syzbot


general protection fault in __lock_acquire

Status: public: reported C repro on 2019/04/13 00:00
Reported-by: syzbot+60dcb218e358a98c13d9@syzkaller.appspotmail.com
First crash: 2316d, last: 2277d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in __lock_acquire selinux 5 2385d 2436d 3/26 fixed on 2017/10/24 06:54
upstream general protection fault in __lock_acquire (2) tipc C 15 2280d 2365d 4/26 fixed on 2018/01/27 14:55
android-49 general protection fault in __lock_acquire C 3 2315d 1838d 0/3 public: reported C repro on 2019/04/14 00:00

Sample crash report:
audit: type=1400 audit(1516905091.637:6): avc:  denied  { write } for  pid=3329 comm="syzkaller476655" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3329 Comm: syzkaller476655 Not tainted 4.4.113-ge70c132 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800b461af80 task.stack: ffff8800b47f8000
RIP: 0010:[<ffffffff81236989>]  [<ffffffff81236989>] __lock_acquire+0x5c9/0x4b50 kernel/locking/lockdep.c:3092
RSP: 0018:ffff8800b47ff460  EFLAGS: 00010006
RAX: dffffc0000000000 RBX: ffff8800b461af80 RCX: 0000000000000000
RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000028
RBP: ffff8800b47ff600 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 1ffff100168ffe9e R12: 0000000000000000
R13: ffff8800b461af80 R14: 0000000000000028 R15: 0000000000000000
FS:  0000000001566880(0063) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020023000 CR3: 00000000b4d78000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff842bdba0 0000000000000000 ffff8800b47ff620 ffffffff81236f1f
 0000000041b58ab3 ffffffff83fb1858 ffffffff812363c0 0000000082e0107b
 dffffc0000000000 ffff8800b461b830 ffff8800b461b7e0 ffff8800b461b7e8
Call Trace:
 [<ffffffff8123c77e>] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592
 [<ffffffff83770e1a>] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:137 [inline]
 [<ffffffff83770e1a>] _raw_spin_lock_bh+0x3a/0x50 kernel/locking/spinlock.c:175
 [<ffffffff82fa3a75>] spin_lock_bh include/linux/spinlock.h:307 [inline]
 [<ffffffff82fa3a75>] nfulnl_set_flags net/netfilter/nfnetlink_log.c:319 [inline]
 [<ffffffff82fa3a75>] nfulnl_recv_config+0x935/0x1430 net/netfilter/nfnetlink_log.c:932
 [<ffffffff82f97603>] nfnetlink_rcv_msg+0xa63/0xbc0 net/netfilter/nfnetlink.c:215
 [<ffffffff82f889be>] netlink_rcv_skb+0x13e/0x370 net/netlink/af_netlink.c:2349
 [<ffffffff82f95b7e>] nfnetlink_rcv+0x29e/0x1070 net/netfilter/nfnetlink.c:479
 [<ffffffff82f87542>] netlink_unicast_kernel net/netlink/af_netlink.c:1267 [inline]
 [<ffffffff82f87542>] netlink_unicast+0x522/0x760 net/netlink/af_netlink.c:1293
 [<ffffffff82f88068>] netlink_sendmsg+0x8e8/0xc50 net/netlink/af_netlink.c:1847
 [<ffffffff82dea0aa>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82dea0aa>] sock_sendmsg+0xca/0x110 net/socket.c:635
 [<ffffffff82debc81>] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962
 [<ffffffff82dedcd3>] __sys_sendmsg+0xd3/0x190 net/socket.c:1996
 [<ffffffff82deddbd>] SYSC_sendmsg net/socket.c:2007 [inline]
 [<ffffffff82deddbd>] SyS_sendmsg+0x2d/0x50 net/socket.c:2003
 [<ffffffff83771b5f>] entry_SYSCALL_64_fastpath+0x1c/0x98
Code: 25 28 00 00 00 0f 85 0e 31 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 94 32 00 00 49 81 3e 20 39 a2 84 41 ba 00 00 
RIP  [<ffffffff81236989>] __lock_acquire+0x5c9/0x4b50 kernel/locking/lockdep.c:3092
 RSP <ffff8800b47ff460>
---[ end trace 9b5fca9472a60778 ]---

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/25 18:33 https://android.googlesource.com/kernel/common android-4.4 e70c132b2dac 6b2a715e .config console log report syz C ci-android-44-kasan-gce
2017/12/22 08:23 https://android.googlesource.com/kernel/common android-4.4 610c835673f3 81fe66b4 .config console log report syz C ci-android-44-kasan-gce-386
2017/12/21 08:36 https://android.googlesource.com/kernel/common android-4.4 79f138ac8c95 90a46995 .config console log report syz C ci-android-44-kasan-gce-386
2018/01/26 07:22 https://android.googlesource.com/kernel/common android-4.4 e70c132b2dac 1d18b112 .config console log report syz C ci-android-44-kasan-gce-386
2018/01/29 04:47 https://android.googlesource.com/kernel/common android-4.4 202e079275c6 08d47756 .config console log report ci-android-44-kasan-gce
* Struck through repros no longer work on HEAD.