syzbot

 sign-in | mailing list | source | docs
🐞 Open [80] 🐞 Fixed [21] 🐞 Invalid [282] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in call_timer_fn (2)

Status: upstream: reported on 2022/04/15 00:29
Reported-by: syzbot+aa458316adb49b2df9cb@syzkaller.appspotmail.com
First crash: 742d, last: 1d09h
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in call_timer_fn kernel 1 1240d 1240d 0/26 auto-closed as invalid on 2021/03/03 09:48
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in call_timer_fn 2 1434d 1462d 0/1 auto-closed as invalid on 2020/09/20 01:08
android-54 BUG: unable to handle kernel NULL pointer dereference in call_timer_fn 5 1193d 1369d 0/2 auto-closed as invalid on 2021/05/18 23:15

Sample crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1e659a067 P4D 1e659a067 PUD 1e6e74067 PMD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2093 Comm: syz-executor.3 Tainted: G        W         5.4.268-syzkaller-00003-g2d5d8240a7cb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010202
RAX: ffffffff8154e34a RBX: 0000000000000101 RCX: ffff8881e7310fc0
RDX: 0000000080000101 RSI: 0000000000000000 RDI: ffff8881eaa7b1c0
RBP: ffff8881f6e09ec8 R08: ffffffff8154df8e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffa058
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881eaa7b1c0
FS:  00007f46e35d46c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001ebc5b000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1418
 expire_timers kernel/time/timer.c:1463 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1787
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1800
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
Modules linked in:
CR2: 0000000000000000
---[ end trace ff0cb64fcd10e1ad ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010202
RAX: ffffffff8154e34a RBX: 0000000000000101 RCX: ffff8881e7310fc0
RDX: 0000000080000101 RSI: 0000000000000000 RDI: ffff8881eaa7b1c0
RBP: ffff8881f6e09ec8 R08: ffffffff8154df8e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffa058
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881eaa7b1c0
FS:  00007f46e35d46c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001ebc5b000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600

Crashes (279):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/25 11:17 android12-5.4 2d5d8240a7cb 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/25 00:14 android12-5.4 2d5d8240a7cb 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/24 15:38 android12-5.4 2d5d8240a7cb 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/23 21:21 android12-5.4 2d5d8240a7cb 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/23 12:55 android12-5.4 2d5d8240a7cb 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/23 10:21 android12-5.4 2d5d8240a7cb 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/22 23:20 android12-5.4 2d5d8240a7cb 36c961ad .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/19 01:15 android12-5.4 2d5d8240a7cb af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/18 03:06 android12-5.4 2d5d8240a7cb acc528cb .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/17 19:07 android12-5.4 2d5d8240a7cb acc528cb .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/16 15:14 android12-5.4 2d5d8240a7cb 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/16 13:01 android12-5.4 2d5d8240a7cb 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/13 18:37 android12-5.4 d0d34dcb02cc c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/13 12:00 android12-5.4 d0d34dcb02cc c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/12 20:12 android12-5.4 d0d34dcb02cc c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/04/10 15:54 android12-5.4 d0d34dcb02cc 4320ec32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/14 23:05 android12-5.4 43a5ead9254d d615901c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/12 10:40 android12-5.4 43a5ead9254d 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/12 04:38 android12-5.4 43a5ead9254d 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/11 20:16 android12-5.4 43a5ead9254d 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/11 15:33 android12-5.4 43a5ead9254d 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/11 09:06 android12-5.4 43a5ead9254d 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/10 23:56 android12-5.4 43a5ead9254d 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/10 02:44 android12-5.4 43a5ead9254d 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/09 17:44 android12-5.4 43a5ead9254d 6ee49f2e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/08 14:56 android12-5.4 43a5ead9254d cf82cde1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/07 09:40 android12-5.4 50cb39f34248 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/07 07:39 android12-5.4 50cb39f34248 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/07 02:43 android12-5.4 50cb39f34248 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/06 22:37 android12-5.4 50cb39f34248 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/06 20:20 android12-5.4 50cb39f34248 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/06 18:25 android12-5.4 50cb39f34248 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/06 03:55 android12-5.4 50cb39f34248 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/05 18:06 android12-5.4 50cb39f34248 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/04 22:00 android12-5.4 50cb39f34248 3717835d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/04 11:05 android12-5.4 50cb39f34248 25905f5d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/04 05:09 android12-5.4 50cb39f34248 25905f5d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/03 20:06 android12-5.4 50cb39f34248 25905f5d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/03 09:53 android12-5.4 50cb39f34248 25905f5d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/02 23:58 android12-5.4 50cb39f34248 25905f5d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/02 00:39 android12-5.4 50cb39f34248 83acf9e0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/01 09:28 android12-5.4 50cb39f34248 352ab904 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/03/01 01:51 android12-5.4 50cb39f34248 352ab904 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/02/29 18:52 android12-5.4 50cb39f34248 352ab904 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/02/28 20:25 android12-5.4 50cb39f34248 55d6f11d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/02/28 05:29 android12-5.4 50cb39f34248 d367cbe5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/02/27 17:22 android12-5.4 1b3143b9b166 05e69c83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/02/27 12:48 android12-5.4 1b3143b9b166 05e69c83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/02/27 08:15 android12-5.4 1b3143b9b166 05e69c83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2024/02/27 07:13 android12-5.4 1b3143b9b166 05e69c83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
2022/04/15 00:29 android12-5.4 b730087e9a5d b17b2923 .config console log report info ci2-android-5-4-perf-kasan BUG: unable to handle kernel NULL pointer dereference in call_timer_fn
* Struck through repros no longer work on HEAD.