syzbot


general protection fault in reset_buffer_flags

Status: public: reported syz repro on 2019/04/10 16:14
Reported-by: syzbot+bee4eb38cf90371a5dd6@syzkaller.appspotmail.com
First crash: 2037d, last: 2014d

Sample crash report:
audit: type=1400 audit(1540038401.872:9): avc:  denied  { map } for  pid=1802 comm="syz-execprog" path="/root/syzkaller-shm494866241" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI
Modules linked in:
CPU: 1 PID: 7610 Comm: syz-executor2 Not tainted 4.14.77+ #21
task: ffff8801c9bec680 task.stack: ffff8801c84f0000
RIP: 0010:reset_buffer_flags+0x21/0x150 drivers/tty/n_tty.c:323
RSP: 0018:ffff8801c84f78e0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 000000000000044c RSI: ffff8801c9becf00 RDI: 0000000000002260
RBP: ffff8801ccfda200 R08: 0000000000003624 R09: ffffffff950df7c0
R10: ffff8801c9becf00 R11: 0000000000000001 R12: ffff8801ccfda438
R13: ffff8801c84f7938 R14: ffff8801d60ae4a0 R15: 000000000000000b
FS:  00007fa1d5e32700(0000) GS:ffff8801dbb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc7273afbc CR3: 00000001ca4cc006 CR4: 00000000001606a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 n_tty_flush_buffer+0x49/0xeb drivers/tty/n_tty.c:361
 set_termios+0x259/0x440 drivers/tty/tty_ioctl.c:403
 tty_mode_ioctl+0x238/0x920 drivers/tty/tty_ioctl.c:744
 n_tty_ioctl_helper+0x3f/0x350 drivers/tty/tty_ioctl.c:939
 n_tty_ioctl+0x43/0x2e0 drivers/tty/n_tty.c:2452
 tty_ioctl+0x551/0x13e0 drivers/tty/tty_io.c:2659
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1a0/0x1030 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7e/0xb0 fs/ioctl.c:692
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007fa1d5e31c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569
RDX: 0000000020000000 RSI: 0000000000005404 RDI: 0000000000000005
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa1d5e326d4
R13: 00000000004c0da4 R14: 00000000004d17d0 R15: 00000000ffffffff
Code: 41 ff 5b 5d e9 81 b6 5e ff 90 53 48 89 fb e8 77 b6 5e ff 48 8d bb 60 22 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 0f 01 00 00 48 c7 83 60 22 00 00 00 00 00 00 
RIP: reset_buffer_flags+0x21/0x150 drivers/tty/n_tty.c:323 RSP: ffff8801c84f78e0
---[ end trace d0396a3043962b80 ]---

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/10/20 12:46 android-4.14 0ff0788d6a66 ecb386fe .config console log report syz ci-android-414-kasan-gce-root
2018/10/06 10:05 android-4.14 d33692e8014d 8b311eaf .config console log report syz ci-android-414-kasan-gce-root
2018/10/20 12:12 android-4.14 0ff0788d6a66 ecb386fe .config console log report ci-android-414-kasan-gce-root
2018/10/05 03:31 android-4.14 d33692e8014d 8b311eaf .config console log report ci-android-414-kasan-gce-root
2018/09/28 01:04 android-4.14 e709f59a8cd2 0c2fa87b .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.