syzbot

 sign-in | mailing list | source | docs
🐞 Open [988] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12505] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

WARNING: bad usercopy in corrupted (2)

Status: fixed on 2019/03/20 20:32
Reported-by: syzbot+d89b30c46434c433dbf8@syzkaller.appspotmail.com
Fix commit: bc6e019b6ee6 fou: Prevent unbounded recursion in GUE error handler also with UDP-Lite
First crash: 1978d, last: 1931d
Cause bisection: introduced by (bisect log) :
commit b8a51b38e4d4dec3e379d52c0fe1a66827f7cf1e
Author: Stefano Brivio <sbrivio@redhat.com>
Date: Thu Nov 8 11:19:23 2018 +0000

  fou, fou6: ICMP error handlers for FoU and GUE

Crash: no output from test machine (log)
Repro: C syz .config
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
WARNING: bad usercopy in corrupted (2) 4 (6) 2019/03/20 09:39
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: bad usercopy in corrupted hardening mm syz 2 2098d 2098d 0/26 closed as invalid on 2018/07/29 11:55

Sample crash report:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(!hlock->nest_lock)
------------[ cut here ]------------
Bad or missing usercopy whitelist? Kernel memory overwrite attempt detected to SLAB object 'task_struct' (offset 1432, size 2)!
==================================================================
WARNING: CPU: 1 PID: 38 at mm/usercopy.c:83 usercopy_warn+0xee/0x110 mm/usercopy.c:78
BUG: KASAN: use-after-scope in mm_update_next_owner+0x8ef/0x990 kernel/exit.c:449
Kernel panic - not syncing: panic_on_warn set ...
Read of size 4 at addr ffff8881d9b4a464 by task syz-executor688/9075
CPU: 1 PID: 38 Comm: فd Not tainted 4.20.0-rc6+ #349

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
------------[ cut here ]------------
kernel BUG at mm/slab.c:4425!
WARNING: CPU: 1 PID: 38 at kernel/rcu/tree_plugin.h:438 __rcu_read_unlock+0x266/0x2e0 kernel/rcu/tree_plugin.h:432
Modules linked in:
CPU: 1 PID: 38 Comm: فd Not tainted 4.20.0-rc6+ #349
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
usercopy: Kernel memory overwrite attempt detected to SLAB object 'signal_cache' (offset 1328, size 23)!
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:102!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 38 Comm: فd Not tainted 4.20.0-rc6+ #349
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:usercopy_abort+0xbb/0xbd mm/usercopy.c:102
Code: c0 e8 d7 70 b1 ff 48 8b 55 c0 49 89 d9 4d 89 f0 ff 75 c8 4c 89 e1 4c 89 ee 48 c7 c7 40 e1 34 88 ff 75 d0 41 57 e8 e7 bc 97 ff <0f> 0b e8 ac 70 b1 ff e8 37 15 f5 ff 8b 95 e4 fe ff ff 4c 89 e1 31
RSP: 0018:ffff8881d9b49438 EFLAGS: 00010086
RAX: 0000000000000068 RBX: ffffffff882915a0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8165e4b5 RDI: 0000000000000005
RBP: ffff8881d9b49490 R08: ffff8881d9b4a440 R09: ffffed103b5e3ef8
R10: ffffed103b5e3ef8 R11: ffff8881daf1f7c7 R12: ffffffff8915057d
R13: ffffffff8834dfa0 R14: ffffffff8834dee0 R15: ffffffff8834dea0
FS:  0000000000000000(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000130 CR3: 00000001bb464000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace eca63c4def547053 ]---
RIP: 0010:usercopy_abort+0xbb/0xbd mm/usercopy.c:102
Code: c0 e8 d7 70 b1 ff 48 8b 55 c0 49 89 d9 4d 89 f0 ff 75 c8 4c 89 e1 4c 89 ee 48 c7 c7 40 e1 34 88 ff 75 d0 41 57 e8 e7 bc 97 ff <0f> 0b e8 ac 70 b1 ff e8 37 15 f5 ff 8b 95 e4 fe ff ff 4c 89 e1 31
RSP: 0018:ffff8881d9b49438 EFLAGS: 00010086
RAX: 0000000000000068 RBX: ffffffff882915a0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8165e4b5 RDI: 0000000000000005
RBP: ffff8881d9b49490 R08: ffff8881d9b4a440 R09: ffffed103b5e3ef8
R10: ffffed103b5e3ef8 R11: ffff8881daf1f7c7 R12: ffffffff8915057d
R13: ffffffff8834dfa0 R14: ffffffff8834dee0 R15: ffffffff8834dea0
FS:  0000000000000000(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000130 CR3: 00000001bb464000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/17 12:50 net-next-old ae6750e0a5ef def91db3 .config console log report syz C ci-upstream-net-kasan-gce
2018/12/14 00:31 net-next-old 95302c394c3d fe7127be .config console log report syz C ci-upstream-net-kasan-gce
2018/12/12 11:13 net-next-old e1a76515b0c2 c3b10a5d .config console log report syz C ci-upstream-net-kasan-gce
2018/12/06 00:51 net-next-old b255e500c8dc 764b42c4 .config console log report syz C ci-upstream-net-kasan-gce
2018/12/05 12:58 net-next-old a74f0fa082b7 ac6c0578 .config console log report syz C ci-upstream-net-kasan-gce
2018/12/05 02:30 net-next-old 55827458e058 f162ad97 .config console log report syz C ci-upstream-net-kasan-gce
2018/12/01 16:37 net-next-old 97e6c858a26e 5a581673 .config console log report syz C ci-upstream-net-kasan-gce
2018/11/28 06:46 net-next-old 2c30aac50d92 4b6d14f2 .config console log report syz C ci-upstream-net-kasan-gce
2018/11/25 01:06 net-next-old aea0a897af9e ecc7c870 .config console log report syz C ci-upstream-net-kasan-gce
2018/12/15 12:11 linux-next d14b746c6c1c c9128939 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/12/13 21:30 linux-next ca40dc225d19 f3d9d594 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/01/11 07:10 upstream 1bdbe2274920 80dde172 .config console log report syz ci-upstream-kasan-gce-selinux-root
* Struck through repros no longer work on HEAD.