syzbot


kernel BUG at security/keys/keyring.c:LINE!

Status: public: reported C repro on 2019/04/14 08:51
Reported-by: syzbot+4abf3203c56cdefc5376@syzkaller.appspotmail.com
First crash: 2290d, last: 2183d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 kernel BUG at security/keys/keyring.c:LINE! C 3 2183d 2052d 0/1 public: reported C repro on 2019/04/10 16:04
upstream kernel BUG at security/keys/keyring.c:LINE! keyrings lsm C 12 2139d 2239d 11/28 fixed on 2019/03/06 07:43

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: crng init done
------------[ cut here ]------------
kernel BUG at security/keys/keyring.c:1107!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 2046 Comm: syz-executor174 Not tainted 4.9.141+ #72
task: ffff8801d2778000 task.stack: ffff8801cedb8000
RIP: 0010:[<ffffffff819ccf2c>]  [<ffffffff819ccf2c>] __key_link_begin+0x20c/0x2d0 security/keys/keyring.c:1107
RSP: 0018:ffff8801cedbfbe0  EFLAGS: 00010293
RAX: ffff8801d2778000 RBX: ffff8801d532e300 RCX: 1ffff10039db7f71
RDX: 0000000000000000 RSI: ffffffff819ccf2c RDI: ffff8801cedbfd68
RBP: ffff8801cedbfc10 R08: ffffffff83c9ec20 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8801cedbfd58
R13: ffffffff831c1800 R14: ffff8801cedbfd58 R15: ffff8801d532e300
FS:  0000000002146880(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020caaffb CR3: 00000001cee6a000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801cedbfcd8 ffff8801cedbfdf8 ffff8801d532e480 ffffffff831c1800
 ffff8801cedbfd58 ffff8801d532e300 ffff8801cedbfe20 ffffffff819d6475
 0000000000000000 0000000000000000 ffff8801d27788a8 ffff8801cedbfcd8
Call Trace:
 [<ffffffff819d6475>] construct_alloc_key security/keys/request_key.c:388 [inline]
 [<ffffffff819d6475>] construct_key_and_link security/keys/request_key.c:479 [inline]
 [<ffffffff819d6475>] request_key_and_link+0x535/0xac0 security/keys/request_key.c:594
 [<ffffffff819cdf93>] SYSC_request_key security/keys/keyctl.c:213 [inline]
 [<ffffffff819cdf93>] SyS_request_key+0x233/0x2f0 security/keys/keyctl.c:158
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817c13>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: 94 ff 48 c7 c7 e0 01 1c 83 e8 91 02 83 ff eb ac e8 4a eb 94 ff 48 c7 c7 e0 01 1c 83 e8 1e 4b e4 00 e9 f3 fe ff ff e8 34 eb 94 ff <0f> 0b e8 2d eb 94 ff 48 8d bb ce 00 00 00 48 b8 00 00 00 00 00 
RIP  [<ffffffff819ccf2c>] __key_link_begin+0x20c/0x2d0 security/keys/keyring.c:1107
 RSP <ffff8801cedbfbe0>
---[ end trace 75532f90a1e74a3e ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/30 16:22 https://android.googlesource.com/kernel/common android-4.9 4dcb0afde6f4 ade12e91 .config console log report syz C ci-android-49-kasan-gce-root
2018/10/05 09:48 https://android.googlesource.com/kernel/common android-4.9 7bebf33f9d46 8b311eaf .config console log report syz C ci-android-49-kasan-gce-root
2018/08/14 22:41 https://android.googlesource.com/kernel/common android-4.9 9dc978d43ec7 0e6dcb88 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.