syzbot

 sign-in | mailing list | source | docs
🐞 Open [985] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in ax25_send_frame

Status: auto-closed as invalid on 2020/12/21 04:13
Subsystems: hams
[Documentation on labels]
Reported-by: syzbot+e0b81535a27b8be39502@syzkaller.appspotmail.com
First crash: 1946d, last: 1311d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
Reminder: 3 open syzbot bugs in "net/ax25" subsystem 3 (3) 2019/07/24 08:01
Reminder: 4 open syzbot bugs in "net/ax25" subsystem 1 (1) 2019/06/27 03:47
general protection fault in ax25_send_frame 0 (1) 2018/12/31 22:22
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in ax25_send_frame (2) hams 13 537d 524d 22/26 fixed on 2023/02/24 13:50
linux-4.14 general protection fault in ax25_send_frame 1 1821d 1821d 0/1 auto-closed as invalid on 2019/10/25 08:41
linux-4.19 general protection fault in ax25_send_frame 1 1781d 1781d 0/1 auto-closed as invalid on 2019/10/25 08:49

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000065: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000328-0x000000000000032f]
CPU: 1 PID: 26225 Comm: udevd Not tainted 5.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ax25_send_frame+0xe5/0x670 net/ax25/ax25_out.c:56
Code: ce 00 00 48 85 c0 0f 85 11 04 00 00 e8 d4 dc 62 fa 49 8d bc 24 28 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 04 00 00 49 8b 84 24 28 03 00 00 48 85 c0 48
RSP: 0018:ffffc90000da8a88 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff88821522e408 RCX: 0000000000000002
RDX: 0000000000000065 RSI: ffffffff8712ba7c RDI: 0000000000000328
RBP: ffffc90000da8ac8 R08: 1ffffffff16a339c R09: fffffbfff16a339d
R10: fffffbfff16a339c R11: ffffffff8b519ce7 R12: 0000000000000000
R13: ffffffff8c412240 R14: 0000000000000104 R15: 0000000000000000
FS:  00007f0710f607a0(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa170b60e30 CR3: 000000008c634000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 rose_send_frame+0xda/0x310 net/rose/rose_link.c:106
 rose_transmit_clear_request+0x1de/0x2a0 net/rose/rose_link.c:255
 rose_rx_call_request+0x4ec/0x1ac0 net/rose/af_rose.c:976
 rose_loopback_timer+0x164/0x480 net/rose/rose_loopback.c:100
 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
 __do_softirq+0x262/0x98c kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x19b/0x1e0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1146
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 </IRQ>
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x0/0x20 kernel/kcov.c:273
Code: f6 fe ff ff 5d c3 0f 1f 40 00 55 0f b7 d6 0f b7 f7 bf 03 00 00 00 48 89 e5 48 8b 4d 08 e8 d8 fe ff ff 5d c3 66 0f 1f 44 00 00 <55> 89 f2 89 fe bf 05 00 00 00 48 89 e5 48 8b 4d 08 e8 ba fe ff ff
RSP: 0018:ffffc90002857438 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffff888094ef02c0 RBX: 0000000000000003 RCX: 0000000000000003
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002857480 R08: ffff888094ef02c0 R09: fffffbfff1744709
R10: fffffbfff1744708 R11: ffffffff8ba23847 R12: ffff88809ea15a80
R13: 0000000000000022 R14: 00000000000001fc R15: 0000000000000000
 tomoyo_supervisor+0x2d5/0xee0 security/tomoyo/common.c:2089
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission security/tomoyo/file.c:587 [inline]
 tomoyo_path_permission+0x263/0x360 security/tomoyo/file.c:573
 tomoyo_check_open_permission+0x3a6/0x3e0 security/tomoyo/file.c:777
 tomoyo_file_open security/tomoyo/tomoyo.c:319 [inline]
