syzbot

 sign-in | mailing list | source | docs
🐞 Open [969] ≡ Subsystems 🐞 Fixed [4558] 🐞 Invalid [10512] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in scatterwalk_copychunks (4)

Status: upstream: reported C repro on 2021/03/16 06:48
Labels: net crypto (incorrect?)
Reported-by: syzbot+66e3ea42c4b176748b9c@syzkaller.appspotmail.com
First crash: 812d, last: 14d

Cause bisection: introduced by (bisect log) :
commit 635d9398178659d8ddba79dd061f9451cec0b4d1
Author: Vadim Fedorenko <vfedorenko@novek.ru>
Date: Wed May 20 08:41:44 2020 +0000

  net/tls: free record only on encryption error

Crash: general protection fault in gcmaes_crypt_by_sg (log)
Repro: C syz .config
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] general protection fault in scatterwalk_copychunks (4) 0 (3) 2021/08/14 13:07
▶ ▼ Similar bugs (11)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in scatterwalk_copychunks (3) C 95 1683d 1809d 0/24 closed as invalid on 2019/06/10 23:08
upstream general protection fault in scatterwalk_copychunks (2) crypto C 141 1974d 2001d 3/24 fixed on 2018/01/11 01:23
linux-4.14 general protection fault in scatterwalk_copychunks C error 204 111d 1503d 0/1 upstream: reported C repro on 2019/04/21 07:15
linux-5.15 BUG: unable to handle kernel paging request in scatterwalk_copychunks 3 37d 74d 0/3 upstream: reported on 2023/03/20 18:37
linux-4.19 general protection fault in scatterwalk_copychunks C error 152 112d 1443d 0/1 upstream: reported C repro on 2019/06/20 18:59
upstream general protection fault in scatterwalk_copychunks crypto C 414 2002d 2012d 3/24 fixed on 2017/12/08 02:32
linux-4.14 KASAN: use-after-free Read in scatterwalk_copychunks C inconclusive 4 849d 1503d 0/1 upstream: reported C repro on 2019/04/21 07:18
linux-4.19 KASAN: use-after-free Read in scatterwalk_copychunks C error 17 123d 1338d 0/1 upstream: reported C repro on 2019/10/03 04:34
linux-4.14 KASAN: slab-out-of-bounds Read in scatterwalk_copychunks C inconclusive 6 856d 1360d 0/1 upstream: reported C repro on 2019/09/11 08:57
upstream BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks (2) 2 1787d 1787d 0/24 closed as invalid on 2018/09/05 12:51
upstream BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks crypto C 3 1995d 1996d 3/24 fixed on 2018/01/11 01:23
▶ ▼ Fix bisection attempts (4)
Created Duration User Patch Repo Result
2023/05/06 19:54 23m bisect fix net-next-old job log (0) log
2023/03/24 14:58 34m bisect fix upstream job log (0) log
2022/04/26 06:05 17m bisect fix upstream job log (0) log
2021/10/12 17:46 37m bisect fix upstream job log (0) log

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 50 Comm: kworker/u4:2 Not tainted 5.18.0-rc6-syzkaller-00009-gfeb9c5e19e91 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: pencrypt_parallel padata_parallel_worker
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:69 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:89 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:78 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:50
Code: ff df 80 3c 02 00 0f 85 b4 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc90000dbf618 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff83f469c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff900729cf
R10: ffffffff83f46971 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffc90000dbf878 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1333ae001d CR3: 0000000025ef1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 skcipher_next_slow crypto/skcipher.c:278 [inline]
 skcipher_walk_next+0x7af/0x1660 crypto/skcipher.c:363
 skcipher_walk_first+0xf8/0x3c0 crypto/skcipher.c:446
 skcipher_walk_aead_common+0x7a5/0xbc0 crypto/skcipher.c:539
 gcmaes_crypt_by_sg+0x31d/0x890 arch/x86/crypto/aesni-intel_glue.c:658
 gcmaes_encrypt+0xe2/0x230 arch/x86/crypto/aesni-intel_glue.c:722
 generic_gcmaes_encrypt+0x12e/0x190 arch/x86/crypto/aesni-intel_glue.c:1076
 crypto_aead_encrypt+0xaa/0xf0 crypto/aead.c:94
 crypto_aead_encrypt+0xaa/0xf0 crypto/aead.c:94
 pcrypt_aead_enc+0x13/0x70 crypto/pcrypt.c:83
 padata_parallel_worker+0x60/0xb0 kernel/padata.c:144
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:69 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:89 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:78 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:50
Code: ff df 80 3c 02 00 0f 85 b4 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc90000dbf618 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff83f469c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff900729cf
R10: ffffffff83f46971 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffc90000dbf878 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1333ae001d CR3: 0000000025ef1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 80 3c 02 00 0f    	filds  0xf00023c(%rax)
   6:	85 b4 01 00 00 49 8d 	test   %esi,-0x72b70000(%rcx,%rax,1)
   d:	44 24 08             	rex.R and $0x8,%al
  10:	4d 89 26             	mov    %r12,(%r14)
  13:	48 89 c2             	mov    %rax,%rdx
  16:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
  1b:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  22:	fc ff df
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	74 08                	je     0x39
  31:	3c 03                	cmp    $0x3,%al
  33:	0f 8e 77 01 00 00    	jle    0x1b0
  39:	48                   	rex.W
  3a:	b8 00 00 00 00       	mov    $0x0,%eax

