BUG: unable to handle kernel paging request in do_syscall_64
15 views
Skip to first unread message
syzbot
Mar 24, 2020, 12:49:17 AM3/24/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 14cfdbd3 Linux 4.19.112
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=112ee8c5e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=48ea0e0a21a4900f
dashboard link: https://syzkaller.appspot.com/bug?extid=400533692f72a27e4bc1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+400533...@syzkaller.appspotmail.com
BUG: unable to handle kernel paging request at fffffffffffffffe
PGD 8a70067 P4D 8a70067 PUD 8a72067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 18810 Comm: blkid Not tainted 4.19.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:do_syscall_64+0x107/0x620 arch/x86/entry/common.c:293
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c3 04 00 00 48 89 ef ff 14 dd 40 46 60 87 48 8d 7d 50 48 ba 00 00 00 00 00 fc ff df <48> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffff888032a1ff28 EFLAGS: 00010287
RAX: fffffffffffffffe RBX: 0000000000000015 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffffff81a5f4ad RDI: ffff888032a1ffa8
RBP: ffff888032a1ff58 R08: ffff88805dd64280 R09: ffffed1015ce4733
R10: ffffed1015ce4732 R11: ffff8880ae723993 R12: 0000000000000000
R13: ffffffff88b25698 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffe CR3: 00000000955be000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fbf8a7e6267
Code: 73 01 c3 48 8d 0d 3d af 20 00 31 d2 48 29 c2 89 11 48 83 c8 ff eb eb 90 90 90 90 90 90 90 90 90 90 90 90 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 0d af 20 00 31 d2 48 29 c2 89
RSP: 002b:00007ffe05dfa788 EFLAGS: 00000246 ORIG_RAX: 0000000000000015
RAX: ffffffffffffffda RBX: 0000000000401300 RCX: 00007fbf8a7e6267
RDX: 000000000000001d RSI: 0000000000000000 RDI: 00007fbf8a7ea2e6
RBP: 00007fbf8a9e9000 R08: 00007fbf8a9f1570 R09: 0000000000000000
R10: 000000006ffffeff R11: 0000000000000246 R12: 00007fbf8a9f11c8
R13: 00007fbf8a9e9718 R14: 00000000000033ef R15: 00007fbf8a9f1570
Modules linked in:
CR2: fffffffffffffffe
---[ end trace 9c3026c3ac7e771a ]---
RIP: 0010:do_syscall_64+0x107/0x620 arch/x86/entry/common.c:293
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c3 04 00 00 48 89 ef ff 14 dd 40 46 60 87 48 8d 7d 50 48 ba 00 00 00 00 00 fc ff df <48> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffff888032a1ff28 EFLAGS: 00010287
RAX: fffffffffffffffe RBX: 0000000000000015 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffffff81a5f4ad RDI: ffff888032a1ffa8
RBP: ffff888032a1ff58 R08: ffff88805dd64280 R09: ffffed1015ce4733
R10: ffffed1015ce4732 R11: ffff8880ae723993 R12: 0000000000000000
R13: ffffffff88b25698 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffe CR3: 00000000955be000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 14cfdbd3 Linux 4.19.112
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=112ee8c5e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=48ea0e0a21a4900f
dashboard link: https://syzkaller.appspot.com/bug?extid=400533692f72a27e4bc1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+400533...@syzkaller.appspotmail.com
BUG: unable to handle kernel paging request at fffffffffffffffe
PGD 8a70067 P4D 8a70067 PUD 8a72067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 18810 Comm: blkid Not tainted 4.19.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:do_syscall_64+0x107/0x620 arch/x86/entry/common.c:293
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c3 04 00 00 48 89 ef ff 14 dd 40 46 60 87 48 8d 7d 50 48 ba 00 00 00 00 00 fc ff df <48> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffff888032a1ff28 EFLAGS: 00010287
RAX: fffffffffffffffe RBX: 0000000000000015 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffffff81a5f4ad RDI: ffff888032a1ffa8
RBP: ffff888032a1ff58 R08: ffff88805dd64280 R09: ffffed1015ce4733
R10: ffffed1015ce4732 R11: ffff8880ae723993 R12: 0000000000000000
R13: ffffffff88b25698 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffe CR3: 00000000955be000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fbf8a7e6267
