syzbot

 sign-in | mailing list | source | docs
🐞 Open [1161] 🐞 Fixed [4314] 🐞 Invalid [9650] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes

general protection fault in scatterwalk_copychunks (4)

Status: upstream: reported C repro on 2021/03/16 06:48
Reported-by: syzbot+66e3ea42c4b176748b9c@syzkaller.appspotmail.com
First crash: 691d, last: 20d

Cause bisection: introduced by (bisect log) :
commit 635d9398178659d8ddba79dd061f9451cec0b4d1
Author: Vadim Fedorenko <vfedorenko@novek.ru>
Date: Wed May 20 08:41:44 2020 +0000

  net/tls: free record only on encryption error

Crash: general protection fault in gcmaes_crypt_by_sg (log)
Repro: C syz .config
similar bugs (10):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in scatterwalk_copychunks (3) C 95 1562d 1688d 0/24 closed as invalid on 2019/06/10 23:08
upstream general protection fault in scatterwalk_copychunks (2) C 141 1853d 1880d 3/24 fixed on 2018/01/11 01:23
linux-4.14 general protection fault in scatterwalk_copychunks C error 201 1d04h 1382d 0/1 upstream: reported C repro on 2019/04/21 07:15
linux-4.19 general protection fault in scatterwalk_copychunks C error 149 1d20h 1321d 0/1 upstream: reported C repro on 2019/06/20 18:59
upstream general protection fault in scatterwalk_copychunks C 414 1881d 1890d 3/24 fixed on 2017/12/08 02:32
linux-4.14 KASAN: use-after-free Read in scatterwalk_copychunks C inconclusive 4 727d 1382d 0/1 upstream: reported C repro on 2019/04/21 07:18
linux-4.19 KASAN: use-after-free Read in scatterwalk_copychunks C error 17 1d20h 1217d 0/1 upstream: reported C repro on 2019/10/03 04:34
linux-4.14 KASAN: slab-out-of-bounds Read in scatterwalk_copychunks C inconclusive 6 735d 1239d 0/1 upstream: reported C repro on 2019/09/11 08:57
upstream BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks (2) 2 1666d 1666d 0/24 closed as invalid on 2018/09/05 12:51
upstream BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks C 3 1874d 1875d 3/24 fixed on 2018/01/11 01:23

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 50 Comm: kworker/u4:2 Not tainted 5.18.0-rc6-syzkaller-00009-gfeb9c5e19e91 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: pencrypt_parallel padata_parallel_worker
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:69 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:89 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:78 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:50
Code: ff df 80 3c 02 00 0f 85 b4 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc90000dbf618 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff83f469c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff900729cf
R10: ffffffff83f46971 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffc90000dbf878 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1333ae001d CR3: 0000000025ef1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 skcipher_next_slow crypto/skcipher.c:278 [inline]
 skcipher_walk_next+0x7af/0x1660 crypto/skcipher.c:363
 skcipher_walk_first+0xf8/0x3c0 crypto/skcipher.c:446
 skcipher_walk_aead_common+0x7a5/0xbc0 crypto/skcipher.c:539
 gcmaes_crypt_by_sg+0x31d/0x890 arch/x86/crypto/aesni-intel_glue.c:658
 gcmaes_encrypt+0xe2/0x230 arch/x86/crypto/aesni-intel_glue.c:722
 generic_gcmaes_encrypt+0x12e/0x190 arch/x86/crypto/aesni-intel_glue.c:1076
 crypto_aead_encrypt+0xaa/0xf0 crypto/aead.c:94
 crypto_aead_encrypt+0xaa/0xf0 crypto/aead.c:94
 pcrypt_aead_enc+0x13/0x70 crypto/pcrypt.c:83
 padata_parallel_worker+0x60/0xb0 kernel/padata.c:144
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:69 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:89 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:78 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:50
Code: ff df 80 3c 02 00 0f 85 b4 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc90000dbf618 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff83f469c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff900729cf
R10: ffffffff83f46971 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffc90000dbf878 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1333ae001d CR3: 0000000025ef1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 80 3c 02 00 0f    	filds  0xf00023c(%rax)
   6:	85 b4 01 00 00 49 8d 	test   %esi,-0x72b70000(%rcx,%rax,1)
   d:	44 24 08             	rex.R and $0x8,%al
  10:	4d 89 26             	mov    %r12,(%r14)
  13:	48 89 c2             	mov    %rax,%rdx
  16:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
  1b:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  22:	fc ff df
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	74 08                	je     0x39
  31:	3c 03                	cmp    $0x3,%al
  33:	0f 8e 77 01 00 00    	jle    0x1b0
  39:	48                   	rex.W
  3a:	b8 00 00 00 00       	mov    $0x0,%eax

