general protection fault in path_openat

19 views
Skip to first unread message

syzbot

unread,
Jan 29, 2020, 6:13:11 PM1/29/20
to syzkaller...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 9fa690a2 Linux 4.14.169
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13ed2b85e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=eb55b601e76e3476
dashboard link: https://syzkaller.appspot.com/bug?extid=c486b6e32d3d23beb4c3
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c486b6...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 28142 Comm: modprobe Not tainted 4.14.169-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff888177c46080 task.stack: ffff88818be80000
RIP: 0010:do_last fs/namei.c:3269 [inline]
RIP: 0010:path_openat+0x20b/0x3db0 fs/namei.c:3569
RSP: 0018:ffff88818be87b28 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0001020304050608
RDX: 0000000000000000 RSI: 1ffff110317d0f56 RDI: 0000000000000004
RBP: ffff88818be87c80 R08: ffff888177c46080 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000003 R12: ffff88818be87cc0
R13: ffff88818be87cc0 R14: ffff888091d04000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f953bec6000 CR3: 000000020e7a9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_filp_open+0x18e/0x250 fs/namei.c:3603
do_sys_open+0x2c5/0x430 fs/open.c:1084
SYSC_open fs/open.c:1102 [inline]
SyS_open+0x2d/0x40 fs/open.c:1097
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f852cc701a7
RSP: 002b:00007ffd9b192c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000562a4d90e5c1 RCX: 00007f852cc701a7
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 00007f852cc74282
RBP: 0000000000000001 R08: 00007f852ce7b570 R09: 0000000000000000
R10: ffffffffffffffb0 R11: 0000000000000246 R12: 00007f852ce7b090
R13: 00007f852ce7a040 R14: 0000000000000000 R15: 00007f852ce7b570
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 03 30 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5e 58 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP: do_last fs/namei.c:3269 [inline] RSP: ffff88818be87b28
RIP: path_openat+0x20b/0x3db0 fs/namei.c:3569 RSP: ffff88818be87b28
---[ end trace a76fd7e23e61fd33 ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Jan 29, 2020, 11:23:12 PM1/29/20
to syzkaller...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 7cdefde3 Linux 4.19.100
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=136498d9e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=78c8736935e5597
dashboard link: https://syzkaller.appspot.com/bug?extid=f0669fa513073e7ed9fa
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f0669f...@syzkaller.appspotmail.com

general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 11668 Comm: modprobe Not tainted 4.19.100-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff88801327fae0 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff88801327fc60 R08: ffff88804c210480 R09: 0000000000000001
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000000
R13: ffff88801327fe60 R14: ffff88801327fe60 R15: ffff88801327fca0
FS: 00007fadcb8b7700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000014a9978 CR3: 000000008552d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_filp_open+0x1a1/0x280 fs/namei.c:3567
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_open fs/open.c:1106 [inline]
__se_sys_open fs/open.c:1101 [inline]
__x64_sys_open+0x7e/0xc0 fs/open.c:1101
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fadcb1cf120
Code: 48 8b 15 1b 4d 2b 00 f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 83 3d d5 a4 2b 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 5e 8c 01 00 48 89 04 24
RSP: 002b:00007fff0d2145e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fadcb49a471 RCX: 00007fadcb1cf120
RDX: 0000000000000000 RSI: 0000000000090800 RDI: 00007fadcb49a471
RBP: 00007fadcb69f2e8 R08: 72656c6c616b7a79 R09: 00007fff0d215742
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 00055facc785c680
Modules linked in:
---[ end trace e326868bff836b81 ]---
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff88801327fae0 EFLAGS: 00010247
EXT4-fs: 35 callbacks suppressed
EXT4-fs (sda1): re-mounted. Opts:
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff88801327fc60 R08: ffff88804c210480 R09: 0000000000000001
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000000
R13: ffff88801327fe60 R14: ffff88801327fe60 R15: ffff88801327fca0
FS: 00007fadcb8b7700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000008552d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


syzbot

unread,
Jan 30, 2020, 1:03:13 AM1/30/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 7cdefde3 Linux 4.19.100
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=148ec7c9e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=78c8736935e5597
dashboard link: https://syzkaller.appspot.com/bug?extid=f0669fa513073e7ed9fa
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10f5fe95e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f0669f...@syzkaller.appspotmail.com