Code: 73 01 c3 48 8d 0d 3d af 20 00 31 d2 48 29 c2 89 11 48 83 c8 ff eb eb 90 90 90 90 90 90 90 90 90 90 90 90 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 0d af 20 00 31 d2 48 29 c2 89
RSP: 002b:00007ffe05dfa788 EFLAGS: 00000246 ORIG_RAX: 0000000000000015
RAX: ffffffffffffffda RBX: 0000000000401300 RCX: 00007fbf8a7e6267
RDX: 000000000000001d RSI: 0000000000000000 RDI: 00007fbf8a7ea2e6
RBP: 00007fbf8a9e9000 R08: 00007fbf8a9f1570 R09: 0000000000000000
R10: 000000006ffffeff R11: 0000000000000246 R12: 00007fbf8a9f11c8
R13: 00007fbf8a9e9718 R14: 00000000000033ef R15: 00007fbf8a9f1570
Modules linked in:
CR2: fffffffffffffffe
---[ end trace 9c3026c3ac7e771a ]---
RIP: 0010:do_syscall_64+0x107/0x620 arch/x86/entry/common.c:293
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c3 04 00 00 48 89 ef ff 14 dd 40 46 60 87 48 8d 7d 50 48 ba 00 00 00 00 00 fc ff df <48> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffff888032a1ff28 EFLAGS: 00010287
RAX: fffffffffffffffe RBX: 0000000000000015 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffffff81a5f4ad RDI: ffff888032a1ffa8
RBP: ffff888032a1ff58 R08: ffff88805dd64280 R09: ffffed1015ce4733
R10: ffffed1015ce4732 R11: ffff8880ae723993 R12: 0000000000000000
R13: ffffffff88b25698 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffe CR3: 00000000955be000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
May 3, 2020, 3:42:15 PM5/3/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: fdc07232 Linux 4.19.120
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10a12f90100000
kernel config: https://syzkaller.appspot.com/x/.config?x=7848de5371b4200c
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=173075f8100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+400533...@syzkaller.appspotmail.com
audit: type=1400 audit(1588534725.329:8): avc: denied { execmem } for pid=6468 comm="syz-executor462" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
IPVS: ftp: loaded support on port[0] = 21
BUG: unable to handle kernel paging request at ffffffffffffffff
PGD 8c70067 P4D 8c70067 PUD 8c72067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6469 Comm: syz-executor462 Not tainted 4.19.120-syzkaller #0
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:253 [inline]
RIP: 0010:do_syscall_64+0x14c/0x620 arch/x86/entry/common.c:296
Code: b8 00 00 00 00 00 fc ff df 65 48 8b 1c 25 00 70 00 70 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 84 04 00 00 48 c7 c0 c0 56 d2 88 <4c> 8b 23 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f
RSP: 0018:ffff888089007f28 EFLAGS: 00010246
RAX: ffffffff88d256c0 RBX: ffffffffffffffff RCX: 1ffff11011200ff5
RDX: 1fffffffffffffff RSI: ffffffff81009b31 RDI: ffff888089007fa8
RBP: ffff888089007f58 R08: ffff888089e946c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff88d256d8 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000002211880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
Code: 05 48 3d 01 f0 ff ff 0f 83 ed 52 f9 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d b1 0e 27 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 c4 52 f9 ff c3 48 83 ec 08 e8 ea 74 fd ff
RSP: 002b:00007fff8714a9f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: 0000000000000000 RBX: 00007fff8714aa40 RCX: 0000000000472160
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff8714aa00
RBP: 0000000000000006 R08: 0000000000000001 R09: 0000000002211880
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000a863
R13: 0000000000407940 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffffffffffffff
---[ end trace 105ca70c34b27fe1 ]---
BUG: unable to handle kernel NULL pointer dereference at 0000000000000007
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:253 [inline]
RIP: 0010:do_syscall_64+0x14c/0x620 arch/x86/entry/common.c:296
PGD 891b8067 P4D 891b8067 PUD 949a3067 PMD 0
Code: b8 00 00 00 00 00 fc ff df 65 48 8b 1c 25 00 70 00 70 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 84 04 00 00 48 c7 c0 c0 56 d2 88 <4c> 8b 23 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f
