syzbot


kernel BUG in vhost_get_vq_desc

Status: upstream: reported C repro on 2022/02/17 22:45
Reported-by: syzbot+63743ac64a8371b29c4b@syzkaller.appspotmail.com
First crash: 284d, last: 244d
similar bugs (6):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 kernel BUG in vhost_get_vq_desc C error done 19 260d 304d 2/2 fixed on 2022/05/13 02:56
linux-4.19 kernel BUG in vhost_get_vq_desc 2 29d 98d 0/1 upstream: reported on 2022/08/23 01:56
upstream kernel BUG in vhost_get_vq_desc C inconclusive 19 277d 289d 23/24 upstream: reported C repro on 2022/02/12 22:47
linux-4.14 kernel BUG in vhost_get_vq_desc C 1 32d 279d 0/1 upstream: reported C repro on 2022/02/22 17:48
upstream kernel BUG at drivers/vhost/vhost.c:LINE! (2) C 139 1667d 1697d 6/24 fixed on 2018/05/08 18:30
upstream kernel BUG at drivers/vhost/vhost.c:LINE! C 152 1697d 1716d 6/24 fixed on 2018/04/06 16:37

Sample crash report:
------------[ cut here ]------------
kernel BUG at drivers/vhost/vhost.c:2356!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 623 Comm: vhost-622 Not tainted 5.4.161-syzkaller-00007-g2426795494c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:vhost_get_vq_desc+0x2045/0x2050 drivers/vhost/vhost.c:2356
Code: 0f 8c f6 fd ff ff 48 8b bc 24 48 01 00 00 e8 62 c4 59 fe 48 8b 94 24 48 01 00 00 e9 dc fd ff ff e8 90 4b 06 fe e8 ab a7 2c fe <0f> 0b 66 0f 1f 84 00 00 00 00 00 55 41 57 41 56 41 55 41 54 53 48
RSP: 0018:ffff8881eca7fbf8 EFLAGS: 00010293
RAX: ffffffff8333ffb5 RBX: 0000000000000000 RCX: ffff8881ed16ee40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8333f4b7 R09: 0000000000000001
R10: ffffed103d94ff99 R11: 0000000000000000 R12: ffff8881eca7fe00
R13: dffffc0000000000 R14: 1ffff1103d94ff98 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 00000001ec8a7000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 vhost_vsock_handle_tx_kick+0x1fb/0xc10 drivers/vhost/vsock.c:458
 vhost_worker+0x299/0x430 drivers/vhost/vhost.c:362
 kthread+0x30f/0x330 kernel/kthread.c:288
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 5f1d8eb44728a400 ]---
RIP: 0010:vhost_get_vq_desc+0x2045/0x2050 drivers/vhost/vhost.c:2356
Code: 0f 8c f6 fd ff ff 48 8b bc 24 48 01 00 00 e8 62 c4 59 fe 48 8b 94 24 48 01 00 00 e9 dc fd ff ff e8 90 4b 06 fe e8 ab a7 2c fe <0f> 0b 66 0f 1f 84 00 00 00 00 00 55 41 57 41 56 41 55 41 54 53 48
RSP: 0018:ffff8881eca7fbf8 EFLAGS: 00010293
RAX: ffffffff8333ffb5 RBX: 0000000000000000 RCX: ffff8881ed16ee40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8333f4b7 R09: 0000000000000001
R10: ffffed103d94ff99 R11: 0000000000000000 R12: ffff8881eca7fe00
R13: dffffc0000000000 R14: 1ffff1103d94ff98 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 00000001ec8a7000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-android-5-4-kasan 2022/02/17 22:44 android12-5.4 2426795494c7 3cd800e4 .config log report syz C kernel BUG in vhost_get_vq_desc
ci2-android-5-4-kasan 2022/03/30 04:45 android12-5.4 ed043095f483 6bdac766 .config log report info kernel BUG in vhost_get_vq_desc
ci2-android-5-4-kasan 2022/03/15 23:22 android12-5.4 be3489a5dd5d 9e8eaa75 .config log report info kernel BUG in vhost_get_vq_desc
ci2-android-5-4-kasan 2022/03/13 23:08 android12-5.4 db2bb2db5424 9e8eaa75 .config log report info kernel BUG in vhost_get_vq_desc
* Struck through repros no longer work on HEAD.