syzbot


general protection fault in ebitmap_destroy

Status: public: reported C repro on 2019/04/13 00:01
Reported-by: syzbot+d5dbd076fa402dd14b31@syzkaller.appspotmail.com
First crash: 2103d, last: 2092d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in ebitmap_destroy selinux syz 1 2103d 2103d 11/28 fixed on 2019/03/06 07:43
android-414 general protection fault in ebitmap_destroy syz 1 2103d 2011d 0/1 public: reported syz repro on 2019/04/10 16:14
upstream general protection fault in ebitmap_destroy (2) selinux C done 36 2030d 2038d 11/28 fixed on 2019/04/01 10:28
android-49 general protection fault in ebitmap_destroy C 2216 1774d 2011d 0/3 public: reported C repro on 2019/04/11 08:44

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 3380 Comm: syz-executor520 Not tainted 4.4.169+ #2
task: ffff8800b4f0c740 task.stack: ffff8801d1c80000
RIP: 0010:[<ffffffff8197dcf2>]  [<ffffffff8197dcf2>] ebitmap_destroy+0x32/0xe0 security/selinux/ss/ebitmap.c:331
RSP: 0018:ffff8801d1c87658  EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 1ffff1003a390ed7 RCX: ffff8800b4f0d008
RDX: 0000000000000001 RSI: ffffffff8197dce1 RDI: 0000000000000008
RBP: ffff8801d1c87678 R08: 0000000000000003 R09: ffff8800b4f0d078
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801d27aff60
R13: 0000000000000008 R14: 00000000ffffffea R15: ffff8801d1c87718
FS:  00007f2db97e0700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efcf032c000 CR3: 00000000b4c3b000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 1ffff1003a390ed7 ffff8801d27aff60 0000000000000000 00000000ffffffea
 ffff8801d1c87698 ffffffff81986a69 ffff8801d1c87a40 ffff8801d27aff60
 ffff8801d1c87740 ffffffff8198732d ffff8801d2634ab0 0000000000000004
Call Trace:
 [<ffffffff81986a69>] sens_destroy+0x49/0xa0 security/selinux/ss/policydb.c:729
 [<ffffffff8198732d>] sens_read+0x1dd/0x360 security/selinux/ss/policydb.c:1627
 [<ffffffff8199122b>] policydb_read+0xc3b/0x2280 security/selinux/ss/policydb.c:2364
 [<ffffffff819a197c>] security_load_policy+0x23c/0x9c0 security/selinux/ss/services.c:2073
 [<ffffffff81978705>] sel_write_load+0x175/0xf90 security/selinux/selinuxfs.c:535
 [<ffffffff814962e6>] __vfs_write+0x116/0x3d0 fs/read_write.c:489
 [<ffffffff81497fe2>] vfs_write+0x182/0x4e0 fs/read_write.c:538
 [<ffffffff8149a61c>] SYSC_write fs/read_write.c:585 [inline]
 [<ffffffff8149a61c>] SyS_write+0xdc/0x1c0 fs/read_write.c:577
 [<ffffffff827153a1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: 55 49 89 fd 41 54 53 e8 2d b7 98 ff 4d 85 ed 0f 84 92 00 00 00 e8 1f b7 98 ff 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 91 00 00 00 49 be 00 00 00 00 00 fc ff df 4d 
RIP  [<ffffffff8197dcf2>] ebitmap_destroy+0x32/0xe0 security/selinux/ss/ebitmap.c:331
 RSP <ffff8801d1c87658>
---[ end trace 325e214f888ddfa3 ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/09 14:21 https://android.googlesource.com/kernel/common android-4.4 d08574b6f0ae 45c0c1b1 .config console log report syz C ci-android-44-kasan-gce
2019/01/20 03:47 https://android.googlesource.com/kernel/common android-4.4 24189101975d 353f32ea .config console log report ci-android-44-kasan-gce
2019/01/09 13:56 https://android.googlesource.com/kernel/common android-4.4 d08574b6f0ae 45c0c1b1 .config console log report ci-android-44-kasan-gce
* Struck through repros no longer work on HEAD.