syzbot

 sign-in | mailing list | source | docs
🐞 Open [979] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12473] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

WARNING in kernfs_get

Status: fixed on 2019/11/20 22:01
Reported-by: syzbot+3dcb532381f98c86aeb1@syzkaller.appspotmail.com
Fix commit: ac43432cb1f5 driver core: Fix use-after-free and double free on glue directory
First crash: 2048d, last: 1719d
Cause bisection: introduced by (bisect log) :
commit 726e41097920a73e4c7c33385dcc0debb1281e18
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date: Tue Jul 10 00:29:10 2018 +0000

  drivers: core: Remove glue dirs from sysfs earlier

Crash: WARNING: refcount bug in hci_register_dev (log)
Repro: C syz .config
  
▶ ▼ Duplicate bugs (3)
duplicates (3):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
WARNING in sysfs_remove_group (2) fs C 1725 1669d 2036d 0/26 closed as dup on 2018/11/25 13:06
WARNING in kernfs_put kernfs C 4 1874d 1996d 0/26 closed as dup on 2018/10/31 16:05
WARNING: refcount bug in kobject_put kernel C 4 1755d 1994d 0/26 closed as dup on 2018/11/02 15:33
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
WARNING in kernfs_get 4 (6) 2019/11/20 10:42
Reminder: 29 open syzbot bugs in bluetooth subsystem 1 (1) 2019/07/24 01:41
Reminder: 29 open syzbot bugs in bluetooth subsystem 1 (1) 2019/07/09 19:07
Reminder: 27 open syzbot bugs in bluetooth subsystem 1 (1) 2019/06/24 05:14
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 WARNING in kernfs_get C done 14 1680d 1820d 1/1 fixed on 2019/12/05 23:59
upstream WARNING in kernfs_get (2) kernfs 2 1300d 1318d 0/26 auto-closed as invalid on 2021/01/25 03:55
linux-4.14 WARNING in kernfs_get C done 17 1704d 1824d 1/1 fixed on 2019/12/07 19:24
upstream WARNING in kernfs_get (4) kernfs syz error 3 436d 439d 0/26 auto-obsoleted due to no activity on 2023/06/07 19:32
upstream WARNING in kernfs_get (3) kernfs 3 864d 869d 0/26 auto-closed as invalid on 2022/02/04 06:25
android-414 WARNING in kernfs_get syz 69 1683d 1835d 0/1 public: reported syz repro on 2019/04/10 15:44

Sample crash report:
debugfs: Directory 'hci2' with parent 'bluetooth' already present!
------------[ cut here ]------------
WARNING: CPU: 0 PID: 11590 at fs/kernfs/dir.c:493 kernfs_get.part.0.cold+0x11/0x18 fs/kernfs/dir.c:493
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 11590 Comm: syz-executor983 Not tainted 5.3.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 panic+0x2dc/0x755 kernel/panic.c:219
 __warn.cold+0x20/0x4c kernel/panic.c:576
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:179 [inline]
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1026
RIP: 0010:kernfs_get.part.0.cold+0x11/0x18 fs/kernfs/dir.c:493
Code: ff e8 cc 37 97 ff 48 c7 c7 80 6f 99 87 e8 14 d8 80 ff 0f 0b e9 45 a8 ff ff e8 b4 37 97 ff 48 c7 c7 80 6f 99 87 e8 fc d7 80 ff <0f> 0b e9 69 ac ff ff e8 9c 37 97 ff 48 c7 c7 80 6f 99 87 e8 e4 d7
RSP: 0018:ffff88808b017818 EFLAGS: 00010282
RAX: 0000000000000024 RBX: ffff88809704c2a0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815c5216 RDI: ffffed1011602ef5
RBP: ffff88808b017828 R08: 0000000000000024 R09: fffffbfff134ada0
R10: fffffbfff134ad9f R11: ffffffff89a56cff R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88821b6fd540
 kernfs_get fs/kernfs/dir.c:492 [inline]
 kernfs_new_node+0xb6/0x120 fs/kernfs/dir.c:700
 kernfs_create_dir_ns+0x52/0x160 fs/kernfs/dir.c:1022
 sysfs_create_dir_ns+0x136/0x290 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:89 [inline]
 kobject_add_internal lib/kobject.c:255 [inline]
 kobject_add_internal.cold+0x116/0x662 lib/kobject.c:225
 kobject_add_varg lib/kobject.c:390 [inline]
 kobject_add+0x150/0x1c0 lib/kobject.c:442
 device_add+0x3b7/0x17a0 drivers/base/core.c:2065
 hci_register_dev+0x2e8/0x8f0 net/bluetooth/hci_core.c:3307
 __vhci_create_device+0x2c5/0x5d0 drivers/bluetooth/hci_vhci.c:124
 vhci_create_device drivers/bluetooth/hci_vhci.c:148 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:204 [inline]
 vhci_write+0x2d0/0x470 drivers/bluetooth/hci_vhci.c:284
 call_write_iter include/linux/fs.h:1870 [inline]
 new_sync_write+0x4d3/0x770 fs/read_write.c:483
 __vfs_write+0xe1/0x110 fs/read_write.c:496
 vfs_write+0x268/0x5d0 fs/read_write.c:558
 ksys_write+0x14f/0x290 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:620
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441289
Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffdcfb21698 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441289
RDX: 0000000000000002 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 00000000000184d0 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000402000
R13: 0000000000402090 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (316):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/08/01 20:45 upstream 1e78030e5e5b 835dffe7 .config console log report syz C ci-upstream-kasan-gce-root
2019/06/30 07:09 upstream 728254541ebc 7509bf36 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/06/27 07:50 upstream 249155c20f9b 7509bf36 .config console log report syz C ci-upstream-kasan-gce-root
2019/06/01 17:02 upstream 3ab4436f688c 53c81ea5 .config console log report syz C ci-upstream-kasan-gce-root
2019/06/01 05:30 upstream 3ab4436f688c 53c81ea5 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/23 00:05 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce
2019/03/14 04:41 upstream ebc551f2b8f9 2881fc25 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/03/09 23:16 upstream 38e7571c07be 12365b99 .config console log report syz C ci-upstream-kasan-gce-root
2019/03/07 06:25 upstream afe6fe7036c6 18215b8d .config console log report syz C ci-upstream-kasan-gce
2019/03/06 19:36 upstream 3717f613f48d 05cf83bf .config console log report syz C ci-upstream-kasan-gce-root
2019/03/06 17:47 upstream 3717f613f48d 05cf83bf .config console log report syz C ci-upstream-kasan-gce
2019/03/06 17:46 upstream 3717f613f48d 05cf83bf .config console log report syz C ci-upstream-kasan-gce-root
2019/03/06 17:45 upstream 3717f613f48d 05cf83bf .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/03/06 17:45 upstream 3717f613f48d 05cf83bf .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/03/02 12:43 upstream a215ce8f0e00 1c0e457a .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/02/27 15:49 upstream 7d762d69145a 083cfd0e .config console log report syz C ci-upstream-kasan-gce-root
2019/02/27 15:17 upstream 7d762d69145a 083cfd0e .config console log report syz C ci-upstream-kasan-gce
2019/02/26 19:14 upstream 7d762d69145a a36ecd98 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/02/26 19:07 upstream 7d762d69145a a36ecd98 .config console log report syz C ci-upstream-kasan-gce
2019/02/19 21:02 upstream b5372fe5dc84 4df543c9 .config console log report syz C ci-upstream-kasan-gce-root
2019/02/14 10:38 upstream 1f947a7a011f 6a46f448 .config console log report syz C ci-upstream-kasan-gce
2019/02/14 10:37 upstream 1f947a7a011f 6a46f448 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/02/14 10:33 upstream 1f947a7a011f 6a46f448 .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/09/10 02:01 upstream 9a5682765a2e 6b5120a4 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/23 00:35 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-386
2019/04/22 17:01 upstream 085b7755808a 0a77c33c .config console log report syz C ci-upstream-kasan-gce-386
2019/02/27 15:15 upstream 7d762d69145a 083cfd0e .config console log report syz C ci-upstream-kasan-gce-386
2019/04/27 04:08 linux-next 3ddfa8af5dc9 b617407b .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/03/04 23:20 linux-next 5d57915a1c8b 7c693b52 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/02/26 19:07 linux-next 8e7f81e2ebc4 a36ecd98 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/02/19 13:07 linux-next 43dc36c945ef 59f36113 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/02/14 12:12 linux-next b3418f8bddf4 6a46f448 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/07/01 00:57 upstream 6fbc7275c7a9 699d6448 .config console log report syz ci-upstream-kasan-gce