Crashes (187):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Manager Title
2022/05/11 03:38 upstream feb9c5e19e91 8d7b3b67 .config strace log report syz C ci-upstream-kasan-gce-selinux-root general protection fault in scatterwalk_copychunks
2022/03/26 20:36 upstream 52d543b5497c 89bc8608 .config console log report syz C ci-upstream-kasan-gce-smack-root general protection fault in scatterwalk_copychunks
2022/03/03 19:11 upstream 5859a2b19911 45a13a73 .config console log report syz C ci-upstream-kasan-gce-root general protection fault in scatterwalk_copychunks
2021/09/12 04:35 upstream c605c39677b9 5ae8508a .config console log report syz C ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2021/08/13 10:03 upstream f8fbb47c6e86 3fd2ea69 .config console log report syz C ci-upstream-kasan-gce-selinux-root general protection fault in scatterwalk_copychunks
2021/08/13 10:35 net-old 700fa08da43e 3fd2ea69 .config console log report syz C ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2021/08/13 10:38 net-next-old bed5a942e27e 3fd2ea69 .config console log report syz C ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/03/27 06:01 linux-next fd4fbb998102 89bc8608 .config console log report syz C ci-upstream-linux-next-kasan-gce-root general protection fault in scatterwalk_copychunks
2023/05/19 14:07 upstream 2d1bcbc6cd70 3bb7af1d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in scatterwalk_copychunks
2022/12/05 15:24 upstream 76dcd734eca2 045cbb84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/15 08:53 upstream 55be6084c8e0 67cb024c .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-smack-root general protection fault in scatterwalk_copychunks
2022/10/14 09:36 upstream 55be6084c8e0 4954e4b2 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-smack-root general protection fault in scatterwalk_copychunks
2022/10/14 06:47 upstream 55be6084c8e0 4954e4b2 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/12 18:06 upstream 55be6084c8e0 89b5a509 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/11 18:34 upstream 55be6084c8e0 1353c374 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/10 08:09 upstream 4899a36f91a9 aea5da89 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/10 07:28 upstream 4899a36f91a9 aea5da89 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/10 00:58 upstream a6afa4199d3d aea5da89 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/09 02:26 upstream a6afa4199d3d aea5da89 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/07 01:25 upstream ffb39098bf87 8a212197 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/05 14:41 upstream 2bca25eaeba6 267e3bb1 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-smack-root general protection fault in scatterwalk_copychunks
2022/10/05 00:38 upstream 0326074ff465 eab8f949 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/04 21:36 upstream f3dfe925f954 267e3bb1 .config console log report info ci-qemu-upstream general protection fault in scatterwalk_copychunks
2022/09/26 03:16 upstream f76349cf4145 0042f2b4 .config console log report info ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/09/16 19:49 upstream 6879c2d3b960 dd9a85ff .config console log report info ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/09/13 19:59 upstream d1221cea11fc b884348d .config console log report info ci-qemu-upstream general protection fault in scatterwalk_copychunks
2022/09/11 12:07 upstream b96fbd602d35 356d8217 .config console log report info ci-upstream-kasan-gce general protection fault in scatterwalk_copychunks
2022/09/02 03:45 upstream 42e66b1cc3a0 a805568e .config console log report info ci-qemu-upstream general protection fault in scatterwalk_copychunks
2022/08/31 12:29 upstream dcf8e5633e2e 51e54e30 .config console log report info ci-qemu-upstream general protection fault in scatterwalk_copychunks
2022/08/21 07:48 upstream 15b3f48a4339 26a13b38 .config console log report info ci-upstream-kasan-gce-root general protection fault in scatterwalk_copychunks
2022/08/09 04:19 upstream 200e340f2196 da700653 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in scatterwalk_copychunks
2022/10/04 19:59 upstream 4fe89d07dcc2 eab8f949 .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-386 general protection fault in scatterwalk_copychunks
2022/09/01 05:51 upstream c5e4d5e99162 b01ec571 .config console log report info ci-qemu-upstream-386 general protection fault in scatterwalk_copychunks
