syzbot


general protection fault in __pm_runtime_resume

Status: fixed on 2019/10/15 23:40
Reported-by: syzbot+3cbe5cd105d2ad56a1df@syzkaller.appspotmail.com
Fix commit: 5f9242775bb6 HID: logitech: Fix general protection fault caused by Logitech driver
First crash: 1232d, last: 1168d
duplicates (15):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: unable to handle kernel paging request in __pm_runtime_resume 1 1173d 1173d 0/24 closed as dup on 2019/09/20 20:20
BUG: bad usercopy in ld_usb_read (2) C 135 1148d 1177d 0/24 closed as dup on 2019/09/17 12:21
KASAN: use-after-free Read in usbhid_close 3 1177d 1190d 0/24 closed as dup on 2019/09/03 12:12
KASAN: use-after-free Read in hiddev_ioctl 9 1206d 1218d 0/24 closed as dup on 2019/08/21 17:01
KASAN: use-after-free Read in usbhid_power C 590 1168d 1232d 0/24 closed as dup on 2019/08/12 14:29
general protection fault in usb_autopm_put_interface 1 1199d 1190d 0/24 closed as dup on 2019/09/03 12:12
WARNING in usbhid_raw_request/usb_submit_urb syz 37 1157d 1226d 0/24 closed as dup on 2019/08/21 14:08
KASAN: slab-out-of-bounds Read in ld_usb_read (2) 58 1148d 1177d 0/24 closed as dup on 2019/09/17 12:20
KASAN: use-after-free Read in usbhid_wait_io 2 1217d 1219d 0/24 closed as dup on 2019/08/21 17:01
KMSAN: uninit-value in ld_usb_read C 22 1148d 1177d 0/24 closed as dup on 2019/09/17 12:21
KMSAN: uninit-value in usb_autopm_put_interface C 2 1185d 1177d 0/24 closed as dup on 2019/09/17 11:56
WARNING in hiddev_ioctl/usb_submit_urb 1 1218d 1217d 0/24 closed as dup on 2019/08/21 17:02
KASAN: use-after-free Write in usbhid_open 4 1176d 1190d 0/24 closed as dup on 2019/09/03 12:13
KASAN: global-out-of-bounds Read in __pm_runtime_resume 3 1184d 1177d 0/24 closed as dup on 2019/09/17 12:15
KASAN: use-after-free Read in __pm_runtime_resume C 21 1169d 1222d 0/24 closed as dup on 2019/08/12 14:27
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in __pm_runtime_resume C done 108 287d 466d 22/24 fixed on 2022/03/08 16:11
upstream general protection fault in __pm_runtime_resume (2) C error 7 259d 269d 23/24 upstream: reported C repro on 2022/03/13 05:35
Patch testing requests:
Created Duration User Patch Repo Result
2019/08/20 17:45 17m stern@rowland.harvard.edu patch https://github.com/google/kasan.git 7f7867ff OK
2019/08/15 17:11 18m stern@rowland.harvard.edu patch https://github.com/google/kasan.git 6a3599ce OK
2019/08/15 15:57 10m stern@rowland.harvard.edu patch https://github.com/google/kasan.git 6a3599ce report log
2019/08/12 14:47 18m hdanton@sina.com patch https://github.com/google/kasan.git 7f7867ff OK
2019/08/12 12:32 18m andreyknvl@google.com patch https://github.com/google/kasan.git 6a3599ce OK

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
CPU: 1 PID: 1729 Comm: syz-executor902 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__pm_runtime_resume+0x49/0x180 drivers/base/power/runtime.c:1069
Code: ad ab cf fe 45 85 ed 0f 85 9a 00 00 00 e8 2f aa cf fe 48 8d bd 41 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 fe 00 00 00
RSP: 0018:ffff8881d2b5f8e0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000020 RCX: ffffffff826e3063
RDX: 000000002000006e RSI: ffffffff826e3071 RDI: 0000000100000370
RBP: 000000010000002f R08: ffff8881d39f9800 R09: fffffbfff0ec4971
R10: ffff8881d2b5f940 R11: ffffffff87624b87 R12: 0000000000000004
R13: 0000000000000000 R14: ffff8881d2f3a000 R15: ffffffff89a84fe0
FS:  00005555569d2880(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043f6e0 CR3: 00000001d591d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 pm_runtime_get_sync include/linux/pm_runtime.h:226 [inline]
 usb_autopm_get_interface+0x1b/0x50 drivers/usb/core/driver.c:1709
 usbhid_power+0x7c/0xe0 drivers/hid/usbhid/hid-core.c:1234
 hid_hw_power include/linux/hid.h:1038 [inline]
 hidraw_open+0x20d/0x740 drivers/hid/hidraw.c:282
 chrdev_open+0x219/0x5c0 fs/char_dev.c:414
 do_dentry_open+0x494/0x1120 fs/open.c:797
 do_last fs/namei.c:3416 [inline]
 path_openat+0x1430/0x3f50 fs/namei.c:3533
 do_filp_open+0x1a1/0x280 fs/namei.c:3563
 do_sys_open+0x3c0/0x580 fs/open.c:1089
 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x401a50
Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 7d 5c 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00
