syzbot


BUG: unable to handle kernel paging request in ipcget

Status: fixed on 2018/01/11 01:23
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+362ae63b121c06066d2b6e1385d38efecbeca4f6@syzkaller.appspotmail.com
Fix commit: d76c68109f37 crypto: pcrypt - fix freeing pcrypt instances
First crash: 2378d, last: 2377d

Sample crash report:
binder: BINDER_SET_CONTEXT_MGR already set
binder: 26895:26908 ioctl 40046207 0 returned -16
BUG: unable to handle kernel paging request at ffff880227bf4830
IP: __read_once_size include/linux/compiler.h:183 [inline]
IP: __rhashtable_lookup include/linux/rhashtable.h:631 [inline]
IP: rhashtable_lookup include/linux/rhashtable.h:666 [inline]
IP: rhashtable_lookup_fast include/linux/rhashtable.h:692 [inline]
IP: ipc_findkey ipc/util.c:183 [inline]
IP: ipcget_public ipc/util.c:378 [inline]
IP: ipcget+0x12a/0x620 ipc/util.c:654
PGD 404e067 P4D 404e067 PUD 4051067 PMD 0 
Oops: 0000 [#1] SMP
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 26917 Comm: syz-executor2 Not tainted 4.15.0-rc3-next-20171214+ #67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:183 [inline]
RIP: 0010:__rhashtable_lookup include/linux/rhashtable.h:631 [inline]
RIP: 0010:rhashtable_lookup include/linux/rhashtable.h:666 [inline]
RIP: 0010:rhashtable_lookup_fast include/linux/rhashtable.h:692 [inline]
RIP: 0010:ipc_findkey ipc/util.c:183 [inline]
RIP: 0010:ipcget_public ipc/util.c:378 [inline]
RIP: 0010:ipcget+0x12a/0x620 ipc/util.c:654
RSP: 0018:ffffc90000e97ea8 EFLAGS: 00010212
RAX: 0000000000010000 RBX: 000000000248bdf6 RCX: ffffffff8161ed2a
RDX: 0000000000000016 RSI: ffffc90003669000 RDI: ffffc90000e97ee4
RBP: ffffc90000e97f10 R08: 0000000000000001 R09: 0000000000000002
R10: ffffc90000e97e30 R11: 0000000000000002 R12: ffff88020d6a53d8
R13: ffffc90000e97f20 R14: ffff880215795800 R15: ffff880227bf4830
FS:  00007eff574ea700(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff880227bf4830 CR3: 00000001fd3e8003 CR4: 00000000001606e0
Call Trace:
 SYSC_shmget ipc/shm.c:675 [inline]
 SyS_shmget+0x52/0x60 ipc/shm.c:659
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x452a09
RSP: 002b:00007eff574e9c58 EFLAGS: 00000212 ORIG_RAX: 000000000000001d
RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452a09
RDX: 0000000000000a00 RSI: 0000000000002000 RDI: 00000000798dd81e
RBP: 00000000000002f2 R08: 0000000000000000 R09: 0000000000000000
R10: 000000002094e000 R11: 0000000000000212 R12: 00000000006f1750
R13: 00000000ffffffff R14: 00007eff574ea6d4 R15: 0000000000000000
Code: 41 8b 0e c1 e8 05 8d 59 ff 21 c3 41 8b 4e 04 85 c9 0f 85 d5 03 00 00 e8 25 b6 c9 ff 89 d8 4d 8d bc c6 80 00 00 00 e8 16 b6 c9 ff <4d> 8b 3f 4c 89 7d a0 e8 8a e6 c2 ff 85 c0 74 12 e8 01 b6 c9 ff 
RIP: __read_once_size include/linux/compiler.h:183 [inline] RSP: ffffc90000e97ea8
RIP: __rhashtable_lookup include/linux/rhashtable.h:631 [inline] RSP: ffffc90000e97ea8
RIP: rhashtable_lookup include/linux/rhashtable.h:666 [inline] RSP: ffffc90000e97ea8
RIP: rhashtable_lookup_fast include/linux/rhashtable.h:692 [inline] RSP: ffffc90000e97ea8
RIP: ipc_findkey ipc/util.c:183 [inline] RSP: ffffc90000e97ea8
RIP: ipcget_public ipc/util.c:378 [inline] RSP: ffffc90000e97ea8
RIP: ipcget+0x12a/0x620 ipc/util.c:654 RSP: ffffc90000e97ea8
CR2: ffff880227bf4830
---[ end trace a8608be9e2a540ba ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/20 04:30 linux-next 6084b576dca2 2d836b1d .config console log report ci-upstream-next-kasan-gce
2017/12/19 01:25 linux-next 6084b576dca2 1c4160ef .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.