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce-smack-root 2022/04/26 06:23 upstream d615b5416f8a 89bc8608 .config console log report syz C
ci-upstream-kasan-gce 2021/10/12 18:24 upstream fa5878760579 5ae8508a .config console log report syz C
* Struck through repros no longer work on HEAD.
Crashes (178):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce-selinux-root 2022/05/11 03:38 upstream feb9c5e19e91 8d7b3b67 .config strace log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2022/03/26 20:36 upstream 52d543b5497c 89bc8608 .config console log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/03/03 19:11 upstream 5859a2b19911 45a13a73 .config console log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2021/09/12 04:35 upstream c605c39677b9 5ae8508a .config console log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2021/08/13 10:03 upstream f8fbb47c6e86 3fd2ea69 .config console log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/08/13 10:35 net 700fa08da43e 3fd2ea69 .config console log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/08/13 10:38 net-next bed5a942e27e 3fd2ea69 .config console log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2022/03/27 06:01 linux-next fd4fbb998102 89bc8608 .config console log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/12/05 15:24 upstream 76dcd734eca2 045cbb84 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2022/10/15 08:53 upstream 55be6084c8e0 67cb024c .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2022/10/14 09:36 upstream 55be6084c8e0 4954e4b2 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/14 06:47 upstream 55be6084c8e0 4954e4b2 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/12 18:06 upstream 55be6084c8e0 89b5a509 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/11 18:34 upstream 55be6084c8e0 1353c374 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/10 08:09 upstream 4899a36f91a9 aea5da89 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/10 07:28 upstream 4899a36f91a9 aea5da89 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/10 00:58 upstream a6afa4199d3d aea5da89 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/09 02:26 upstream a6afa4199d3d aea5da89 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/07 01:25 upstream ffb39098bf87 8a212197 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2022/10/05 14:41 upstream 2bca25eaeba6 267e3bb1 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/10/05 00:38 upstream 0326074ff465 eab8f949 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/10/04 21:36 upstream f3dfe925f954 267e3bb1 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/09/26 03:16 upstream f76349cf4145 0042f2b4 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/09/16 19:49 upstream 6879c2d3b960 dd9a85ff .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/09/13 19:59 upstream d1221cea11fc b884348d .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/09/11 12:07 upstream b96fbd602d35 356d8217 .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/09/02 03:45 upstream 42e66b1cc3a0 a805568e .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/31 12:29 upstream dcf8e5633e2e 51e54e30 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/08/21 07:48 upstream 15b3f48a4339 26a13b38 .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/17 20:02 upstream 274a2eebf80c a9409d47 .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/11 01:23 upstream 200e340f2196 a6201f11 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/08/10 16:40 upstream 200e340f2196 a6201f11 .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/09 20:59 upstream 200e340f2196 c2a623d6 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2022/08/09 04:19 upstream 200e340f2196 da700653 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/08/06 16:52 upstream 200e340f2196 88e3a122 .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/01 13:28 upstream 3d7cb6b04c3f fef302b1 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-386 2022/10/04 19:59 upstream 4fe89d07dcc2 eab8f949 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/09/01 05:51 upstream c5e4d5e99162 b01ec571 .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/08/31 23:05 upstream c5e4d5e99162 51e54e30 .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/08/27 04:42 upstream e022620b5d05 07177916 .config console log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/08/09 19:35 upstream 200e340f2196 c2a623d6 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/12/15 04:36 net 7ae9888d6e1c b18f0a64 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/11/25 12:57 net 661e5ebbafd2 74a66371 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/11/23 00:30 net 2dc4ac91f845 9da37ae8 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/11/07 12:28 net f9027f88f7d1 6d752409 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/10/04 15:59 net 93e2be344a7d eab8f949 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/09/17 00:05 net 96628951869c dd9a85ff .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/08/06 06:43 net 8eaa1d110800 e853abd9 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/03/11 22:47 net 47142ed6c34d 429d8a6b .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2023/01/11 19:23 net-next 60d86034b14e 96166539 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/12/12 12:57 net-next 6d534ee057b6 67be1ae7 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/12/10 22:09 net-next dd8b3a802b64 67be1ae7 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/12/01 22:18 net-next 9e855b1fe37f e080de16 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/11/08 03:19 net-next fbeb229a6622 881db35d .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/10/28 18:23 net-next 99c8eb46773e ea12ae9b .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/10/05 09:51 net-next 0326074ff465 267e3bb1 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/10/04 13:11 net-next 450a580fc4b5 77d3f689 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/10/04 06:15 net-next 9d43507319cc feb56351 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/10/03 13:32 net-next 9d43507319cc feb56351 .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2022/10/06 12:16 linux-next aaa11ce2ffc8 131b38ac .config console log report info [disk image] [vmlinux] general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2022/08/28 09:47 linux-next 8d0c42c9e807 07177916 .config console log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2021/08/10 04:03 upstream 9a73fa375d58 6972b106 .config console log report info KASAN: use-after-free Read in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/12/20 23:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 d3e76707 .config console log report info [disk image] [vmlinux] [kernel image] BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/10/06 23:59 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 8a212197 .config console log report info [disk image] [vmlinux] BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/30 14:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5911b92626df feb56351 .config console log report info [disk image] [vmlinux] BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/29 11:04 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c194837ebb57 1d385642 .config console log report info [disk image] [vmlinux] BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/28 00:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c194837ebb57 75c78242 .config console log report info [disk image] [vmlinux] BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/22 16:11 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci aa49f95768a9 0042f2b4 .config console log report info [disk image] [vmlinux] BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/21 10:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5aa266bb455b 380f82fb .config console log report info [disk image] [vmlinux] BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/08/30 16:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a41a877bc12d 4a380809 .config console log report info BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
* Struck through repros no longer work on HEAD.