general protection fault in sock_from_file
5 views
Skip to first unread message
syzbot
Aug 14, 2020, 6:24:23 AM8/14/20
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: fc9e35d7 ANDROID: GKI: enable CONFIG_LEDS_TRIGGER_TIMER
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=14fb47be900000
kernel config: https://syzkaller.appspot.com/x/.config?x=9a08223aba9cb282
dashboard link: https://syzkaller.appspot.com/bug?extid=adcc5d0fca50adbb3e03
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+adcc5d...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 11845 Comm: syz-executor.0 Not tainted 5.4.58-syzkaller-00208-gfc9e35d72c06 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:sock_from_file+0x27/0xb0 net/socket.c:441
Code: 00 00 00 41 57 41 56 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 24 72 1f fe 49 8d 5f 28 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 7a a4 4d fe 48 c7 c0 f0 f5 72 84
RSP: 0018:ffff888199e57938 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: 0000000000040000
RDX: ffffc9000024e000 RSI: 00000000000000a8 RDI: 00000000000000a9
RBP: ffff888199e57b40 R08: ffffffff8188679b R09: ffffffff81885fd5
R10: ffff888198055d00 R11: 000000000000000c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888199e57a80 R15: 0000000000000000
FS: 00007f32229b2700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020002780 CR3: 00000001cdf73001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
io_send_recvmsg fs/io_uring.c:1671 [inline]
io_recvmsg fs/io_uring.c:1727 [inline]
__io_submit_sqe+0x99d/0x3bf0 fs/io_uring.c:2148
__io_queue_sqe+0x39/0xa00 fs/io_uring.c:2436
io_ring_submit fs/io_uring.c:2947 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3820 [inline]
__se_sys_io_uring_enter+0xc37/0x1ff0 fs/io_uring.c:3781
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d249
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f32229b1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000008280 RCX: 000000000045d249
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004
RBP: 000000000118cf98 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffd91e4c00f R14: 00007f32229b29c0 R15: 000000000118cf4c
Modules linked in:
---[ end trace 2f41371fcc93f144 ]---
RIP: 0010:sock_from_file+0x27/0xb0 net/socket.c:441
Code: 00 00 00 41 57 41 56 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 24 72 1f fe 49 8d 5f 28 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 7a a4 4d fe 48 c7 c0 f0 f5 72 84
RSP: 0018:ffff888199e57938 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: 0000000000040000
RDX: ffffc9000024e000 RSI: 00000000000000a8 RDI: 00000000000000a9
RBP: ffff888199e57b40 R08: ffffffff8188679b R09: ffffffff81885fd5
R10: ffff888198055d00 R11: 000000000000000c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888199e57a80 R15: 0000000000000000
FS: 00007f32229b2700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001716978 CR3: 00000001cdf73005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: fc9e35d7 ANDROID: GKI: enable CONFIG_LEDS_TRIGGER_TIMER
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=14fb47be900000
kernel config: https://syzkaller.appspot.com/x/.config?x=9a08223aba9cb282
dashboard link: https://syzkaller.appspot.com/bug?extid=adcc5d0fca50adbb3e03
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+adcc5d...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 11845 Comm: syz-executor.0 Not tainted 5.4.58-syzkaller-00208-gfc9e35d72c06 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:sock_from_file+0x27/0xb0 net/socket.c:441
Code: 00 00 00 41 57 41 56 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 24 72 1f fe 49 8d 5f 28 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 7a a4 4d fe 48 c7 c0 f0 f5 72 84
RSP: 0018:ffff888199e57938 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: 0000000000040000
RDX: ffffc9000024e000 RSI: 00000000000000a8 RDI: 00000000000000a9
RBP: ffff888199e57b40 R08: ffffffff8188679b R09: ffffffff81885fd5
R10: ffff888198055d00 R11: 000000000000000c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888199e57a80 R15: 0000000000000000
FS: 00007f32229b2700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020002780 CR3: 00000001cdf73001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
io_send_recvmsg fs/io_uring.c:1671 [inline]
io_recvmsg fs/io_uring.c:1727 [inline]
__io_submit_sqe+0x99d/0x3bf0 fs/io_uring.c:2148
__io_queue_sqe+0x39/0xa00 fs/io_uring.c:2436
io_ring_submit fs/io_uring.c:2947 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3820 [inline]
__se_sys_io_uring_enter+0xc37/0x1ff0 fs/io_uring.c:3781
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d249
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f32229b1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000008280 RCX: 000000000045d249
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004
RBP: 000000000118cf98 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffd91e4c00f R14: 00007f32229b29c0 R15: 000000000118cf4c
Modules linked in:
---[ end trace 2f41371fcc93f144 ]---
RIP: 0010:sock_from_file+0x27/0xb0 net/socket.c:441
Code: 00 00 00 41 57 41 56 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 24 72 1f fe 49 8d 5f 28 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 7a a4 4d fe 48 c7 c0 f0 f5 72 84
RSP: 0018:ffff888199e57938 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: 0000000000040000
RDX: ffffc9000024e000 RSI: 00000000000000a8 RDI: 00000000000000a9
RBP: ffff888199e57b40 R08: ffffffff8188679b R09: ffffffff81885fd5
R10: ffff888198055d00 R11: 000000000000000c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888199e57a80 R15: 0000000000000000
FS: 00007f32229b2700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001716978 CR3: 00000001cdf73005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Aug 14, 2020, 6:41:16 AM8/14/20
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: fc9e35d7 ANDROID: GKI: enable CONFIG_LEDS_TRIGGER_TIMER
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=11c7325e900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17c0d116900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+adcc5d...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 329 Comm: syz-executor749 Not tainted 5.4.58-syzkaller-00208-gfc9e35d72c06 #0
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff8881c38aec80
RDX: 0000000000000000 RSI: ffff8881ce24fa80 RDI: 0000000000000000
RBP: ffff8881ce24fb40 R08: ffffffff8188679b R09: ffffffff81885fd5
R10: ffff8881c38aec80 R11: 000000000000000c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff8881ce24fa80 R15: 0000000000000000
FS: 0000000000a50880(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcaaa07108 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004404e9
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401cf0
R13: 0000000000401d80 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 9914176413542463 ]---
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff8881c38aec80
RDX: 0000000000000000 RSI: ffff8881ce24fa80 RDI: 0000000000000000
RBP: ffff8881ce24fb40 R08: ffffffff8188679b R09: ffffffff81885fd5
R13: dffffc0000000000 R14: ffff8881ce24fa80 R15: 0000000000000000
Rebooting in 86400 seconds..
