syzbot

 sign-in | mailing list | source | docs
🐞 Open [987] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12505] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in crypto_remove_spawns (2)

Status: fixed on 2019/03/06 07:43
Subsystems: crypto
[Documentation on labels]
Reported-by: syzbot+ee4f315443a4ea97512e@syzkaller.appspotmail.com
Fix commit: 6db43410179b crypto: adiantum - initialize crypto_spawn::inst
First crash: 1929d, last: 1922d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
general protection fault in crypto_remove_spawns (2) 1 (2) 2019/01/15 18:39
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in crypto_remove_spawns crypto C 85 2302d 2340d 3/26 fixed on 2018/01/19 01:24

Sample crash report:
binder: 18706:18709 ioctl 40046207 0 returned -16
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 18713 Comm: cryptomgr_test Not tainted 5.0.0-rc1+ #21
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:crypto_remove_spawns+0x7ac/0x1340 crypto/algapi.c:194
Code: 49 8d 7c 24 10 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 f2 06 00 00 49 c7 44 24 10 00 00 00 00 4d 8d 66 10 4c 89 e0 48 c1 e8 03 <80> 3c 18 00 0f 85 ef 06 00 00 49 83 7e 10 00 74 0a e8 4e 9e 24 fe
RSP: 0000:ffff888054737b88 EFLAGS: 00010202
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 1ffff1100a8e6f86
RDX: 0000000000000000 RSI: ffffffff835d58d2 RDI: ffff888085c226b8
RBP: ffff888054737df8 R08: ffff88804fb4e4c0 R09: ffff88804fb4ed60
R10: ffff88804fb4ed40 R11: 0000000000000001 R12: 0000000000000010
R13: ffffed100a8e6f8e R14: 0000000000000000 R15: ffff888054737dd0
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6091a29000 CR3: 00000000876f9000 CR4: 00000000001406e0
kobject: 'loop2' (00000000d1d42c09): kobject_uevent_env
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kobject: 'loop2' (00000000d1d42c09): fill_kobj_path: path = '/devices/virtual/block/loop2'
 crypto_alg_tested+0x52d/0x790 crypto/algapi.c:339
 cryptomgr_test+0x18/0x30 crypto/algboss.c:226
 kthread+0x357/0x430 kernel/kthread.c:246
binder: BINDER_SET_CONTEXT_MGR already set
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
kobject: 'loop3' (0000000091226001): kobject_uevent_env
binder: 18723:18724 ioctl 40046207 0 returned -16
kobject: 'loop3' (0000000091226001): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'loop5' (0000000038d1e891): kobject_uevent_env
kobject: 'loop5' (0000000038d1e891): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop1' (0000000047f20675): kobject_uevent_env
kobject: 'loop1' (0000000047f20675): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop0' (00000000f3ca3d42): kobject_uevent_env
kobject: 'loop0' (00000000f3ca3d42): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop5' (0000000038d1e891): kobject_uevent_env
kobject: 'loop5' (0000000038d1e891): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop1' (0000000047f20675): kobject_uevent_env
kobject: 'loop1' (0000000047f20675): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop2' (00000000d1d42c09): kobject_uevent_env
kobject: 'loop2' (00000000d1d42c09): fill_kobj_path: path = '/devices/virtual/block/loop2'
---[ end trace d2934b3fdb1c156e ]---
RIP: 0010:crypto_remove_spawns+0x7ac/0x1340 crypto/algapi.c:194
Code: 49 8d 7c 24 10 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 f2 06 00 00 49 c7 44 24 10 00 00 00 00 4d 8d 66 10 4c 89 e0 48 c1 e8 03 <80> 3c 18 00 0f 85 ef 06 00 00 49 83 7e 10 00 74 0a e8 4e 9e 24 fe
RSP: 0000:ffff888054737b88 EFLAGS: 00010202
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 1ffff1100a8e6f86
RDX: 0000000000000000 RSI: ffffffff835d58d2 RDI: ffff888085c226b8
RBP: ffff888054737df8 R08: ffff88804fb4e4c0 R09: ffff88804fb4ed60
R10: ffff88804fb4ed40 R11: 0000000000000001 R12: 0000000000000010
R13: ffffed100a8e6f8e R14: 0000000000000000 R15: ffff888054737dd0
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000110cfd0 CR3: 0000000094f35000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/12 17:49 upstream 4b3c31c8d4dd c3f3344c .config console log report ci-upstream-kasan-gce
2019/01/20 06:03 net-next-old 133bbb18ab1a 353f32ea .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.