syzbot


BUG: unable to handle kernel NULL pointer dereference in kauditd_hold_skb

Status: upstream: reported syz repro on 2024/05/09 08:14
Subsystems: audit
[Documentation on labels]
Reported-by: syzbot+8ffdaad8822cadf6ff4e@syzkaller.appspotmail.com
First crash: 49d, last: 35d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [audit?] BUG: unable to handle kernel NULL pointer dereference in kauditd_hold_skb 3 (4) 2024/05/13 14:59
Last patch testing requests (2)
Created Duration User Patch Repo Result
2024/05/24 17:43 22m retest repro upstream OK log
2024/05/24 17:43 22m retest repro upstream OK log

Sample crash report:
kauditd_printk_skb: 26 callbacks suppressed
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read
[00000000] *pgd=80000080004003, *pmd=00000000
Internal error: Oops: 207 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 30 Comm: kauditd Not tainted 6.9.0-rc7-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at printk_get_level include/linux/printk.h:21 [inline]
PC is at printk_parse_prefix+0xc/0x90 kernel/printk/printk.c:2137
LR is at printk_sprint+0x10c/0x164 kernel/printk/printk.c:2177
pc : [<802bc524>]    lr : [<802bc6b4>]    psr: 60000093
sp : df8d9d70  ip : df8d9d80  fp : df8d9d7c
r10: 8262a180  r9 : 00000000  r8 : 00000000
r7 : df8d9dc8  r6 : 00000000  r5 : 00000000  r4 : 00000000
r3 : df8d9ebc  r2 : 00000000  r1 : 00000000  r0 : 00000000
Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 84ff8900  DAC: 00000000
Register r0 information: NULL pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: 2-page vmalloc region starting at 0xdf8d8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2797
Register r4 information: NULL pointer
Register r5 information: NULL pointer
Register r6 information: NULL pointer
Register r7 information: 2-page vmalloc region starting at 0xdf8d8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2797
Register r8 information: NULL pointer
Register r9 information: NULL pointer
Register r10 information: non-slab/vmalloc memory
Register r11 information: 2-page vmalloc region starting at 0xdf8d8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2797
Register r12 information: 2-page vmalloc region starting at 0xdf8d8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2797
Process kauditd (pid: 30, stack limit = 0xdf8d8000)
Stack: (0xdf8d9d70 to 0xdf8da000)
9d60:                                     df8d9d9c df8d9d80 802bc6b4 802bc524
9d80: 00000000 00000000 dddd9595 00000000 df8d9e24 df8d9da0 802bc918 802bc5b4
9da0: 81fce7a8 df8d9ebc dddd9584 00000010 d2208c39 df8d9dc0 0000001e 81fce7a8
9dc0: 60000013 00000005 00000000 df8d9ebc 8263bcf0 00000000 00000000 8262a22c
9de0: 60000093 3fffe336 00000000 75613501 00746964 94afcf0d 802ba9e0 00000000
9e00: ffffffff 82622ec4 00000000 00000000 00000000 81fce7a8 df8d9e64 df8d9e28
9e20: 802bda40 802bc718 df8d9ebc 8262a1ac 82604d40 00000000 81a10a44 82e50000
9e40: 85140000 00000000 8033fd34 843e9c00 00000000 00000000 df8d9e7c df8d9e68
9e60: 802bdbdc 802bd948 df8d9ebc df8d9e78 df8d9e9c df8d9e80 802bec18 802bdbc0
9e80: 81893794 818ce120 843e9c00 ffffff91 df8d9eb4 df8d9ea0 818a6700 802bebb0
9ea0: df8d9ebc 94afcf0d df8d9ee4 df8d9ec8 803404e4 818a66dc 81fce7a8 00000579
9ec0: 85140010 00000000 826fb6ec 843e9c00 00000000 8033fd34 df8d9f24 df8d9ee8
9ee0: 8033ff54 80340414 df8d9f04 00000001 00000000 8289fa50 df8d9f24 826fb6ec
9f00: 8289f9f8 00000000 00000000 82f18c80 00000000 00000000 df8d9f84 df8d9f28
