panic: runtime error: invalid memory address or nil pointer dereference (5)

Status: fixed on 2021/01/06 10:11
Reported-by: syzbot+814105309d2ae8651084@syzkaller.appspotmail.com
Fix commit: 2a200811d4c9 fs/fuse: check that a task has a specified file descriptor
First crash: 2113d, last: 2062d
▶ ▼ Similar bugs (30)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: runtime error: invalid memory address or nil pointer dereference (18) 2 4 1084d 1085d 26/26 fixed on 2023/09/13 00:17
gvisor panic: runtime error: invalid memory address or nil pointer dereference (29) 2 syz, C 7 358d 362d 26/26 fixed on 2025/09/19 06:07
gvisor panic: runtime error: invalid memory address or nil pointer dereference (9) 2 syz, C 262 1665d 1662d 14/26 fixed on 2022/02/10 01:56
gvisor panic: runtime error: invalid memory address or nil pointer dereference (7) 2 syz, C 45305 1767d 1796d 14/26 fixed on 2021/10/27 00:49
gvisor panic: runtime error: invalid memory address or nil pointer dereference (3) 2 syz, C 20051 2188d 2723d 0/26 fixed on 2020/09/09 05:34
gvisor panic: runtime error: invalid memory address or nil pointer dereference (23) 2 syz, C 4239 893d 898d 26/26 fixed on 2024/03/19 11:42
gvisor panic: runtime error: invalid memory address or nil pointer dereference (31) 2 syz, C 169 119d 120d 26/26 fixed on 2026/05/01 11:36
gvisor panic: runtime error: invalid memory address or nil pointer dereference (22) 2 1 1003d 1003d 26/26 fixed on 2023/12/01 06:13
gvisor panic: runtime error: invalid memory address or nil pointer dereference (10) 2 syz, C 11 1618d 1624d 14/26 fixed on 2022/03/25 11:21
gvisor panic: runtime error: invalid memory address or nil pointer dereference (12) 2 syz, C 31 1317d 1378d 18/26 fixed on 2023/01/23 05:20
gvisor panic: runtime error: invalid memory address or nil pointer dereference (28) 2 syz, C 21 563d 564d 26/26 fixed on 2025/02/13 10:39
gvisor panic: runtime error: invalid memory address or nil pointer dereference (26) 2 syz, C 7905 645d 653d 26/26 fixed on 2024/11/22 02:29
gvisor panic: runtime error: invalid memory address or nil pointer dereference (21) 2 1 1017d 1017d 26/26 fixed on 2023/11/17 08:30
gvisor panic: runtime error: invalid memory address or nil pointer dereference (14) 2 syz, C 753 1277d 1278d 18/26 fixed on 2023/02/28 09:05
gvisor panic: runtime error: invalid memory address or nil pointer dereference 2 syz, C 20682 2936d 2989d 0/26 fixed on 2018/08/19 04:32
gvisor panic: runtime error: invalid memory address or nil pointer dereference (25) 2 1 755d 755d 26/26 fixed on 2024/08/06 09:03
gvisor panic: runtime error: invalid memory address or nil pointer dereference (27) 2 syz, C 1117 643d 645d 26/26 fixed on 2024/11/23 14:37
gvisor panic: runtime error: invalid memory address or nil pointer dereference (24) 2 92 886d 886d 0/26 closed as invalid on 2024/03/26 13:32
gvisor panic: runtime error: invalid memory address or nil pointer dereference (13) 2 syz, C 2752 1278d 1282d 18/26 fixed on 2023/02/27 08:23
gvisor panic: runtime error: invalid memory address or nil pointer dereference (8) 2 syz, C 214 1669d 1694d 14/26 fixed on 2022/02/01 22:27
gvisor panic: runtime error: invalid memory address or nil pointer dereference (2) 2 syz, C 4493 2911d 2932d 0/26 fixed on 2018/10/15 18:31
