syzbot

 sign-in | mailing list | source | docs
🐞 Open [955] 🐞 Fixed [4037] 🐞 Invalid [8978] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes

general protection fault in scatterwalk_copychunks (4)

Status: upstream: reported C repro on 2021/03/16 06:48
Reported-by: syzbot+66e3ea42c4b176748b9c@syzkaller.appspotmail.com
First crash: 570d, last: 6h37m

Cause bisection: introduced by (bisect log) :
commit 635d9398178659d8ddba79dd061f9451cec0b4d1
Author: Vadim Fedorenko <vfedorenko@novek.ru>
Date: Wed May 20 08:41:44 2020 +0000

  net/tls: free record only on encryption error

Crash: general protection fault in gcmaes_crypt_by_sg (log)
Repro: C syz .config
similar bugs (10):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in scatterwalk_copychunks (3) C 95 1441d 1567d 0/24 closed as invalid on 2019/06/10 23:08
upstream general protection fault in scatterwalk_copychunks (2) C 141 1732d 1759d 3/24 fixed on 2018/01/11 01:23
linux-4.14 general protection fault in scatterwalk_copychunks C error 197 2d20h 1261d 0/1 upstream: reported C repro on 2019/04/21 07:15
linux-4.19 general protection fault in scatterwalk_copychunks C error 138 3d19h 1201d 0/1 upstream: reported C repro on 2019/06/20 18:59
upstream general protection fault in scatterwalk_copychunks C 414 1760d 1770d 3/24 fixed on 2017/12/08 02:32
linux-4.14 KASAN: use-after-free Read in scatterwalk_copychunks C inconclusive 4 606d 1261d 0/1 upstream: reported C repro on 2019/04/21 07:18
linux-4.19 KASAN: use-after-free Read in scatterwalk_copychunks C error 15 59d 1096d 0/1 upstream: reported C repro on 2019/10/03 04:34
linux-4.14 KASAN: slab-out-of-bounds Read in scatterwalk_copychunks C inconclusive 6 614d 1118d 0/1 upstream: reported C repro on 2019/09/11 08:57
upstream BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks (2) 2 1545d 1545d 0/24 closed as invalid on 2018/09/05 12:51
upstream BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks C 3 1753d 1754d 3/24 fixed on 2018/01/11 01:23

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 50 Comm: kworker/u4:2 Not tainted 5.18.0-rc6-syzkaller-00009-gfeb9c5e19e91 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: pencrypt_parallel padata_parallel_worker
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:69 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:89 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:78 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:50
Code: ff df 80 3c 02 00 0f 85 b4 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc90000dbf618 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff83f469c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff900729cf
R10: ffffffff83f46971 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffc90000dbf878 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1333ae001d CR3: 0000000025ef1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 skcipher_next_slow crypto/skcipher.c:278 [inline]
 skcipher_walk_next+0x7af/0x1660 crypto/skcipher.c:363
 skcipher_walk_first+0xf8/0x3c0 crypto/skcipher.c:446
 skcipher_walk_aead_common+0x7a5/0xbc0 crypto/skcipher.c:539
 gcmaes_crypt_by_sg+0x31d/0x890 arch/x86/crypto/aesni-intel_glue.c:658
 gcmaes_encrypt+0xe2/0x230 arch/x86/crypto/aesni-intel_glue.c:722
 generic_gcmaes_encrypt+0x12e/0x190 arch/x86/crypto/aesni-intel_glue.c:1076
 crypto_aead_encrypt+0xaa/0xf0 crypto/aead.c:94
 crypto_aead_encrypt+0xaa/0xf0 crypto/aead.c:94
 pcrypt_aead_enc+0x13/0x70 crypto/pcrypt.c:83
 padata_parallel_worker+0x60/0xb0 kernel/padata.c:144
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:69 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:89 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:78 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:50
Code: ff df 80 3c 02 00 0f 85 b4 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc90000dbf618 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff83f469c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff900729cf
R10: ffffffff83f46971 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffc90000dbf878 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1333ae001d CR3: 0000000025ef1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 80 3c 02 00 0f    	filds  0xf00023c(%rax)
   6:	85 b4 01 00 00 49 8d 	test   %esi,-0x72b70000(%rcx,%rax,1)
   d:	44 24 08             	rex.R and $0x8,%al
  10:	4d 89 26             	mov    %r12,(%r14)
  13:	48 89 c2             	mov    %rax,%rdx
  16:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
  1b:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  22:	fc ff df
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	74 08                	je     0x39
  31:	3c 03                	cmp    $0x3,%al
  33:	0f 8e 77 01 00 00    	jle    0x1b0
  39:	48                   	rex.W
  3a:	b8 00 00 00 00       	mov    $0x0,%eax

