syzbot


BUG: object ADDR is on stack ADDR, but NOT annotated.

Status: auto-closed as invalid on 2019/04/28 09:31
Reported-by: syzbot+cda1f204ba0ff6b88b2f@syzkaller.appspotmail.com
First crash: 2008d, last: 2008d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 BUG: object ADDR is on stack ADDR, but NOT annotated. (2) 1 1770d 1770d 0/3 auto-closed as invalid on 2019/10/25 08:39

Sample crash report:
audit: type=1400 audit(2000000187.480:3307): avc:  denied  { wake_alarm } for  pid=14568 comm="syz-executor4" capability=35  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1
ODEBUG: object ffff8801c8077d70 is on stack ffff8801c8070000, but NOT annotated.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 14603 at lib/debugobjects.c:303 debug_object_is_on_stack lib/debugobjects.c:303 [inline]
WARNING: CPU: 0 PID: 14603 at lib/debugobjects.c:303 __debug_object_init.cold.8+0x6b/0x258 lib/debugobjects.c:329
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 14603 Comm: syz-executor4 Not tainted 4.9.135+ #61
 ffff8801c8077ac8 ffffffff81b36bf9 ffffffff82a38ba0 00000000ffffffff
 0000000000000000 0000000000000000 000000000000012f ffff8801c8077b88
 ffffffff813f6aa5 0000000041b58ab3 ffffffff82e2a6e3 ffffffff813f68e6
Call Trace:
 [<ffffffff81b36bf9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b36bf9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff813f6aa5>] panic+0x1bf/0x39f kernel/panic.c:179
 [<ffffffff813f6d74>] __warn.cold.9+0xc1/0x17f kernel/panic.c:542
 [<ffffffff810dbe2c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
 [<ffffffff81bdc2f1>] debug_object_is_on_stack lib/debugobjects.c:303 [inline]
 [<ffffffff81bdc2f1>] __debug_object_init.cold.8+0x6b/0x258 lib/debugobjects.c:329
 [<ffffffff81b9d666>] debug_object_init+0x16/0x20 lib/debugobjects.c:366
 [<ffffffff812685fa>] debug_hrtimer_init kernel/time/hrtimer.c:393 [inline]
 [<ffffffff812685fa>] debug_init kernel/time/hrtimer.c:438 [inline]
 [<ffffffff812685fa>] hrtimer_init+0x2a/0x2e0 kernel/time/hrtimer.c:1165
 [<ffffffff8128ca6d>] alarm_init kernel/time/alarmtimer.c:321 [inline]
 [<ffffffff8128ca6d>] alarm_timer_nsleep+0x14d/0x4d0 kernel/time/alarmtimer.c:783
 [<ffffffff81273e99>] SYSC_clock_nanosleep kernel/time/posix-timers.c:1119 [inline]
 [<ffffffff81273e99>] SyS_clock_nanosleep+0x1b9/0x270 kernel/time/posix-timers.c:1101
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff8280ac13>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
------------[ cut here ]------------
WARNING: CPU: 1 PID: 14575 at lib/debugobjects.c:303 debug_object_is_on_stack lib/debugobjects.c:303 [inline]
WARNING: CPU: 1 PID: 14575 at lib/debugobjects.c:303 __debug_object_init.cold.8+0x6b/0x258 lib/debugobjects.c:329
Modules linked in:
CPU: 1 PID: 14575 Comm: syz-executor4 Not tainted 4.9.135+ #61
 ffff8801d4547b88 ffffffff81b36bf9 ffffffff82b44120 0000000000000000
 0000000000000000 ffffffff81bdc2f1 000000000000012f ffff8801d4547bd0
 ffffffff813f6df0 0000000000000000 0000000900000001 ffffffff82b44120
Call Trace:
 [<ffffffff81b36bf9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b36bf9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff813f6df0>] __warn.cold.9+0x13d/0x17f kernel/panic.c:550
 [<ffffffff810dbe2c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
 [<ffffffff81bdc2f1>] debug_object_is_on_stack lib/debugobjects.c:303 [inline]
 [<ffffffff81bdc2f1>] __debug_object_init.cold.8+0x6b/0x258 lib/debugobjects.c:329
 [<ffffffff81b9d666>] debug_object_init+0x16/0x20 lib/debugobjects.c:366
 [<ffffffff812685fa>] debug_hrtimer_init kernel/time/hrtimer.c:393 [inline]
 [<ffffffff812685fa>] debug_init kernel/time/hrtimer.c:438 [inline]
 [<ffffffff812685fa>] hrtimer_init+0x2a/0x2e0 kernel/time/hrtimer.c:1165
 [<ffffffff8128ca6d>] alarm_init kernel/time/alarmtimer.c:321 [inline]
 [<ffffffff8128ca6d>] alarm_timer_nsleep+0x14d/0x4d0 kernel/time/alarmtimer.c:783
 [<ffffffff81273e99>] SYSC_clock_nanosleep kernel/time/posix-timers.c:1119 [inline]
 [<ffffffff81273e99>] SyS_clock_nanosleep+0x1b9/0x270 kernel/time/posix-timers.c:1101
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff8280ac13>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
---[ end trace a7bff20feb188d20 ]---
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/10/27 22:25 https://android.googlesource.com/kernel/common android-4.9 4ba3f69128be 8efba39a .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.