gvisor panic: runtime error: invalid memory address or nil pointer dereference (17) 2 2 1121d 1121d 26/26 fixed on 2023/08/04 01:52
gvisor panic: runtime error: invalid memory address or nil pointer dereference (32) 2 syz 6 61d 54d 26/26 fixed on 2026/07/07 11:38
gvisor panic: runtime error: invalid memory address or nil pointer dereference (11) 2 syz, C 2733 1387d 1481d 14/26 fixed on 2022/11/11 17:56
gvisor panic: runtime error: invalid memory address or nil pointer dereference (19) 2 syz, C 79 1059d 1073d 26/26 fixed on 2023/10/05 23:05
gvisor panic: runtime error: invalid memory address or nil pointer dereference (20) 2 syz, C 8 1031d 1038d 26/26 fixed on 2023/11/02 02:06
gvisor panic: runtime error: invalid memory address or nil pointer dereference (16) 2 syz, C 48 1123d 1130d 26/26 fixed on 2023/08/02 12:57
gvisor panic: runtime error: invalid memory address or nil pointer dereference (30) 2 syz, C 16194 337d 337d 26/26 fixed on 2025/09/26 06:32
gvisor panic: runtime error: invalid memory address or nil pointer dereference (15) 2 1 1170d 1170d 26/26 fixed on 2023/07/12 19:22
gvisor panic: runtime error: invalid memory address or nil pointer dereference (4) 2 syz, C 4 2122d 2140d 0/26 fixed on 2020/11/13 09:22

Sample crash report:
panic: runtime error: invalid memory address or nil pointer dereference
	panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x7a2014]

goroutine 3039 [running]:
panic(0x101bea0, 0x1a7a090)
	GOROOT/src/runtime/panic.go:1064 +0x470 fp=0xc000973380 sp=0xc0009732c8 pc=0x437030
runtime.panicmem(...)
	GOROOT/src/runtime/panic.go:212
runtime.sigpanic()
	GOROOT/src/runtime/signal_unix.go:720 +0x413 fp=0xc0009733b0 sp=0xc000973380 pc=0x44de13
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef(0x0, 0x131cb80, 0xc000bfea80)
	pkg/sentry/vfs/file_description.go:163 +0x54 fp=0xc0009733f0 sp=0xc0009733b0 pc=0x7a2014
runtime.call32(0x0, 0x11e46e0, 0xc000695068, 0x1800000018)
	src/runtime/asm_amd64.s:540 +0x3e fp=0xc000973420 sp=0xc0009733f0 pc=0x46ed1e
runtime.reflectcallSave(0xc000973550, 0x11e46e0, 0xc000695068, 0xc000000018)
	GOROOT/src/runtime/panic.go:881 +0x58 fp=0xc000973450 sp=0xc000973420 pc=0x436af8
runtime.runOpenDeferFrame(0xc00076db00, 0xc000695020, 0xc000973598)
	GOROOT/src/runtime/panic.go:855 +0x2cd fp=0xc0009734e0 sp=0xc000973450 pc=0x4369ad
panic(0x101bea0, 0x1a7a090)
	GOROOT/src/runtime/panic.go:969 +0x175 fp=0xc000973598 sp=0xc0009734e0 pc=0x436d35
runtime.panicmem(...)
	GOROOT/src/runtime/panic.go:212
runtime.sigpanic()
	GOROOT/src/runtime/signal_unix.go:720 +0x413 fp=0xc0009735c8 sp=0xc000973598 pc=0x44de13
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Impl(...)
	pkg/sentry/vfs/file_description.go:300
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.FilesystemType.GetFilesystem(0x131cb80, 0xc000bfea80, 0xc00021d808, 0xc0001f2c00, 0xc000356f00, 0x0, 0xc000357100, 0x1a, 0x0, 0x0, ...)
	pkg/sentry/fsimpl/fuse/fusefs.go:133 +0x418 fp=0xc000973750 sp=0xc0009735c8 pc=0xe5c398
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.(*FilesystemType).GetFilesystem(0x1ac0ce0, 0x131cb80, 0xc000bfea80, 0xc00021d808, 0xc0001f2c00, 0xc000356f00, 0x0, 0xc000357100, 0x1a, 0x0, ...)