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2022/04/26 06:23 upstream d615b5416f8a 89bc8608 .config log report syz C
ci-upstream-kasan-gce 2021/10/12 18:24 upstream fa5878760579 5ae8508a .config log report syz C
* Struck through repros no longer work on HEAD.
Crashes (143):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2022/05/11 03:38 upstream feb9c5e19e91 8d7b3b67 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2022/03/26 20:36 upstream 52d543b5497c 89bc8608 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/03/03 19:11 upstream 5859a2b19911 45a13a73 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2021/09/12 04:35 upstream c605c39677b9 5ae8508a .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2021/08/13 10:03 upstream f8fbb47c6e86 3fd2ea69 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/08/13 10:35 net 700fa08da43e 3fd2ea69 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/08/13 10:38 net-next bed5a942e27e 3fd2ea69 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2022/03/27 06:01 linux-next fd4fbb998102 89bc8608 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/09/26 03:16 upstream f76349cf4145 0042f2b4 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/09/16 19:49 upstream 6879c2d3b960 dd9a85ff .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/09/13 19:59 upstream d1221cea11fc b884348d .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/09/11 12:07 upstream b96fbd602d35 356d8217 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/09/02 03:45 upstream 42e66b1cc3a0 a805568e .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/31 12:29 upstream dcf8e5633e2e 51e54e30 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/08/21 07:48 upstream 15b3f48a4339 26a13b38 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/17 20:02 upstream 274a2eebf80c a9409d47 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/11 01:23 upstream 200e340f2196 a6201f11 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/08/10 16:40 upstream 200e340f2196 a6201f11 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/09 20:59 upstream 200e340f2196 c2a623d6 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2022/08/09 04:19 upstream 200e340f2196 da700653 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/08/06 16:52 upstream 200e340f2196 88e3a122 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/08/01 13:28 upstream 3d7cb6b04c3f fef302b1 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/07/30 03:13 upstream e65c6a46df94 fef302b1 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/07/29 13:06 upstream 6e2c0490769e fef302b1 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/07/27 15:25 upstream 4a57a8400075 da9d0366 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/07/27 00:52 upstream 4a57a8400075 ae971e66 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/07/26 14:54 upstream 4a57a8400075 279b89c2 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/07/19 14:11 upstream 4a57a8400075 72a3cc0c .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/06/17 06:15 upstream 47700948a4ab 1719ee24 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/06/15 20:54 upstream 979086f5e006 1719ee24 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/06/12 22:49 upstream 997952851843 0d5abf15 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/03/22 07:56 upstream eaa54b1458ca e2d91b1d .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/03/12 19:26 upstream aad611a868d1 9e8eaa75 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/03/12 05:56 upstream 68453767131a 9e8eaa75 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2021/12/31 02:17 upstream 74c78b4291b4 36bd2e48 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/09/01 05:51 upstream c5e4d5e99162 b01ec571 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/08/31 23:05 upstream c5e4d5e99162 51e54e30 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/08/27 04:42 upstream e022620b5d05 07177916 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/08/09 19:35 upstream 200e340f2196 c2a623d6 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/07/25 11:52 upstream 4a57a8400075 664c519c .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/07/11 14:44 upstream 32346491ddf2 f3f217ff .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/05/23 11:49 upstream 4b0986a3613c 4c7657cb .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-386 2022/02/12 10:37 upstream 83e396641110 8b9ca619 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/02/11 20:17 upstream f1baf68e1383 8b9ca619 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/09/17 00:05 net 96628951869c dd9a85ff .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/08/06 06:43 net 8eaa1d110800 e853abd9 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/06/06 17:59 net 58f9d52ff689 c8857892 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/03/26 13:13 net b50d3b46f842 89bc8608 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/02/11 15:40 net 525de9a79349 0b33604d .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/03/11 22:47 net 47142ed6c34d 429d8a6b .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/10/03 13:32 net-next 9d43507319cc feb56351 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/06/27 00:59 net-next ebeae54d3a77 a371c43c .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/06/04 20:04 net-next 58f9d52ff689 c8857892 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/05/14 15:48 net-next d9713088158b 744a39e2 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/02/20 06:45 net-next 48c77bdf729a 3cd800e4 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/02/05 13:31 net-next ed8c8f605c0b a7dab638 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2022/08/28 09:47 linux-next 8d0c42c9e807 07177916 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2022/05/27 21:57 linux-next d3fde8ff50ab a46af346 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2021/08/10 04:03 upstream 9a73fa375d58 6972b106 .config log report info KASAN: use-after-free Read in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/30 14:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5911b92626df feb56351 .config log report info BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/29 11:04 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c194837ebb57 1d385642 .config log report info BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/28 00:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c194837ebb57 75c78242 .config log report info BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/22 16:11 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci aa49f95768a9 0042f2b4 .config log report info BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/09/21 10:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5aa266bb455b 380f82fb .config log report info BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
ci-upstream-gce-arm64 2022/08/30 16:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a41a877bc12d 4a380809 .config log report info BUG: unable to handle kernel NULL pointer dereference in scatterwalk_copychunks
* Struck through repros no longer work on HEAD.