RSP: 002b:00007ffc0b4f5ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000401a50
RDX: 0000000000000000 RSI: 0000000000002040 RDI: 00007ffc0b4f5cf0
RBP: 6666666666666667 R08: 000000000000000f R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402a70
R13: 0000000000402b00 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 61f26407f0c07ddd ]---
RIP: 0010:__pm_runtime_resume+0x49/0x180 drivers/base/power/runtime.c:1069
Code: ad ab cf fe 45 85 ed 0f 85 9a 00 00 00 e8 2f aa cf fe 48 8d bd 41 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 fe 00 00 00
RSP: 0018:ffff8881d2b5f8e0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000020 RCX: ffffffff826e3063
RDX: 000000002000006e RSI: ffffffff826e3071 RDI: 0000000100000370
RBP: 000000010000002f R08: ffff8881d39f9800 R09: fffffbfff0ec4971
R10: ffff8881d2b5f940 R11: ffffffff87624b87 R12: 0000000000000004
R13: 0000000000000000 R14: ffff8881d2f3a000 R15: ffffffff89a84fe0
FS:  00005555569d2880(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043f6e0 CR3: 00000001d591d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (197):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-usb 2019/09/10 03:32 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report syz C
ci2-upstream-usb 2019/09/08 21:10 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report syz C
ci2-upstream-usb 2019/08/21 20:12 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 4ea67ff8 .config log report syz C
ci2-upstream-usb 2019/08/14 18:18 https://github.com/google/kasan.git usb-fuzzer d0847550e22d 5576551b .config log report syz C
ci2-upstream-usb 2019/08/14 17:18 https://github.com/google/kasan.git usb-fuzzer d0847550e22d 5576551b .config log report syz C
ci2-upstream-usb 2019/08/14 17:00 https://github.com/google/kasan.git usb-fuzzer d0847550e22d 5576551b .config log report syz C
ci2-upstream-usb 2019/08/14 14:12 https://github.com/google/kasan.git usb-fuzzer d0847550e22d 5576551b .config log report syz C
ci2-upstream-usb 2019/08/14 11:52 https://github.com/google/kasan.git usb-fuzzer d0847550e22d ef801a3e .config log report syz C
ci2-upstream-usb 2019/08/14 09:46 https://github.com/google/kasan.git usb-fuzzer d0847550e22d ef801a3e .config log report syz C
ci2-upstream-usb 2019/08/14 05:01 https://github.com/google/kasan.git usb-fuzzer d0847550e22d ef801a3e .config log report syz C
ci2-upstream-usb 2019/08/14 01:13 https://github.com/google/kasan.git usb-fuzzer d0847550e22d ef801a3e .config log report syz C
ci2-upstream-usb 2019/08/13 19:10 https://github.com/google/kasan.git usb-fuzzer d0847550e22d 74d61399 .config log report syz C
ci2-upstream-usb 2019/08/13 18:52 https://github.com/google/kasan.git usb-fuzzer d0847550e22d 74d61399 .config log report syz C
ci2-upstream-usb 2019/08/10 00:56 https://github.com/google/kasan.git usb-fuzzer e96407b49762 aff9e255 .config log report syz C
ci2-upstream-usb 2019/08/09 10:18 https://github.com/google/kasan.git usb-fuzzer e96407b49762 ede31a9b .config log report syz C
ci2-upstream-usb 2019/08/09 08:23 https://github.com/google/kasan.git usb-fuzzer e96407b49762 ede31a9b .config log report syz C
ci2-upstream-usb 2019/08/08 08:59 https://github.com/google/kasan.git usb-fuzzer e96407b49762 e6ebef88 .config log report syz C
ci2-upstream-usb 2019/08/05 21:09 https://github.com/google/kasan.git usb-fuzzer e96407b49762 6affd8e8 .config log report syz C
ci2-upstream-usb 2019/07/25 06:57 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 32329ceb .config log report syz C
ci2-upstream-usb 2019/07/25 05:03 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 32329ceb .config log report syz C
ci2-upstream-usb 2019/08/08 20:06 https://github.com/google/kasan.git usb-fuzzer e96407b49762 bcc419e9 .config log report syz
ci2-upstream-usb 2019/09/25 12:17 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e e38a6630 .config log report
ci2-upstream-usb 2019/09/25 10:46 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e e38a6630 .config log report
ci2-upstream-usb 2019/09/25 08:02 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e e38a6630 .config log report
ci2-upstream-usb 2019/09/24 23:05 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e e38a6630 .config log report
ci2-upstream-usb 2019/09/24 07:11 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config log report
