syzbot

 sign-in | mailing list | source | docs
🐞 Open [1282]
≡ Subsystems
🐞 Fixed [5729]
🐞 Invalid [13965]
⬇ Missing Backports [95]
Kernel Health Bugs/Month Bug Lifetimes Fuzzing Crashes
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

kernel BUG at drivers/android/binder_alloc.c:LINE! (3)

Status: fixed on 2019/06/14 18:22
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+f9f3f388440283da2965@syzkaller.appspotmail.com
Fix commit: a3c7cd0cdf11 batman-adv: mcast: fix multicast tt/tvlv worker locking
First crash: 2028d, last: 1959d
Cause bisection: introduced by (bisect log) :
commit 1a7c3d9bb7a926e88d5f57643e75ad1abfc55013
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 18:35:14 2019 +0000

  binder: create userspace-to-binder-buffer copy function

Crash: WARNING in batadv_mcast_mla_tt_retract (log)
Repro: C syz .config
  
▶ ▼ Duplicate bugs (1)
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
invalid opcode in binder_alloc_do_buffer_copy kernel 2 2047d 2049d 0/28 closed as dup on 2019/05/17 09:50
▶ ▼ Discussions (9)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 5.1 001/375] gfs2: Fix lru_count going negative 88 (88) 2019/06/17 15:57
[PATCH 4.19 000/276] 4.19.47-stable review 304 (304) 2019/06/06 19:22
[PATCH 5.0 000/346] 5.0.20-stable review 355 (355) 2019/05/31 14:18
[PATCH 5.1 000/405] 5.1.6-stable review 414 (414) 2019/05/31 14:16
[PATCH 4.14 000/193] 4.14.123-stable review 199 (199) 2019/05/31 05:16
[PATCH AUTOSEL 5.0 001/317] gfs2: Fix lru_count going negative 107 (107) 2019/05/29 19:00
[PATCH AUTOSEL 4.19 001/244] gfs2: Fix lru_count going negative 84 (84) 2019/05/22 19:29
kernel BUG at drivers/android/binder_alloc.c:LINE! (3) 7 (12) 2019/05/17 17:24
[PATCH 0/2] pull request for net: batman-adv 2019-05-09 4 (4) 2019/05/09 16:45
▶ ▼ Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG at drivers/android/binder_alloc.c:LINE! kernel C 856 2506d 2510d 4/28 fixed on 2018/02/01 10:32
android-414 kernel BUG at drivers/android/binder_alloc.c:LINE! (2) C 3 1947d 1947d 0/1 public: reported C repro on 2019/06/17 23:05
upstream kernel BUG in binder_alloc_deferred_release kernel C done 4 847d 849d 22/28 fixed on 2023/02/24 13:50
upstream kernel BUG at drivers/android/binder_alloc.c:LINE! (2) kernel C 1257 2028d 2070d 11/28 fixed on 2019/03/28 12:00
upstream kernel BUG at drivers/android/binder_alloc.c:LINE! (4) C done 26 1938d 1946d 12/28 fixed on 2019/08/05 13:45
android-414 kernel BUG at drivers/android/binder_alloc.c:LINE! C 30 2029d 2030d 1/1 fixed on 2019/03/28 03:28
android-49 kernel BUG at drivers/android/binder_alloc.c:LINE! C 44 1782d 2030d 1/3 internal: reported C repro on 2019/03/26 19:34
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2019/03/29 00:59 20m tkjos@google.com patch git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git master OK
2019/03/29 00:26 19m tkjos@google.com patch git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git master OK
2019/03/28 20:01 11m tkjos@google.com git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-linus error
2019/03/28 16:32 1m tkjos@google.com patch git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-linus error