	<autogenerated>:1 +0xc5 fp=0xc0009737d0 sp=0xc000973750 pc=0xe6b005
gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).MountDisconnected(0xc00021d808, 0x131cb80, 0xc000bfea80, 0xc0001f2c00, 0xc000356f00, 0x0, 0xc000356e00, 0x4, 0xc000973a50, 0x0, ...)
	pkg/sentry/vfs/mount.go:200 +0x13e fp=0xc0009738a0 sp=0xc0009737d0 pc=0x7ac77e
gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).MountAt(0xc00021d808, 0x131cb80, 0xc000bfea80, 0xc0001f2c00, 0xc000356f00, 0x0, 0xc000973a80, 0xc000356e00, 0x4, 0xc000973a50, ...)
	pkg/sentry/vfs/mount.go:272 +0xd4 fp=0xc000973940 sp=0xc0009738a0 pc=0x7ace54
gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.Mount(0xc000bfea80, 0xf0ffff, 0x200020c0, 0x20002100, 0x0, 0x20000040, 0x0, 0x0, 0x0, 0x0, ...)
	pkg/sentry/syscalls/linux/vfs2/mount.go:112 +0x499 fp=0xc000973af8 sp=0xc000973940 pc=0xd8abf9
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc000bfea80, 0xa5, 0xf0ffff, 0x200020c0, 0x20002100, 0x0, 0x20000040, 0x0, 0xdd6f37, 0x119f480, ...)
	pkg/sentry/kernel/task_syscall.go:104 +0x13c fp=0xc000973c58 sp=0xc000973af8 pc=0x9d011c
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc000bfea80, 0xa5, 0xf0ffff, 0x200020c0, 0x20002100, 0x0, 0x20000040, 0x0, 0x20000040, 0x0)
	pkg/sentry/kernel/task_syscall.go:239 +0x66 fp=0xc000973ce0 sp=0xc000973c58 pc=0x9d12e6
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc000bfea80, 0xa5, 0xf0ffff, 0x200020c0, 0x20002100, 0x0, 0x20000040, 0x0, 0x0, 0x0)
	pkg/sentry/kernel/task_syscall.go:199 +0x98 fp=0xc000973d40 sp=0xc000973ce0 pc=0x9d0e98
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc000bfea80, 0x2, 0xc000bfea80)
	pkg/sentry/kernel/task_syscall.go:174 +0x15c fp=0xc000973e10 sp=0xc000973d40 pc=0x9d083c
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0x0, 0xc000bfea80, 0x12eee40, 0x0)
	pkg/sentry/kernel/task_run.go:282 +0xc45 fp=0xc000973f60 sp=0xc000973e10 pc=0x9c4c45
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc000bfea80, 0x31)
	pkg/sentry/kernel/task_run.go:97 +0x1af fp=0xc000973fd0 sp=0xc000973f60 pc=0x9c390f
runtime.goexit()
	src/runtime/asm_amd64.s:1374 +0x1 fp=0xc000973fd8 sp=0xc000973fd0 pc=0x4705a1
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:323 +0xfe

Crashes (62):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/20 10:54 gvisor b645fcd241a8 04201c06 .config console log report syz ci-gvisor-kvm
2020/12/20 10:50 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-2-race
2020/12/20 10:49 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-3
2020/12/20 10:40 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-2
2020/12/20 10:40 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-1
2020/12/20 10:25 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-1-race
2020/12/20 10:24 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-2-cover
2020/12/20 10:24 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-2-race
2020/12/20 10:24 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-3-race
2020/12/20 10:24 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-3
2020/12/20 10:20 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-3-cover
2020/12/20 10:20 gvisor b645fcd241a8 04201c06 .config console log report syz ci-gvisor-kvm
2020/12/20 10:18 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-2
2020/12/20 10:18 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-1
2020/12/20 10:01 gvisor 9a72730f2456 04201c06 .config console log report syz ci-gvisor-ptrace-1-cover
2021/01/05 05:51 gvisor 807a080d9574 2a28ff1f .config console log report info ci-gvisor-ptrace-1-cover
2021/01/04 07:19 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-1-cover
2021/01/04 02:21 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-3-cover
2021/01/03 18:12 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-1-cover
2021/01/03 15:01 gvisor 3b1d37f6ab5c 79264ae3 .config console log report info ci-gvisor-kvm
