panic: runtime error: invalid memory address or nil pointer dereference (3)

Status: fixed on 2020/09/09 05:34
Reported-by: syzbot+074ec22c42305725b79f@syzkaller.appspotmail.com
Fix commit: b3ff31d041c9 fix panic when calling SO_ORIGINAL_DST without initializing iptables
First crash: 2838d, last: 2188d
▶ ▼ Similar bugs (30)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: runtime error: invalid memory address or nil pointer dereference (18) 2 4 1084d 1085d 26/26 fixed on 2023/09/13 00:17
gvisor panic: runtime error: invalid memory address or nil pointer dereference (29) 2 syz, C 7 358d 361d 26/26 fixed on 2025/09/19 06:07
gvisor panic: runtime error: invalid memory address or nil pointer dereference (9) 2 syz, C 262 1665d 1662d 14/26 fixed on 2022/02/10 01:56
gvisor panic: runtime error: invalid memory address or nil pointer dereference (7) 2 syz, C 45305 1767d 1796d 14/26 fixed on 2021/10/27 00:49
gvisor panic: runtime error: invalid memory address or nil pointer dereference (23) 2 syz, C 4239 893d 898d 26/26 fixed on 2024/03/19 11:42
gvisor panic: runtime error: invalid memory address or nil pointer dereference (31) 2 syz, C 169 119d 120d 26/26 fixed on 2026/05/01 11:36
gvisor panic: runtime error: invalid memory address or nil pointer dereference (22) 2 1 1002d 1002d 26/26 fixed on 2023/12/01 06:13
gvisor panic: runtime error: invalid memory address or nil pointer dereference (10) 2 syz, C 11 1618d 1624d 14/26 fixed on 2022/03/25 11:21
gvisor panic: runtime error: invalid memory address or nil pointer dereference (12) 2 syz, C 31 1317d 1378d 18/26 fixed on 2023/01/23 05:20
gvisor panic: runtime error: invalid memory address or nil pointer dereference (28) 2 syz, C 21 563d 564d 26/26 fixed on 2025/02/13 10:39
gvisor panic: runtime error: invalid memory address or nil pointer dereference (26) 2 syz, C 7905 645d 653d 26/26 fixed on 2024/11/22 02:29
gvisor panic: runtime error: invalid memory address or nil pointer dereference (21) 2 1 1017d 1017d 26/26 fixed on 2023/11/17 08:30
gvisor panic: runtime error: invalid memory address or nil pointer dereference (14) 2 syz, C 753 1277d 1278d 18/26 fixed on 2023/02/28 09:05
gvisor panic: runtime error: invalid memory address or nil pointer dereference 2 syz, C 20682 2935d 2989d 0/26 fixed on 2018/08/19 04:32
gvisor panic: runtime error: invalid memory address or nil pointer dereference (25) 2 1 755d 755d 26/26 fixed on 2024/08/06 09:03
gvisor panic: runtime error: invalid memory address or nil pointer dereference (27) 2 syz, C 1117 643d 645d 26/26 fixed on 2024/11/23 14:37
gvisor panic: runtime error: invalid memory address or nil pointer dereference (24) 2 92 886d 886d 0/26 closed as invalid on 2024/03/26 13:32
gvisor panic: runtime error: invalid memory address or nil pointer dereference (13) 2 syz, C 2752 1278d 1282d 18/26 fixed on 2023/02/27 08:23
gvisor panic: runtime error: invalid memory address or nil pointer dereference (8) 2 syz, C 214 1669d 1694d 14/26 fixed on 2022/02/01 22:27
