syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel paging request in tpg_fill_plane_buffer

Status: auto-closed as invalid on 2020/09/11 05:35
Reported-by: syzbot+ea604414a8a6dc515e27@syzkaller.appspotmail.com
First crash: 1709d, last: 1436d
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) syz error 8 491d 991d 0/1 upstream: reported syz repro on 2021/08/02 00:51
linux-4.14 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer 1 1541d 1541d 0/1 auto-closed as invalid on 2020/05/29 08:05
linux-4.14 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) 1 825d 825d 0/1 auto-closed as invalid on 2022/05/15 07:48
upstream BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) media 1 375d 371d 0/26 auto-obsoleted due to no activity on 2023/07/09 12:46
upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (2) media C inconclusive done 14 445d 956d 22/26 fixed on 2023/02/24 13:51
upstream BUG: unable to handle kernel paging request in tpg_fill_plane_buffer media ntfs3 syz done 17 1600d 1970d 0/26 auto-obsoleted due to no activity on 2022/12/18 03:07

Sample crash report:
BUG: unable to handle kernel paging request at ffffc90010eae340
PGD 12c2bc067 P4D 12c2bc067 PUD 21bc31067 PMD 550f8067 PTE 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 27355 Comm: vivid-000-vid-c Not tainted 4.19.122-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:55
Code: eb 88 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe
PM: Marking nosave pages: [mem 0x00000000-0x00000fff]
RSP: 0018:ffff888193097838 EFLAGS: 00010246
RAX: ffffc90010eae340 RBX: ffffc90001ded000 RCX: 0000000000000080
RDX: 0000000000000080 RSI: ffffc90001ded000 RDI: ffffc90010eae340
RBP: ffffc90001ded000 R08: ffff8881dff42480 R09: fffff520021d5c78
R10: fffff520021d5c77 R11: ffffc90010eae3bf R12: 0000000000000000
R13: 0000000000000080 R14: ffff888218735518 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90010eae340 CR3: 0000000055453000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 memcpy include/linux/string.h:348 [inline]
 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2358 [inline]
 tpg_fill_plane_buffer+0x1105/0x2ef0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2446
 vivid_fillbuff+0x195a/0x6410 drivers/media/platform/vivid/vivid-kthread-cap.c:473
 vivid_thread_vid_cap_tick drivers/media/platform/vivid/vivid-kthread-cap.c:707 [inline]
 vivid_thread_vid_cap+0x9a3/0x1ff0 drivers/media/platform/vivid/vivid-kthread-cap.c:809
PM: Marking nosave pages: [mem 0x0009f000-0x000fffff]
PM: Marking nosave pages: [mem 0xbfffd000-0xffffffff]
PM: Basic memory bitmaps created
 kthread+0x34a/0x420 kernel/kthread.c:246
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
CR2: ffffc90010eae340
---[ end trace 9efb0ec1fc372a2d ]---
RIP: 0010:memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:55
Code: eb 88 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe
RSP: 0018:ffff888193097838 EFLAGS: 00010246
RAX: ffffc90010eae340 RBX: ffffc90001ded000 RCX: 0000000000000080
RDX: 0000000000000080 RSI: ffffc90001ded000 RDI: ffffc90010eae340
RBP: ffffc90001ded000 R08: ffff8881dff42480 R09: fffff520021d5c78
R10: fffff520021d5c77 R11: ffffc90010eae3bf R12: 0000000000000000
R13: 0000000000000080 R14: ffff888218735518 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90010eae340 CR3: 0000000055453000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/14 05:34 linux-4.19.y 033c4ea49a4b a885920d .config console log report ci2-linux-4-19
2020/02/26 05:58 linux-4.19.y f25804f38984 4f588111 .config console log report ci2-linux-4-19
2019/11/18 21:57 linux-4.19.y c555efaf1402 d5696d51 .config console log report ci2-linux-4-19
2019/08/14 23:23 linux-4.19.y 893af1c79e42 5576551b .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.