syzbot

 sign-in | mailing list | source | docs
🐞 Open [994] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12516] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in process_init_reply

Status: fixed on 2018/08/28 17:48
Subsystems: fuse
[Documentation on labels]
Reported-by: syzbot+b62f08f4d5857755e3bc@syzkaller.appspotmail.com
Fix commit: e8f3bd773d22 fuse: Fix oops at process_init_reply()
First crash: 2110d, last: 2075d
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH 3.16 000/328] 3.16.62-rc1 review 338 (338) 2018/12/16 22:01
[PATCH 4.14 000/165] 4.14.68-stable review 173 (173) 2018/10/03 09:14
[PATCH 4.4 00/80] 4.4.154-stable review 87 (87) 2018/09/13 07:10
[PATCH 4.18 000/123] 4.18.6-stable review 145 (145) 2018/09/09 03:58
[PATCH 4.9 000/107] 4.9.125-stable review 105 (105) 2018/09/04 22:51
[PATCH (resend)] fuse: Fix oops at process_init_reply(). 5 (5) 2018/07/20 08:41
[PATCH] fuse: Fix oops at process_init_reply(). 1 (1) 2018/07/18 10:00
general protection fault in process_init_reply 0 (1) 2018/07/17 23:49
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 general protection fault in process_init_reply C 4 2066d 1840d 0/3 public: reported C repro on 2019/04/14 00:00

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
CPU: 0 PID: 17978 Comm: syz-executor367 Not tainted 4.18.0-rc5-next-20180717+ #9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:process_init_reply+0xedc/0x1500 fs/fuse/inode.c:923
Code: 0f 95 c0 84 c2 0f 85 65 05 00 00 49 8d be 00 01 00 00 80 8b e9 01 00 00 06 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 32 05 00 00 49 c7 86 00 01 00 00 a0 7f 16 89 41 
RSP: 0018:ffff8801a97cf478 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8801cdfdfb40 RCX: 0000000000000001
RDX: 0000000000000020 RSI: ffffffff826e5a3d RDI: 0000000000000100
RBP: ffff8801a97cf4b0 R08: ffff8801b2a625c0 R09: ffffed0039cd05da
R10: ffffed0039cd05da R11: ffff8801ce682ed3 R12: ffff8801ce682e00
R13: ffff8801cdfdfd29 R14: 0000000000000000 R15: ffff8801cdfdfd25
FS:  00007f7f6d9b8700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7f6d9d8e78 CR3: 00000001d64ed000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 request_end+0x3de/0xb20 fs/fuse/dev.c:402
 fuse_dev_do_read.isra.25+0xf21/0x1960 fs/fuse/dev.c:1316
 fuse_dev_read+0x1a9/0x250 fs/fuse/dev.c:1349
 call_read_iter include/linux/fs.h:1820 [inline]
 new_sync_read fs/read_write.c:406 [inline]
 __vfs_read+0x6ac/0x9b0 fs/read_write.c:418
 vfs_read+0x17f/0x3c0 fs/read_write.c:452
 ksys_read+0x101/0x260 fs/read_write.c:578
 __do_sys_read fs/read_write.c:588 [inline]
 __se_sys_read fs/read_write.c:586 [inline]
 __x64_sys_read+0x73/0xb0 fs/read_write.c:586
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x445f69
Code: e8 ac e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 
RSP: 002b:00007f7f6d9b7da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00000000006dbc3c RCX: 0000000000445f69
RDX: 0000000000001000 RSI: 0000000020001000 RDI: 0000000000000006
RBP: 00000000006dbc38 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e
R13: 64695f70756f7267 R14: 65646f6d746f6f72 R15: 0000000000000007
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace d538f9cc84504f57 ]---
RIP: 0010:process_init_reply+0xedc/0x1500 fs/fuse/inode.c:923
Code: 0f 95 c0 84 c2 0f 85 65 05 00 00 49 8d be 00 01 00 00 80 8b e9 01 00 00 06 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 32 05 00 00 49 c7 86 00 01 00 00 a0 7f 16 89 41 
RSP: 0018:ffff8801a97cf478 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8801cdfdfb40 RCX: 0000000000000001
RDX: 0000000000000020 RSI: ffffffff826e5a3d RDI: 0000000000000100
RBP: ffff8801a97cf4b0 R08: ffff8801b2a625c0 R09: ffffed0039cd05da
R10: ffffed0039cd05da R11: ffff8801ce682ed3 R12: ffff8801ce682e00
R13: ffff8801cdfdfd29 R14: 0000000000000000 R15: ffff8801cdfdfd25
FS:  00007f7f6d9b8700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7f6d9d8e78 CR3: 00000001d64ed000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/17 22:32 linux-next 1dcbe5f2c615 6d5bd5b5 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/08/19 15:01 upstream 08b5fa819970 2dc4378f .config console log report ci-upstream-kasan-gce
2018/08/14 09:54 upstream 7796916146b8 7a88b141 .config console log report ci-upstream-kasan-gce-root
2018/08/13 06:53 upstream d6dd6431591b 7a88b141 .config console log report ci-upstream-kasan-gce
2018/08/12 13:18 upstream ec0c96714e7d 7a88b141 .config console log report ci-upstream-kasan-gce
2018/08/11 08:20 upstream f313b43be461 7a88b141 .config console log report ci-upstream-kasan-gce
2018/08/11 03:26 upstream f313b43be461 7a88b141 .config console log report ci-upstream-kasan-gce-root
2018/08/09 20:16 upstream 112cbae26d18 1fb62d58 .config console log report ci-upstream-kasan-gce-root
2018/08/08 02:30 upstream 1236568ee3cb 1beb8136 .config console log report ci-upstream-kasan-gce
2018/08/06 08:26 upstream 1ffaddd029c8 1beb8136 .config console log report ci-upstream-kasan-gce
2018/08/05 22:03 upstream a8c199208cd6 1beb8136 .config console log report ci-upstream-kasan-gce-root
2018/08/05 06:08 upstream 60f5a2173632 3476a2df .config console log report ci-upstream-kasan-gce
2018/08/05 01:53 upstream 60f5a2173632 3476a2df .config console log report ci-upstream-kasan-gce
2018/08/04 06:59 upstream 0b5b1f9a78b5 df7f6947 .config console log report ci-upstream-kasan-gce-root
2018/08/01 08:14 upstream c1d61e7fe376 1477993e .config console log report ci-upstream-kasan-gce-root
2018/08/01 01:28 upstream c1d61e7fe376 1477993e .config console log report ci-upstream-kasan-gce
2018/07/31 15:40 upstream 527838d470e3 1a381291 .config console log report ci-upstream-kasan-gce
2018/07/23 23:32 upstream d72e90f33aa4 912c93d7 .config console log report ci-upstream-kasan-gce-root
2018/08/21 23:41 upstream 0214f46b3a03 95b5c82b .config console log report ci-upstream-kasan-gce-386
2018/08/16 16:28 upstream f91e654474d4 9ccc1d45 .config console log report ci-upstream-kasan-gce-386
2018/08/11 03:17 upstream f313b43be461 7a88b141 .config console log report ci-upstream-kasan-gce-386
2018/08/10 10:28 upstream 112cbae26d18 1fb62d58 .config console log report ci-upstream-kasan-gce-386
2018/08/09 02:27 upstream fedb8da96355 2eeda842 .config console log report ci-upstream-kasan-gce-386
2018/08/01 13:36 upstream c1d61e7fe376 1477993e .config console log report ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.