 tomoyo_file_open+0xa9/0xd0 security/tomoyo/tomoyo.c:314
 security_file_open+0x71/0x300 security/security.c:1529
 do_dentry_open+0x37a/0x1380 fs/open.c:784
 vfs_open+0xa0/0xd0 fs/open.c:914
 do_last fs/namei.c:3490 [inline]
 path_openat+0x12ee/0x3490 fs/namei.c:3607
 do_filp_open+0x192/0x260 fs/namei.c:3637
 do_sys_openat2+0x5eb/0x7e0 fs/open.c:1149
 do_sys_open+0xf2/0x180 fs/open.c:1165
 ksys_open include/linux/syscalls.h:1386 [inline]
 __do_sys_open fs/open.c:1171 [inline]
 __se_sys_open fs/open.c:1169 [inline]
 __x64_sys_open+0x7e/0xc0 fs/open.c:1169
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f0710668120
Code: 48 8b 15 1b 4d 2b 00 f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 83 3d d5 a4 2b 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 5e 8c 01 00 48 89 04 24
RSP: 002b:00007ffe8ec5a238 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000dfe700 RCX: 00007f0710668120
RDX: 00000000000001b6 RSI: 0000000000080000 RDI: 00007ffe8ec5a310
RBP: 00007ffe8ec5a2b0 R08: 0000000000000008 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008
R13: 000000000041f57a R14: 0000000000de6250 R15: 000000000000000b
Modules linked in:
---[ end trace ee4fa1e3c2e9dd9a ]---
RIP: 0010:ax25_send_frame+0xe5/0x670 net/ax25/ax25_out.c:56
Code: ce 00 00 48 85 c0 0f 85 11 04 00 00 e8 d4 dc 62 fa 49 8d bc 24 28 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 04 00 00 49 8b 84 24 28 03 00 00 48 85 c0 48
RSP: 0018:ffffc90000da8a88 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff88821522e408 RCX: 0000000000000002
RDX: 0000000000000065 RSI: ffffffff8712ba7c RDI: 0000000000000328
RBP: ffffc90000da8ac8 R08: 1ffffffff16a339c R09: fffffbfff16a339d
R10: fffffbfff16a339c R11: ffffffff8b519ce7 R12: 0000000000000000
R13: ffffffff8c412240 R14: 0000000000000104 R15: 0000000000000000
FS:  00007f0710f607a0(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa170b60e30 CR3: 000000008c634000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1411):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/04 23:26 upstream 63623fd44972 c88c7b75 .config console log report ci-upstream-kasan-gce-root
2019/04/23 18:24 upstream 085b7755808a 53199d6e .config console log report ci-upstream-kasan-gce-smack-root
2019/04/15 05:46 upstream dc4060a5dc25 505ab413 .config console log report ci-upstream-kasan-gce-selinux-root
2020/09/05 11:52 net-old c70672d8d316 abf9ba4f .config console log report ci-upstream-net-this-kasan-gce
2020/08/30 10:12 net-old c8146fe292a7 d5a3ae1f .config console log report ci-upstream-net-this-kasan-gce
2020/08/27 11:00 net-old 5875568aa187 816e0689 .config console log report ci-upstream-net-this-kasan-gce
2020/08/27 08:54 net-old 5875568aa187 816e0689 .config console log report ci-upstream-net-this-kasan-gce
2020/08/13 01:30 net-old 06a7a37be55e bc15f7db .config console log report ci-upstream-net-this-kasan-gce
2020/08/04 21:21 net-old ac3a0c847296 80a06902 .config console log report ci-upstream-net-this-kasan-gce
2020/08/01 01:53 net-old 85496a292241 d895b3be .config console log report ci-upstream-net-this-kasan-gce
2020/07/26 23:50 net-old 04300d66f0a0 51265195 .config console log report ci-upstream-net-this-kasan-gce
2020/07/24 17:27 net-old 8e8135862ccb 554af388 .config console log report ci-upstream-net-this-kasan-gce
2020/07/24 04:52 net-old e6827d1abdc9 70c104a1 .config console log report ci-upstream-net-this-kasan-gce
2020/07/21 21:48 net-old 6ef9dcb78046 21f1765e .config console log report ci-upstream-net-this-kasan-gce
