syzbot

 sign-in | mailing list | source | docs
🐞 Open [712]
🐞 Fixed [297]
🐞 Invalid [838]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

general protection fault in hrtimer_active

Status: upstream: reported C repro on 2019/09/09 21:23
Reported-by: syzbot+86e010bb5328c3dea6ee@syzkaller.appspotmail.com
First crash: 1929d, last: 1185d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in hrtimer_active (3) kernel syz done error 34 1053d 1358d 20/28 fixed on 2022/03/08 16:11
upstream general protection fault in hrtimer_active (5) kernel C error 22 676d 680d 22/28 fixed on 2023/06/08 14:41
upstream general protection fault in hrtimer_active kernel C 669 2597d 2621d 3/28 fixed on 2017/11/28 03:36
upstream general protection fault in hrtimer_active (4) kernel 7 882d 992d 0/28 auto-obsoleted due to no activity on 2022/10/20 15:45
upstream KASAN: null-ptr-deref Read in hrtimer_active kernel 7 396d 534d 0/28 closed as invalid on 2024/01/16 13:47
upstream general protection fault in hrtimer_active (2) kernel C 10612 2484d 2489d 4/28 fixed on 2018/03/06 13:29
▶ ▼ Fix bisection attempts (21)
Created Duration User Patch Repo Result
2021/10/23 06:41 16m bisect fix linux-4.19.y error job log
2021/09/22 12:50 27m bisect fix linux-4.19.y OK (0) job log log
2021/08/23 11:40 28m bisect fix linux-4.19.y OK (0) job log log
2021/07/24 11:05 26m bisect fix linux-4.19.y OK (0) job log log
2021/06/24 10:11 23m bisect fix linux-4.19.y OK (0) job log log
2021/05/25 03:39 26m bisect fix linux-4.19.y OK (0) job log log
2021/04/25 02:36 27m bisect fix linux-4.19.y OK (0) job log log
2021/03/25 17:40 21m bisect fix linux-4.19.y OK (0) job log log
2021/02/23 17:17 22m bisect fix linux-4.19.y OK (0) job log log
2021/01/21 05:41 23m bisect fix linux-4.19.y OK (0) job log log
2020/12/22 05:17 24m bisect fix linux-4.19.y OK (0) job log log
2020/11/22 04:53 23m bisect fix linux-4.19.y OK (0) job log log
2020/10/23 04:30 22m bisect fix linux-4.19.y OK (0) job log log
2020/09/23 04:06 23m bisect fix linux-4.19.y OK (0) job log log
2020/08/24 03:39 27m bisect fix linux-4.19.y OK (0) job log log
2020/07/25 03:13 26m bisect fix linux-4.19.y OK (0) job log log
2020/06/25 02:47 25m bisect fix linux-4.19.y OK (0) job log log
2020/05/26 02:22 24m bisect fix linux-4.19.y OK (0) job log log
2020/04/26 01:57 25m bisect fix linux-4.19.y OK (0) job log log
2020/03/27 01:32 24m bisect fix linux-4.19.y OK (0) job log log
2020/02/26 01:06 25m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
RBP: 00007fff66caa1f0 R08: 0000000000000001 R09: 0000000000000035
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7501 Comm: syz-executor337 Not tainted 4.19.71 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:__read_seqcount_begin include/linux/seqlock.h:113 [inline]
RIP: 0010:raw_read_seqcount_begin include/linux/seqlock.h:148 [inline]
RIP: 0010:hrtimer_active+0x11e/0x230 kernel/time/hrtimer.c:1327
Code: 48 39 c3 0f 84 d3 00 00 00 e8 0e 21 0f 00 48 8b 45 c8 80 38 00 0f 85 06 01 00 00 49 8b 5d 30 4c 8d 63 10 4c 89 e0 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RSP: 0018:ffff88809b76f350 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000000 RCX: ffff88809ee1d078
RDX: 0000000000000000 RSI: ffffffff815c4582 RDI: ffff88809ee1d040
RBP: ffff88809b76f3a8 R08: ffff88808e480580 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000010
R13: ffff88809ee1d040 R14: ffff88807faf0800 R15: dffffc0000000000
FS:  0000000001d8a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000083fea000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 hrtimer_try_to_cancel+0x74/0x5b0 kernel/time/hrtimer.c:1144
 hrtimer_cancel+0x20/0x40 kernel/time/hrtimer.c:1170
 qdisc_watchdog_cancel+0x16/0x20 net/sched/sch_api.c:632
