vhci_hcd: release socket
vhci_hcd: stop threads
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 7988 Comm: syz-executor241 Not tainted 4.14.226-syzkaller #0
Modules linked in:
vhci_hcd: disconnect device
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880b3ec86c0 task.stack: ffff8880982c0000
RIP: 0010:__lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369
RSP: 0018:ffff8880982c7868 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 00000000000007e0
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: ffff8880b3ec86c0 R12: 00000000000007e0
RDX: 00000000000000fc RSI: 0000000000000000 RDI: 00000000000007e0
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8beb5d40
FS: 00007f8daf55b700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004b2768 CR3: 00000000aad24000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
try_to_wake_up+0x6a/0x1100 kernel/sched/core.c:1997
store_attach+0x577/0x990 drivers/usb/usbip/vhci_sysfs.c:435
dev_attr_store+0x56/0x80 drivers/base/core.c:738
sysfs_kf_write+0x106/0x160 fs/sysfs/file.c:142
kernfs_fop_write+0x289/0x440 fs/kernfs/file.c:316
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x40684f
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
try_to_wake_up+0x6a/0x1100 kernel/sched/core.c:1997
store_attach+0x577/0x990 drivers/usb/usbip/vhci_sysfs.c:435
dev_attr_store+0x56/0x80 drivers/base/core.c:738
sysfs_kf_write+0x106/0x160 fs/sysfs/file.c:142
kernfs_fop_write+0x289/0x440 fs/kernfs/file.c:316
__vfs_write+0xe4/0x630 fs/read_write.c:480
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RSP: 002b:00007f8daf55ad60 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000040684f
RDX: 0000000000000007 RSI: 00007f8daf55adb0 RDI: 0000000000000005
RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f8daf55ad00
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f8daf55adb0
R13: 0000000000000000 R14: 00007f8daf55b400 R15: 0000000000022000
Code: 18 00 00 00 00 48 81 c4 80 01 00 00 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 67 2a 00 00 49 81 3c 24 a0 17 2e 8b 0f 84 5f
RIP: __lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369 RSP: ffff8880982c7868
---[ end trace d85b11c131318e26 ]---
syzbot
May 16, 2021, 4:59:05 PM5/16/21
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit f6420532cfd7f73ad05045d89efc9c3a9377b85e
Author: Phillip Potter <ph...@philpotter.co.uk>
Date: Tue Apr 6 17:45:54 2021 +0000
net: tun: set tun->dev->addr_len during TUNSETLINK processing
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1040e223d00000
start commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
#syz fix: net: tun: set tun->dev->addr_len during TUNSETLINK processing
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit f6420532cfd7f73ad05045d89efc9c3a9377b85e
Author: Phillip Potter <ph...@philpotter.co.uk>
Date: Tue Apr 6 17:45:54 2021 +0000
net: tun: set tun->dev->addr_len during TUNSETLINK processing
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1040e223d00000
start commit: cb83ddcd Linux 4.14.226
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=124f4e6b89b71fac
dashboard link: https://syzkaller.appspot.com/bug?extid=a34f9da6d80289f86f4f
dashboard link: https://syzkaller.appspot.com/bug?extid=a34f9da6d80289f86f4f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1210069ed00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1588e63ad00000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1588e63ad00000
#syz fix: net: tun: set tun->dev->addr_len during TUNSETLINK processing
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Jul 13, 2021, 3:29:12 PM7/13/21
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit d42c3ebb315618ca536ef764e3f929ce1d5c3485
Author: Tetsuo Handa <penguin...@i-love.sakura.ne.jp>
Date: Sat Jun 5 10:26:35 2021 +0000
can: bcm/raw/isotp: use per module netdevice notifier
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1516f19c300000
start commit: 830a059c Linux 4.19.186
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=7415cc95f9edb7b9
dashboard link: https://syzkaller.appspot.com/bug?extid=3e7e8c857b28e3a7ed4d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110e15fcd00000
If the result looks correct, please mark the issue as fixed by replying with:
Reply all
Reply to author
Forward
0 new messages