syzbot

 sign-in | mailing list | source | docs
🐞 Open [994] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12516] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: null-ptr-deref Write in kthread_stop

Status: fixed on 2019/01/11 01:22
Subsystems: media
[Documentation on labels]
Reported-by: syzbot+53d5b2df0d9744411e2e@syzkaller.appspotmail.com
Fix commit: 701f49bc028e media: vivid: fix error handling of kthread_run
First crash: 2007d, last: 1949d
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH 4.19 00/99] 4.19.17-stable review 109 (109) 2019/04/22 19:40
[PATCH 4.4 000/104] 4.4.172-stable review 111 (111) 2019/01/30 07:30
[PATCH 3.18 00/52] 3.18.133-stable review 55 (55) 2019/01/25 23:16
[PATCH 4.14 00/59] 4.14.95-stable review 65 (65) 2019/01/23 12:55
[PATCH 4.9 00/51] 4.9.152-stable review 56 (56) 2019/01/23 09:06
[PATCH 4.20 000/111] 4.20.4-stable review 120 (120) 2019/01/23 06:43
KASAN: null-ptr-deref Write in kthread_stop 0 (2) 2018/10/31 03:17
[PATCH] vivid: fix error handling of kthread_run 1 (1) 2018/10/29 10:15
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: null-ptr-deref Write in kthread_stop C done 12 1726d 1831d 1/1 fixed on 2019/12/03 19:11

Sample crash report:
sshd (5629) used greatest stack depth: 15744 bytes left
==================================================================
BUG: KASAN: null-ptr-deref in atomic_inc include/asm-generic/atomic-instrumented.h:109 [inline]
BUG: KASAN: null-ptr-deref in kthread_stop+0x108/0x8f0 kernel/kthread.c:545
Write of size 4 at addr 0000000000000020 by task syz-executor789/5655

CPU: 1 PID: 5655 Comm: syz-executor789 Not tainted 4.19.0-next-20181030+ #101
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 kasan_report_error mm/kasan/report.c:352 [inline]
 kasan_report.cold.8+0x6d/0x309 mm/kasan/report.c:412
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
 kasan_check_write+0x14/0x20 mm/kasan/kasan.c:278
 atomic_inc include/asm-generic/atomic-instrumented.h:109 [inline]
 kthread_stop+0x108/0x8f0 kernel/kthread.c:545
 vivid_stop_generating_vid_cap+0x2bc/0x93b drivers/media/platform/vivid/vivid-kthread-cap.c:919
 vid_cap_stop_streaming+0x8d/0xe0 drivers/media/platform/vivid/vivid-vid-cap.c:259
 __vb2_queue_cancel+0x171/0xca0 drivers/media/common/videobuf2/videobuf2-core.c:1668
 vb2_core_streamoff+0x60/0x140 drivers/media/common/videobuf2/videobuf2-core.c:1804
 __vb2_cleanup_fileio+0x73/0x160 drivers/media/common/videobuf2/videobuf2-core.c:2325
 vb2_core_queue_release+0x1e/0x80 drivers/media/common/videobuf2/videobuf2-core.c:2052
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:672 [inline]
 _vb2_fop_release+0x1d2/0x2b0 drivers/media/common/videobuf2/videobuf2-v4l2.c:843
 vb2_fop_release+0x77/0xc0 drivers/media/common/videobuf2/videobuf2-v4l2.c:857
 vivid_fop_release+0x18e/0x440 drivers/media/platform/vivid/vivid-core.c:474
 v4l2_release+0xfb/0x1a0 drivers/media/v4l2-core/v4l2-dev.c:448
 __fput+0x3bc/0xa70 fs/file_table.c:279
 ____fput+0x15/0x20 fs/file_table.c:312
 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x400ef0
Code: 01 f0 ff ff 0f 83 b0 0a 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d dd 57 2d 00 00 75 14 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 84 0a 00 00 c3 48 83 ec 08 e8 3a 01 00 00
RSP: 002b:00007fff00659738 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000400ef0
RDX: 0000000020000024 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000001446880 R09: 00000000004002e0
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000401e00
R13: 0000000000401e90 R14: 0000000000000000 R15: 0000000000000000
==================================================================