 cbs_destroy+0x5e/0xd0 net/sched/sch_cbs.c:377
 qdisc_create+0xaa6/0x1230 net/sched/sch_api.c:1203
 tc_modify_qdisc+0x51b/0x1bdc net/sched/sch_api.c:1570
 rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:4747
 netlink_rcv_skb+0x17d/0x460 net/netlink/af_netlink.c:2454
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4765
 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
 netlink_unicast+0x537/0x720 net/netlink/af_netlink.c:1343
 netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:632
 ___sys_sendmsg+0x803/0x920 net/socket.c:2115
 __sys_sendmsg+0x105/0x1d0 net/socket.c:2153
 __do_sys_sendmsg net/socket.c:2162 [inline]
 __se_sys_sendmsg net/socket.c:2160 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2160
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4429a9
Code: 43 02 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff66caa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004429a9
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 00007fff66caa1f0 R08: 0000000000000001 R09: 0000000000000035
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 1657ab6f142951e8 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:__read_seqcount_begin include/linux/seqlock.h:113 [inline]
RIP: 0010:raw_read_seqcount_begin include/linux/seqlock.h:148 [inline]
RIP: 0010:hrtimer_active+0x11e/0x230 kernel/time/hrtimer.c:1327
Code: 48 39 c3 0f 84 d3 00 00 00 e8 0e 21 0f 00 48 8b 45 c8 80 38 00 0f 85 06 01 00 00 49 8b 5d 30 4c 8d 63 10 4c 89 e0 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RSP: 0018:ffff88809b76f350 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000000 RCX: ffff88809ee1d078
RDX: 0000000000000000 RSI: ffffffff815c4582 RDI: ffff88809ee1d040
RBP: ffff88809b76f3a8 R08: ffff88808e480580 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000010
R13: ffff88809ee1d040 R14: ffff88807faf0800 R15: dffffc0000000000
FS:  0000000001d8a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000083fea000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (66):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/09 20:56 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report syz C ci2-linux-4-19
2020/01/27 01:06 linux-4.19.y d183c8e2647a dd56146d .config console log report ci2-linux-4-19
2020/01/26 22:55 linux-4.19.y d183c8e2647a dd56146d .config console log report ci2-linux-4-19
2020/01/19 03:22 linux-4.19.y dc4ba5be1bab bc8bc756 .config console log report ci2-linux-4-19
2020/01/18 18:56 linux-4.19.y dc4ba5be1bab 3de7aabb .config console log report ci2-linux-4-19
2020/01/17 13:40 linux-4.19.y db5b9190ff82 3de7aabb .config console log report ci2-linux-4-19
2020/01/15 22:26 linux-4.19.y db5b9190ff82 f9b69507 .config console log report ci2-linux-4-19
2020/01/11 14:27 linux-4.19.y cb1f9a169a0e 4c04afaa .config console log report ci2-linux-4-19
2019/12/28 00:56 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/26 01:25 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/24 12:06 linux-4.19.y 672481c2deff be5c2c81 .config console log report ci2-linux-4-19
2019/12/13 15:04 linux-4.19.y 312017a460d5 2a752b7c .config console log report ci2-linux-4-19
2019/12/09 02:10 linux-4.19.y fb683b5e3f53 1508f453 .config console log report ci2-linux-4-19
2019/11/23 19:14 linux-4.19.y c63ee2939dc1 598ca6c8 .config console log report ci2-linux-4-19
2019/11/23 17:56 linux-4.19.y c63ee2939dc1 598ca6c8 .config console log report ci2-linux-4-19
2019/11/20 17:15 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 22:35 linux-4.19.y c555efaf1402 432c7650 .config console log report ci2-linux-4-19
