syzbot

 sign-in | mailing list | source | docs
🐞 Open [984] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12476] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in __run_timers

Status: closed as invalid on 2017/10/22 12:45
Subsystems: kernel
[Documentation on labels]
First crash: 2425d, last: 2404d
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __run_timers (3) reiserfs C error 4 227d 264d 0/26 auto-obsoleted due to no activity on 2024/01/10 00:11
upstream general protection fault in __run_timers (2) kernel C 5 2064d 2079d 0/26 closed as invalid on 2018/09/05 12:51
upstream general protection fault in __run_timers (3) kernel 1 1318d 1314d 0/26 auto-closed as invalid on 2020/12/09 00:33
android-54 KASAN: use-after-free Write in __run_timers syz 384 9h31m 1378d 0/2 upstream: reported syz repro on 2020/07/11 21:22

Sample crash report:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.14.0-rc1-next-20170919+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006dac6040 task.stack: ffff88006dac8000
RIP: 0010:__hlist_del include/linux/list.h:650 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:791 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1309 [inline]
RIP: 0010:__run_timers+0x619/0xb90 kernel/time/timer.c:1620
RSP: 0018:ffff88006de07968 EFLAGS: 00010806
RAX: 1bd5a00000000041 RBX: ffff88004c13c840 RCX: 1ffff1000dbc0f76
RDX: ffff88006de07bb0 RSI: 0000000000000008 RDI: dead000000000208
RBP: ffff88006de07c58 R08: ffff88006de072b8 R09: ffff88006de072b0
R10: ffff88006de07228 R11: 1ffff1000db58e9b R12: ffff88004c13c848
R13: dffffc0000000000 R14: dead000000000200 R15: ffff88006de07c30
FS:  0000000000000000(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001ddbc21000 CR3: 000000002c301000 CR4: 00000000000006e0
Call Trace:
 <IRQ>
 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1646
 __do_softirq+0x2bb/0xbd0 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1d3/0x210 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x177/0x710 arch/x86/kernel/apic/apic.c:1048
 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:577
 </IRQ>
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:787 [inline]
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x56/0x70 kernel/locking/spinlock.c:199
RSP: 0018:ffff88006dacfbe8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffff88006de25c00 RCX: 0000000000000000
RDX: 1ffffffff0b59347 RSI: 0000000000000001 RDI: ffffffff85ac9a38
RBP: ffff88006dacfbf0 R08: ffff88006de25c18 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003ac46200
R13: 1ffff1000db59f86 R14: ffff88006dac6040 R15: ffff88006dac6040
 finish_lock_switch kernel/sched/sched.h:1335 [inline]
 finish_task_switch+0x1d3/0x740 kernel/sched/core.c:2657
 context_switch kernel/sched/core.c:2793 [inline]
 __schedule+0x8f0/0x2070 kernel/sched/core.c:3366
 schedule_idle+0x58/0x80 kernel/sched/core.c:3452
 do_idle+0x12f/0x3b0 kernel/sched/idle.c:269
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:351
 start_secondary+0x2ea/0x3f0 arch/x86/kernel/smpboot.c:278
 secondary_startup_64+0xa5/0xa5 arch/x86/kernel/head_64.S:235
Code: 4d 85 f6 4c 89 32 48 89 95 58 fd ff ff 42 c6 04 28 f8 74 26 e8 a9 33 10 00 49 8d 7e 08 48 8b 95 58 fd ff ff 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 b5 04 00 00 49 89 56 08 e8 83 33 10 00 4c 
RIP: __hlist_del include/linux/list.h:650 [inline] RSP: ffff88006de07968
RIP: detach_timer kernel/time/timer.c:791 [inline] RSP: ffff88006de07968
RIP: expire_timers kernel/time/timer.c:1309 [inline] RSP: ffff88006de07968
RIP: __run_timers+0x619/0xb90 kernel/time/timer.c:1620 RSP: ffff88006de07968
---[ end trace d8c3d167cc937f55 ]---

Crashes (35):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/09/19 16:39 linux-next 840cc455c5f5 92f543f0 .config console log report ci-upstream-next-kasan-gce
2017/09/18 21:35 linux-next fc2e8b1a47c1 2bab8ad8 .config console log report skylake-linux-next-kasan-qemu
2017/09/18 13:45 linux-next fc2e8b1a47c1 2bab8ad8 .config console log report skylake-linux-next-kasan-qemu
2017/09/16 15:02 linux-next 1f183459b514 da1873aa .config console log report skylake-linux-next-kasan-qemu
2017/09/15 19:23 linux-next 1f183459b514 da1873aa .config console log report skylake-linux-next-kasan-qemu
2017/09/15 07:05 linux-next 1f183459b514 da1873aa .config console log report skylake-linux-next-kasan-qemu
2017/09/12 08:03 linux-next 0d71e2d4aa14 0bd6a0a5 .config console log report ci-upstream-next-kasan-gce
2017/09/10 02:01 linux-next 58bcd35f859b d18bfda0 .config console log report skylake-linux-next-kasan-qemu
2017/09/08 03:40 linux-next c6be5a0e3ceb 0ed1da4a .config console log report skylake-linux-next-kasan-qemu
2017/09/07 13:51 linux-next c6be5a0e3ceb 0ed1da4a .config console log report skylake-linux-next-kasan-qemu
2017/09/07 00:31 linux-next e9fcbcd00963 0ed1da4a .config console log report skylake-linux-next-kasan-qemu
2017/09/06 15:15 linux-next e9fcbcd00963 0ed1da4a .config console log report skylake-linux-next-kasan-qemu
2017/09/06 08:48 linux-next e9fcbcd00963 0ed1da4a .config console log report skylake-linux-next-kasan-qemu
2017/09/02 20:48 linux-next 1d53d908b79d a54dce00 .config console log report ci-upstream-next-kasan-gce
2017/08/31 20:37 linux-next e8b684315214 4ccdd782 .config console log report ci-upstream-next-kasan-gce
2017/08/31 10:32 linux-next e8b684315214 4ccdd782 .config console log report skylake-linux-next-kasan-qemu
2017/08/31 08:24 linux-next 9458bf6edfa8 ed7f9598 .config console log report ci-upstream-next-kasan-gce
2017/08/31 02:52 linux-next 9458bf6edfa8 ed7f9598 .config console log report ci-upstream-next-kasan-gce
2017/08/31 01:08 linux-next 9458bf6edfa8 ed7f9598 .config console log report ci-upstream-next-kasan-gce
2017/08/29 05:18 linux-next adc4148c101c be291771 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.