HEAD commit: fc9e35d7 ANDROID: GKI: enable CONFIG_LEDS_TRIGGER_TIMER
git tree: android-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=9a08223aba9cb282
dashboard link: https://syzkaller.appspot.com/bug?extid=adcc5d0fca50adbb3e03
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15cc5681900000
dashboard link: https://syzkaller.appspot.com/bug?extid=adcc5d0fca50adbb3e03
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17c0d116900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+adcc5d...@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:sock_from_file+0x27/0xb0 net/socket.c:441
Code: 00 00 00 41 57 41 56 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 24 72 1f fe 49 8d 5f 28 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 7a a4 4d fe 48 c7 c0 f0 f5 72 84
RSP: 0018:ffff8881ce24f938 EFLAGS: 00010206
RIP: 0010:sock_from_file+0x27/0xb0 net/socket.c:441
Code: 00 00 00 41 57 41 56 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 24 72 1f fe 49 8d 5f 28 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 7a a4 4d fe 48 c7 c0 f0 f5 72 84
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff8881c38aec80
RDX: 0000000000000000 RSI: ffff8881ce24fa80 RDI: 0000000000000000
RBP: ffff8881ce24fb40 R08: ffffffff8188679b R09: ffffffff81885fd5
R10: ffff8881c38aec80 R11: 000000000000000c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff8881ce24fa80 R15: 0000000000000000
FS: 0000000000a50880(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055950de40300 CR3: 00000001c5f0b005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
io_send_recvmsg fs/io_uring.c:1671 [inline]
io_recvmsg fs/io_uring.c:1727 [inline]
__io_submit_sqe+0x99d/0x3bf0 fs/io_uring.c:2148
__io_queue_sqe+0x39/0xa00 fs/io_uring.c:2436
io_ring_submit fs/io_uring.c:2947 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3820 [inline]
__se_sys_io_uring_enter+0xc37/0x1ff0 fs/io_uring.c:3781
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4404e9
io_send_recvmsg fs/io_uring.c:1671 [inline]
io_recvmsg fs/io_uring.c:1727 [inline]
__io_submit_sqe+0x99d/0x3bf0 fs/io_uring.c:2148
__io_queue_sqe+0x39/0xa00 fs/io_uring.c:2436
io_ring_submit fs/io_uring.c:2947 [inline]
__do_sys_io_uring_enter fs/io_uring.c:3820 [inline]
__se_sys_io_uring_enter+0xc37/0x1ff0 fs/io_uring.c:3781
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcaaa07108 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004404e9
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401cf0
R13: 0000000000401d80 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 9914176413542463 ]---
RIP: 0010:sock_from_file+0x27/0xb0 net/socket.c:441
Code: 00 00 00 41 57 41 56 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 24 72 1f fe 49 8d 5f 28 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 7a a4 4d fe 48 c7 c0 f0 f5 72 84
RSP: 0018:ffff8881ce24f938 EFLAGS: 00010206
Code: 00 00 00 41 57 41 56 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 24 72 1f fe 49 8d 5f 28 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 7a a4 4d fe 48 c7 c0 f0 f5 72 84
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff8881c38aec80
RDX: 0000000000000000 RSI: ffff8881ce24fa80 RDI: 0000000000000000
RBP: ffff8881ce24fb40 R08: ffffffff8188679b R09: ffffffff81885fd5
R13: dffffc0000000000 R14: ffff8881ce24fa80 R15: 0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Kernel Offset: disabled
Rebooting in 86400 seconds..
syzbot
Aug 27, 2022, 5:49:20 AM8/27/22
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages