syzbot

 sign-in | mailing list | source | docs
🐞 Open [712]
🐞 Fixed [297]
🐞 Invalid [838]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: unable to handle kernel paging request in do_syscall_64

Status: fixed on 2021/09/26 12:12
Reported-by: syzbot+400533692f72a27e4bc1@syzkaller.appspotmail.com
Fix commit: 6be10fb6c143 fbmem: add margin check to fb_check_caps()
First crash: 1703d, last: 1184d
Fix bisection: fixed by (bisect log) :
commit 6be10fb6c143608a7c7ab3901a096e272233bf64
Author: George Kennedy <george.kennedy@oracle.com>
Date: Tue Jul 7 19:26:03 2020 +0000

  fbmem: add margin check to fb_check_caps()

  
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in do_syscall_64 kernel 1 1646d 1642d 0/28 closed as dup on 2020/08/15 13:35
linux-4.14 BUG: unable to handle kernel paging request in do_syscall_64 1 1655d 1655d 0/1 auto-closed as invalid on 2020/09/08 08:37
▶ ▼ Fix bisection attempts (16)
Created Duration User Patch Repo Result
2021/09/23 19:31 4h24m bisect fix linux-4.19.y OK (1) job log
2021/08/24 18:57 31m bisect fix linux-4.19.y OK (0) job log log
2021/07/25 18:31 26m bisect fix linux-4.19.y OK (0) job log log
2021/06/25 18:05 25m bisect fix linux-4.19.y OK (0) job log log
2021/05/26 16:27 33m bisect fix linux-4.19.y OK (0) job log log
2021/04/26 15:50 36m bisect fix linux-4.19.y OK (0) job log log
2021/03/27 15:19 23m bisect fix linux-4.19.y OK (0) job log log
2021/02/25 14:55 24m bisect fix linux-4.19.y OK (0) job log log
2021/01/26 14:31 24m bisect fix linux-4.19.y OK (0) job log log
2020/12/27 14:05 25m bisect fix linux-4.19.y OK (0) job log log
2020/11/27 12:49 29m bisect fix linux-4.19.y OK (0) job log log
2020/10/28 11:25 23m bisect fix linux-4.19.y OK (0) job log log
2020/08/31 21:09 37m bisect fix linux-4.19.y OK (0) job log log
2020/08/01 20:38 31m bisect fix linux-4.19.y OK (0) job log log
2020/07/02 20:09 28m bisect fix linux-4.19.y OK (0) job log log
2020/06/02 19:41 27m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
audit: type=1400 audit(1588534725.329:8): avc:  denied  { execmem } for  pid=6468 comm="syz-executor462" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
IPVS: ftp: loaded support on port[0] = 21
BUG: unable to handle kernel paging request at ffffffffffffffff
PGD 8c70067 P4D 8c70067 PUD 8c72067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6469 Comm: syz-executor462 Not tainted 4.19.120-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:253 [inline]
RIP: 0010:do_syscall_64+0x14c/0x620 arch/x86/entry/common.c:296
Code: b8 00 00 00 00 00 fc ff df 65 48 8b 1c 25 00 70 00 70 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 84 04 00 00 48 c7 c0 c0 56 d2 88 <4c> 8b 23 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f
RSP: 0018:ffff888089007f28 EFLAGS: 00010246
RAX: ffffffff88d256c0 RBX: ffffffffffffffff RCX: 1ffff11011200ff5
RDX: 1fffffffffffffff RSI: ffffffff81009b31 RDI: ffff888089007fa8
RBP: ffff888089007f58 R08: ffff888089e946c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff88d256d8 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000002211880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffff CR3: 00000000a97e3000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x472160
Code: 05 48 3d 01 f0 ff ff 0f 83 ed 52 f9 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d b1 0e 27 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 c4 52 f9 ff c3 48 83 ec 08 e8 ea 74 fd ff
RSP: 002b:00007fff8714a9f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: 0000000000000000 RBX: 00007fff8714aa40 RCX: 0000000000472160
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff8714aa00
RBP: 0000000000000006 R08: 0000000000000001 R09: 0000000002211880
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000a863
R13: 0000000000407940 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffffffffffffff
---[ end trace 105ca70c34b27fe1 ]---
BUG: unable to handle kernel NULL pointer dereference at 0000000000000007
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:253 [inline]
RIP: 0010:do_syscall_64+0x14c/0x620 arch/x86/entry/common.c:296
PGD 891b8067 P4D 891b8067 PUD 949a3067 PMD 0 
Code: b8 00 00 00 00 00 fc ff df 65 48 8b 1c 25 00 70 00 70 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 84 04 00 00 48 c7 c0 c0 56 d2 88 <4c> 8b 23 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f
Oops: 0002 [#2] PREEMPT SMP KASAN
RSP: 0018:ffff888089007f28 EFLAGS: 00010246
CPU: 1 PID: 6495 Comm: syz-executor462 Tainted: G      D           4.19.120-syzkaller #0
RAX: ffffffff88d256c0 RBX: ffffffffffffffff RCX: 1ffff11011200ff5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RDX: 1fffffffffffffff RSI: ffffffff81009b31 RDI: ffff888089007fa8
RIP: 0010:update_vsyscall+0x128/0x380 arch/x86/entry/vsyscall/vsyscall_gtod.c:46
RBP: ffff888089007f58 R08: ffff888089e946c0 R09: 0000000000000000
Code: 48 8d 7d 1c 48 89 fa 48 c1 ea 03 89 05 69 25 9c 09 48 b8 00 00 00 00 00 fc ff df 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 <00> 00 00 00 0f 85 d8 01 00 00 8b 45 1c 48 8d 7d 70 48 89 fa 48 c1
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
RSP: 0018:ffff8880ae707c48 EFLAGS: 00010002
R13: ffffffff88d256d8 R14: 0000000000000000 R15: 0000000000000000
RAX: 0000000000000007 RBX: ffffffff88d250c0 RCX: ffffffff8159a0cf
FS:  0000000002211880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
RDX: 0000000000000000 RSI: ffffffff8100ba36 RDI: ffffffff8b8e1b3c
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
RBP: ffffffff8b8e1b20 R08: ffff8880a94be600 R09: 0000000000000001
CR2: ffffffffffffffff CR3: 00000000a97e3000 CR4: 00000000001406f0
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
R13: ffffffff8b8e1bb0 R14: 000000004a08dfb7 R15: ffffffff8b8e1b48
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
FS:  00007f3325d06700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/03 19:41 linux-4.19.y fdc072324f3c 58ae5e18 .config console log report syz C ci2-linux-4-19
2020/09/28 11:25 linux-4.19.y 10ad6cfd5736 6bfdbe89 .config console log report info ci2-linux-4-19
2020/03/24 04:48 linux-4.19.y 14cfdbd39e31 33e14df3 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.