syzbot


KASAN: user-memory-access Write in n_tty_set_termios

Status: public: reported syz repro on 2019/04/10 16:04
Reported-by: syzbot+f79f965eb444cb4d361f@syzkaller.appspotmail.com
First crash: 2062d, last: 1930d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: user-memory-access Write in n_tty_set_termios serial C 85 1946d 2216d 11/26 fixed on 2019/01/15 20:25
android-49 KASAN: user-memory-access Write in n_tty_set_termios C 10 1951d 1840d 0/3 public: reported C repro on 2019/04/13 00:00

Sample crash report:
audit: type=1400 audit(1547337441.890:9): avc:  denied  { map } for  pid=1813 comm="syz-execprog" path="/root/syzkaller-shm745338252" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
==================================================================
BUG: KASAN: user-memory-access in memset include/linux/string.h:329 [inline]
BUG: KASAN: user-memory-access in bitmap_zero include/linux/bitmap.h:197 [inline]
BUG: KASAN: user-memory-access in n_tty_set_termios+0xee/0xcc0 drivers/tty/n_tty.c:1799
Write of size 512 at addr 0000000000001060 by task syz-executor0/9325

CPU: 0 PID: 9325 Comm: syz-executor0 Not tainted 4.14.92+ #5
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 kasan_report_error mm/kasan/report.c:349 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0x1f8/0x2a5 mm/kasan/report.c:393
==================================================================
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 9325 Comm: syz-executor0 Tainted: G    B           4.14.92+ #5
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 panic+0x1d9/0x3c2 kernel/panic.c:182
 kasan_end_report+0x43/0x49 mm/kasan/report.c:176
 kasan_report_error mm/kasan/report.c:356 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0xa4/0x2a5 mm/kasan/report.c:393
Kernel Offset: 0x1b000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
Rebooting in 86400 seconds..

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/13 00:01 android-4.14 fab7352ca8d1 c3f3344c .config console log report syz ci-android-414-kasan-gce-root
2018/12/26 06:27 android-4.14 815e34f802d8 8a41a0ad .config console log report syz ci-android-414-kasan-gce-root
2018/11/28 06:45 android-4.14 0e1d81608a8a 4b6d14f2 .config console log report syz ci-android-414-kasan-gce-root
2018/11/24 21:30 android-4.14 ea91d158d712 ecc7c870 .config console log report syz ci-android-414-kasan-gce-root
2018/11/17 19:45 android-4.14 4e76528bd48d b08ee62a .config console log report syz ci-android-414-kasan-gce-root
2018/11/14 06:52 android-4.14 97c308ca4091 5f5f6d14 .config console log report syz ci-android-414-kasan-gce-root
2018/10/22 01:13 android-4.14 c556d1ffe528 ecb386fe .config console log report syz ci-android-414-kasan-gce-root
2018/09/22 17:24 android-4.14 666c420fa3ea 37079712 .config console log report syz ci-android-414-kasan-gce-root
2018/09/03 10:17 android-4.14 47350a9f13c6 a4718693 .config console log report syz ci-android-414-kasan-gce-root
2018/09/03 04:03 android-4.14 47350a9f13c6 a4718693 .config console log report syz ci-android-414-kasan-gce-root
2018/09/02 21:21 android-4.14 47350a9f13c6 a4718693 .config console log report syz ci-android-414-kasan-gce-root
2018/12/09 04:00 android-4.14 13b8d9fdf844 c7918378 .config console log report ci-android-414-kasan-gce-root
2018/12/06 19:00 android-4.14 23bc51816857 3ab38479 .config console log report ci-android-414-kasan-gce-root
2018/12/06 04:51 android-4.14 d142f569a166 764b42c4 .config console log report ci-android-414-kasan-gce-root
2018/11/24 20:50 android-4.14 ea91d158d712 ecc7c870 .config console log report ci-android-414-kasan-gce-root
2018/11/17 19:16 android-4.14 4e76528bd48d b08ee62a .config console log report ci-android-414-kasan-gce-root
2018/11/14 06:24 android-4.14 97c308ca4091 5f5f6d14 .config console log report ci-android-414-kasan-gce-root
2018/10/22 00:37 android-4.14 c556d1ffe528 ecb386fe .config console log report ci-android-414-kasan-gce-root
2018/09/24 12:35 android-4.14 666c420fa3ea 2f485cdf .config console log report ci-android-414-kasan-gce-root
2018/09/22 16:33 android-4.14 666c420fa3ea 37079712 .config console log report ci-android-414-kasan-gce-root
2018/09/03 09:44 android-4.14 47350a9f13c6 a4718693 .config console log report ci-android-414-kasan-gce-root
2018/09/03 03:24 android-4.14 47350a9f13c6 a4718693 .config console log report ci-android-414-kasan-gce-root
2018/09/02 20:44 android-4.14 47350a9f13c6 a4718693 .config console log report ci-android-414-kasan-gce-root
2018/09/02 19:06 android-4.14 47350a9f13c6 a4718693 .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.