syzbot


general protection fault in path_openat

Status: fixed on 2020/03/06 08:34
Reported-by: syzbot+f0669fa513073e7ed9fa@syzkaller.appspotmail.com
Fix commit: 8d7a5100e29d vfs: fix do_last() regression
First crash: 1489d, last: 1483d
Fix bisection: fixed by (bisect log) :
commit 8d7a5100e29dde6b6557beb31ea9f2bbc9e998ca
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat Feb 1 16:26:45 2020 +0000

  vfs: fix do_last() regression

  
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in path_openat reiserfs C error inconclusive 52 55d 453d 0/26 upstream: reported C repro on 2022/12/01 14:25
android-5-10 general protection fault in path_openat C done 9 19d 282d 0/2 upstream: reported C repro on 2023/05/21 01:33
upstream general protection fault in path_openat ext4 C done 7 1487d 1487d 15/26 fixed on 2020/02/18 14:31
linux-4.14 general protection fault in path_openat C done 40 1483d 1489d 1/1 fixed on 2020/03/06 21:15
android-5-15 general protection fault in path_openat origin:downstream C done 5 18d 282d 0/2 upstream: reported C repro on 2023/05/21 01:53
android-6-1 general protection fault in path_openat origin:downstream C done 5 2d06h 282d 0/2 upstream: reported C repro on 2023/05/21 01:53
android-54 general protection fault in path_openat syz 26 1482d 1489d 1/2 fixed on 2021/10/12 13:38

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15262 Comm: udevd Not tainted 4.19.100-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff888094a4f790 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff888094a4f910 R08: ffff888088d2c3c0 R09: 0000000000000002
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000000
R13: ffff888094a4fb38 R14: ffff888094a4fb38 R15: ffff888094a4f950
FS:  00007f586da657a0(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efd267bc848 CR3: 0000000090ed7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_filp_open+0x1a1/0x280 fs/namei.c:3567
 do_open_execat+0x140/0x660 fs/exec.c:853
 open_exec+0x47/0x80 fs/exec.c:885
 load_elf_binary+0x879/0x53a0 fs/binfmt_elf.c:780
 search_binary_handler fs/exec.c:1653 [inline]
 search_binary_handler+0x179/0x570 fs/exec.c:1631
 exec_binprm fs/exec.c:1695 [inline]
 __do_execve_file.isra.0+0x1227/0x2150 fs/exec.c:1819
 do_execveat_common fs/exec.c:1866 [inline]
 do_execve fs/exec.c:1883 [inline]
 __do_sys_execve fs/exec.c:1964 [inline]
 __se_sys_execve fs/exec.c:1959 [inline]
 __x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f586d149207
Code: 77 19 f4 48 89 d7 44 89 c0 0f 05 48 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 f7 d8 64 41 89 01 eb df b8 3b 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 f3 c3 48 8b 15 00 8c 2d 00 f7 d8 64 89 02
RSP: 002b:00007ffec4caabf8 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f586d149207
RDX: 000000000247daf0 RSI: 00007ffec4caacf0 RDI: 00007ffec4cabd00
RBP: 0000000000625500 R08: 0000000000001fc8 R09: 0000000000001fc8
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000247daf0
R13: 0000000000000007 R14: 00000000022ec030 R15: 0000000000000005
Modules linked in:
---[ end trace 0ef5a8dee3d85af0 ]---
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff888094a4f790 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff888094a4f910 R08: ffff888088d2c3c0 R09: 0000000000000002
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000000
R13: ffff888094a4fb38 R14: ffff888094a4fb38 R15: ffff888094a4f950
FS:  00007f586da657a0(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4d1592ca20 CR3: 0000000090ed7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/01 04:56 linux-4.19.y 7cdefde351b6 0eb59c27 .config console log report syz C ci2-linux-4-19
2020/02/01 01:15 linux-4.19.y 7cdefde351b6 0eb59c27 .config console log report syz ci2-linux-4-19
2020/01/30 10:33 linux-4.19.y 7cdefde351b6 5ed23f9a .config console log report syz ci2-linux-4-19
2020/01/30 06:02 linux-4.19.y 7cdefde351b6 5ed23f9a .config console log report syz ci2-linux-4-19
2020/02/05 02:55 linux-4.19.y 32ee7492f104 93e5e335 .config console log report ci2-linux-4-19
2020/02/04 16:29 linux-4.19.y 32ee7492f104 93e5e335 .config console log report ci2-linux-4-19
2020/02/04 07:01 linux-4.19.y 32ee7492f104 93e5e335 .config console log report ci2-linux-4-19
2020/02/04 00:07 linux-4.19.y 32ee7492f104 93e5e335 .config console log report ci2-linux-4-19
2020/02/03 20:10 linux-4.19.y 32ee7492f104 93e5e335 .config console log report ci2-linux-4-19
2020/02/01 15:53 linux-4.19.y 32ee7492f104 326d4c78 .config console log report ci2-linux-4-19
2020/01/31 05:47 linux-4.19.y 7cdefde351b6 5ed23f9a .config console log report ci2-linux-4-19
2020/01/30 22:58 linux-4.19.y 7cdefde351b6 5ed23f9a .config console log report ci2-linux-4-19
2020/01/30 04:22 linux-4.19.y 7cdefde351b6 5ed23f9a .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.