syzbot


general protection fault in futex_wake

Status: auto-closed as invalid on 2020/10/20 15:46
Reported-by: syzbot+40f353d2d539305488a5@syzkaller.appspotmail.com
First crash: 768d, last: 768d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in futex_wake (2) 2 432d 436d 0/24 auto-closed as invalid on 2021/10/21 19:26
linux-4.14 general protection fault in futex_wake 1 1018d 1018d 0/1 auto-closed as invalid on 2020/04/13 04:56
linux-4.19 general protection fault in futex_wake 1 768d 768d 0/1 auto-closed as invalid on 2020/12/19 07:00
linux-4.19 general protection fault in futex_wake (2) 1 550d 550d 0/1 auto-closed as invalid on 2021/07/25 11:26

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 23150 Comm: syz-executor.5 Not tainted 5.9.0-rc1-next-20200821-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:futex_wake+0x22c/0x490 kernel/futex.c:1603
Code: 39 64 24 08 48 8d 58 e8 0f 84 06 02 00 00 49 bc 00 00 00 00 00 fc ff df eb 34 e8 8f a5 0b 00 4c 8d 73 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 0f 85 e4 01 00 00 48 8b 43 18 48 89 dd 48 83 e8 18
RSP: 0018:ffffc9000763fb50 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffffffffffe9 RCX: ffffffff8168cda1
RDX: ffff888036d7e480 RSI: ffffffff8168cd31 RDI: 0000000000000006
RBP: ffffc90000e0dce8 R08: 0000000000000001 R09: 0000000000000003
R10: ffffffff8c6cc8a8 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 000000000118c000
FS:  0000000002303940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000118cf44 CR3: 00000002115db000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_futex+0x322/0x1a50 kernel/futex.c:3754
 __do_sys_futex kernel/futex.c:3810 [inline]
 __se_sys_futex kernel/futex.c:3778 [inline]
 __x64_sys_futex+0x378/0x4e0 kernel/futex.c:3778
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d4d9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffff51eb128 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 000000000118cf4c RCX: 000000000045d4d9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000118cf4c
RBP: 000000000118cf40 R08: 0000000001190090 R09: 0000000000000000
R10: 00007ffff51eb200 R11: 0000000000000246 R12: 0000000001190008
R13: 0000000000000000 R14: 000000000000007d R15: 000000000118cf4c
Modules linked in:
---[ end trace 16dea509d3dfd5b8 ]---
RIP: 0010:futex_wake+0x22c/0x490 kernel/futex.c:1603
Code: 39 64 24 08 48 8d 58 e8 0f 84 06 02 00 00 49 bc 00 00 00 00 00 fc ff df eb 34 e8 8f a5 0b 00 4c 8d 73 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 0f 85 e4 01 00 00 48 8b 43 18 48 89 dd 48 83 e8 18
RSP: 0018:ffffc9000763fb50 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffffffffffe9 RCX: ffffffff8168cda1
RDX: ffff888036d7e480 RSI: ffffffff8168cd31 RDI: 0000000000000006
RBP: ffffc90000e0dce8 R08: 0000000000000001 R09: 0000000000000003
R10: ffffffff8c6cc8a8 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 000000000118c000
FS:  0000000002303940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000118cf44 CR3: 00000002115db000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-linux-next-kasan-gce-root 2020/08/21 15:45 linux-next 494d311a82bb 6436ce4b .config log report
* Struck through repros no longer work on HEAD.