EXT4-fs (sda1): re-mounted. Opts:
EXT4-fs (sda1): re-mounted. Opts:
EXT4-fs (sda1): re-mounted. Opts:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8967 Comm: blkid Not tainted 4.19.100-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff888094dc7ae0 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff888094dc7c60 R08: ffff888091c120c0 R09: 0000000000000001
R10: ffffed1015d24732 R11: ffff8880ae923993 R12: 0000000000000000
R13: ffff888094dc7e60 R14: ffff888094dc7e60 R15: ffff888094dc7ca0
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc9faed0300 CR3: 0000000098208000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_filp_open+0x1a1/0x280 fs/namei.c:3567
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_open fs/open.c:1106 [inline]
__se_sys_open fs/open.c:1101 [inline]
__x64_sys_open+0x7e/0xc0 fs/open.c:1101
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f3d56eb61a7
Code: c3 66 90 c7 05 fa af 20 00 16 00 00 00 b8 ff ff ff ff c3 f7 d8 89 05 ec af 20 00 83 c8 ff c3 90 90 90 90 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d cd af 20 00 31 d2 48 29 c2 89
RSP: 002b:00007ffd6cc61578 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000400f31 RCX: 00007f3d56eb61a7
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 00007f3d56eba282
RBP: 0000000000000001 R08: 00007f3d570c1570 R09: 0000000000000000
R10: ffffffffffffffb0 R11: 0000000000000246 R12: 00007f3d570c1090
R13: 00007f3d570c0040 R14: 0000000000000000 R15: 00007f3d570c1570
Modules linked in:
---[ end trace a8bf89f3f4806589 ]---
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff888094dc7ae0 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff888094dc7c60 R08: ffff888091c120c0 R09: 0000000000000001
R10: ffffed1015d24732 R11: ffff8880ae923993 R12: 0000000000000000
R13: ffff888094dc7e60 R14: ffff888094dc7e60 R15: ffff888094dc7ca0
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f51024fd6f0 CR3: 0000000098208000 CR4: 00000000001406e0

syzbot

unread,
Jan 30, 2020, 1:56:11 AM1/30/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 9fa690a2 Linux 4.14.169
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17c7985ee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=eb55b601e76e3476
dashboard link: https://syzkaller.appspot.com/bug?extid=c486b6e32d3d23beb4c3
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135a064ee00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c486b6...@syzkaller.appspotmail.com

EXT4-fs (sda1): re-mounted. Opts: (null)
EXT4-fs (sda1): re-mounted. Opts: (null)
EXT4-fs (sda1): re-mounted. Opts: (null)
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 2956 Comm: udevd Not tainted 4.14.169-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880876dc140 task.stack: ffff88809bae8000
RIP: 0010:do_last fs/namei.c:3269 [inline]
RIP: 0010:path_openat+0x20b/0x3db0 fs/namei.c:3569
RSP: 0018:ffff88809baef868 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0001020304050608
RDX: 0000000000000000 RSI: 1ffff1101375defe RDI: 0000000000000004
RBP: ffff88809baef9c0 R08: ffff8880876dc140 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000003 R12: ffff88809baefa00
R13: ffff88809baefa00 R14: ffff8880943058c0 R15: 0000000000000000
FS: 00007f02837a97a0(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004fda8c CR3: 0000000091f14000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_filp_open+0x18e/0x250 fs/namei.c:3603
do_open_execat+0xe7/0x4a0 fs/exec.c:849
open_exec+0x37/0x70 fs/exec.c:881
load_elf_binary+0x77c/0x4d60 fs/binfmt_elf.c:767
search_binary_handler fs/exec.c:1638 [inline]
search_binary_handler+0x149/0x6f0 fs/exec.c:1616
exec_binprm fs/exec.c:1680 [inline]
do_execveat_common.isra.0+0x1000/0x1dd0 fs/exec.c:1802
do_execve fs/exec.c:1847 [inline]
SYSC_execve fs/exec.c:1928 [inline]
SyS_execve+0x39/0x50 fs/exec.c:1923
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f0282e8d207
RSP: 002b:00007ffd6b164728 EFLAGS: 00000206 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f0282e8d207
RDX: 0000000000a86de0 RSI: 00007ffd6b164820 RDI: 00007ffd6b165830
RBP: 0000000000625500 R08: 0000000000001b3a R09: 0000000000001b3a
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000a86de0
R13: 0000000000000007 R14: 00000000008f5030 R15: 0000000000000005
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 03 30 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5e 58 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP: do_last fs/namei.c:3269 [inline] RSP: ffff88809baef868
RIP: path_openat+0x20b/0x3db0 fs/namei.c:3569 RSP: ffff88809baef868
---[ end trace 79a35ded8aed3faf ]---