Oops: 0002 [#2] PREEMPT SMP KASAN
RSP: 0018:ffff888089007f28 EFLAGS: 00010246
CPU: 1 PID: 6495 Comm: syz-executor462 Tainted: G D 4.19.120-syzkaller #0
RAX: ffffffff88d256c0 RBX: ffffffffffffffff RCX: 1ffff11011200ff5
RIP: 0010:update_vsyscall+0x128/0x380 arch/x86/entry/vsyscall/vsyscall_gtod.c:46
RBP: ffff888089007f58 R08: ffff888089e946c0 R09: 0000000000000000
Code: 48 8d 7d 1c 48 89 fa 48 c1 ea 03 89 05 69 25 9c 09 48 b8 00 00 00 00 00 fc ff df 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 <00> 00 00 00 0f 85 d8 01 00 00 8b 45 1c 48 8d 7d 70 48 89 fa 48 c1
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
RSP: 0018:ffff8880ae707c48 EFLAGS: 00010002
R13: ffffffff88d256d8 R14: 0000000000000000 R15: 0000000000000000
RAX: 0000000000000007 RBX: ffffffff88d250c0 RCX: ffffffff8159a0cf
FS: 0000000002211880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
RDX: 0000000000000000 RSI: ffffffff8100ba36 RDI: ffffffff8b8e1b3c
CR2: ffffffffffffffff CR3: 00000000a97e3000 CR4: 00000000001406f0
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
HEAD commit: fdc07232 Linux 4.19.120
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10a12f90100000
kernel config: https://syzkaller.appspot.com/x/.config?x=7848de5371b4200c
dashboard link: https://syzkaller.appspot.com/bug?extid=400533692f72a27e4bc1
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ff6b40100000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=173075f8100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+400533...@syzkaller.appspotmail.com
IPVS: ftp: loaded support on port[0] = 21
BUG: unable to handle kernel paging request at ffffffffffffffff
PGD 8c70067 P4D 8c70067 PUD 8c72067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6469 Comm: syz-executor462 Not tainted 4.19.120-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:253 [inline]
RIP: 0010:do_syscall_64+0x14c/0x620 arch/x86/entry/common.c:296
Code: b8 00 00 00 00 00 fc ff df 65 48 8b 1c 25 00 70 00 70 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 84 04 00 00 48 c7 c0 c0 56 d2 88 <4c> 8b 23 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f
RSP: 0018:ffff888089007f28 EFLAGS: 00010246
RAX: ffffffff88d256c0 RBX: ffffffffffffffff RCX: 1ffff11011200ff5
RDX: 1fffffffffffffff RSI: ffffffff81009b31 RDI: ffff888089007fa8
RBP: ffff888089007f58 R08: ffff888089e946c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff88d256d8 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000002211880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffff CR3: 00000000a97e3000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x472160
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: 05 48 3d 01 f0 ff ff 0f 83 ed 52 f9 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d b1 0e 27 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 c4 52 f9 ff c3 48 83 ec 08 e8 ea 74 fd ff
RSP: 002b:00007fff8714a9f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: 0000000000000000 RBX: 00007fff8714aa40 RCX: 0000000000472160
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff8714aa00
RBP: 0000000000000006 R08: 0000000000000001 R09: 0000000002211880
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000a863
R13: 0000000000407940 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffffffffffffff
---[ end trace 105ca70c34b27fe1 ]---
BUG: unable to handle kernel NULL pointer dereference at 0000000000000007
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:253 [inline]
RIP: 0010:do_syscall_64+0x14c/0x620 arch/x86/entry/common.c:296
PGD 891b8067 P4D 891b8067 PUD 949a3067 PMD 0
Code: b8 00 00 00 00 00 fc ff df 65 48 8b 1c 25 00 70 00 70 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 84 04 00 00 48 c7 c0 c0 56 d2 88 <4c> 8b 23 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f
Oops: 0002 [#2] PREEMPT SMP KASAN
RSP: 0018:ffff888089007f28 EFLAGS: 00010246
CPU: 1 PID: 6495 Comm: syz-executor462 Tainted: G D 4.19.120-syzkaller #0
