KASAN: null-ptr-deref Read in kvm_vfio_set

Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported
general protection fault in syscall_return_slowpath kernel	syz	inconclusive	done	1	1417d	1503d

syz

inconclusive

done

1417d

1503d

Title	Replies (including bot)	Last reply
KASAN: null-ptr-deref Read in kvm_vfio_set_attr	0 (1)	2020/03/27 08:30

================================================================== BUG: KASAN: null-ptr-deref in kvm_vfio_set_group arch/x86/kvm/../../../virt/kvm/vfio.c:235 [inline] BUG: KASAN: null-ptr-deref in kvm_vfio_set_attr+0x7da/0xa30 arch/x86/kvm/../../../virt/kvm/vfio.c:337 Read of size 8 at addr 0000000000000000 by task syz-executor.2/9641 CPU: 0 PID: 9641 Comm: syz-executor.2 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 __kasan_report.cold+0x5/0x32 mm/kasan/report.c:510 kasan_report+0xe/0x20 mm/kasan/common.c:618 kvm_vfio_set_group arch/x86/kvm/../../../virt/kvm/vfio.c:235 [inline] kvm_vfio_set_attr+0x7da/0xa30 arch/x86/kvm/../../../virt/kvm/vfio.c:337 </IRQ> ================================================================== Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 9641 Comm: syz-executor.2 Tainted: G B 5.6.0-rc3-next-20200228-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 end_report+0x43/0x49 mm/kasan/report.c:96 __kasan_report.cold+0xd/0x32 mm/kasan/report.c:513 kasan_report+0xe/0x20 mm/kasan/common.c:618 kvm_vfio_set_group arch/x86/kvm/../../../virt/kvm/vfio.c:235 [inline] kvm_vfio_set_attr+0x7da/0xa30 arch/x86/kvm/../../../virt/kvm/vfio.c:337 </IRQ> Shutting down cpus with NMI Kernel Offset: disabled Rebooting in 86400 seconds..