2021/01/03 09:54 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-2-cover
2021/01/03 05:06 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-3-cover
2021/01/03 04:06 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-2-cover
2021/01/03 01:10 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-2-cover
2021/01/02 22:37 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-1-cover
2021/01/02 13:43 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-1-cover
2021/01/01 20:32 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-1-cover
2021/01/01 17:39 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-2-cover
2021/01/01 16:10 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-3-cover
2021/01/01 03:21 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/31 21:31 gvisor 807a080d9574 79264ae3 .config console log report info ci-gvisor-ptrace-1-cover
2020/12/31 14:09 gvisor 3b1d37f6ab5c 79264ae3 .config console log report info ci-gvisor-ptrace-1-cover
2020/12/30 23:41 gvisor ed5850e8eb98 ecb8c012 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/30 16:15 gvisor ed5850e8eb98 ecb8c012 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/30 00:43 gvisor 3ff7324dfa7c 80910769 .config console log report info ci-gvisor-ptrace-2-cover
2020/12/29 23:37 gvisor 3ff7324dfa7c 80910769 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/29 22:51 gvisor 3ff7324dfa7c 80910769 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/29 08:45 gvisor 5dc60a76328a 8259d56c .config console log report info ci-gvisor-ptrace-3-cover
2020/12/29 02:31 gvisor 5dc60a76328a 8259d56c .config console log report info ci-gvisor-ptrace-2-cover
2020/12/29 01:03 gvisor 5dc60a76328a 8259d56c .config console log report info ci-gvisor-ptrace-2-cover
2020/12/28 09:31 gvisor d07915987631 2242f77f .config console log report info ci-gvisor-ptrace-3-cover
2020/12/27 06:50 gvisor d07915987631 821e0b09 .config console log report info ci-gvisor-kvm
2020/12/27 01:52 gvisor d07915987631 821e0b09 .config console log report info ci-gvisor-ptrace-1-cover
2020/12/26 18:34 gvisor d07915987631 821e0b09 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/26 02:36 gvisor d07915987631 821e0b09 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/26 01:52 gvisor d07915987631 821e0b09 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/25 23:33 gvisor d07915987631 821e0b09 .config console log report info ci-gvisor-ptrace-1-cover
2020/12/25 08:18 gvisor d07915987631 c2c1d1dd .config console log report info ci-gvisor-ptrace-1-cover
2020/12/24 22:02 gvisor d07915987631 c2c1d1dd .config console log report info ci-gvisor-ptrace-1-cover
2020/12/24 17:04 gvisor d07915987631 c2c1d1dd .config console log report info ci-gvisor-ptrace-1-cover
2020/12/24 07:29 gvisor d07915987631 c2c1d1dd .config console log report info ci-gvisor-ptrace-3-cover
2020/12/24 06:22 gvisor d07915987631 c2c1d1dd .config console log report info ci-gvisor-ptrace-1-cover
2020/12/22 15:27 gvisor fee2cd640fc3 04201c06 .config console log report info ci-gvisor-ptrace-1-cover
2020/12/21 19:02 gvisor 9a72730f2456 04201c06 .config console log report info ci-gvisor-ptrace-2-cover
2020/12/21 17:56 gvisor 9a72730f2456 04201c06 .config console log report info ci-gvisor-ptrace-2-cover
2020/12/21 14:53 gvisor 9a72730f2456 04201c06 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/20 12:27 gvisor 9a72730f2456 04201c06 .config console log report info ci-gvisor-ptrace-2-cover
2020/12/20 10:12 gvisor 9a72730f2456 04201c06 .config console log report info ci-gvisor-ptrace-3-cover
2020/12/20 09:54 gvisor 9a72730f2456 04201c06 .config console log report info ci-gvisor-ptrace-1-cover
2020/12/18 19:31 gvisor b645fcd241a8 04201c06 .config console log report info ci-gvisor-kvm
2020/11/14 23:35 gvisor 182c126013a2 1bf9a662 .config console log report info ci-gvisor-kvm-direct-sandbox
* Struck through repros no longer work on HEAD.