RAX: ffffffff88d256c0 RBX: ffffffffffffffff RCX: 1ffff11011200ff5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RDX: 1fffffffffffffff RSI: ffffffff81009b31 RDI: ffff888089007fa8
RIP: 0010:update_vsyscall+0x128/0x380 arch/x86/entry/vsyscall/vsyscall_gtod.c:46
RBP: ffff888089007f58 R08: ffff888089e946c0 R09: 0000000000000000
Code: 48 8d 7d 1c 48 89 fa 48 c1 ea 03 89 05 69 25 9c 09 48 b8 00 00 00 00 00 fc ff df 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 <00> 00 00 00 0f 85 d8 01 00 00 8b 45 1c 48 8d 7d 70 48 89 fa 48 c1
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
RSP: 0018:ffff8880ae707c48 EFLAGS: 00010002
R13: ffffffff88d256d8 R14: 0000000000000000 R15: 0000000000000000
RAX: 0000000000000007 RBX: ffffffff88d250c0 RCX: ffffffff8159a0cf
FS: 0000000002211880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
RDX: 0000000000000000 RSI: ffffffff8100ba36 RDI: ffffffff8b8e1b3c
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
RBP: ffffffff8b8e1b20 R08: ffff8880a94be600 R09: 0000000000000001
CR2: ffffffffffffffff CR3: 00000000a97e3000 CR4: 00000000001406f0
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
R13: ffffffff8b8e1bb0 R14: 000000004a08dfb7 R15: ffffffff8b8e1b48
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
FS: 00007f3325d06700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
syzbot
May 11, 2020, 4:37:14 AM5/11/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: ab9dfda2 Linux 4.14.180
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=110235ec100000
kernel config: https://syzkaller.appspot.com/x/.config?x=221566a7407ce2de
dashboard link: https://syzkaller.appspot.com/bug?extid=a3059c4c76388c1e6e31
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
cgroup: cgroup2: unknown option "� 6
"Q4�I�.�5�t� d�V��iA���O� M*�+ݛ�n ��l�_ R Ԗ��� �.���_��l"� ;��o ���|��<��-y��
"
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'.
BUG: unable to handle kernel paging request at 0000000000040000
IP: do_syscall_64+0x1e3/0x640 arch/x86/entry/common.c:292
PGD 0 P4D 0
CPU: 0 PID: 10004 Comm: systemd-udevd Not tainted 4.14.180-syzkaller #0
RIP: 0010:do_syscall_64+0x1e3/0x640 arch/x86/entry/common.c:292
RSP: 0018:ffff88820f1f7f00 EFLAGS: 00010282
RAX: 0000000000040000 RBX: ffffffff818b51c0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88820f1f7fa8
RBP: ffff88820f1f7f58 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed103f6ab5ff R11: 0000000000000000 R12: ffffffff87d16698
R13: ffff88820f1f7fd0 R14: ffff88821299a080 R15: 0000000000000000
FS: 00007f8b653ac8c0(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 10004 Comm: systemd-udevd Not tainted 4.14.180-syzkaller #0
RIP: 0010:warn_bad_vsyscall arch/x86/entry/vsyscall/vsyscall_64.c:79 [inline]
RIP: 0010:warn_bad_vsyscall.cold+0x39/0x189 arch/x86/entry/vsyscall/vsyscall_64.c:73
RSP: 0018:ffff88820f1f7560 EFLAGS: 00010082
RAX: ffff88821299a080 RBX: 1ffff11041e3eeb5 RCX: ffff88820f1f75c8
RDX: 0000000000000000 RSI: ffff88820f1f7608 RDI: 00007f8b644f3210
RBP: 00007f8b644f3210 R08: ffff88820f1f7690 R09: fffffbfff14a9552
R10: fffffbfff14a9551 R11: ffffffff8a54aa8b R12: ffff88820f1f7690
R13: ffff88820f1f75c8 R14: ffff88820f1f7608 R15: ffff88820f1f75e8
FS: 00007f8b653ac8c0(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
RIP: warn_bad_vsyscall arch/x86/entry/vsyscall/vsyscall_64.c:79 [inline] RSP: ffff88820f1f7560
RIP: warn_bad_vsyscall.cold+0x39/0x189 arch/x86/entry/vsyscall/vsyscall_64.c:73 RSP: ffff88820f1f7560
---[ end trace 01e055129f053947 ]---
syzbot found the following crash on:
HEAD commit: ab9dfda2 Linux 4.14.180
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=110235ec100000
kernel config: https://syzkaller.appspot.com/x/.config?x=221566a7407ce2de
dashboard link: https://syzkaller.appspot.com/bug?extid=a3059c4c76388c1e6e31
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a3059c...@syzkaller.appspotmail.com
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
cgroup: cgroup2: unknown option "� 6
"Q4�I�.�5�t� d�V��iA���O� M*�+ݛ�n ��l�_ R Ԗ��� �.���_��l"� ;��o ���|��<��-y��
"
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'.