2019/06/05 09:04 upstream 788a024921c4 bfb4a51e .config console log report syz ci-upstream-kasan-gce
2019/06/02 12:35 upstream 3ab4436f688c 53c81ea5 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/03/22 13:59 upstream 0939221e6468 dce6e62f .config console log report syz ci-upstream-kasan-gce-root
2019/03/12 04:52 upstream a089e4fed5c5 12365b99 .config console log report syz ci-upstream-kasan-gce
2019/03/07 05:07 upstream afe6fe7036c6 18215b8d .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/03/07 01:54 upstream afe6fe7036c6 18215b8d .config console log report syz ci-upstream-kasan-gce-root
2019/06/27 05:45 upstream 249155c20f9b 7509bf36 .config console log report syz ci-upstream-kasan-gce-386
2019/03/16 14:40 upstream 9c7dc824d9a4 bab43553 .config console log report syz ci-upstream-kasan-gce-386
2019/03/07 04:28 upstream afe6fe7036c6 18215b8d .config console log report syz ci-upstream-kasan-gce-386
2019/03/02 16:54 upstream a215ce8f0e00 1c0e457a .config console log report syz ci-upstream-kasan-gce-386
2019/07/25 10:11 linux-next 13bf6d6a51df 32329ceb .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/08/05 01:33 upstream 4b6f23161b4e 6affd8e8 .config console log report ci-upstream-kasan-gce
2019/08/01 19:33 upstream 1e78030e5e5b 835dffe7 .config console log report ci-upstream-kasan-gce
2019/07/31 13:51 upstream 629f8205a6cc 7c7ded69 .config console log report ci-upstream-kasan-gce
2019/07/27 08:59 upstream 3ea54d9b0d65 c85e1c5b .config console log report ci-upstream-kasan-gce
2019/07/20 10:24 upstream abdfd52a295f 1656845f .config console log report ci-upstream-kasan-gce-root
2019/07/19 18:35 upstream 3bfe1fc46794 1656845f .config console log report ci-upstream-kasan-gce
2019/07/17 04:08 upstream 3eb514866f20 0d10349c .config console log report ci-upstream-kasan-gce
2019/07/04 12:56 upstream 550d1f5bda33 55565fa0 .config console log report ci-upstream-kasan-gce
2019/06/26 11:20 upstream 249155c20f9b 4d342240 .config console log report ci-upstream-kasan-gce
2019/06/21 18:41 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-root
2019/06/21 14:25 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-root
2019/06/15 23:19 upstream e01e060fe00d 442206d7 .config console log report ci-upstream-kasan-gce-selinux-root
2019/06/14 15:23 upstream c11fb13a117e 998ccc76 .config console log report ci-upstream-kasan-gce-selinux-root
2019/06/11 22:16 upstream 01ccc3ad4413 ea2f4006 .config console log report ci-upstream-kasan-gce
2019/06/08 12:52 upstream 79c3ba3206c7 cf9c3a50 .config console log report ci-upstream-kasan-gce
2019/06/08 06:28 upstream 79c3ba3206c7 cf9c3a50 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/06 00:32 upstream 156c05917e09 bfb4a51e .config console log report ci-upstream-kasan-gce
2019/04/28 13:47 upstream 037904a22bf8 b617407b .config console log report ci-upstream-kasan-gce-smack-root
2019/04/28 00:14 upstream 037904a22bf8 b617407b .config console log report ci-upstream-kasan-gce
2019/04/25 21:05 upstream f6f3e747454f f46aabc8 .config console log report ci-upstream-kasan-gce-smack-root
2019/04/24 12:06 upstream ba25b50d582f 8e3c52b1 .config console log report ci-upstream-kasan-gce-root
2019/04/23 21:52 upstream 7142eaa58b49 4d3d6a50 .config console log report ci-upstream-kasan-gce-root
2019/04/22 14:58 upstream 085b7755808a 0a77c33c .config console log report ci-upstream-kasan-gce-smack-root
2019/04/13 11:15 upstream 6d0a598489ca c402d8f1 .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/13 02:46 upstream 8ee15f324866 c402d8f1 .config console log report ci-upstream-kasan-gce
2019/04/10 20:20 upstream 771acc7e4a6e e955ac50 .config console log report ci-upstream-kasan-gce
2019/04/10 03:36 upstream 869e3305f23d 65b612b7 .config console log report ci-upstream-kasan-gce
2019/04/09 04:07 upstream 869e3305f23d 995065ff .config console log report ci-upstream-kasan-gce
2019/04/08 04:40 upstream 3b0468914708 c34fde03 .config console log report ci-upstream-kasan-gce-root
2019/04/04 05:35 upstream 8ed86627f715 d6fc4177 .config console log report ci-upstream-kasan-gce-root
2019/04/03 05:33 upstream 5e7a8ca31926 dfd3394d .config console log report ci-upstream-kasan-gce-root
2019/07/19 21:01 upstream 31cc088a4f5d 1656845f .config console log report ci-upstream-kasan-gce-386
2019/07/01 08:19 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-386
2019/06/23 18:19 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-386
2019/06/19 20:11 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce-386
2019/05/27 02:03 upstream 128f2bfafcf2 85c57315 .config console log report ci-upstream-kasan-gce-386
2019/05/23 12:37 upstream 54dee406374c 0dadcd9d .config console log report ci-upstream-kasan-gce-386
2019/05/22 04:17 upstream 5bdd9ad875b6 13427bd9 .config console log report ci-upstream-kasan-gce-386
2019/05/19 11:53 upstream 72cf0b07418a 5a4461b0 .config console log report ci-upstream-kasan-gce-386
2019/04/28 10:40 upstream 037904a22bf8 b617407b .config console log report ci-upstream-kasan-gce-386
2019/04/21 00:49 upstream 9e5de623a0cb b0e8efcb .config console log report ci-upstream-kasan-gce-386
2019/04/17 20:50 upstream fe5cdef29e41 b0e8efcb .config console log report ci-upstream-kasan-gce-386
2019/03/28 00:38 upstream 65ae689329c5 4e668495 .config console log report ci-upstream-kasan-gce-386
2019/07/24 05:37 linux-next 6d21a41b7b1f de453f34 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/28 02:04 linux-next 8087b004bd09 7509bf36 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/18 01:13 linux-next a125097c8410 442206d7 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/09 02:52 linux-next ac5b84a1ffe9 995065ff .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/08 11:32 linux-next ac5b84a1ffe9 c34fde03 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.