syzbot

 sign-in | mailing list | source | docs
🐞 Open [103]
🐞 Fixed [70]
🐞 Invalid [187]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: out-of-bounds Read in __show_regs

Status: premoderation: reported on 2024/12/08 21:45
Reported-by: syzbot+bda6bddeceb0853ee39e@syzkaller.appspotmail.com
First crash: 13d, last: 13d
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in __show_regs (2) kernel C error 2412 75d 190d 0/28 auto-obsoleted due to no activity on 2024/12/17 01:51
android-5-15 KASAN: stack-out-of-bounds Read in __show_regs 1 535d 535d 0/2 auto-obsoleted due to no activity on 2023/10/03 16:34
android-5-10 KASAN: stack-out-of-bounds Read in __show_regs 1 119d 119d 0/2 auto-obsoleted due to no activity on 2024/11/22 17:27
upstream BUG: unable to handle kernel NULL pointer dereference in exc_page_fault kernel 5 116d 123d 0/28 closed as invalid on 2024/09/13 11:13
upstream KASAN: stack-out-of-bounds Read in __show_regs kernel C unreliable unreliable 517 780d 1284d 0/28 auto-obsoleted due to no activity on 2023/05/14 10:00

Sample crash report:
RAX: 1ffff11023686e00 RBX: 0000000113c82067 RCX: ffff888122868000
RDX: 0000000000000000 RSI: 0000000020016000 RDI: ffff8881057ccde0
==================================================================
BUG: KASAN: out-of-bounds in __show_regs+0x151/0x540 arch/x86/kernel/process_64.c:85
Read of size 8 at addr ffffc90001327998 by task kworker/u4:0/7

CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.10.227-syzkaller-00554-g550d1177dc67 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_unbound linkwatch_event
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x81/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x179/0x1c0 mm/kasan/report.c:452
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
 __show_regs+0x151/0x540 arch/x86/kernel/process_64.c:85
 show_regs_if_on_stack+0xd9/0xe0 arch/x86/kernel/dumpstack.c:173
 show_trace_log_lvl+0x2a7/0x380 arch/x86/kernel/dumpstack.c:301
 show_stack+0x37/0x40 arch/x86/kernel/dumpstack.c:321
 sched_show_task+0x35b/0x540 kernel/sched/core.c:6747
 show_state_filter+0x17e/0x1e0 kernel/sched/core.c:6790
 show_state include/linux/sched/debug.h:21 [inline]
 fn_show_state+0x10/0x20 drivers/tty/vt/keyboard.c:588
 k_spec+0xff/0x130 drivers/tty/vt/keyboard.c:641
 kbd_keycode drivers/tty/vt/keyboard.c:1489 [inline]
 kbd_event+0x250d/0x3780 drivers/tty/vt/keyboard.c:1507
 input_to_handler drivers/input/input.c:129 [inline]
 input_pass_values+0x8c5/0x1040 drivers/input/input.c:156
 input_handle_event+0xcb6/0x1500 drivers/input/input.c:421
 input_event+0xa5/0xd0 drivers/input/input.c:452
 hidinput_hid_event+0xe92/0x15c0 drivers/hid/hid-input.c:1423
 hid_process_event+0x461/0x5c0 drivers/hid/hid-core.c:1532
 hid_input_field drivers/hid/hid-core.c:1584 [inline]
 hid_report_raw_event+0xe19/0x1560 drivers/hid/hid-core.c:1800
 hid_input_report+0x41a/0x4d0 drivers/hid/hid-core.c:1867
 hid_irq_in+0x4a4/0x700 drivers/hid/usbhid/hid-core.c:284
 __usb_hcd_giveback_urb+0x337/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1748
 dummy_timer+0x86b/0x2f70 drivers/usb/gadget/udc/dummy_hcd.c:1974
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1789
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x268/0x5bb kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1094
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:84 [inline]
RIP: 0010:console_unlock+0xe13/0x1390 kernel/printk/printk.c:2561
Code: 85 db 4c 8d b4 24 d0 01 00 00 48 8b 5c 24 68 0f 85 37 05 00 00 e8 ad 65 00 00 48 89 9c 24 b0 00 00 00 ff b4 24 b0 00 00 00 9d <48> 8b 44 24 30 42 80 3c 38 00 74 08 4c 89 f7 e8 39 2c 56 00 48 c7
RSP: 0018:ffffc90000077520 EFLAGS: 00000246
RAX: ffffffff81529279 RBX: 0000000000000246 RCX: ffff88810024bb40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90000077830 R08: ffffffff81522c92 R09: 0000000000000003
R10: fffff5200000ee94 R11: dffffc0000000001 R12: ffffffff866c4a30
R13: ffffc90000077790 R14: ffffc900000776f0 R15: dffffc0000000000
 vprintk_emit+0x1c0/0x380 kernel/printk/printk.c:2069
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2086
 vprintk_func+0x19d/0x1e0 kernel/printk/printk_safe.c:401
 printk+0xd1/0x111 kernel/printk/printk.c:2117
 addrconf_notify+0xbe9/0xe90 net/ipv6/addrconf.c:3647
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x8c/0xf0 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2054 [inline]
 netdev_state_change+0x1a3/0x250 net/core/dev.c:1484
 linkwatch_do_dev+0x100/0x140 net/core/link_watch.c:167
 __linkwatch_run_queue+0x4ca/0x7f0 net/core/link_watch.c:213
 linkwatch_event+0x4c/0x60 net/core/link_watch.c:252
 process_one_work+0x6dc/0xbd0 kernel/workqueue.c:2301
 worker_thread+0xaea/0x1510 kernel/workqueue.c:2447
 kthread+0x34b/0x3d0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298