2022/08/31 23:05 upstream c5e4d5e99162 51e54e30 .config console log report info ci-qemu-upstream-386 general protection fault in scatterwalk_copychunks
2023/02/14 17:40 net-old 05d7623a892a 1d6b4af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2022/12/15 04:36 net-old 7ae9888d6e1c b18f0a64 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2022/11/25 12:57 net-old 661e5ebbafd2 74a66371 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2022/11/23 00:30 net-old 2dc4ac91f845 9da37ae8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2022/11/07 12:28 net-old f9027f88f7d1 6d752409 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/04 15:59 net-old 93e2be344a7d eab8f949 .config console log report info [disk image] [vmlinux] ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2022/09/17 00:05 net-old 96628951869c dd9a85ff .config console log report info [disk image] [vmlinux] ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2021/03/11 22:47 net-old 47142ed6c34d 429d8a6b .config console log report info ci-upstream-net-this-kasan-gce general protection fault in scatterwalk_copychunks
2023/04/06 19:53 net-next b536f32b5b03 08707520 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2023/02/22 13:41 net-next-old 5b7c4cabbb65 409945bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2023/02/22 11:49 net-next-old 5b7c4cabbb65 409945bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2023/01/11 19:23 net-next-old 60d86034b14e 96166539 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/12/12 12:57 net-next-old 6d534ee057b6 67be1ae7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/12/10 22:09 net-next-old dd8b3a802b64 67be1ae7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/12/01 22:18 net-next-old 9e855b1fe37f e080de16 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/11/08 03:19 net-next-old fbeb229a6622 881db35d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/28 18:23 net-next-old 99c8eb46773e ea12ae9b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/05 09:51 net-next-old 0326074ff465 267e3bb1 .config console log report info [disk image] [vmlinux] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/04 13:11 net-next-old 450a580fc4b5 77d3f689 .config console log report info [disk image] [vmlinux] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/04 06:15 net-next-old 9d43507319cc feb56351 .config console log report info [disk image] [vmlinux] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/03 13:32 net-next-old 9d43507319cc feb56351 .config console log report info [disk image] [vmlinux] ci-upstream-net-kasan-gce general protection fault in scatterwalk_copychunks
2022/10/06 12:16 linux-next aaa11ce2ffc8 131b38ac .config console log report info [disk image] [vmlinux] ci-upstream-linux-next-kasan-gce-root general protection fault in scatterwalk_copychunks
2021/08/10 04:03 upstream 9a73fa375d58 6972b106 .config console log report info ci-upstream-kasan-gce-root KASAN: use-after-free Read in scatterwalk_copychunks
2023/02/08 17:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci eaed33698e35 fc9c934e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
2022/12/20 23:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 d3e76707 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
2022/10/06 23:59 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 8a212197 .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
2022/09/30 14:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5911b92626df feb56351 .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
2022/09/29 11:04 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c194837ebb57 1d385642 .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
2022/09/28 00:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c194837ebb57 75c78242 .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
2022/09/22 16:11 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci aa49f95768a9 0042f2b4 .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
2022/09/21 10:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5aa266bb455b 380f82fb .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
2022/08/30 16:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a41a877bc12d 4a380809 .config console log report info ci-upstream-gce-arm64 BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
* Struck through repros no longer work on HEAD.