syzbot


BUG: unable to handle kernel NULL pointer dereference in bsearch

Status: moderation: reported on 2024/08/25 00:13
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+e41e16bb6cddd37d1f63@syzkaller.appspotmail.com
First crash: 25d, last: 23d

Sample crash report:
------------[ cut here ]------------
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 800000002bfd8067 P4D 800000002bfd8067 PUD 2e5eb067 PMD 0 
Oops: Oops: 0010 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 5322 Comm: syz.1.7 Not tainted 6.11.0-rc4-next-20240821-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90004476d78 EFLAGS: 00010093
RAX: ffffffff84b3ef8a RBX: 7fffe4800223b7f4 RCX: 0000000000040000
RDX: ffffc900049f1000 RSI: ffff5aff9b22fc40 RDI: ffffc90004476e00
RBP: ffff5aff9b22fc40 R08: ffffffff84b3ef6a R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8e4cac88
R13: ffffc90004476e00 R14: 00000000ffffffff R15: 000000000000000c
FS:  00007f127237a6c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007a740000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __inline_bsearch include/linux/bsearch.h:15 [inline]
 bsearch+0x4d/0xc0 lib/bsearch.c:33
 search_extable+0xb3/0x100 lib/extable.c:116
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Oops: general protection fault, probably for non-canonical address 0xdffffbff8bb6f3ee: 0000 [#2] PREEMPT SMP KASAN PTI
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90004476d78 EFLAGS: 00010093
CPU: 0 UID: 0 PID: 5322 Comm: syz.1.7 Tainted: G      D            6.11.0-rc4-next-20240821-syzkaller #0
RAX: ffffffff84b3ef8a RBX: 7fffe4800223b7f4 RCX: 0000000000040000
Tainted: [D]=DIE
RDX: ffffc900049f1000 RSI: ffff5aff9b22fc40 RDI: ffffc90004476e00
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RBP: ffff5aff9b22fc40 R08: ffffffff84b3ef6a R09: 0000000000000000
RIP: fff9:number+0xb5e/0xf90
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8e4cac88
RSP: 49e5:0000000000000018 EFLAGS: 1fffc0000000000
R13: ffffc90004476e00 R14: 00000000ffffffff R15: 000000000000000c
 ORIG_RAX: ffffc90004475b90
RAX: ffffc90004475f64 RBX: 0000000000000000 RCX: ffffc90004475b00
FS:  00007f127237a6c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
RDX: ffffffff81fc4903 RSI: ffffc90004475b00 RDI: ffff1060ffffff09
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
RBP: ffffc90004475c70 R08: 0000000000000000 R09: ffffffff8c0d4a0a
CR2: ffffffffffffffd6 CR3: 000000007a740000 CR4: 00000000003506f0
R10: 0000000000000018 R11: ffffffff8bb9a210 R12: dffffc0000000000
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
R13: 000000000000270e R14: ffffffff94fcfe10 R15: ffffffff952d5320
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
FS:  00007f127237a6c0 GS:  0000000000000000

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/22 05:09 linux-next eb8c5ca373cb ca02180f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in bsearch
2024/08/21 02:50 linux-next bb1b0acdcd66 9f0ab3fb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in bsearch
2024/08/20 20:58 linux-next bb1b0acdcd66 9f0ab3fb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in bsearch
* Struck through repros no longer work on HEAD.