syzbot


general protection fault in n_tty_set_termios

Status: public: reported C repro on 2019/04/14 00:00
Reported-by: syzbot+07c9bb8aea61bc371292@syzkaller.appspotmail.com
First crash: 2159d, last: 1940d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in n_tty_set_termios serial C 13 1939d 2159d 0/26 closed as dup on 2018/05/01 10:15
android-414 general protection fault in n_tty_set_termios syz 5 1940d 1813d 0/1 public: reported syz repro on 2019/04/12 00:01

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3805 Comm: syz-executor257 Not tainted 4.9.97-g2bcbbd5 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801b7118000 task.stack: ffff8801c51a0000
RIP: 0010:[<ffffffff8211b7b3>]  [<ffffffff8211b7b3>] n_tty_set_termios+0x2a3/0xd30 drivers/tty/n_tty.c:1784
RSP: 0018:ffff8801c51a77b0  EFLAGS: 00010203
RAX: 000000000000009a RBX: 0000000000000000 RCX: 000000000000000b
RDX: dffffc0000000000 RSI: ffffffff8211b79f RDI: ffff8801c51a7854
RBP: ffff8801c51a77e8 R08: ffff8801b7118938 R09: 0000000000000001
R10: ffff8801b7118000 R11: 0000000000000001 R12: ffff8801b616cc80
R13: ffff8801b616d034 R14: 000000000000005d R15: ffff8801c51a7848
FS:  00007f7c6c885700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7c6c842e78 CR3: 00000001c23dc000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801b616cc80 ffff88010000009a ffff8801d02c8e80 ffffffff8211b510
 dffffc0000000000 ffff8801b616d04c ffff8801b616cc80 ffff8801c51a78d0
 ffffffff821252e6 0000000000000001 00ff8801000000bf 1ffff10038a34f05
Call Trace:
 [<ffffffff821252e6>] tty_set_termios+0x626/0x8a0 drivers/tty/tty_ioctl.c:562
 [<ffffffff8212634f>] set_termios+0x38f/0x620 drivers/tty/tty_ioctl.c:635
 [<ffffffff82126ea2>] tty_mode_ioctl+0x8c2/0x980 drivers/tty/tty_ioctl.c:970
 [<ffffffff82127004>] n_tty_ioctl_helper+0x44/0x370 drivers/tty/tty_ioctl.c:1161
 [<ffffffff8211a146>] n_tty_ioctl+0x46/0x2c0 drivers/tty/n_tty.c:2443
 [<ffffffff82113514>] tty_ioctl+0x5a4/0x2270 drivers/tty/tty_io.c:3009
 [<ffffffff815b051c>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff815b051c>] file_ioctl fs/ioctl.c:493 [inline]
 [<ffffffff815b051c>] do_vfs_ioctl+0x1ac/0x11a0 fs/ioctl.c:677
 [<ffffffff815b159f>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff815b159f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f4653>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: d2 0f 85 9b 09 00 00 41 8b 84 24 b4 03 00 00 89 45 d0 e8 61 12 24 ff 4c 89 f1 8b 45 d0 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 <0f> b6 14 11 4c 89 f1 83 e1 07 d1 e8 83 e0 01 38 ca 7f 08 84 d2 
RIP  [<ffffffff8211b7b3>] n_tty_set_termios+0x2a3/0xd30 drivers/tty/n_tty.c:1784
 RSP <ffff8801c51a77b0>
---[ end trace 3781f35b40af2b0d ]---

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/01 06:08 https://android.googlesource.com/kernel/common android-4.9 2bcbbd5b3924 d5b114b4 .config console log report syz C ci-android-49-kasan-gce-root
2018/12/06 05:57 https://android.googlesource.com/kernel/common android-4.9 e16c0406470a 764b42c4 .config console log report syz ci-android-49-kasan-gce-root
2018/10/20 18:13 https://android.googlesource.com/kernel/common android-4.9 03fcc2fe7130 ecb386fe .config console log report syz ci-android-49-kasan-gce-root
2018/05/27 13:12 https://android.googlesource.com/kernel/common android-4.9 0cecdf831513 f48c20b8 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.