syzbot

 sign-in | mailing list | source | docs
🐞 Open [976] ≡ Subsystems 🐞 Fixed [5208] 🐞 Invalid [12459] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

INFO: trying to register non-static key in uhid_dev_destroy

Status: fixed on 2020/11/16 12:12
Subsystems: input
[Documentation on labels]
Reported-by: syzbot+0c601d7fbb8122d39093@syzkaller.appspotmail.com
Fix commit: bce1305c0ece HID: core: Correctly handle ReportSize being zero
First crash: 1501d, last: 1329d
Cause bisection: introduced by (bisect log) [merge commit]:
commit ada131c2f22498cf14248986a24ad1e6d4a1ae75
Author: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Date: Mon Feb 10 14:39:40 2020 +0000

  Merge branch 'for-5.6/upstream-fixes' into for-next

Crash: WARNING: ODEBUG bug in netdev_freemem (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit bce1305c0ece3dc549663605e567655dd701752c
Author: Marc Zyngier <maz@kernel.org>
Date: Sat Aug 29 11:26:01 2020 +0000

  HID: core: Correctly handle ReportSize being zero

  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
INFO: trying to register non-static key in uhid_dev_destroy 1 (3) 2020/11/11 13:22
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: trying to register non-static key in uhid_dev_destroy C done 14 1334d 1502d 1/1 fixed on 2020/09/20 13:43
linux-4.14 INFO: trying to register non-static key in uhid_dev_destroy C error 10 1421d 1495d 0/1 upstream: reported C repro on 2020/03/13 03:28
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2020/09/22 06:03 37m brookebasile@gmail.com upstream OK
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2020/10/06 01:48 3h05m bisect fix upstream job log (1)
2020/08/26 05:16 21m bisect fix upstream job log (0) log
2020/07/26 11:53 21m bisect fix upstream job log (0) log