Sample crash report:
------------[ cut here ]------------
kernel BUG at drivers/android/binder_alloc.c:1141!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8127 Comm: syz-executor353 Not tainted 5.1.0-rc2+ #40
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 drivers/android/binder_alloc.c:1141
Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41
RSP: 0018:ffff8880a4837550 EFLAGS: 00010293
RAX: ffff8880a8f40100 RBX: 0000000020001000 RCX: ffffffff854c7d3c
RDX: 0000000000000000 RSI: ffffffff854c7d46 RDI: 0000000000000006
RBP: ffff8880a48375d0 R08: ffff8880a8f40100 R09: 0000000000000028
R10: ffffed1014906f01 R11: ffff8880a483780f R12: 0000000000000008
R13: 0000000000000028 R14: ffff8880a0918b10 R15: 0000000000000000
FS:  00007fde4490b700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000958f9000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 binder_alloc_copy_from_buffer+0x37/0x42 drivers/android/binder_alloc.c:1187
 binder_get_object+0xc3/0x200 drivers/android/binder.c:2062
 binder_transaction+0x2b4a/0x6690 drivers/android/binder.c:3231
 binder_thread_write+0x87e/0x2820 drivers/android/binder.c:3781
 binder_ioctl_write_read drivers/android/binder.c:4825 [inline]
 binder_ioctl+0x1033/0x183b drivers/android/binder.c:5002
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x44b749
Code: e8 8c b7 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b cd fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fde4490ace8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006e39e8 RCX: 000000000044b749
RDX: 0000000020000240 RSI: 00000000c0306201 RDI: 0000000000000005
RBP: 00000000006e39e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006e39ec
R13: 00007ffe8277ac2f R14: 00007fde4490b9c0 R15: 0000000000000000
Modules linked in:
---[ end trace 464d10687ac51b6e ]---
RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 drivers/android/binder_alloc.c:1141
Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41
RSP: 0018:ffff8880a4837550 EFLAGS: 00010293
RAX: ffff8880a8f40100 RBX: 0000000020001000 RCX: ffffffff854c7d3c
RDX: 0000000000000000 RSI: ffffffff854c7d46 RDI: 0000000000000006
RBP: ffff8880a48375d0 R08: ffff8880a8f40100 R09: 0000000000000028
R10: ffffed1014906f01 R11: ffff8880a483780f R12: 0000000000000008
R13: 0000000000000028 R14: ffff8880a0918b10 R15: 0000000000000000
FS:  00007fde4490b700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000958f9000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/28 15:29 upstream 1a9df9e29c2a f94f56fe .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/03/28 15:28 upstream 1a9df9e29c2a f94f56fe .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/03/28 15:18 upstream 1a9df9e29c2a f94f56fe .config console log report syz C ci-upstream-kasan-gce
2019/03/28 15:15 upstream 1a9df9e29c2a f94f56fe .config console log report syz C ci-upstream-kasan-gce-root
2019/03/28 14:53 upstream 1a9df9e29c2a f94f56fe .config console log report syz C ci-upstream-kasan-gce-386
2019/06/05 13:39 upstream 788a024921c4 bfb4a51e .config console log report ci-upstream-kasan-gce-smack-root
2019/06/05 13:21 upstream 788a024921c4 bfb4a51e .config console log report ci-upstream-kasan-gce-root
2019/04/26 01:57 upstream f6f3e747454f f46aabc8 .config console log report ci-upstream-kasan-gce-root
2019/04/26 01:52 upstream f6f3e747454f f46aabc8 .config console log report ci-upstream-kasan-gce
2019/04/26 01:51 upstream f6f3e747454f f46aabc8 .config console log report ci-upstream-kasan-gce-smack-root
2019/04/16 03:28 upstream 5512320c9f6f 505ab413 .config console log report ci-upstream-kasan-gce
2019/04/14 10:50 upstream b60bc0665e6a c402d8f1 .config console log report ci-upstream-kasan-gce
2019/04/13 03:53 upstream 8ee15f324866 c402d8f1 .config console log report ci-upstream-kasan-gce-root
2019/04/12 10:24 upstream 2d06b235815e 8916f5e1 .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/12 10:19 upstream 2d06b235815e 8916f5e1 .config console log report ci-upstream-kasan-gce
2019/03/30 02:23 upstream 0e40da3efeb0 c35ee0ea .config console log report ci-upstream-kasan-gce-smack-root
2019/03/30 15:19 upstream 0e40da3efeb0 c35ee0ea .config console log report ci-upstream-kasan-gce-386
2019/03/30 06:27 upstream 0e40da3efeb0 c35ee0ea .config console log report ci-upstream-kasan-gce-386
2019/03/29 12:44 upstream 9936328b41ce 98c1bf1c .config console log report ci-upstream-kasan-gce-386
2019/03/29 03:04 upstream 8c7ae38d1ce1 14c58f8d .config console log report ci-upstream-kasan-gce-386
2019/03/28 16:20 upstream 1a9df9e29c2a f94f56fe .config console log report ci-upstream-kasan-gce-386
2019/03/28 15:43 upstream 1a9df9e29c2a f94f56fe .config console log report ci-upstream-kasan-gce-386
2019/03/28 15:34 upstream 1a9df9e29c2a f94f56fe .config console log report ci-upstream-kasan-gce-386
2019/03/28 14:17 upstream 1a9df9e29c2a f94f56fe .config console log report ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.