syzbot


general protection fault in path_openat

Status: fixed on 2020/03/06 08:34
Reported-by: syzbot+f0669fa513073e7ed9fa@syzkaller.appspotmail.com
Fix commit: 8d7a5100e29d vfs: fix do_last() regression
First crash: 926d, last: 920d

Fix bisection: fixed by (bisect log) :
commit 8d7a5100e29dde6b6557beb31ea9f2bbc9e998ca
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat Feb 1 16:26:45 2020 +0000

  vfs: fix do_last() regression

similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in path_openat C done 7 924d 924d 16/23 fixed on 2020/02/18 14:31
linux-4.14 general protection fault in path_openat C done 40 920d 927d 1/1 fixed on 2020/03/06 21:15
android-54 general protection fault in path_openat syz 26 919d 926d 1/2 fixed on 2021/10/12 13:38

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15262 Comm: udevd Not tainted 4.19.100-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff888094a4f790 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff888094a4f910 R08: ffff888088d2c3c0 R09: 0000000000000002
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000000
R13: ffff888094a4fb38 R14: ffff888094a4fb38 R15: ffff888094a4f950
FS:  00007f586da657a0(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efd267bc848 CR3: 0000000090ed7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_filp_open+0x1a1/0x280 fs/namei.c:3567
 do_open_execat+0x140/0x660 fs/exec.c:853
 open_exec+0x47/0x80 fs/exec.c:885
 load_elf_binary+0x879/0x53a0 fs/binfmt_elf.c:780
 search_binary_handler fs/exec.c:1653 [inline]
 search_binary_handler+0x179/0x570 fs/exec.c:1631
 exec_binprm fs/exec.c:1695 [inline]
 __do_execve_file.isra.0+0x1227/0x2150 fs/exec.c:1819
 do_execveat_common fs/exec.c:1866 [inline]
 do_execve fs/exec.c:1883 [inline]
 __do_sys_execve fs/exec.c:1964 [inline]
 __se_sys_execve fs/exec.c:1959 [inline]
 __x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f586d149207
Code: 77 19 f4 48 89 d7 44 89 c0 0f 05 48 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 f7 d8 64 41 89 01 eb df b8 3b 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 f3 c3 48 8b 15 00 8c 2d 00 f7 d8 64 89 02
RSP: 002b:00007ffec4caabf8 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f586d149207
RDX: 000000000247daf0 RSI: 00007ffec4caacf0 RDI: 00007ffec4cabd00
RBP: 0000000000625500 R08: 0000000000001fc8 R09: 0000000000001fc8
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000247daf0
R13: 0000000000000007 R14: 00000000022ec030 R15: 0000000000000005
Modules linked in:
---[ end trace 0ef5a8dee3d85af0 ]---
RIP: 0010:do_last fs/namei.c:3262 [inline]
RIP: 0010:path_openat+0x293/0x4500 fs/namei.c:3537
Code: 80 3c 02 00 0f 85 fa 34 00 00 48 8b 85 28 ff ff ff 48 8b 58 58 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b7
RSP: 0018:ffff888094a4f790 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff81b0246e
RDX: 0000000000000000 RSI: ffffffff81b0247c RDI: 0000000000000004
RBP: ffff888094a4f910 R08: ffff888088d2c3c0 R09: 0000000000000002
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: 0000000000000000
R13: ffff888094a4fb38 R14: ffff888094a4fb38 R15: ffff888094a4f950
FS:  00007f586da657a0(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4d1592ca20 CR3: 0000000090ed7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (13):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2020/02/01 04:56 linux-4.19.y 7cdefde351b6 0eb59c27 .config log report syz C
ci2-linux-4-19 2020/02/01 01:15 linux-4.19.y 7cdefde351b6 0eb59c27 .config log report syz
ci2-linux-4-19 2020/01/30 10:33 linux-4.19.y 7cdefde351b6 5ed23f9a .config log report syz
ci2-linux-4-19 2020/01/30 06:02 linux-4.19.y 7cdefde351b6 5ed23f9a .config log report syz
ci2-linux-4-19 2020/02/05 02:55 linux-4.19.y 32ee7492f104 93e5e335 .config log report
ci2-linux-4-19 2020/02/04 16:29 linux-4.19.y 32ee7492f104 93e5e335 .config log report
ci2-linux-4-19 2020/02/04 07:01 linux-4.19.y 32ee7492f104 93e5e335 .config log report
ci2-linux-4-19 2020/02/04 00:07 linux-4.19.y 32ee7492f104 93e5e335 .config log report
ci2-linux-4-19 2020/02/03 20:10 linux-4.19.y 32ee7492f104 93e5e335 .config log report
ci2-linux-4-19 2020/02/01 15:53 linux-4.19.y 32ee7492f104 326d4c78 .config log report
ci2-linux-4-19 2020/01/31 05:47 linux-4.19.y 7cdefde351b6 5ed23f9a .config log report
ci2-linux-4-19 2020/01/30 22:58 linux-4.19.y 7cdefde351b6 5ed23f9a .config log report
ci2-linux-4-19 2020/01/30 04:22 linux-4.19.y 7cdefde351b6 5ed23f9a .config log report