syzbot

unread,
Jan 30, 2020, 5:09:12 PM1/30/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 9fa690a2 Linux 4.14.169
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12bbe0a1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=eb55b601e76e3476
dashboard link: https://syzkaller.appspot.com/bug?extid=c486b6e32d3d23beb4c3
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16eb7735e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11aa85bee00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c486b6...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 7832 Comm: syz-executor648 Not tainted 4.14.169-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880a97b0280 task.stack: ffff88808a8c0000
RIP: 0010:do_last fs/namei.c:3269 [inline]
RIP: 0010:path_openat+0x20b/0x3db0 fs/namei.c:3569
RSP: 0018:ffff88808a8c7b18 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0001020304050608
RDX: 0000000000000000 RSI: 1ffff11011518f54 RDI: 0000000000000004
RBP: ffff88808a8c7c70 R08: ffff8880a97b0280 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000003 R12: ffff88808a8c7cb0
R13: ffff88808a8c7cb0 R14: ffff888091b66000 R15: 0000000000000000
FS: 00000000026d0880(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd6a44c8c4 CR3: 00000000928c4000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_filp_open+0x18e/0x250 fs/namei.c:3603
do_sys_open+0x2c5/0x430 fs/open.c:1084
SYSC_openat fs/open.c:1111 [inline]
SyS_openat+0x30/0x40 fs/open.c:1105
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4412d9
RSP: 002b:00007ffd6a44c8b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004412d9
RDX: 0000000000000000 RSI: 0000000020000200 RDI: ffffffffffffff9c
RBP: 000000000000f97d R08: 0000000000000004 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402050
R13: 00000000004020e0 R14: 0000000000000000 R15: 0000000000000000
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 03 30 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5e 58 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP: do_last fs/namei.c:3269 [inline] RSP: ffff88808a8c7b18
RIP: path_openat+0x20b/0x3db0 fs/namei.c:3569 RSP: ffff88808a8c7b18
---[ end trace 26c63089819ee757 ]---

syzbot

unread,
Jan 31, 2020, 11:56:13 PM1/31/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 7cdefde3 Linux 4.19.100
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12080195e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=78c8736935e5597
dashboard link: https://syzkaller.appspot.com/bug?extid=f0669fa513073e7ed9fa
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=156f58b5e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16d18df1e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f0669f...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15262 Comm: udevd Not tainted 4.19.100-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff888094a4f790 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff888094a4f910 R08: ffff888088d2c3c0 R09: 0000000000000002
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000000
R13: ffff888094a4fb38 R14: ffff888094a4fb38 R15: ffff888094a4f950
FS: 00007f586da657a0(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efd267bc848 CR3: 0000000090ed7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_filp_open+0x1a1/0x280 fs/namei.c:3567
do_open_execat+0x140/0x660 fs/exec.c:853
open_exec+0x47/0x80 fs/exec.c:885
load_elf_binary+0x879/0x53a0 fs/binfmt_elf.c:780
search_binary_handler fs/exec.c:1653 [inline]
search_binary_handler+0x179/0x570 fs/exec.c:1631
exec_binprm fs/exec.c:1695 [inline]
__do_execve_file.isra.0+0x1227/0x2150 fs/exec.c:1819
do_execveat_common fs/exec.c:1866 [inline]
do_execve fs/exec.c:1883 [inline]
__do_sys_execve fs/exec.c:1964 [inline]
__se_sys_execve fs/exec.c:1959 [inline]
__x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f586d149207
Code: 77 19 f4 48 89 d7 44 89 c0 0f 05 48 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 f7 d8 64 41 89 01 eb df b8 3b 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 f3 c3 48 8b 15 00 8c 2d 00 f7 d8 64 89 02
RSP: 002b:00007ffec4caabf8 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f586d149207
RDX: 000000000247daf0 RSI: 00007ffec4caacf0 RDI: 00007ffec4cabd00
RBP: 0000000000625500 R08: 0000000000001fc8 R09: 0000000000001fc8
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000247daf0
R13: 0000000000000007 R14: 00000000022ec030 R15: 0000000000000005
Modules linked in:
---[ end trace 0ef5a8dee3d85af0 ]---
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff888094a4f790 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff888094a4f910 R08: ffff888088d2c3c0 R09: 0000000000000002
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000000
R13: ffff888094a4fb38 R14: ffff888094a4fb38 R15: ffff888094a4f950
FS: 00007f586da657a0(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4d1592ca20 CR3: 0000000090ed7000 CR4: 00000000001406f0

syzbot

unread,
Mar 6, 2020, 1:58:04 AM3/6/20
to syzkaller...@googlegroups.com
syzbot suspects this bug was fixed by commit:

commit 8d7a5100e29dde6b6557beb31ea9f2bbc9e998ca
Author: Al Viro <vi...@zeniv.linux.org.uk>
Date: Sat Feb 1 16:26:45 2020 +0000

vfs: fix do_last() regression

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16efdce3e00000
start commit: 7cdefde3 Linux 4.19.100
git tree: linux-4.19.y
If the result looks correct, please mark the bug fixed by replying with:

#syz fix: vfs: fix do_last() regression

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

syzbot

unread,
Mar 6, 2020, 8:21:03 AM3/6/20
to syzkaller...@googlegroups.com
syzbot suspects this bug was fixed by commit:

commit 40642747dd9feab4912157882166c05722cec7b0
Author: Al Viro <vi...@zeniv.linux.org.uk>
Date: Sat Feb 1 16:26:45 2020 +0000

vfs: fix do_last() regression

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13d662f9e00000
start commit: 9fa690a2 Linux 4.14.169
git tree: linux-4.14.y
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15d8c995e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120000f6e00000
Reply all
Reply to author
Forward
0 new messages