Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] general protection fault in ax25_send_frame (2) | 2 (3) | 2022/11/22 21:24 |
syzbot |
sign-in | mailing list | source | docs |
Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] general protection fault in ax25_send_frame (2) | 2 (3) | 2022/11/22 21:24 |
Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
upstream | general protection fault in ax25_send_frame hams | 1411 | 1452d | 2082d | 0/28 | auto-closed as invalid on 2020/12/21 04:13 | |||
linux-4.14 | general protection fault in ax25_send_frame | 1 | 1962d | 1962d | 0/1 | auto-closed as invalid on 2019/10/25 08:41 | |||
linux-4.19 | general protection fault in ax25_send_frame | 1 | 1922d | 1922d | 0/1 | auto-closed as invalid on 2019/10/25 08:49 |
general protection fault, probably for non-canonical address 0xdffffc000000006c: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000360-0x0000000000000367] CPU: 1 PID: 10715 Comm: syz-executor.3 Not tainted 6.0.0-rc4-syzkaller-00136-g0727a9a5fbc1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 RIP: 0010:ax25_dev_ax25dev include/net/ax25.h:342 [inline] RIP: 0010:ax25_send_frame+0xe4/0x640 net/ax25/ax25_out.c:56 Code: 00 48 85 c0 49 89 c4 0f 85 fb 03 00 00 e8 34 cb 2b f9 49 8d bd 60 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b1 04 00 00 4d 8b ad 60 03 00 00 4d 85 ed 0f 84 RSP: 0000:ffffc90004c77a00 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88814a308008 RCX: 0000000000000100 RDX: 000000000000006c RSI: ffffffff88503efc RDI: 0000000000000360 RBP: ffffffff91561460 R08: 0000000000000001 R09: ffffffff908e4a9f R10: 0000000000000001 R11: 1ffffffff2020d9a R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000104 R15: 0000000000000000 FS: 0000555556215400(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2f328000 CR3: 0000000050a64000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> rose_send_frame+0xcc/0x2f0 net/rose/rose_link.c:106 rose_transmit_clear_request+0x1d5/0x290 net/rose/rose_link.c:255 rose_rx_call_request+0x4c0/0x1bc0 net/rose/af_rose.c:1009 rose_loopback_timer+0x19e/0x590 net/rose/rose_loopback.c:111 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803 __do_softirq+0x1d3/0x9c6 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x45/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0033:0x7fe1ccc37497 Code: 75 37 b8 00 00 00 80 48 01 d0 48 3d ff ff ff 7e 0f 87 2a 02 00 00 44 89 c0 c1 e8 10 44 31 c0 83 f0 3d 8d 04 c0 89 c7 c1 ef 04 <31> f8 69 c0 2d eb d4 27 31 c5 c1 e8 0f 31 c5 80 3d e4 de 09 01 00 RSP: 002b:00007fff5e3de460 EFLAGS: 00000a06 RAX: 000000009127bfa1 RBX: 00007fe1ccd9c018 RCX: 0000001b2f320000 RDX: ffffffff81e7790e RSI: 0000001b2f324438 RDI: 0000000009127bfa RBP: 0000000081e7790e R08: ffffffff81e77903 R09: 00000000ab355ea3 R10: 00007fff5e3de630 R11: 0000000000000246 R12: 00007fe1ccd90000 R13: 0000000000000001 R14: 00000000000165f4 R15: ffffffff81e7790e </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:ax25_dev_ax25dev include/net/ax25.h:342 [inline] RIP: 0010:ax25_send_frame+0xe4/0x640 net/ax25/ax25_out.c:56 Code: 00 48 85 c0 49 89 c4 0f 85 fb 03 00 00 e8 34 cb 2b f9 49 8d bd 60 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b1 04 00 00 4d 8b ad 60 03 00 00 4d 85 ed 0f 84 RSP: 0000:ffffc90004c77a00 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88814a308008 RCX: 0000000000000100 RDX: 000000000000006c RSI: ffffffff88503efc RDI: 0000000000000360 RBP: ffffffff91561460 R08: 0000000000000001 R09: ffffffff908e4a9f R10: 0000000000000001 R11: 1ffffffff2020d9a R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000104 R15: 0000000000000000 FS: 0000555556215400(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2f328000 CR3: 0000000050a64000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 48 85 add %cl,-0x7b(%rax) 3: c0 49 89 c4 rorb $0xc4,-0x77(%rcx) 7: 0f 85 fb 03 00 00 jne 0x408 d: e8 34 cb 2b f9 callq 0xf92bcb46 12: 49 8d bd 60 03 00 00 lea 0x360(%r13),%rdi 19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 20: fc ff df 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 b1 04 00 00 jne 0x4e5 34: 4d 8b ad 60 03 00 00 mov 0x360(%r13),%r13 3b: 4d 85 ed test %r13,%r13 3e: 0f .byte 0xf 3f: 84 .byte 0x84
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2022/09/15 02:25 | net-old | 0727a9a5fbc1 | b884348d | .config | console log | report | info | [disk image] [vmlinux] | ci-upstream-net-this-kasan-gce | general protection fault in ax25_send_frame | ||
2022/08/30 12:40 | net-old | cb10b0f91c5f | 5b44472d | .config | console log | report | info | ci-upstream-net-this-kasan-gce | general protection fault in ax25_send_frame | |||
2022/08/29 01:39 | net-old | ebe5555c2f34 | 07177916 | .config | console log | report | info | ci-upstream-net-this-kasan-gce | general protection fault in ax25_send_frame | |||
2022/08/25 04:28 | net-old | 0c4a95417ee4 | 514514f6 | .config | console log | report | info | ci-upstream-net-this-kasan-gce | general protection fault in ax25_send_frame | |||
2022/11/01 22:48 | net-next-old | 99c8eb46773e | edac4fd1 | .config | console log | report | info | ci-upstream-net-kasan-gce | general protection fault in ax25_send_frame | |||
2022/10/23 14:10 | net-next-old | 3bd5549bd479 | c0b80a55 | .config | console log | report | info | ci-upstream-net-kasan-gce | general protection fault in ax25_send_frame | |||
2022/10/05 17:19 | net-next-old | 0326074ff465 | 267e3bb1 | .config | console log | report | info | [disk image] [vmlinux] | ci-upstream-net-kasan-gce | general protection fault in ax25_send_frame | ||
2022/09/20 03:10 | net-next-old | 42666b2c452c | dd9a85ff | .config | console log | report | info | ci-upstream-net-kasan-gce | general protection fault in ax25_send_frame | |||
2022/09/11 10:25 | net-next-old | 169ccf0e4082 | 356d8217 | .config | console log | report | info | ci-upstream-net-kasan-gce | general protection fault in ax25_send_frame | |||
2022/08/30 13:05 | net-next-old | f97e971dbdc7 | 5b44472d | .config | console log | report | info | ci-upstream-net-kasan-gce | general protection fault in ax25_send_frame | |||
2022/08/28 17:56 | net-next-old | 53a406803ca5 | 07177916 | .config | console log | report | info | ci-upstream-net-kasan-gce | general protection fault in ax25_send_frame | |||
2022/11/05 04:56 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | bbed346d5a96 | 6d752409 | .config | console log | report | info | [disk image] [vmlinux] | ci-upstream-gce-arm64 | BUG: unable to handle kernel NULL pointer dereference in ax25_send_frame | ||
2022/11/03 13:27 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | bbed346d5a96 | 7a2ebf95 | .config | console log | report | info | [disk image] [vmlinux] | ci-upstream-gce-arm64 | BUG: unable to handle kernel NULL pointer dereference in ax25_send_frame |