syzbot


kernel warning in vprintfmt (2)

Status: fixed on 2019/05/09 00:49
Reported-by: syzbot+36f58f45c1902ffdca18@syzkaller.appspotmail.com
Fix commit: f24797cdfdfd 9ns: fix format-string vulnerability in cmderror()
First crash: 2030d, last: 2024d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
akaros kernel warning in vprintfmt C 226 2030d 2031d 1/1 fixed on 2019/05/03 06:19

Sample crash report:
kernel warning at kern/src/printfmt.c:189, from core 1: _x && _x < ULIM
Stack Backtrace on Core 1:
#01 [<0xffffffffc200a42c>] in backtrace at src/kdebug.c:235
#02 [<0xffffffffc2009c54>] in _warn at src/init.c:326
#03 [<0xffffffffc20490e4>] in vprintfmt at src/printfmt.c:189
#04 [<0xffffffffc2049312>] in vsnprintf at src/printfmt.c:328
#05 [<0xffffffffc2058539>] in vset_errstr at src/syscall.c:509
#06 [<0xffffffffc205866b>] in set_error at src/syscall.c:542
#07 [<0xffffffffc2039a29>] in cmderror at src/ns/parse.c:121
#08 [<0xffffffffc2039b1b>] in lookupcmd at src/ns/parse.c:152
#09 [<0xffffffffc202876a>] in netlogctl at src/net/netlog.c:213
#10 [<0xffffffffc2016d5e>] in ipwrite at src/net/devip.c:1447
#11 [<0xffffffffc2040639>] in rwrite at src/ns/sysfile.c:1117
#12 [<0xffffffffc204088b>] in syswrite at src/ns/sysfile.c:1135
#13 [<0xffffffffc20593e9>] in sys_write at src/syscall.c:1785
#14 [<0xffffffffc2059f49>] in syscall at src/syscall.c:2578
#15 [<0xffffffffc205aaf8>] in run_local_syscall at src/syscall.c:2615
#16 [<0xffffffffc205b039>] in prep_syscalls at src/syscall.c:2635
#17 [<0xffffffffc20ac812>] in sysenter_callwrapper at arch/x86/trap.c:877
kernel panic at kern/arch/x86/trap.c:318, from core 1: Proc-ful Page Fault in the Kernel at 0x0000000000000005!
HW TRAP frame at 0xfffffff0000149c0 on core 1
  rax  0xffffffffc20baa10
  rbx  0xfffffff000014af8
  rcx  0x00000000ffffffff
  rdx  0x0000000000000005
  rbp  0xfffffff000014ae8
  rsi  0x0000000000000780
  rdi  0xffffffffc210fb30
  r8   0x0000000000000020
  r9   0x0000000000000005
  r10  0xffff8000000b8f00
  r11  0xffff8000000b8ec0
  r12  0xffffffffc2048830
  r13  0xfffffff000014b50
  r14  0x00000000ffffffff
  r15  0xffff80000d8041f1
  trap 0x0000000e Page Fault
  gsbs 0xffffffffc8e37dc0
  fsbs 0x0000000000000000
  err  0x--------00000000
  rip  0xffffffffc2048c49
  cs   0x------------0008
  flag 0x0000000000010286
  rsp  0xfffffff000014a88
  ss   0x------------0010
Backtrace of kernel context on Core 1:
#01 [<0xffffffffc2048c49>] in vprintfmt at src/printfmt.c:192
#02 [<0xffffffffc2049312>] in vsnprintf at src/printfmt.c:328
#03 [<0xffffffffc2058539>] in vset_errstr at src/syscall.c:509
#04 [<0xffffffffc205866b>] in set_error at src/syscall.c:542
#05 [<0xffffffffc2039a29>] in cmderror at src/ns/parse.c:121
#06 [<0xffffffffc2039b1b>] in lookupcmd at src/ns/parse.c:152
#07 [<0xffffffffc202876a>] in netlogctl at src/net/netlog.c:213
#08 [<0xffffffffc2016d5e>] in ipwrite at src/net/devip.c:1447
#09 [<0xffffffffc2040639>] in rwrite at src/ns/sysfile.c:1117
#10 [<0xffffffffc204088b>] in syswrite at src/ns/sysfile.c:1135
#11 [<0xffffffffc20593e9>] in sys_write at src/syscall.c:1785
#12 [<0xffffffffc2059f49>] in syscall at src/syscall.c:2578
#13 [<0xffffffffc205aaf8>] in run_local_syscall at src/syscall.c:2615
#14 [<0xffffffffc205b039>] in prep_syscalls at src/syscall.c:2635
#15 [<0xffffffffc20ac812>] in sysenter_callwrapper at arch/x86/trap.c:877

Crashes (98):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/03 07:09 akaros d8ea787e7260 1bfa09b9 .config console log report syz C ci-akaros-main
2019/05/08 22:39 akaros d8ea787e7260 1bb034d0 .config console log report ci-akaros-main
2019/05/08 19:33 akaros d8ea787e7260 1bb034d0 .config console log report ci-akaros-main
2019/05/08 16:52 akaros d8ea787e7260 1bb034d0 .config console log report ci-akaros-main
2019/05/08 15:37 akaros d8ea787e7260 1bb034d0 .config console log report ci-akaros-main
2019/05/08 14:30 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/08 11:19 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/08 08:36 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/08 06:35 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/08 05:29 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/08 03:07 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/08 00:17 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/07 22:12 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/07 19:09 akaros d8ea787e7260 a7383bfa .config console log report ci-akaros-main
2019/05/07 16:41 akaros d8ea787e7260 04e9d8ce .config console log report ci-akaros-main
2019/05/07 14:21 akaros d8ea787e7260 04e9d8ce .config console log report ci-akaros-main
2019/05/07 10:44 akaros d8ea787e7260 04e9d8ce .config console log report ci-akaros-main
2019/05/07 07:44 akaros d8ea787e7260 04e9d8ce .config console log report ci-akaros-main
2019/05/07 03:12 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/07 01:53 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 21:08 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 19:03 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 16:08 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 15:02 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 14:43 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 11:23 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 07:58 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 05:34 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 03:55 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 01:36 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/06 00:08 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 19:45 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 18:44 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 17:28 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 15:22 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 14:36 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 14:18 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 13:31 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 12:10 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 10:38 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 08:50 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 08:22 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 05:57 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 05:39 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 05:29 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 04:08 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 03:56 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/05 03:49 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/04 23:52 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/04 23:45 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/04 22:11 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/04 22:03 akaros d8ea787e7260 d28f4ce5 .config console log report ci-akaros-main
2019/05/03 06:51 akaros d8ea787e7260 1bfa09b9 .config console log report ci-akaros-main
2019/05/03 06:36 akaros d8ea787e7260 1bfa09b9 .config console log report ci-akaros-main
* Struck through repros no longer work on HEAD.