Memory state around the buggy address:
 ffffc90001327880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90001327900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90001327980: f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00
                               ^
 ffffc90001327a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90001327a80: 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00
==================================================================
RBP: 0000000000000246 R08: 950a3f4b29591500 R09: ffffed102450d001
R10: ffffffff819e6c20 R11: ffffffff85d12083 R12: ffffffff819ce9f0
R13: ffffffff85d11c40 R14: 0000000041b58ab3 R15: 0000000000000176
task:syz.6.1723      state:R  running task     stack:    0 pid: 7452 ppid:  4331 flags:0x00004000
Call Trace:
 __switch_to_asm+0x60/0x60
RIP: 0033:0x7f610b80e729
RSP: 002b:00007f6109e0f1c0 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3
RAX: 0000000000000000 RBX: 00007f610b790b60 RCX: 00007f610b80e729
RDX: 00007f610b790b60 RSI: 0000000000000058 RDI: 00007ffc597e2e90
RBP: 00007f6109e0f6c0 R08: 00007f6109e0f6c0 R09: 00007ffc597e2f77
R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8
R13: 000000000000006e R14: 00007ffc597e2e90 R15: 00007ffc597e2f78
----------------
Code disassembly (best guess):
   0:	85 db                	test   %ebx,%ebx
   2:	4c 8d b4 24 d0 01 00 	lea    0x1d0(%rsp),%r14
   9:	00
   a:	48 8b 5c 24 68       	mov    0x68(%rsp),%rbx
   f:	0f 85 37 05 00 00    	jne    0x54c
  15:	e8 ad 65 00 00       	call   0x65c7
  1a:	48 89 9c 24 b0 00 00 	mov    %rbx,0xb0(%rsp)
  21:	00
  22:	ff b4 24 b0 00 00 00 	push   0xb0(%rsp)
  29:	9d                   	popf
* 2a:	48 8b 44 24 30       	mov    0x30(%rsp),%rax <-- trapping instruction
  2f:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  34:	74 08                	je     0x3e
  36:	4c 89 f7             	mov    %r14,%rdi
  39:	e8 39 2c 56 00       	call   0x562c77
  3e:	48                   	rex.W
  3f:	c7                   	.byte 0xc7

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/08 21:45 android13-5.10-lts 550d1177dc67 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: out-of-bounds Read in __show_regs
* Struck through repros no longer work on HEAD.