2020/06/27 17:20 net-old 4a21185cda0f ffec44b5 .config console log report ci-upstream-net-this-kasan-gce
2020/06/20 00:15 net-old 4d3da2d8d91f 81abc331 .config console log report ci-upstream-net-this-kasan-gce
2020/06/07 04:16 net-old 4e2905adac9f e6b89e4e .config console log report ci-upstream-net-this-kasan-gce
2020/06/06 17:45 net-old 7f89cc07d22a e6b89e4e .config console log report ci-upstream-net-this-kasan-gce
2020/05/30 06:51 net-old 784688993eba 954bd312 .config console log report ci-upstream-net-this-kasan-gce
2020/05/23 20:36 net-old d04322a0da1e 9682898d .config console log report ci-upstream-net-this-kasan-gce
2020/05/21 23:48 net-old d69100b8eee2 1f30020f .config console log report ci-upstream-net-this-kasan-gce
2020/09/22 04:12 net-next-old b696db590f5d 9e1fa68e .config console log report info ci-upstream-net-kasan-gce
2020/09/10 23:15 net-next-old 4f6a5caf187f 409809d8 .config console log report ci-upstream-net-kasan-gce
2020/09/08 23:44 net-next-old 4349abdb409b abf9ba4f .config console log report ci-upstream-net-kasan-gce
2020/09/04 01:30 net-next-old 22b330b622e3 abf9ba4f .config console log report ci-upstream-net-kasan-gce
2020/09/02 19:18 net-next-old dc1a9bf2c816 abf9ba4f .config console log report ci-upstream-net-kasan-gce
2020/09/02 04:47 net-next-old dc1a9bf2c816 abf9ba4f .config console log report ci-upstream-net-kasan-gce
2020/08/25 06:08 net-next-old 85eb5bc33717 344da168 .config console log report ci-upstream-net-kasan-gce
2020/08/24 09:21 net-next-old 7611cbb900b4 cef5ae68 .config console log report ci-upstream-net-kasan-gce
2020/08/21 07:23 net-next-old 1e76a2ff317d 1d75fe45 .config console log report ci-upstream-net-kasan-gce
2020/08/07 14:53 net-next-old bfdd5aaa54b0 cb436c69 .config console log report ci-upstream-net-kasan-gce
2020/08/06 21:28 net-next-old c1055b76ad00 1f122f88 .config console log report ci-upstream-net-kasan-gce
2020/08/03 07:01 net-next-old bd0b33b24897 196277c4 .config console log report ci-upstream-net-kasan-gce
2020/08/02 03:22 net-next-old 7126bd5c8bcb d895b3be .config console log report ci-upstream-net-kasan-gce
2020/08/01 21:57 net-next-old 8f3f330da28e d895b3be .config console log report ci-upstream-net-kasan-gce
2020/08/01 15:44 net-next-old 8f3f330da28e d895b3be .config console log report ci-upstream-net-kasan-gce
2020/07/21 07:05 net-next-old 4f1b4da541db d88894e6 .config console log report ci-upstream-net-kasan-gce
2020/07/20 08:07 net-next-old 7dce80c2a526 9c812472 .config console log report ci-upstream-net-kasan-gce
2020/07/01 09:25 net-next-old 491f14db45dc 917afeaa .config console log report ci-upstream-net-kasan-gce
2020/06/18 17:00 net-next-old cb8e59cc8720 d45a4d69 .config console log report ci-upstream-net-kasan-gce
2020/06/13 03:30 net-next-old cb8e59cc8720 f4724dd3 .config console log report ci-upstream-net-kasan-gce
2020/06/09 11:36 net-next-old cb8e59cc8720 0d60b78a .config console log report ci-upstream-net-kasan-gce
2020/05/25 17:56 net-next-old 06ec313eea4f 30927cd7 .config console log report ci-upstream-net-kasan-gce
2020/05/21 11:14 net-next-old f78cdbd75a57 c61086ab .config console log report ci-upstream-net-kasan-gce
2020/05/20 05:20 net-next-old 2de499258659 67fa1f59 .config console log report ci-upstream-net-kasan-gce
2018/12/27 21:15 net-next-old 90cadbbf341d 43cf01dd .config console log report ci-upstream-net-kasan-gce
2019/06/27 05:36 linux-next 1dd45f170b7e 7509bf36 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.