syzbot

 sign-in | mailing list | source | docs
🐞 Open [993] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12515] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf

Status: fixed on 2023/02/24 13:50
Subsystems: serial
[Documentation on labels]
Reported-by: syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com
Fix commit: f16c6d2e58a4 tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
First crash: 627d, last: 601d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Duplicate bugs (2)
duplicates (2):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: unable to handle kernel NULL pointer dereference in tty_ldisc_receive_buf serial C 26 599d 611d 0/26 closed as dup on 2022/08/30 06:41
BUG: unable to handle kernel NULL pointer dereference in tiocsti serial C 39 598d 611d 0/26 closed as dup on 2022/08/30 06:41
▶ ▼ Discussions (7)
Title Replies (including bot) Last reply
[PATCH 5.10 3/3] tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() 1 (1) 2023/12/12 11:17
[PATCH 5.15 000/107] 5.15.66-rc1 review 131 (131) 2022/09/16 16:25
[PATCH 5.19 000/155] 5.19.8-rc1 review 167 (167) 2022/09/08 09:40
[PATCH v2] tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() 1 (1) 2022/08/14 01:52
RE: [PATCH] tty: n_gsm: fix missing assignment of gsm->receive() in gsmld_attach_gsm() 2 (2) 2022/08/12 19:41
[PATCH] tty: n_gsm: fix missing assignment of gsm->receive() in gsmld_attach_gsm() 2 (2) 2022/08/10 05:18
[syzbot] BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf 1 (3) 2022/08/09 12:47
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2022/08/09 02:25 16m mazinalhaddad05@gmail.com patch linux-next OK log

Sample crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1be59067 P4D 1be59067 PUD 1e75f067 PMD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3604 Comm: syz-executor245 Not tainted 6.0.0-rc2-syzkaller-00327-g8379c0b31fbc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90003b5fcf0 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8881474a2000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881474a2000
RBP: ffffc90003b5fda1 R08: 0000000000000001 R09: 0000000000000004
R10: 0000000000000000 R11: 1ffffffff2005487 R12: 0000000000000001
R13: 0000000000000000 R14: ffffc90003b5fd90 R15: dffffc0000000000
FS:  0000555555cb6300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000001f485000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861
 tiocsti drivers/tty/tty_io.c:2293 [inline]
 tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fefe82adb39
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff1e9ea178 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fefe82adb39
RDX: 00000000200000c0 RSI: 0000000000005412 RDI: 0000000000000003
RBP: 00007fefe8271ce0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fefe8271d70
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90003b5fcf0 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8881474a2000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881474a2000
RBP: ffffc90003b5fda1 R08: 0000000000000001 R09: 0000000000000004
R10: 0000000000000000 R11: 1ffffffff2005487 R12: 0000000000000001
R13: 0000000000000000 R14: ffffc90003b5fd90 R15: dffffc0000000000
FS:  0000555555cb6300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000001f485000 CR4: 0000000000350ef0

