syzbot


BUG: unable to handle kernel paging request in devpts_mntget

Status: fixed on 2018/02/01 10:32
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+529dcc7acae97863327261a275c516477f0f4595@syzkaller.appspotmail.com
Fix commit: c9cc8d01fb04 devpts: fix error handling in devpts_mntget()
First crash: 2410d, last: 2290d

Sample crash report:
audit: type=1400 audit(1513989601.405:7): avc:  denied  { map } for  pid=3147 comm="syzkaller741191" path="/root/syzkaller741191674" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
BUG: unable to handle kernel paging request at fffffffffffffff5
IP: devpts_mntget+0x13f/0x280 fs/devpts/inode.c:173
PGD 5e25067 P4D 5e25067 PUD 5e27067 PMD 0 
Oops: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3150 Comm: syzkaller741191 Not tainted 4.15.0-rc4+ #234
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:devpts_mntget+0x13f/0x280 fs/devpts/inode.c:173
RSP: 0018:ffff8801c8cb7a50 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffffffffffffed RCX: ffffffff81d22440
RDX: 1ffffffffffffffe RSI: 0000000000000001 RDI: fffffffffffffff5
RBP: ffff8801c8cb7ae0 R08: ffffffff85e12740 R09: 1ffff10039196f05
R10: ffff8801c8cb7760 R11: 0000000000000000 R12: 1ffff10039196f4a
R13: ffff8801c8cb7a70 R14: ffff8801c3656400 R15: ffff8801c8cb7b20
FS:  00007f8e8960c700(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff5 CR3: 00000001c865a004 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ptm_open_peer+0x11a/0x2f0 drivers/tty/pty.c:632
 tty_ioctl+0x517/0x1610 drivers/tty/tty_io.c:2622
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x445619
RSP: 002b:00007f8e8960bda8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f8e8960c700 RCX: 0000000000445619
RDX: 0000000000000000 RSI: 0000000000005441 RDI: 0000000000000004
RBP: 00007ffc3eeefe40 R08: 00007f8e8960c700 R09: 0000000000000000
R10: 00007f8e8960c700 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc3eeefd9f R14: 00007f8e8960c9c0 R15: 0000000000000005
Code: 01 00 00 48 8b 5d 90 e8 50 c5 9d ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 24 01 00 00 <4c> 8b 7b 08 48 b8 00 00 00 00 00 fc ff df 49 8d bf 80 06 00 00 
RIP: devpts_mntget+0x13f/0x280 fs/devpts/inode.c:173 RSP: ffff8801c8cb7a50
CR2: fffffffffffffff5
---[ end trace f0f360a47cdabe10 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (21):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/23 00:41 upstream ead68f216110 8e409090 .config console log report syz C ci-upstream-kasan-gce
2017/12/24 01:06 linux-next 0e08c463db38 73aba437 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/22 21:37 mmots 37759fa6d0fa 8e409090 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/23 00:51 upstream ead68f216110 8e409090 .config console log report syz ci-upstream-kasan-gce
2017/10/30 07:45 upstream 19e12196da60 80c74880 .config console log report syz ci-upstream-kasan-gce-386
2017/10/29 20:52 upstream 19e12196da60 80c74880 .config console log report syz ci-upstream-kasan-gce-386
2017/12/24 01:45 linux-next 0e08c463db38 73aba437 .config console log report syz ci-upstream-next-kasan-gce
2017/12/23 13:44 mmots 37759fa6d0fa 73aba437 .config console log report syz ci-upstream-mmots-kasan-gce
2017/10/30 07:46 linux-next 36ef71cae353 e511d9f8 .config console log report syz ci-upstream-next-kasan-gce
2017/10/30 07:45 mmots 0f611fb6dcc0 e0a2b195 .config console log report syz ci-upstream-mmots-kasan-gce
2017/10/30 07:38 linux-next 36ef71cae353 e511d9f8 .config console log report syz ci-upstream-next-kasan-gce
2017/10/30 01:24 linux-next 36ef71cae353 e511d9f8 .config console log report syz ci-upstream-next-kasan-gce
2017/10/29 20:53 mmots 0f611fb6dcc0 e0a2b195 .config console log report syz ci-upstream-mmots-kasan-gce
2017/10/29 20:52 linux-next 36ef71cae353 e511d9f8 .config console log report syz ci-upstream-next-kasan-gce
2017/12/27 18:51 upstream beacbc68ac3e 09c8f4c0 .config console log report ci-upstream-kasan-gce
2017/12/21 05:26 upstream d1ce8ceb8ba8 90a46995 .config console log report ci-upstream-kasan-gce
2017/12/14 00:52 upstream d39a01eff9af 06ea774d .config console log report ci-upstream-kasan-gce
2018/01/19 08:05 mmots 216435561218 161c1d64 .config console log report ci-upstream-mmots-kasan-gce
2017/12/22 21:23 mmots 37759fa6d0fa 8e409090 .config console log report ci-upstream-mmots-kasan-gce
2017/11/23 14:01 mmots 1ea8d039f9ed deb5f6ae .config console log report ci-upstream-mmots-kasan-gce
2017/09/20 16:01 linux-next 0b093a564fe0 4e341009 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.