Crashes (2527):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/10/31 03:16 linux-next 6201f31a39f8 4ccf7bb4 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/12/05 18:28 upstream 0072a0c14d5b ac6c0578 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/12/05 17:48 upstream 0072a0c14d5b ac6c0578 .config console log report syz ci-upstream-kasan-gce-root
2018/12/05 17:32 upstream 0072a0c14d5b ac6c0578 .config console log report syz ci-upstream-kasan-gce
2018/12/05 17:08 upstream 0072a0c14d5b ac6c0578 .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/11/10 05:49 upstream 3541833fd1f2 f9815aaf .config console log report syz ci-upstream-kasan-gce-root
2018/11/10 04:45 upstream 3541833fd1f2 f9815aaf .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/10 01:27 upstream 3541833fd1f2 f9815aaf .config console log report syz ci-upstream-kasan-gce
2018/11/10 01:12 upstream 3541833fd1f2 f9815aaf .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/09 23:45 upstream 3541833fd1f2 f9815aaf .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/09 23:39 upstream 3541833fd1f2 f9815aaf .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/11/09 13:48 upstream 24ccea7e102d 8fd01d3a .config console log report syz ci-upstream-kasan-gce-root
2018/11/09 11:49 upstream 24ccea7e102d 8fd01d3a .config console log report syz ci-upstream-kasan-gce-root
2018/11/09 09:48 upstream 24ccea7e102d 8fd01d3a .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/11/09 08:39 upstream 24ccea7e102d 8fd01d3a .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/11/08 18:05 upstream 85758777c2a2 e85d2a61 .config console log report syz ci-upstream-kasan-gce
2018/11/08 12:25 upstream 85758777c2a2 e85d2a61 .config console log report syz ci-upstream-kasan-gce
2018/11/07 08:19 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/07 07:27 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/07 03:23 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/07 02:46 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/07 01:20 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/07 01:02 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/07 00:43 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/06 23:04 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/11/06 22:43 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/06 22:24 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/06 22:12 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/11/06 21:16 upstream 8053e5b93eca 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/12/05 17:33 upstream 0072a0c14d5b ac6c0578 .config console log report syz ci-upstream-kasan-gce-386
2018/11/09 23:19 upstream 3541833fd1f2 f9815aaf .config console log report syz ci-upstream-kasan-gce-386
2018/11/08 17:36 upstream 85758777c2a2 e85d2a61 .config console log report syz ci-upstream-kasan-gce-386
2018/11/08 12:54 upstream 85758777c2a2 e85d2a61 .config console log report syz ci-upstream-kasan-gce-386
2018/12/05 17:30 linux-next 442b8cea2477 ac6c0578 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/10 14:22 linux-next 442b8cea2477 f9815aaf .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/10 12:59 linux-next 442b8cea2477 f9815aaf .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/08 10:22 linux-next f7af6d2c48bf e85d2a61 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/08 09:29 linux-next f7af6d2c48bf e85d2a61 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/06 20:59 linux-next 337734cbca74 8bd6bd63 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/06 20:20 linux-next 337734cbca74 8bd6bd63 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/06 18:47 linux-next 337734cbca74 8bd6bd63 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/10/29 07:26 linux-next 8c60c36d0b8c 9ca2afa1 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/12/25 23:43 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/25 22:15 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/25 21:08 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/25 19:37 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce-selinux-root
2018/12/25 18:28 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce-selinux-root
2018/12/25 16:58 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce-smack-root
2018/12/25 12:37 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce-selinux-root
2018/12/25 09:35 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/25 07:42 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/25 06:10 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/25 04:34 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/25 03:03 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/25 00:35 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce-selinux-root
2018/12/24 22:48 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce
2018/12/24 21:00 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce-root
2018/12/24 19:46 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce-root
2018/12/24 15:39 upstream 8fe28cb58bcb be79df56 .config console log report ci-upstream-kasan-gce-root
2018/12/24 13:13 upstream 8fe28cb58bcb be79df56 .config console log report ci-upstream-kasan-gce
2018/12/24 11:26 upstream 8fe28cb58bcb be79df56 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/24 08:37 upstream 8fe28cb58bcb be79df56 .config console log report ci-upstream-kasan-gce
2018/12/24 07:36 upstream 8fe28cb58bcb be79df56 .config console log report ci-upstream-kasan-gce
2018/12/24 06:26 upstream 8fe28cb58bcb be79df56 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/24 04:48 upstream 3c730b1041ae e3bd7ab8 .config console log report ci-upstream-kasan-gce
2018/12/24 03:42 upstream 3c730b1041ae e3bd7ab8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/24 02:33 upstream 3c730b1041ae e3bd7ab8 .config console log report ci-upstream-kasan-gce
2018/12/24 01:03 upstream 3c730b1041ae e3bd7ab8 .config console log report ci-upstream-kasan-gce-selinux-root
2018/12/23 21:47 upstream 3c730b1041ae e3bd7ab8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/23 20:17 upstream 3c730b1041ae e3bd7ab8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/23 18:32 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/23 17:14 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce-root
2018/12/23 14:38 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce
2018/12/23 12:13 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce-selinux-root
2018/12/23 10:15 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce-root
2018/12/23 08:48 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce
2018/12/23 06:31 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce-root
2018/12/23 04:12 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce
2018/12/23 03:04 upstream 9105b8aa50c1 e3bd7ab8 .config console log report ci-upstream-kasan-gce
2018/12/23 02:03 upstream 23203e3f34c9 e3bd7ab8 .config console log report ci-upstream-kasan-gce
2018/12/23 00:22 upstream 23203e3f34c9 e3bd7ab8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/22 23:18 upstream 23203e3f34c9 e3bd7ab8 .config console log report ci-upstream-kasan-gce
2018/12/22 20:33 upstream 23203e3f34c9 e3bd7ab8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/22 14:56 upstream 23203e3f34c9 e3bd7ab8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/22 13:42 upstream 23203e3f34c9 e3bd7ab8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/25 15:57 upstream 8fe28cb58bcb 8a41a0ad .config console log report ci-upstream-kasan-gce-386
2018/12/24 14:39 upstream 8fe28cb58bcb be79df56 .config console log report ci-upstream-kasan-gce-386
2018/12/22 11:05 upstream 5092adb2272e 603b5124 .config console log report ci-upstream-kasan-gce-386
2018/12/07 05:56 linux-next 442b8cea2477 dcf836b1 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/10/29 04:24 linux-next 8c60c36d0b8c 9ca2afa1 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.