syzbot


general protection fault in n_tty_set_termios

Status: public: reported syz repro on 2019/04/12 00:01
Reported-by: syzbot+ddf1753706416ef2fb90@syzkaller.appspotmail.com
First crash: 2021d, last: 1961d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in n_tty_set_termios serial C 13 1960d 2180d 0/26 closed as dup on 2018/05/01 10:15
android-49 general protection fault in n_tty_set_termios C 4 1961d 1832d 0/3 public: reported C repro on 2019/04/14 00:00

Sample crash report:
audit: type=1400 audit(1544072758.387:9): avc:  denied  { map } for  pid=1820 comm="syz-execprog" path="/root/syzkaller-shm841920427" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI
Modules linked in:
CPU: 0 PID: 5052 Comm: syz-executor4 Not tainted 4.14.86+ #16
task: ffff8881d39ade00 task.stack: ffff8881d1d38000
RIP: 0010:n_tty_set_termios+0x291/0xcb0 drivers/tty/n_tty.c:1815
RSP: 0018:ffff8881d1d3f7f8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffffffff594b886
RDX: 000000000000000b RSI: ffff8881d1d3f878 RDI: ffff8881d1d3f884
RBP: ffff8881d59baa80 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8881d39ae680 R11: 0000000000000001 R12: ffff8881d59bae34
R13: 0000000000000001 R14: 000000000000005d R15: ffff8881d1d3f878
FS:  00007fe277374700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f496e28dab0 CR3: 00000001d2f12005 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 tty_set_termios+0x5fd/0x860 drivers/tty/tty_ioctl.c:340
 set_termios+0x2bf/0x440 drivers/tty/tty_ioctl.c:413
 tty_mode_ioctl+0x870/0x920 drivers/tty/tty_ioctl.c:748
 n_tty_ioctl_helper+0x3f/0x350 drivers/tty/tty_ioctl.c:939
 n_tty_ioctl+0x43/0x2e0 drivers/tty/n_tty.c:2466
 tty_ioctl+0x551/0x13e0 drivers/tty/tty_io.c:2659
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1a0/0x1030 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7e/0xb0 fs/ioctl.c:692
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457569
RSP: 002b:00007fe277373c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569
RDX: 0000000020000000 RSI: 0000000000005402 RDI: 0000000000000005
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe2773746d4
R13: 00000000004c10be R14: 00000000004d2270 R15: 00000000ffffffff
Code: d2 0f 85 14 09 00 00 44 8b ad b4 03 00 00 e8 27 a2 5d ff 4c 89 f2 41 d1 ed 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 41 83 e5 01 <0f> b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 f1 07 00 
RIP: n_tty_set_termios+0x291/0xcb0 drivers/tty/n_tty.c:1815 RSP: ffff8881d1d3f7f8
---[ end trace e846c13530128f86 ]---

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/06 05:29 android-4.14 d142f569a166 764b42c4 .config console log report syz ci-android-414-kasan-gce-root
2018/10/20 04:23 android-4.14 0ff0788d6a66 ecb386fe .config console log report syz ci-android-414-kasan-gce-root
2018/12/06 04:55 android-4.14 d142f569a166 764b42c4 .config console log report ci-android-414-kasan-gce-root
2018/10/20 03:47 android-4.14 0ff0788d6a66 ecb386fe .config console log report ci-android-414-kasan-gce-root
2018/10/06 09:32 android-4.14 d33692e8014d 8b311eaf .config console log report ci-android-414-kasan-gce-root
* Struck through repros no longer work on HEAD.