gvisor panic: runtime error: invalid memory address or nil pointer dereference (2) 2 syz, C 4493 2911d 2931d 0/26 fixed on 2018/10/15 18:31
gvisor panic: runtime error: invalid memory address or nil pointer dereference (17) 2 2 1121d 1121d 26/26 fixed on 2023/08/04 01:52
gvisor panic: runtime error: invalid memory address or nil pointer dereference (5) 2 syz 62 2061d 2106d 14/26 fixed on 2021/01/06 10:11
gvisor panic: runtime error: invalid memory address or nil pointer dereference (32) 2 syz 6 61d 54d 26/26 fixed on 2026/07/07 11:38
gvisor panic: runtime error: invalid memory address or nil pointer dereference (11) 2 syz, C 2733 1387d 1481d 14/26 fixed on 2022/11/11 17:56
gvisor panic: runtime error: invalid memory address or nil pointer dereference (19) 2 syz, C 79 1059d 1073d 26/26 fixed on 2023/10/05 23:05
gvisor panic: runtime error: invalid memory address or nil pointer dereference (20) 2 syz, C 8 1031d 1038d 26/26 fixed on 2023/11/02 02:06
gvisor panic: runtime error: invalid memory address or nil pointer dereference (16) 2 syz, C 48 1123d 1130d 26/26 fixed on 2023/08/02 12:57
gvisor panic: runtime error: invalid memory address or nil pointer dereference (30) 2 syz, C 16194 336d 337d 26/26 fixed on 2025/09/26 06:32
gvisor panic: runtime error: invalid memory address or nil pointer dereference (15) 2 1 1170d 1170d 26/26 fixed on 2023/07/12 19:22
gvisor panic: runtime error: invalid memory address or nil pointer dereference (4) 2 syz, C 4 2122d 2140d 0/26 fixed on 2020/11/13 09:22

Sample crash report:
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x6af046]

goroutine 43 [running]:
gvisor.googlesource.com/gvisor/pkg/sentry/mm.pmaIterator.ValuePtr(...)
	bazel-out/k8-fastbuild/bin/pkg/sentry/mm/pma_set.go:973
gvisor.googlesource.com/gvisor/pkg/sentry/mm.pmaIterator.getInternalMappingsLocked(0x0, 0x0, 0x0, 0x0)
	pkg/sentry/mm/pma.go:972 +0x26
gvisor.googlesource.com/gvisor/pkg/sentry/mm.(*MemoryManager).getPMAInternalMappingsLocked(0xc0007f4000, 0xc0007f4668, 0x3, 0x20000f80, 0x20001010, 0x20000000, 0x20002000, 0x1, 0xc0007f4668)
	pkg/sentry/mm/pma.go:748 +0x5d
gvisor.googlesource.com/gvisor/pkg/sentry/mm.(*MemoryManager).withInternalMappings(0xc0007f4000, 0xd1fec0, 0xc000748a80, 0x20000f80, 0x20001010, 0xc000000100, 0xc00082d818, 0xc00082d9a8, 0x62fd1b, 0x78)
	pkg/sentry/mm/io.go:493 +0x331
gvisor.googlesource.com/gvisor/pkg/sentry/mm.(*MemoryManager).CopyOut(0xc0007f4000, 0xd1fec0, 0xc000748a80, 0x20000f80, 0xc0001b0100, 0x90, 0x100, 0x100, 0x100, 0xc09860, ...)
	pkg/sentry/mm/io.go:119 +0x14d
gvisor.googlesource.com/gvisor/pkg/sentry/usermem.(*IOReadWriter).Write(0xc00082d910, 0xc0001b0100, 0x90, 0x100, 0x1338ac0, 0xc09860, 0xc000220120)
	pkg/sentry/usermem/usermem.go:155 +0x7c
gvisor.googlesource.com/gvisor/pkg/sentry/usermem.CopyObjectOut(0xd1fec0, 0xc000748a80, 0xd1ef60, 0xc0007f4000, 0x20000f80, 0xc09860, 0xc000220120, 0xc000820100, 0x90, 0xc000220120, ...)