Crashes (324):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/08/29 08:42 upstream 8379c0b31fbc 07177916 .config strace log report syz C ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 08:02 upstream 8379c0b31fbc 07177916 .config strace log report syz C ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/23 14:31 upstream 072e51356cd5 cea8b0f7 .config strace log report syz C ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/21 07:37 upstream 15b3f48a4339 26a13b38 .config strace log report syz C ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/08 13:04 linux-next ca688bff68bc 88e3a122 .config strace log report syz C ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/04 00:39 upstream d895ec7938c4 28811d0a .config console log report info [disk image] [vmlinux] ci-upstream-kasan-gce-selinux-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/03 09:11 upstream d895ec7938c4 49e94a20 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/03 07:25 upstream 0b3acd1cc022 49e94a20 .config console log report info ci-upstream-kasan-gce-selinux-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/03 05:27 upstream 0b3acd1cc022 49e94a20 .config console log report info ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/03 01:29 upstream 0b3acd1cc022 25194605 .config console log report info ci-upstream-kasan-gce-smack-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/02 18:02 upstream 42e66b1cc3a0 25194605 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/02 14:19 upstream 42e66b1cc3a0 25194605 .config console log report info ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/02 11:10 upstream 42e66b1cc3a0 a805568e .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/02 08:59 upstream 42e66b1cc3a0 a805568e .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/02 06:33 upstream 42e66b1cc3a0 a805568e .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/01 22:33 upstream 2880e1a175b9 86c46e46 .config console log report info ci-upstream-kasan-gce-selinux-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/01 21:33 upstream 2880e1a175b9 86c46e46 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/01 05:51 upstream c5e4d5e99162 b01ec571 .config console log report info ci-upstream-kasan-gce-smack-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/31 16:03 upstream dcf8e5633e2e 51e54e30 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/31 09:40 upstream dcf8e5633e2e 4a380809 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/31 00:29 upstream dcf8e5633e2e 4a380809 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/30 21:40 upstream dcf8e5633e2e 4a380809 .config console log report info ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/30 11:01 upstream dcf8e5633e2e 5b44472d .config console log report info ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/30 05:52 upstream dcf8e5633e2e 5b44472d .config console log report info ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/30 04:18 upstream b90cb1053190 5b44472d .config console log report info ci-upstream-kasan-gce-selinux-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/30 00:03 upstream b90cb1053190 5b44472d .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 21:37 upstream b90cb1053190 5b44472d .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 11:41 upstream 8379c0b31fbc 07177916 .config console log report info ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 07:15 upstream 8379c0b31fbc 07177916 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 05:39 upstream 8379c0b31fbc 07177916 .config console log report info ci-upstream-kasan-gce-selinux-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 04:30 upstream 8379c0b31fbc 07177916 .config console log report info ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/28 22:06 upstream 10d4879f9ef0 07177916 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/28 20:21 upstream 10d4879f9ef0 07177916 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/28 19:14 upstream 10d4879f9ef0 07177916 .config console log report info ci-upstream-kasan-gce-smack-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/28 18:03 upstream 10d4879f9ef0 07177916 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/28 14:50 upstream 10d4879f9ef0 07177916 .config console log report info ci-upstream-kasan-gce-smack-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/28 12:51 upstream 10d4879f9ef0 07177916 .config console log report info ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/28 08:59 upstream 10d4879f9ef0 07177916 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/28 02:14 upstream e022620b5d05 07177916 .config console log report info ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/27 21:59 upstream e022620b5d05 07177916 .config console log report info ci-upstream-kasan-gce-smack-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/27 18:56 upstream e022620b5d05 07177916 .config console log report info ci-upstream-kasan-gce-selinux-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/27 09:50 upstream 3e5c673f0d75 07177916 .config console log report info ci-upstream-kasan-gce-smack-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/27 08:47 upstream e022620b5d05 07177916 .config console log report info ci-qemu-upstream BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/27 07:43 upstream 3e5c673f0d75 07177916 .config console log report info ci-upstream-kasan-gce-smack-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/27 06:33 upstream 3e5c673f0d75 07177916 .config console log report info ci-upstream-kasan-gce-selinux-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/04 02:11 upstream d895ec7938c4 28811d0a .config console log report info ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/03 19:19 upstream d895ec7938c4 28811d0a .config console log report info ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/09/02 08:16 upstream 42e66b1cc3a0 a805568e .config console log report info ci-upstream-kasan-gce-386 BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 18:20 linux-next b27a3ca08ba7 5b44472d .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 17:00 linux-next b27a3ca08ba7 5b44472d .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/29 02:18 linux-next 8d0c42c9e807 07177916 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/27 13:06 linux-next 8d0c42c9e807 07177916 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/26 19:20 linux-next 8d0c42c9e807 e5a303f1 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/26 16:18 linux-next 8d0c42c9e807 e5a303f1 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/08 06:30 linux-next ca688bff68bc 88e3a122 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
2022/08/08 06:26 linux-next ca688bff68bc 88e3a122 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in gsmld_receive_buf
* Struck through repros no longer work on HEAD.