general protection fault in ebitmap_destroy (2)

Status: fixed on 2019/04/01 10:28
Subsystems: selinux
[Documentation on labels]
Reported-by: syzbot+a57b2aff60832666fc28@syzkaller.appspotmail.com
Fix commit: 6a1afffb08ce selinux: fix NULL dereference in policydb_destroy()
First crash: 2692d, last: 2683d
Cause bisection: introduced by (bisect log) :
commit acdf52d97f824019888422842757013b37441dd1
Author: Kent Overstreet <kent.overstreet@gmail.com>
Date: Tue Mar 12 06:31:10 2019 +0000

  selinux: convert to kvmalloc

Crash: general protection fault in ebitmap_destroy (log)
Repro: C syz .config
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
general protection fault in ebitmap_destroy (2) 2 (4) 2019/03/21 22:20
[PATCH] selinux: fix NULL dereference in policydb_destroy() 3 (3) 2019/03/18 16:29
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in ebitmap_destroy selinux 2 syz 1 2755d 2755d 11/29 fixed on 2019/03/06 07:43
android-44 general protection fault in ebitmap_destroy 2 C 3 2745d 2662d 0/2 public: reported C repro on 2019/04/13 00:01
android-414 general protection fault in ebitmap_destroy 2 syz 1 2755d 2664d 0/1 public: reported syz repro on 2019/04/10 16:14
android-49 general protection fault in ebitmap_destroy 2 C 2216 2427d 2664d 0/3 public: reported C repro on 2019/04/11 08:44
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2019/03/21 18:58 16m kent.overstreet@gmail.com http://evilpiepirate.org/git/bcachefs.git syzbot-fix OK

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8151 Comm: syz-executor646 Not tainted 5.0.0+ #20
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ebitmap_destroy+0x32/0xf0 security/selinux/ss/ebitmap.c:334
Code: 49 89 fd 41 54 53 e8 6d f6 7f fe 4d 85 ed 0f 84 99 00 00 00 e8 5f f6 7f fe 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 98 00 00 00 49 be 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffff8880918478c8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880a15c93e8 RCX: ffffffff82f1b92c
RDX: 0000000000000002 RSI: ffffffff82f06dd1 RDI: 0000000000000010
RBP: ffff8880918478e8 R08: ffff88807c05c080 R09: ffff88807c05c948
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000010 R14: ffffed10142b92b2 R15: 0000000000000401
FS:  0000000000f65880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 000000007e591000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 policydb_destroy+0x62c/0x7f0 security/selinux/ss/policydb.c:832
 policydb_read+0xe27/0x52c0 security/selinux/ss/policydb.c:2522
 security_load_policy+0x36d/0x1170 security/selinux/ss/services.c:2147
 sel_write_load+0x25a/0x470 security/selinux/selinuxfs.c:565
 __vfs_write+0x8d/0x110 fs/read_write.c:485
 vfs_write+0x20c/0x580 fs/read_write.c:549
 ksys_write+0xea/0x1f0 fs/read_write.c:598
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write fs/read_write.c:607 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:607
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4401f9
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff747a42f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004401f9
RDX: 0000000000000050 RSI: 0000000020000180 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a80
R13: 0000000000401b10 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace c9a4ce516f33c859 ]---
RIP: 0010:ebitmap_destroy+0x32/0xf0 security/selinux/ss/ebitmap.c:334
Code: 49 89 fd 41 54 53 e8 6d f6 7f fe 4d 85 ed 0f 84 99 00 00 00 e8 5f f6 7f fe 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 98 00 00 00 49 be 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffff8880918478c8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880a15c93e8 RCX: ffffffff82f1b92c
RDX: 0000000000000002 RSI: ffffffff82f06dd1 RDI: 0000000000000010
RBP: ffff8880918478e8 R08: ffff88807c05c080 R09: ffff88807c05c948
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000010 R14: ffffed10142b92b2 R15: 0000000000000401
FS:  0000000000f65880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 000000007e591000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (36):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/13 19:08 upstream ebc551f2b8f9 2881fc25 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/03/22 17:45 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 14:13 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 14:12 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 11:46 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 10:29 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 10:18 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 10:16 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 04:08 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 01:35 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/20 03:24 upstream b7a42146dca3 2458c1c6 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/20 03:18 upstream b7a42146dca3 2458c1c6 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/19 17:42 upstream 9e98c678c2d6 e4549234 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/19 17:41 upstream 9e98c678c2d6 e4549234 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/19 16:41 upstream 9e98c678c2d6 e4549234 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/18 19:05 upstream 9e98c678c2d6 4656beca .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/17 20:08 upstream 80b98e92ebcb ba18afea .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/17 08:58 upstream a9dce6679d73 bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/16 17:43 upstream 9c7dc824d9a4 bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/16 11:50 upstream 6c83d0d5eb62 bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/16 09:24 upstream 6c83d0d5eb62 bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/16 06:34 upstream 6c83d0d5eb62 bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/16 06:33 upstream 6c83d0d5eb62 bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/15 18:14 upstream f261c4e529da bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/15 14:10 upstream f261c4e529da bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/15 14:09 upstream f261c4e529da bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/15 14:06 upstream f261c4e529da bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/15 14:05 upstream f261c4e529da bab43553 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/15 04:53 upstream 3b319ee220a8 d72db19b .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/15 04:52 upstream 3b319ee220a8 d72db19b .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/15 04:52 upstream 3b319ee220a8 d72db19b .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/14 22:49 upstream 3b319ee220a8 d72db19b .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/14 22:37 upstream 3b319ee220a8 d72db19b .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/14 17:00 upstream fa3d493f7a57 d09a902e .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/14 11:32 upstream fa3d493f7a57 d09a902e .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/13 18:22 upstream ebc551f2b8f9 2881fc25 .config console log report ci-upstream-kasan-gce-selinux-root
* Struck through repros no longer work on HEAD.