	pkg/sentry/usermem/usermem.go:184 +0x10a
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).CopyOut(0xc000748a80, 0x20000f80, 0xc09860, 0xc000220120, 0x0, 0x0, 0x0)
	pkg/sentry/kernel/task_usermem.go:73 +0x7b
gvisor.googlesource.com/gvisor/pkg/sentry/syscalls/linux.stat(0xc000748a80, 0xc00022e510, 0xc00022e600, 0x20000f80, 0x0, 0xd146e0)
	pkg/sentry/syscalls/linux/sys_stat.go:127 +0x413
gvisor.googlesource.com/gvisor/pkg/sentry/syscalls/linux.Fstat(0xc000748a80, 0x4, 0x20000f80, 0x433be9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	pkg/sentry/syscalls/linux/sys_stat.go:96 +0xc6
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc000748a80, 0x5, 0x4, 0x20000f80, 0x433be9, 0x0, 0x0, 0x0, 0xc000107080, 0xc37500, ...)
	pkg/sentry/kernel/task_syscall.go:165 +0x30a
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc000748a80, 0x5, 0x4, 0x20000f80, 0x433be9, 0x0, 0x0, 0x0, 0x0, 0x0)
	pkg/sentry/kernel/task_syscall.go:283 +0x69
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc000748a80, 0x5, 0x4, 0x20000f80, 0x433be9, 0x0, 0x0, 0x0, 0x100080000, 0xc0001a5138)
	pkg/sentry/kernel/task_syscall.go:244 +0x99
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc000748a80, 0x2, 0xc000554480)
	pkg/sentry/kernel/task_syscall.go:219 +0x142
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*runApp).execute(0x0, 0xc000748a80, 0xd12c20, 0x0)
	pkg/sentry/kernel/task_run.go:215 +0xfda
gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).run(0xc000748a80, 0xc)
	pkg/sentry/kernel/task_run.go:91 +0x149
created by gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:279 +0xfe

Crashes (20051):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/17 18:48 https://gvisor.googlesource.com/gvisor master e491ebbacf54 def91db3 .config console log report syz C ci-gvisor-kvm-direct-sandbox
2020/04/15 06:47 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host-race
2020/04/15 06:47 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/15 06:47 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/15 06:40 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/04/15 04:07 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/15 02:57 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/15 02:47 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host-race
2020/04/15 02:47 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/15 02:39 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/04/15 01:44 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/04/15 01:37 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host-race
2020/04/15 01:30 gvisor 52b4b19249ad 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/14 16:48 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/14 16:37 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/14 16:27 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/14 16:27 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host-race
2020/04/14 16:27 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/04/14 16:18 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/14 16:05 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/14 15:57 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/14 15:57 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/04/14 15:57 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host-race
2020/04/14 15:47 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/14 15:40 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/04/14 15:37 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host-race
2020/04/14 15:36 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/04/14 15:35 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/14 15:26 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/04/14 15:26 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host-race
2020/04/14 15:21 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/14 15:16 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/14 15:10 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-main
2020/04/14 11:15 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host-race
2020/04/14 10:58 gvisor c230d12b5ce5 3f3c5574 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/03/16 02:43 gvisor 97127750289b 749688d2 .config console log report syz ci-gvisor-main
2020/03/16 02:23 gvisor 97127750289b 749688d2 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2020/03/01 09:08 gvisor ce4d1e45bb88 c88c7b75 .config console log report syz ci-gvisor-ptrace-direct-overlay-host
2020/09/01 00:04 gvisor ba25485d9683 d5a3ae1f .config console log report ci-gvisor-ptrace-proxy-sandbox-race
