syzbot


general protection fault in crc_itu_t

Status: upstream: reported C repro on 2022/12/29 23:30
Subsystems: udf
[Documentation on labels]
Reported-by: syzbot+b14a3b939448d70a1ce0@syzkaller.appspotmail.com
First crash: 532d, last: 467d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in crc_itu_t udf C inconclusive done 50 171d 621d 26/27 fixed on 2024/01/30 23:26
linux-4.19 KASAN: use-after-free Read in crc_itu_t udf C error 4 517d 559d 0/1 upstream: reported C repro on 2022/12/03 10:52
linux-6.1 KASAN: use-after-free Read in crc_itu_t origin:upstream C 5 26d 381d 0/3 upstream: reported C repro on 2023/05/30 07:40
linux-5.15 KASAN: use-after-free Read in crc_itu_t origin:upstream C 4 4d02h 442d 0/3 upstream: reported C repro on 2023/03/29 16:09
Fix bisection attempts (2)
Created Duration User Patch Repo Result
2023/03/05 06:23 53m bisect fix linux-4.14.y job log (0) log
2023/02/03 05:54 29m bisect fix linux-4.14.y job log (0) log

Sample crash report:
UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 7970 Comm: syz-executor248 Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff888097efe340 task.stack: ffff8880a3238000
RIP: 0010:crc_itu_t+0x40/0xc0 lib/crc-itu-t.c:62
RSP: 0018:ffff8880a323f9a0 EFLAGS: 00010206
RAX: 0000000000000004 RBX: 000000000000a489 RCX: 0000000000000000
RDX: 0000000000000006 RSI: 0000000000000026 RDI: 0000000000000026
RBP: 00000000000000bc R08: 0000000000000001 R09: ffff88808f271c03
R10: ffff88808f271c03 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000027 R14: ffff88808ffd02a0 R15: 00000000000000bc
FS:  0000555556ef5300(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056465fc4972c CR3: 00000000a588f000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 udf_write_fi+0x6c7/0xe80 fs/udf/namei.c:113
 udf_rename+0xcab/0x1180 fs/udf/namei.c:1194
 vfs_rename+0x560/0x1820 fs/namei.c:4498
 SYSC_renameat2 fs/namei.c:4646 [inline]
 SyS_renameat2+0x95b/0xad0 fs/namei.c:4535
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f995df428c9
RSP: 002b:00007fffd7d04438 EFLAGS: 00000246 ORIG_RAX: 000000000000013c
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f995df428c9
RDX: 0000000000000005 RSI: 00000000200001c0 RDI: 0000000000000005
RBP: 00007f995df02160 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000200 R11: 0000000000000246 R12: 00007f995df021f0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: 48 85 ed 74 7c 49 bc 00 00 00 00 00 fc ff df 4c 01 ed e8 04 a1 3a fe 4c 89 ef 49 83 c5 01 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 20 38 d0 7f 04 84 c0 75 59 44 0f b7 f3 0f b6 df 41 
RIP: crc_itu_t+0x40/0xc0 lib/crc-itu-t.c:62 RSP: ffff8880a323f9a0
---[ end trace ad3afe9f2cfebb01 ]---
----------------
Code disassembly (best guess):
   0:	48 85 ed             	test   %rbp,%rbp
   3:	74 7c                	je     0x81
   5:	49 bc 00 00 00 00 00 	movabs $0xdffffc0000000000,%r12
   c:	fc ff df
   f:	4c 01 ed             	add    %r13,%rbp
  12:	e8 04 a1 3a fe       	callq  0xfe3aa11b
  17:	4c 89 ef             	mov    %r13,%rdi
  1a:	49 83 c5 01          	add    $0x1,%r13
  1e:	48 89 f8             	mov    %rdi,%rax
  21:	48 89 fa             	mov    %rdi,%rdx
  24:	48 c1 e8 03          	shr    $0x3,%rax
  28:	83 e2 07             	and    $0x7,%edx
* 2b:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax <-- trapping instruction
  30:	38 d0                	cmp    %dl,%al
  32:	7f 04                	jg     0x38
  34:	84 c0                	test   %al,%al
  36:	75 59                	jne    0x91
  38:	44 0f b7 f3          	movzwl %bx,%r14d
  3c:	0f b6 df             	movzbl %bh,%ebx
  3f:	41                   	rex.B

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/12/29 23:30 linux-4.14.y c4215ee4771b 44712fbc .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 general protection fault in crc_itu_t
2023/01/03 06:20 linux-4.14.y c4215ee4771b ab32d508 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 KASAN: use-after-free Read in crc_itu_t
* Struck through repros no longer work on HEAD.