syzbot


BUG: unable to handle kernel paging request in entry_SYSCALL_64_after_hwframe

Status: auto-closed as invalid on 2019/03/21 01:54
Subsystems: selinux
[Documentation on labels]
Reported-by: syzbot+db7ae25fb1a543526f77@syzkaller.appspotmail.com
First crash: 2043d, last: 2043d

Sample crash report:
9pnet_virtio: no channels available for device /dev/zero
 warn_alloc.cold.119+0xb7/0x1bd mm/page_alloc.c:3426
 __vmalloc_node_range+0x472/0x750 mm/vmalloc.c:1762
 __vmalloc_node mm/vmalloc.c:1791 [inline]
 __vmalloc_node_flags mm/vmalloc.c:1805 [inline]
 vmalloc+0x6f/0x80 mm/vmalloc.c:1827
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffff8801daf2cc30
PGD be6f067 
 sel_write_load+0x1d1/0x460 security/selinux/selinuxfs.c:557
P4D be6f067 
 __vfs_write+0x119/0x9f0 fs/read_write.c:485
PUD 1d9420063 
PMD 80000001dae001e3 
Oops: 0011 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3391 Comm: blkid Not tainted 4.19.0-rc4+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0xffff8801daf2cc30
Code: 00 00 00 00 00 00 00 00 00 00 00 0c 20 00 00 00 00 00 03 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 2e 30 67 9a 2c 07 00 00 <98> a6 16 9d 01 88 ff ff 98 a6 16 9d 01 88 ff ff 80 e5 bc 0f 01 88
 vfs_write+0x1fc/0x560 fs/read_write.c:549
RSP: 0018:ffff8801c0e8ee28 EFLAGS: 00010046
 ksys_write+0x101/0x260 fs/read_write.c:598
RAX: ffff8801daf2cc30 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801d9517db8
RBP: ffff8801c0e8ef40 R08: ffff8801d9517db8 R09: ffff8801c0e8ef90
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write fs/read_write.c:607 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:607
R10: fffffbfff12b9fec R11: ffffffff895cff63 R12: ffffffff895cff98
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
R13: 1ffff1003b2a2fa5 R14: dffffc0000000000 R15: 0000000000000000
FS:  00007f5b07f1c7a0(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801daf2cc30 CR3: 000000010c7b2000 CR4: 00000000001406e0
Call Trace:
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457679
Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8e2b9adc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
 __wake_up_common_lock+0x1c2/0x330 kernel/sched/wait.c:121
RAX: ffffffffffffffda RBX: 00007f8e2b9ae6d4 RCX: 0000000000457679
RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004d8d00 R14: 00000000004c5602 R15: 0000000000000000
 __wake_up+0xe/0x10 kernel/sched/wait.c:145
 audit_log_end+0x116/0x2b0 kernel/audit.c:2353
 common_lsm_audit+0x692/0x2200 security/lsm_audit.c:464
9pnet_virtio: no channels available for device /dev/zero
9pnet_virtio: no channels available for device /dev/zero
 slow_avc_audit+0x2c8/0x3d0 security/selinux/avc.c:802
warn_alloc_show_mem: 1 callbacks suppressed
Mem-Info:
 avc_audit security/selinux/include/avc.h:138 [inline]
 avc_has_perm+0x658/0x7e0 security/selinux/avc.c:1187
active_anon:1021660 inactive_anon:369 isolated_anon:0
 active_file:7315 inactive_file:3654 isolated_file:0
 unevictable:0 dirty:449 writeback:0 unstable:0
 slab_reclaimable:17871 slab_unreclaimable:118357
 mapped:53577 shmem:385 pagetables:56718 bounce:0
 free:269320 free_pcp:1107 free_cma:0
 inode_has_perm.isra.58+0x173/0x210 security/selinux/hooks.c:1822
 selinux_mmap_file+0x14f/0x240 security/selinux/hooks.c:3723
Node 0 active_anon:4086640kB inactive_anon:1476kB active_file:29260kB inactive_file:14616kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:214308kB dirty:1796kB writeback:0kB shmem:1540kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 3526656kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
 security_mmap_file+0x12b/0x1b0 security/security.c:934
 vm_mmap_pgoff+0x135/0x2c0 mm/util.c:353
Node 0 
 vm_mmap+0x90/0xc0 mm/util.c:376
 elf_map+0x10b/0x2b0 fs/binfmt_elf.c:378
 load_elf_binary+0xeed/0x5620 fs/binfmt_elf.c:1011
DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
lowmem_reserve[]:
 search_binary_handler+0x17d/0x570 fs/exec.c:1653
 0
 exec_binprm fs/exec.c:1695 [inline]
 __do_execve_file.isra.33+0x162f/0x2540 fs/exec.c:1819
 2817
 6321
9pnet_virtio: no channels available for device /dev/zero
 do_execveat_common fs/exec.c:1866 [inline]
 do_execve fs/exec.c:1883 [inline]
 __do_sys_execve fs/exec.c:1964 [inline]
 __se_sys_execve fs/exec.c:1959 [inline]
 __x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5b07600207
Code: Bad RIP value.
RSP: 002b:00007ffe728bf5f8 EFLAGS: 00000202
 6321
 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f5b07600207
RDX: 0000000000903710 RSI: 00007ffe728bf6f0 RDI: 00007ffe728c0700
RBP: 0000000000625500 R08: 00000000000033c4 R09: 00000000000033c4
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000903710
R13: 0000000000000007 R14: 00000000008cd030 R15: 0000000000000005
Modules linked in:
CR2: ffff8801daf2cc30
---[ end trace e00ab6d86d00381a ]---
RIP: 0010:0xffff8801daf2cc30
Code: 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 84 f9 6f 9a 2c 07 00 00 <98> 21 e6 cb 01 88 ff ff 98 21 e6 cb 01 88 ff ff 80 e5 bc 0f 01 88
Node 0 
RSP: 0018:ffff8801c0e8ee28 EFLAGS: 00010046
RAX: ffff8801daf2cc30 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801d9517db8
RBP: ffff8801c0e8ef40 R08: ffff8801d9517db8 R09: ffff8801c0e8ef90
R10: fffffbfff12b9fec R11: ffffffff895cff63 R12: ffffffff895cff98
DMA32 free:820780kB min:30048kB low:37560kB high:45072kB active_anon:1897412kB inactive_anon:0kB active_file:4184kB inactive_file:4892kB unevictable:0kB writepending:132kB present:3129332kB managed:2889300kB mlocked:0kB kernel_stack:30944kB pagetables:32692kB bounce:0kB free_pcp:2904kB local_pcp:1456kB free_cma:0kB
R13: 1ffff1003b2a2fa5 R14: dffffc0000000000 R15: 0000000000000000
FS:  00007f5b07f1c7a0(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5b076001dd CR3: 000000010c7b2000 CR4: 00000000001406e0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/09/22 01:53 upstream 10dc890d4228 37079712 .config console log report ci-upstream-kasan-gce-selinux-root
* Struck through repros no longer work on HEAD.