2020/08/31 21:56 gvisor ba25485d9683 d5a3ae1f .config console log report ci-gvisor-main
2020/08/31 18:06 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-ptrace-proxy-sandbox-race
2020/08/31 12:36 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-main
2020/08/31 05:54 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-main
2020/08/30 18:33 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-main
2020/08/30 17:25 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-main
2020/08/30 14:58 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-main
2020/08/30 09:49 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-main
2020/08/29 22:59 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-main
2020/08/29 11:20 gvisor 3bee863aee7d d5a3ae1f .config console log report ci-gvisor-ptrace-proxy-sandbox-race
2020/08/29 02:18 gvisor 421e35020bbc d5a3ae1f .config console log report ci-gvisor-main
2020/08/28 23:13 gvisor 421e35020bbc d5a3ae1f .config console log report ci-gvisor-ptrace-proxy-sandbox-race
2020/08/28 17:40 gvisor 421e35020bbc d5a3ae1f .config console log report ci-gvisor-main
2020/08/28 06:42 gvisor 01a35a2f1930 816e0689 .config console log report ci-gvisor-main
2020/08/28 00:17 gvisor 01a35a2f1930 816e0689 .config console log report ci-gvisor-ptrace-proxy-sandbox-race
2020/08/27 19:02 gvisor 983a55aa0649 816e0689 .config console log report ci-gvisor-main
2020/08/27 16:55 gvisor 983a55aa0649 816e0689 .config console log report ci-gvisor-main
2020/08/27 13:05 gvisor 983a55aa0649 816e0689 .config console log report ci-gvisor-main
2020/08/27 03:55 gvisor 983a55aa0649 318430cb .config console log report ci-gvisor-main
2020/08/27 02:33 gvisor 983a55aa0649 318430cb .config console log report ci-gvisor-ptrace-proxy-sandbox-race
2020/08/26 23:27 gvisor ebf5293374bc 318430cb .config console log report ci-gvisor-main
2020/08/26 12:19 gvisor ebf5293374bc 318430cb .config console log report ci-gvisor-main
2020/08/26 09:52 gvisor 70a7a3ac704a 344da168 .config console log report ci-gvisor-ptrace-proxy-sandbox-race
2020/08/26 07:12 gvisor 70a7a3ac704a 344da168 .config console log report ci-gvisor-main
2020/08/26 05:02 gvisor 70a7a3ac704a 344da168 .config console log report ci-gvisor-ptrace-proxy-sandbox-race
2020/08/22 13:44 gvisor 0324b94a73fe 6436ce4b .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2019/07/03 22:53 https://gvisor.googlesource.com/gvisor master 0aa9418a778b 55565fa0 .config console log report ci-gvisor-kvm-direct-overlay-host-race
2018/11/20 06:12 https://gvisor.googlesource.com/gvisor master 9d17eba121da 9bc2a903 .config console log report ci-gvisor-kvm-direct-overlay-host-race
2020/04/16 01:14 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 19:31 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 18:48 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 18:10 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 17:44 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 17:22 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 16:21 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 15:38 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 15:15 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 14:36 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 13:37 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 12:52 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 12:32 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 11:49 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 11:23 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 10:59 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 10:32 gvisor c230d12b5ce5 3f3c5574 .config console log report ci-gvisor-kvm-proxy-overlay-sandbox
2020/04/15 10:07 gvisor 52b4b19249ad 3f3c5574 .config console log report ci-gvisor-main
2020/04/15 10:02 gvisor 52b4b19249ad 3f3c5574 .config console log report ci-gvisor-ptrace-direct-overlay-host
2020/04/15 09:58 gvisor 52b4b19249ad 3f3c5574 .config console log report ci-gvisor-ptrace-direct-overlay-host
2020/04/15 09:54 gvisor 52b4b19249ad 3f3c5574 .config console log report ci-gvisor-ptrace-direct-overlay-host-race
2020/04/15 09:50 gvisor 52b4b19249ad 3f3c5574 .config console log report ci-gvisor-ptrace-direct-overlay-host-race
2020/04/15 09:46 gvisor 52b4b19249ad 3f3c5574 .config console log report ci-gvisor-main
2020/04/15 09:42 gvisor 52b4b19249ad 3f3c5574 .config console log report ci-gvisor-ptrace-direct-overlay-host-race
2020/04/07 10:18 gvisor f332a864e8cc 99a96044 .config console log report ci-gvisor-kvm-direct-sandbox
* Struck through repros no longer work on HEAD.