BUG: unable to handle kernel paging request at 0000000000040000
IP: do_syscall_64+0x1e3/0x640 arch/x86/entry/common.c:292
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 10004 Comm: systemd-udevd Not tainted 4.14.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88821299a080 task.stack: ffff88820f1f0000
RIP: 0010:do_syscall_64+0x1e3/0x640 arch/x86/entry/common.c:292
RSP: 0018:ffff88820f1f7f00 EFLAGS: 00010282
RAX: 0000000000040000 RBX: ffffffff818b51c0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88820f1f7fa8
RBP: ffff88820f1f7f58 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed103f6ab5ff R11: 0000000000000000 R12: ffffffff87d16698
R13: ffff88820f1f7fd0 R14: ffff88821299a080 R15: 0000000000000000
FS: 00007f8b653ac8c0(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000040000 CR3: 00000001f80a3000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
entry_SYSCALL_64_after_hwframe+0x42/0xb7
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 10004 Comm: systemd-udevd Not tainted 4.14.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88821299a080 task.stack: ffff88820f1f0000
RIP: 0010:warn_bad_vsyscall arch/x86/entry/vsyscall/vsyscall_64.c:79 [inline]
RIP: 0010:warn_bad_vsyscall.cold+0x39/0x189 arch/x86/entry/vsyscall/vsyscall_64.c:73
RSP: 0018:ffff88820f1f7560 EFLAGS: 00010082
RAX: ffff88821299a080 RBX: 1ffff11041e3eeb5 RCX: ffff88820f1f75c8
RDX: 0000000000000000 RSI: ffff88820f1f7608 RDI: 00007f8b644f3210
RBP: 00007f8b644f3210 R08: ffff88820f1f7690 R09: fffffbfff14a9552
R10: fffffbfff14a9551 R11: ffffffff8a54aa8b R12: ffff88820f1f7690
R13: ffff88820f1f75c8 R14: ffff88820f1f7608 R15: ffff88820f1f75e8
FS: 00007f8b653ac8c0(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000040000 CR3: 00000001f80a3000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 48 c1 <ea> 03 80 3c 02 00 74 05 e8 60 f2 82 00 48 8d 7b 50 b8 ff ff 37
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
RIP: warn_bad_vsyscall arch/x86/entry/vsyscall/vsyscall_64.c:79 [inline] RSP: ffff88820f1f7560
RIP: warn_bad_vsyscall.cold+0x39/0x189 arch/x86/entry/vsyscall/vsyscall_64.c:73 RSP: ffff88820f1f7560
---[ end trace 01e055129f053947 ]---
syzbot
Sep 8, 2020, 4:37:10 AM9/8/20
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
syzbot
Sep 23, 2021, 7:57:09 PM9/23/21
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 6be10fb6c143608a7c7ab3901a096e272233bf64
Author: George Kennedy <george....@oracle.com>
Date: Tue Jul 7 19:26:03 2020 +0000
fbmem: add margin check to fb_check_caps()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1462de17300000
start commit: fdc072324f3c Linux 4.19.120
git tree: linux-4.19.y
#syz fix: fbmem: add margin check to fb_check_caps()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 6be10fb6c143608a7c7ab3901a096e272233bf64
Author: George Kennedy <george....@oracle.com>
Date: Tue Jul 7 19:26:03 2020 +0000
fbmem: add margin check to fb_check_caps()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1462de17300000
start commit: fdc072324f3c Linux 4.19.120
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=7848de5371b4200c
dashboard link: https://syzkaller.appspot.com/bug?extid=400533692f72a27e4bc1
dashboard link: https://syzkaller.appspot.com/bug?extid=400533692f72a27e4bc1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ff6b40100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=173075f8100000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=173075f8100000
#syz fix: fbmem: add margin check to fb_check_caps()
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages