syzbot

 sign-in | mailing list | source | docs
🐞 Open [964] 🐞 Fixed [3807] 🐞 Invalid [8180] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes

general protection fault in scatterwalk_copychunks (4)
Status: upstream: reported C repro on 2021/03/16 06:48
Reported-by: syzbot+66e3ea42c4b176748b9c@syzkaller.appspotmail.com
First crash: 441d, last: 4d02h

Cause bisection: introduced by (bisect log) :
commit 635d9398178659d8ddba79dd061f9451cec0b4d1
Author: Vadim Fedorenko <vfedorenko@novek.ru>
Date: Wed May 20 08:41:44 2020 +0000

  net/tls: free record only on encryption error

Crash: general protection fault in gcmaes_crypt_by_sg (log)
Repro: C syz .config
similar bugs (8):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in scatterwalk_copychunks (3) C 95 1312d 1438d 0/22 closed as invalid on 2019/06/10 23:08
upstream general protection fault in scatterwalk_copychunks (2) C 141 1603d 1630d 3/22 fixed on 2018/01/11 01:23
linux-4.14 general protection fault in scatterwalk_copychunks C error 189 15d 1132d 0/1 upstream: reported C repro on 2019/04/21 07:15
linux-4.19 general protection fault in scatterwalk_copychunks C 121 15d 1071d 0/1 upstream: reported C repro on 2019/06/20 18:59
upstream general protection fault in scatterwalk_copychunks C 414 1631d 1640d 3/22 fixed on 2017/12/08 02:32
linux-4.14 KASAN: use-after-free Read in scatterwalk_copychunks C inconclusive 4 477d 1132d 0/1 upstream: reported C repro on 2019/04/21 07:18
linux-4.19 KASAN: use-after-free Read in scatterwalk_copychunks C error 11 15d 967d 0/1 upstream: reported C repro on 2019/10/03 04:34
linux-4.14 KASAN: slab-out-of-bounds Read in scatterwalk_copychunks C inconclusive 6 485d 989d 0/1 upstream: reported C repro on 2019/09/11 08:57

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 50 Comm: kworker/u4:2 Not tainted 5.18.0-rc6-syzkaller-00009-gfeb9c5e19e91 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: pencrypt_parallel padata_parallel_worker
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:69 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:89 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:78 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:50
Code: ff df 80 3c 02 00 0f 85 b4 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc90000dbf618 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff83f469c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff900729cf
R10: ffffffff83f46971 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffc90000dbf878 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1333ae001d CR3: 0000000025ef1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 skcipher_next_slow crypto/skcipher.c:278 [inline]
 skcipher_walk_next+0x7af/0x1660 crypto/skcipher.c:363
 skcipher_walk_first+0xf8/0x3c0 crypto/skcipher.c:446
 skcipher_walk_aead_common+0x7a5/0xbc0 crypto/skcipher.c:539
 gcmaes_crypt_by_sg+0x31d/0x890 arch/x86/crypto/aesni-intel_glue.c:658
 gcmaes_encrypt+0xe2/0x230 arch/x86/crypto/aesni-intel_glue.c:722
 generic_gcmaes_encrypt+0x12e/0x190 arch/x86/crypto/aesni-intel_glue.c:1076
 crypto_aead_encrypt+0xaa/0xf0 crypto/aead.c:94
 crypto_aead_encrypt+0xaa/0xf0 crypto/aead.c:94
 pcrypt_aead_enc+0x13/0x70 crypto/pcrypt.c:83
 padata_parallel_worker+0x60/0xb0 kernel/padata.c:144
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:69 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:89 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:78 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:50
Code: ff df 80 3c 02 00 0f 85 b4 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 77 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffffc90000dbf618 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff83f469c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff900729cf
R10: ffffffff83f46971 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffc90000dbf878 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1333ae001d CR3: 0000000025ef1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 80 3c 02 00 0f    	filds  0xf00023c(%rax)
   6:	85 b4 01 00 00 49 8d 	test   %esi,-0x72b70000(%rcx,%rax,1)
   d:	44 24 08             	rex.R and $0x8,%al
  10:	4d 89 26             	mov    %r12,(%r14)
  13:	48 89 c2             	mov    %rax,%rdx
  16:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
  1b:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  22:	fc ff df
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	74 08                	je     0x39
  31:	3c 03                	cmp    $0x3,%al
  33:	0f 8e 77 01 00 00    	jle    0x1b0
  39:	48                   	rex.W
  3a:	b8 00 00 00 00       	mov    $0x0,%eax