9f20: 8034080c 8033fe64 8033fd34 80340408 8027cd5c 80340408 8033fcdc 8033fd34
9f40: 00000000 82e50000 802a5074 df8d9f4c df8d9f4c 94afcf0d df8d9f84 82ea4ac0
9f60: 82e50000 8034058c 00000000 82f18c80 df819e50 00000000 df8d9fac df8d9f88
9f80: 802702a0 80340598 82ea4ac0 8027019c 00000000 00000000 00000000 00000000
9fa0: 00000000 df8d9fb0 80200104 802701a8 00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
Call trace: 
[<802bc518>] (printk_parse_prefix) from [<802bc6b4>] (printk_sprint+0x10c/0x164 kernel/printk/printk.c:2177)
[<802bc5a8>] (printk_sprint) from [<802bc918>] (vprintk_store+0x20c/0x450 kernel/printk/printk.c:2279)
 r7:00000000 r6:dddd9595 r5:00000000 r4:00000000
[<802bc70c>] (vprintk_store) from [<802bda40>] (vprintk_emit+0x104/0x278 kernel/printk/printk.c:2329)
 r10:81fce7a8 r9:00000000 r8:00000000 r7:00000000 r6:82622ec4 r5:ffffffff
 r4:00000000
[<802bd93c>] (vprintk_emit) from [<802bdbdc>] (vprintk_default+0x28/0x30 kernel/printk/printk.c:2363)
 r10:00000000 r9:00000000 r8:843e9c00 r7:8033fd34 r6:00000000 r5:85140000
 r4:82e50000
[<802bdbb4>] (vprintk_default) from [<802bec18>] (vprintk+0x74/0x94 kernel/printk/printk_safe.c:45)
[<802beba4>] (vprintk) from [<818a6700>] (_printk+0x34/0x58 kernel/printk/printk.c:2373)
 r6:ffffff91 r4:843e9c00
[<818a66cc>] (_printk) from [<803404e4>] (kauditd_printk_skb kernel/audit.c:546 [inline])
[<818a66cc>] (_printk) from [<803404e4>] (kauditd_hold_skb+0xdc/0xf8 kernel/audit.c:581)
 r3:00000000 r2:85140010 r1:00000579 r0:81fce7a8
[<80340408>] (kauditd_hold_skb) from [<8033ff54>] (kauditd_send_queue+0xfc/0x16c kernel/audit.c:766)
 r7:8033fd34 r6:00000000 r5:843e9c00 r4:826fb6ec
[<8033fe58>] (kauditd_send_queue) from [<8034080c>] (kauditd_thread+0x280/0x2d8 kernel/audit.c:890)
 r10:00000000 r9:00000000 r8:82f18c80 r7:00000000 r6:00000000 r5:8289f9f8
 r4:826fb6ec
[<8034058c>] (kauditd_thread) from [<802702a0>] (kthread+0x104/0x134 kernel/kthread.c:388)
 r10:00000000 r9:df819e50 r8:82f18c80 r7:00000000 r6:8034058c r5:82e50000
 r4:82ea4ac0
[<8027019c>] (kthread) from [<80200104>] (ret_from_fork+0x14/0x30 arch/arm/kernel/entry-common.S:134)
Exception stack(0xdf8d9fb0 to 0xdf8d9ff8)
9fa0:                                     00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027019c r4:82ea4ac0
Code: e89da800 e1a0c00d e92dd800 e24cb004 (e5d03000) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e89da800 	ldm	sp, {fp, sp, pc}
   4:	e1a0c00d 	mov	ip, sp
   8:	e92dd800 	push	{fp, ip, lr, pc}
   c:	e24cb004 	sub	fp, ip, #4
* 10:	e5d03000 	ldrb	r3, [r0] <-- trapping instruction

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/10 17:42 upstream 448b3fe5a0ea 375932ce .config console log report syz [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel NULL pointer dereference in kauditd_hold_skb
2024/05/09 08:14 upstream 6d7ddd805123 20bf80e1 .config console log report syz [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel NULL pointer dereference in kauditd_hold_skb
2024/05/10 16:25 upstream 448b3fe5a0ea 375932ce .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel NULL pointer dereference in kauditd_hold_skb
2024/05/09 07:14 upstream 6d7ddd805123 20bf80e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel NULL pointer dereference in kauditd_hold_skb
2024/04/27 05:26 upstream e6ebf0117218 07b455f9 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel NULL pointer dereference in kauditd_hold_skb
* Struck through repros no longer work on HEAD.