Sample crash report:
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 0 PID: 9537 Comm: syz-executor213 Not tainted 5.7.0-rc5-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 assign_lock_key kernel/locking/lockdep.c:913 [inline]
 register_lock_class+0x1664/0x1760 kernel/locking/lockdep.c:1225
 __lock_acquire+0x104/0x4c50 kernel/locking/lockdep.c:4234
 lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4934
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159
 __wake_up_common_lock+0xb4/0x130 kernel/sched/wait.c:122
 uhid_dev_destroy+0x6f/0x100 drivers/hid/uhid.c:563
 uhid_char_release+0x4e/0xb0 drivers/hid/uhid.c:642
 __fput+0x33e/0x880 fs/file_table.c:280
 task_work_run+0xf4/0x1b0 kernel/task_work.c:123
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xb34/0x2dd0 kernel/exit.c:796
 do_group_exit+0x125/0x340 kernel/exit.c:894
 __do_sys_exit_group kernel/exit.c:905 [inline]
 __se_sys_exit_group kernel/exit.c:903 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:903
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x4337f8
Code: Bad RIP value.
RSP: 002b:00007ffff93d1388 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004337f8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004a79d0 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006b9180 R14: 0000000000000000 R15: 0000000000000000
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 9537 Comm: syz-executor213 Not tainted 5.7.0-rc5-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
RIP: 0010:__wake_up_common+0xdf/0x650 kernel/sched/wait.c:86
Code: 05 00 00 4c 8b 43 40 49 83 e8 18 49 8d 78 18 48 39 3c 24 0f 84 6a 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <80> 3c 01 00 0f 85 3d 05 00 00 49 8b 40 18 89 54 24 10 31 db 48 bd
RSP: 0018:ffffc90001427b70 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: ffff88801d7113f8 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 1ffffffff1513172 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffe8 R09: ffffc90001427c08
R10: 0000000000000003 R11: fffff52000284f68 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000001112880(0000) GS:ffff88802ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004337ce CR3: 00000000257ee000 CR4: 0000000000340ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:123
 uhid_dev_destroy+0x6f/0x100 drivers/hid/uhid.c:563
 uhid_char_release+0x4e/0xb0 drivers/hid/uhid.c:642
 __fput+0x33e/0x880 fs/file_table.c:280
 task_work_run+0xf4/0x1b0 kernel/task_work.c:123
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xb34/0x2dd0 kernel/exit.c:796
 do_group_exit+0x125/0x340 kernel/exit.c:894
 __do_sys_exit_group kernel/exit.c:905 [inline]
 __se_sys_exit_group kernel/exit.c:903 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:903
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x4337f8
Code: Bad RIP value.
RSP: 002b:00007ffff93d1388 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004337f8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004a79d0 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006b9180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 148e569931f1b041 ]---
RIP: 0010:__wake_up_common+0xdf/0x650 kernel/sched/wait.c:86
Code: 05 00 00 4c 8b 43 40 49 83 e8 18 49 8d 78 18 48 39 3c 24 0f 84 6a 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <80> 3c 01 00 0f 85 3d 05 00 00 49 8b 40 18 89 54 24 10 31 db 48 bd
RSP: 0018:ffffc90001427b70 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: ffff88801d7113f8 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 1ffffffff1513172 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffe8 R09: ffffc90001427c08
R10: 0000000000000003 R11: fffff52000284f68 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000001112880(0000) GS:ffff88802ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004337ce CR3: 00000000257ee000 CR4: 0000000000340ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (40):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/16 19:03 upstream 12bf0b632ed0 37bccd4e .config console log report syz C ci-qemu-upstream
2020/05/12 16:18 upstream 152036d1379f 160c7698 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/04/23 13:05 upstream c578ddb39e56 2e44d63e .config console log report syz C ci-upstream-kasan-gce-root
2020/04/16 13:09 upstream 00086336a8d9 c743fcb3 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/04/15 21:43 upstream 8632e9b5645b 3f3c5574 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/04/15 20:40 upstream 8632e9b5645b 3f3c5574 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/04/13 14:05 upstream 8f3d9f354286 17a986e5 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/04/12 07:32 upstream b032227c6293 a8c6a3f8 .config console log report syz C ci-upstream-kasan-gce-root
2020/03/26 13:31 upstream 1b649e0bcae7 e8e6c7d2 .config console log report syz C ci-upstream-kasan-gce
2020/03/26 01:06 upstream 76ccd234269b 41f049cc .config console log report syz C ci-upstream-kasan-gce
2020/03/23 23:37 upstream 16fbf79b0f83 84f999d6 .config console log report syz C ci-upstream-kasan-gce-root
2020/03/23 23:17 upstream 16fbf79b0f83 84f999d6 .config console log report syz C ci-upstream-kasan-gce
2020/03/23 11:39 upstream 67d584e33e54 78267cec .config console log report syz C ci-upstream-kasan-gce
2020/03/13 23:20 upstream 3cc6e2c599cd d850e9d0 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/03/12 05:59 upstream e3a36eb6dfae e7caca8e .config console log report syz C ci-upstream-kasan-gce
2020/03/11 12:59 upstream e94148454103 35f53e45 .config console log report syz C ci-upstream-kasan-gce-root
2020/06/14 03:52 upstream 435faf5c218a dbce178a .config console log report syz C ci-qemu-upstream-386
2020/03/29 11:51 upstream 906c40438bb6 05736b29 .config console log report syz C ci-upstream-kasan-gce-386
2020/03/28 23:15 upstream 69c5eea3128e f1ebdfba .config console log report syz C ci-upstream-kasan-gce-386
2020/03/25 08:39 upstream 76ccd234269b 41f049cc .config console log report syz C ci-upstream-kasan-gce-386
2020/03/12 15:49 upstream e6e6ec48dd0f d850e9d0 .config console log report syz C ci-upstream-kasan-gce-386
2020/04/25 23:04 linux-next ac935d227366 b8bb8e5f .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/04/18 21:15 linux-next ac935d227366 365fba24 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/04/16 21:48 linux-next ac935d227366 c743fcb3 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/04/16 10:21 linux-next ac935d227366 c743fcb3 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/04/02 02:19 linux-next 770fbb32d34e a34e2c33 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/03/23 23:04 linux-next 770fbb32d34e 84f999d6 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/03/06 16:40 linux-next c99b17ac0399 c88c7b75 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/05/11 13:17 upstream 2ef96a5bb12b f8f57555 .config console log report syz ci-upstream-kasan-gce-root
2020/04/14 06:42 upstream 8f3d9f354286 7c54686a .config console log report syz ci-upstream-kasan-gce-root
2020/04/08 06:40 upstream 763dede1b248 db9bcd4b .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/04/03 05:19 upstream 7be97138e727 a34e2c33 .config console log report syz ci-upstream-kasan-gce
2020/04/03 00:27 upstream 7be97138e727 a34e2c33 .config console log report syz ci-upstream-kasan-gce-root
2020/04/24 17:34 upstream b4f633221f0a 03d97a1b .config console log report syz ci-upstream-kasan-gce-386
2020/04/09 04:42 upstream ae46d2aa6a7f db9bcd4b .config console log report syz ci-upstream-kasan-gce-386
2020/03/28 22:16 upstream 69c5eea3128e f1ebdfba .config console log report syz ci-upstream-kasan-gce-386
2020/04/18 12:43 linux-next ac935d227366 435c6d53 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2020/04/07 05:34 upstream 7e63420847ae 99a96044 .config console log report ci-upstream-kasan-gce
2020/03/15 21:20 upstream d3dca69085e9 749688d2 .config console log report ci-upstream-kasan-gce
2020/05/31 06:22 upstream ffeb595d8481 6f3e1c7c .config console log report ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.