ci2-upstream-usb 2019/09/23 19:27 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e c68252d2 .config log report
ci2-upstream-usb 2019/09/23 11:16 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config log report
ci2-upstream-usb 2019/09/22 14:52 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config log report
ci2-upstream-usb 2019/09/22 11:07 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config log report
ci2-upstream-usb 2019/09/22 06:44 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config log report
ci2-upstream-usb 2019/09/22 01:05 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config log report
ci2-upstream-usb 2019/09/21 23:46 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config log report
ci2-upstream-usb 2019/09/20 14:08 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config log report
ci2-upstream-usb 2019/09/20 08:06 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 4d3ae0b7 .config log report
ci2-upstream-usb 2019/09/19 11:50 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 eb940044 .config log report
ci2-upstream-usb 2019/09/19 03:59 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 46c0be24 .config log report
ci2-upstream-usb 2019/09/18 18:22 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 46c0be24 .config log report
ci2-upstream-usb 2019/09/18 14:08 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 1037b424 .config log report
ci2-upstream-usb 2019/09/18 10:20 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 03e0d245 .config log report
ci2-upstream-usb 2019/09/18 04:57 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 03e0d245 .config log report
ci2-upstream-usb 2019/09/17 19:32 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 13dcda9b .config log report
ci2-upstream-usb 2019/09/15 19:09 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 32d59357 .config log report
ci2-upstream-usb 2019/09/15 14:02 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 32d59357 .config log report
ci2-upstream-usb 2019/09/15 08:59 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 32d59357 .config log report
ci2-upstream-usb 2019/09/14 10:06 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 32d59357 .config log report
ci2-upstream-usb 2019/09/13 23:32 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 32d59357 .config log report
ci2-upstream-usb 2019/09/13 22:06 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 32d59357 .config log report
ci2-upstream-usb 2019/09/13 17:52 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 32d59357 .config log report
ci2-upstream-usb 2019/09/13 10:08 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 40fa42bc .config log report
ci2-upstream-usb 2019/09/13 08:52 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 40fa42bc .config log report
ci2-upstream-usb 2019/09/13 04:53 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 40fa42bc .config log report
ci2-upstream-usb 2019/09/13 02:50 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 40fa42bc .config log report
ci2-upstream-usb 2019/09/12 16:33 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 0b7672ee .config log report
ci2-upstream-usb 2019/09/11 14:58 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/11 12:50 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/11 10:49 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/11 09:42 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/11 03:34 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/11 01:14 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/10 23:33 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/10 12:57 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/10 08:10 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/10 05:20 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/09 14:42 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/09 09:36 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/09 03:46 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/09/08 17:24 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 a60cb4cd .config log report
ci2-upstream-usb 2019/07/23 21:22 https://github.com/google/kasan.git usb-fuzzer 6a3599ceaa39 de453f34 .config log report
* Struck through repros no longer work on HEAD.