2019/11/19 03:42 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/18 09:08 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/11/14 20:06 linux-4.19.y c555efaf1402 048f2d49 .config console log report ci2-linux-4-19
2019/11/12 15:24 linux-4.19.y 7d8dbefc22ff 048f2d49 .config console log report ci2-linux-4-19
2019/11/11 18:29 linux-4.19.y 7d8dbefc22ff 377d77fa .config console log report ci2-linux-4-19
2019/11/09 02:47 linux-4.19.y 5ee93551c703 1e35461e .config console log report ci2-linux-4-19
2019/11/09 02:43 linux-4.19.y 5ee93551c703 1e35461e .config console log report ci2-linux-4-19
2019/10/27 01:08 linux-4.19.y c3038e718a19 25bb509e .config console log report ci2-linux-4-19
2019/10/23 06:07 linux-4.19.y c3038e718a19 d0686497 .config console log report ci2-linux-4-19
2019/10/22 22:08 linux-4.19.y c3038e718a19 4ee855e7 .config console log report ci2-linux-4-19
2019/10/22 10:01 linux-4.19.y c3038e718a19 c59a7cd8 .config console log report ci2-linux-4-19
2019/10/21 02:38 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/21 00:03 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/20 19:41 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/20 05:18 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/20 01:55 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/19 04:06 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/19 03:47 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/18 14:24 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/18 02:10 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/17 05:04 linux-4.19.y dafd634415a7 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/14 13:02 linux-4.19.y dafd634415a7 a6aef847 .config console log report ci2-linux-4-19
2019/10/13 16:08 linux-4.19.y dafd634415a7 2f661ec4 .config console log report ci2-linux-4-19
2019/10/11 21:33 linux-4.19.y dafd634415a7 426631dd .config console log report ci2-linux-4-19
2019/10/10 12:30 linux-4.19.y 58fce2064530 d52eff28 .config console log report ci2-linux-4-19
2019/10/10 07:24 linux-4.19.y 58fce2064530 c4b9981b .config console log report ci2-linux-4-19
2019/10/08 23:36 linux-4.19.y 58fce2064530 b1ebbfef .config console log report ci2-linux-4-19
2019/10/06 16:54 linux-4.19.y 6cad9d0cf87b f3f7d9c8 .config console log report ci2-linux-4-19
2019/10/03 21:25 linux-4.19.y 555161ee1b7a fc17ba49 .config console log report ci2-linux-4-19
2019/10/03 12:40 linux-4.19.y 555161ee1b7a fc17ba49 .config console log report ci2-linux-4-19
2019/10/02 14:38 linux-4.19.y 555161ee1b7a 2e29b534 .config console log report ci2-linux-4-19
2019/09/30 02:42 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/29 18:09 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/29 13:05 linux-4.19.y d573e8a79f70 c1ad5441 .config console log report ci2-linux-4-19
2019/09/27 16:46 linux-4.19.y d573e8a79f70 d8074e0b .config console log report ci2-linux-4-19
2019/09/27 03:56 linux-4.19.y d573e8a79f70 2f1548bc .config console log report ci2-linux-4-19
2019/09/27 03:55 linux-4.19.y d573e8a79f70 2f1548bc .config console log report ci2-linux-4-19
2019/09/27 00:15 linux-4.19.y d573e8a79f70 2f1548bc .config console log report ci2-linux-4-19
2019/09/25 04:38 linux-4.19.y d573e8a79f70 e38a6630 .config console log report ci2-linux-4-19
2019/09/21 06:03 linux-4.19.y dbc29aff8d04 d96e88f3 .config console log report ci2-linux-4-19
2019/09/19 15:41 linux-4.19.y dbc29aff8d04 eb940044 .config console log report ci2-linux-4-19
2019/09/14 15:25 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/13 18:25 linux-4.19.y ee809c7e0895 32d59357 .config console log report ci2-linux-4-19
2019/09/11 13:09 linux-4.19.y ee809c7e0895 a60cb4cd .config console log report ci2-linux-4-19
2019/09/09 20:22 linux-4.19.y e7d2672c66e4 a60cb4cd .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.