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2022/04/26 06:23 upstream d615b5416f8a 89bc8608 .config log report syz C
ci-upstream-kasan-gce 2021/10/12 18:24 upstream fa5878760579 5ae8508a .config log report syz C
Crashes (97):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2022/05/11 03:38 upstream feb9c5e19e91 8d7b3b67 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2022/03/26 20:36 upstream 52d543b5497c 89bc8608 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/03/03 19:11 upstream 5859a2b19911 45a13a73 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2021/09/12 04:35 upstream c605c39677b9 5ae8508a .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2021/08/13 10:03 upstream f8fbb47c6e86 3fd2ea69 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/08/13 10:35 net 700fa08da43e 3fd2ea69 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/08/13 10:38 net-next bed5a942e27e 3fd2ea69 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2022/03/27 06:01 linux-next fd4fbb998102 89bc8608 .config log report syz C general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2022/03/22 07:56 upstream eaa54b1458ca e2d91b1d .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream 2022/03/12 19:26 upstream aad611a868d1 9e8eaa75 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2022/03/12 05:56 upstream 68453767131a 9e8eaa75 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2021/12/31 02:17 upstream 74c78b4291b4 36bd2e48 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2021/12/25 20:51 upstream b927dfc67d05 6caa12e4 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2021/09/11 22:22 upstream c605c39677b9 5ae8508a .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2021/09/10 07:47 upstream bf9f243f23e6 e2776ee4 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2021/08/29 22:28 upstream 3f5ad13cb012 be2c130d .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2021/08/27 22:05 upstream 1a6436f37512 d5a29e53 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2021/08/22 04:23 upstream fa54d366a6e4 b599f2fc .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2021/08/14 03:26 upstream dfa377c35d70 2489ab88 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2021/08/12 22:22 upstream f8fbb47c6e86 3fd2ea69 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-smack-root 2021/08/12 21:14 upstream f8fbb47c6e86 3fd2ea69 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2021/08/04 21:36 upstream 251a1524293d b97d64c9 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-selinux-root 2021/08/02 10:44 upstream c500bee1c5b2 6c236867 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2021/08/01 22:28 upstream d4affd6b6e81 6c236867 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce 2021/08/01 22:09 upstream d4affd6b6e81 6c236867 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/05/23 11:49 upstream 4b0986a3613c 4c7657cb .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-386 2022/02/12 10:37 upstream 83e396641110 8b9ca619 .config log report info general protection fault in scatterwalk_copychunks
ci-qemu-upstream-386 2022/02/11 20:17 upstream f1baf68e1383 8b9ca619 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-386 2021/09/01 22:29 upstream 835d31d319d9 7eb7e152 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-386 2021/08/05 06:25 upstream 251a1524293d 7f7bb950 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/03/26 13:13 net b50d3b46f842 89bc8608 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2022/02/11 15:40 net 525de9a79349 0b33604d .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/12/31 19:04 net 4760abaac684 e1768e9c .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/12/21 21:29 net ac8c58f5b535 a938f0b8 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/12/20 03:30 net 60ec7fcfe768 44068e19 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/12/19 19:49 net 60ec7fcfe768 44068e19 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/12/14 13:43 net b0cdc5dbcf2b d018dd31 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/12/13 22:10 net 28a2686c185e 49ca1f59 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/11/14 11:35 net 70701b83e208 83f5c9b5 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/08/28 20:30 net 0d55649d2ad7 be2c130d .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-this-kasan-gce 2021/03/11 22:47 net 47142ed6c34d 429d8a6b .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/05/14 15:48 net-next d9713088158b 744a39e2 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/02/20 06:45 net-next 48c77bdf729a 3cd800e4 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/02/05 13:31 net-next ed8c8f605c0b a7dab638 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/02/05 07:30 net-next ed8c8f605c0b e13a05ed .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/02/05 07:17 net-next ed8c8f605c0b e13a05ed .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2022/01/21 14:28 net-next fe8152b38d3a ab3d9f17 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/12/15 03:53 net-next a3c62a042237 f752fb53 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/12/14 12:42 net-next a3c62a042237 d018dd31 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/12/13 23:47 net-next a3c62a042237 49ca1f59 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/12/11 20:56 net-next be3158290db8 49ca1f59 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/11/04 03:49 net-next cc0356d6a02e 4c1be0be .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/09/10 10:40 net-next 626bf91a292e 5ae8508a .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/09/09 14:25 net-next 626bf91a292e e2776ee4 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/08/29 02:08 net-next c77225119daa be2c130d .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/08/17 22:33 net-next 752be2976405 a2fe1cb5 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-net-kasan-gce 2021/08/13 12:23 net-next b769cf44ed55 3fd2ea69 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2021/12/31 00:36 linux-next ea586a076e8a 36bd2e48 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2021/09/10 12:27 linux-next aa14a3016182 5ae8508a .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-linux-next-kasan-gce-root 2021/09/10 06:35 linux-next aa14a3016182 e2776ee4 .config log report info general protection fault in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2021/08/10 04:03 upstream 9a73fa375d58 6972b106 .config log report info KASAN: use-after-free Read in scatterwalk_copychunks
ci-upstream-kasan-gce-root 2021/08/08 23:35 upstream 36a21d51725a 6972b106 .config log report info KASAN: use-after-free Read in scatterwalk_copychunks
ci-qemu-upstream 2021/08/04 16:06 upstream d5ad8ec3cfb5 b97d64c9 .config log report info KASAN: use-after-free Read in scatterwalk_copychunks