syzbot


KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
Status: upstream: reported on 2021/02/26 09:33
Reported-by: syzbot+be51ca5a4d97f017cd50@syzkaller.appspotmail.com
Fix commit: 6d042ffb598e io_uring: Check current->io_uring in io_uring_cancel_sqpoll
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32]
First crash: 160d, last: 2d11h

Sample crash report:

Crashes (139):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2021/03/04 12:35 upstream f69d02e37a85 d7e4e604 .config log report info KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
ci-upstream-kasan-gce-smack-root 2021/03/04 11:01 upstream f69d02e37a85 d7e4e604 .config log report info KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
ci-upstream-kasan-gce-selinux-root 2021/03/03 19:24 upstream f69d02e37a85 06ed56cd .config log report info KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
ci-qemu2-arm64-compat 2021/04/15 15:35 upstream 7f75285ca572 fcdb12ba .config log report info KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
ci-qemu2-arm64-compat 2021/04/07 18:50 upstream 2d743660786e 6a81331a .config log report info KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
ci-qemu2-arm64 2021/03/25 18:55 upstream e138138003eb 6a383ecf .config log report info KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
ci-qemu-upstream-386 2021/03/10 10:54 upstream 280d542f6ffa 26967e35 .config log report info KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
ci-upstream-linux-next-kasan-gce-root 2021/02/26 09:19 linux-next d01f2f7e3557 76f7fc95 .config log report info KASAN: null-ptr-deref Write in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/08/03 06:16 upstream bf152b0b41dc 6c236867 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/08/02 20:14 upstream bf152b0b41dc 6c236867 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/08/02 12:18 upstream bf152b0b41dc 6c236867 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/08/02 07:02 upstream bf152b0b41dc 6c236867 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/07/26 01:42 upstream bf152b0b41dc 4d1b57d4 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/07/25 12:22 upstream bf152b0b41dc 4d1b57d4 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/07/20 12:29 upstream bf152b0b41dc 1b201b48 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/07/18 16:25 upstream bf152b0b41dc f115ae98 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/07/17 05:00 upstream bf152b0b41dc f115ae98 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/07/13 21:32 upstream bf152b0b41dc 70168d5c .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/07/05 05:31 upstream bf152b0b41dc 55aa55c2 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/07/04 09:58 upstream bf152b0b41dc 55aa55c2 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/26 01:00 upstream bf152b0b41dc ae6bf8dd .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/17 10:02 upstream bf152b0b41dc aba2b2fb .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/16 08:14 upstream bf152b0b41dc 990d3cbe .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/14 20:37 upstream bf152b0b41dc 1ba81399 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/14 16:01 upstream bf152b0b41dc 1ba81399 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/13 07:32 upstream bf152b0b41dc 1ba81399 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/11 13:35 upstream bf152b0b41dc 1ba81399 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/08 20:30 upstream bf152b0b41dc 5c2fe346 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/05 22:44 upstream bf152b0b41dc 500c2339 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/06/04 05:35 upstream bf152b0b41dc 0740de69 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/05/30 21:06 upstream bf152b0b41dc 858ea628 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/05/28 07:12 upstream bf152b0b41dc 858ea628 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/05/26 04:58 upstream bf152b0b41dc 93d3a9f6 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-arm32 2021/05/25 06:07 upstream bf152b0b41dc 3c7fef33 .config log report info BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/16 17:40 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd c06f97ad .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/14 16:21 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/13 05:44 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/12 00:28 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/11 21:57 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/11 19:54 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/11 17:35 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/11 16:22 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/10 21:40 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/10 18:53 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 1ba81399 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/09 20:25 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 84fe5d96 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/06 09:23 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 500c2339 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/05 18:22 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 500c2339 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/05 15:16 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 500c2339 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/06/03 09:20 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 0740de69 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/31 07:20 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 858ea628 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/30 22:28 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 858ea628 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/30 12:34 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 858ea628 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/29 13:06 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 858ea628 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/28 03:42 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 858ea628 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/26 19:24 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 54f0bcf1 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/25 15:45 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 3c7fef33 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/24 23:43 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 3c7fef33 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/24 22:43 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 3c7fef33 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/24 02:38 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 3c7fef33 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll
ci-qemu2-riscv64 2021/05/23 08:34 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 18a3c5f7abfd 3c7fef33 .config log report info BUG: unable to handle kernel access to user memory in io_uring_cancel_sqpoll