syzbot


general protection fault in exit_to_usermode_loop

Status: auto-closed as invalid on 2021/01/19 00:17
Reported-by: syzbot+45167a625fecba330461@syzkaller.appspotmail.com
First crash: 1310d, last: 1310d

Sample crash report:
netlink: 'syz-executor.5': attribute type 5 has an invalid length.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3726 Comm: systemd-udevd Not tainted 4.19.146-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/paravirt.h:794 [inline]
RIP: 0010:exit_to_usermode_loop+0x1a4/0x2c0 arch/x86/entry/common.c:175
Code: 85 db 0f 85 87 00 00 00 e8 89 3c 71 00 48 c7 c0 b0 89 63 89 48 c1 e8 03 80 3c 28 00 0f 85 e3 00 00 00 48 83 3d 3c 00 00 00 00 <00> 70 07 00 00 00 00 00 00 70 07 00 07 07 07 07 00 00 e8 c5 ba 76
RSP: 0018:ffff88808fb47ef0 EFLAGS: 00010282
RAX: 1ffffffff12c7136 RBX: 0000000000000000 RCX: ffffffff8100864a
RDX: 0000000000000000 RSI: ffffffff81008657 RDI: 0000000000000005
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff88808fb47f58
R13: ffffed1011f67078 R14: ffff88808fb383c0 R15: ffff88808fb383c0
FS:  00007fec3d4748c0(0000) GS:ffff8880ae300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000745138 CR3: 000000008f66d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x57c/0x670 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fec3c2bfa07
Code: 2e 00 f7 d8 bf ff ff ff ff 64 89 02 eb d0 0f 1f 44 00 00 48 85 ff 74 3b 53 8b 1f e8 3b bf f6 ff 48 63 fb b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 09 5b c3 0f 1f 80 00 00 00 00 48 8b 15 59 54
RSP: 002b:00007fff89ef0e80 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 000000000000000f RCX: 00007fec3c2bfa07
RDX: 00007fec3c5a5b58 RSI: 0000000000000000 RDI: 000000000000000f
RBP: 00007fec3d474710 R08: 000055cc187ae760 R09: 0000000000008040
R10: 0000000000000020 R11: 0000000000000206 R12: 0000000000000000
R13: 000055cc1878f5d0 R14: 00000000000000ff R15: 000055cc1878f5d0
Modules linked in:
BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1355
in_atomic(): 0, irqs_disabled(): 1, pid: 25517, name: syz-executor.0
INFO: lockdep is turned off.
irq event stamp: 2473203
hardirqs last  enabled at (2473203): [<ffffffff8100a441>] do_syscall_64+0x21/0x670 arch/x86/entry/common.c:280
hardirqs last disabled at (2473202): [<ffffffff8100698a>] trace_hardirqs_off_thunk+0x1a/0x1c
softirqs last  enabled at (2458682): [<ffffffff87e006d1>] __do_softirq+0x6d1/0xad2 kernel/softirq.c:318
softirqs last disabled at (2458675): [<ffffffff8144194d>] invoke_softirq kernel/softirq.c:372 [inline]
softirqs last disabled at (2458675): [<ffffffff8144194d>] irq_exit+0x22d/0x270 kernel/softirq.c:412
CPU: 0 PID: 25517 Comm: syz-executor.0 Tainted: G      D           4.19.146-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ___might_sleep.cold+0x6a/0x7e kernel/sched/core.c:6196
 __do_page_fault+0x40d/0xe00 arch/x86/mm/fault.c:1355
kasan: CONFIG_KASAN_INLINE enabled
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
kasan: GPF could be caused by NULL-ptr deref or user memory access
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
RIP: 0010:do_syscall_64+0x336/0x670 arch/x86/entry/common.c:296
general protection fault: 0000 [#2] PREEMPT SMP KASAN
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 c9 02 00 00 4c 8b 2b 31 ff 45 89 ec 41 81 e4 0e 38 00 00 44 89 e6 e8 fa 1c 71 00 <45> 85 00 00 00 00 00 00 00 00 00 70 07 00 00 70 07 00 00 00 00 00
CPU: 1 PID: 6511 Comm: syz-executor.2 Tainted: G      D           4.19.146-syzkaller #0
RSP: 0018:ffff88808635ff28 EFLAGS: 00010093
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RAX: 0000000000000000 RBX: ffff88809e434240 RCX: ffffffff8100a756
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:317 [inline]
RIP: 0010:test_ti_thread_flag include/linux/thread_info.h:84 [inline]
RIP: 0010:addr_limit_user_check include/linux/syscalls.h:262 [inline]
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:190 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
RIP: 0010:do_syscall_64+0x218/0x670 arch/x86/entry/common.c:296
RDX: 0000000000000000 RSI: ffff88809e434240 RDI: 0000000000000005
Code: ce 1c 71 00 fa 66 0f 1f 44 00 00 65 48 8b 1c 25 40 ee 01 00 e8 29 9b 76 00 48 89 da 48 b8 00 00 00 00 00 00 00 00 48 c1 ea 03 <80> 3c 02 00 0f 85 d3 03 00 00 4c 8b 23 31 ff 49 c1 ec 1f 41 83 e4
RBP: ffff88808635ff58 R08: 0000000000000000 R09: 0000000000000000
RSP: 0018:ffff888086a97f28 EFLAGS: 00010806
R10: 0000000000000005 R11: 0000000000000001 R12: 0000000000000000
RAX: 0000000000000000 RBX: ffff888086a8c280 RCX: 1ffffffff142e4f8
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
RDX: 1ffff11010d51850 RSI: ffffffff817741b4 RDI: 0000000000000000
RBP: ffff888086a97f58 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000009f650c2 R12: 0000000000000000
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
R13: ffffffff896389b8 R14: 0000000000000000 R15: 0000000000000000
RIP: 0033:0x45bac1
FS:  000000000330c940(0000) GS:ffff8880ae300000(0000) knlGS:0000000000000000
Code: 75 14 b8 23 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 84 cf fb ff c3 48 83 ec 08 e8 ea 46 00 00 48 89 04 24 b8 23 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 33 47 00 00 48 89 d0 48 83 c4 08 48 3d 01
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
RSP: 002b:00007ffdb57e5a20 EFLAGS: 00000293 ORIG_RAX: 0000000000000023
CR2: 0000000000745138 CR3: 0000000086a80000 CR4: 00000000001406e0
RAX: 0000000000000000 RBX: 00000000000d72db RCX: 000000000045bac1
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffdb57e5a30
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
RBP: 0000000000000220 R08: 0000000000000000 R09: 0000000002987940
Call Trace:
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000007
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
R13: 00007ffdb57e5a80 R14: 00000000000d7227 R15: 00007ffdb57e5a90
RIP: 0033:0x45bac1
Code: 75 14 b8 23 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 84 cf fb ff c3 48 83 ec 08 e8 ea 46 00 00 48 89 04 24 b8 23 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 33 47 00 00 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffe51ce6500 EFLAGS: 00000293 ORIG_RAX: 0000000000000023
RAX: 0000000000000000 RBX: 00000000000d7397 RCX: 000000000045bac1
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffe51ce6510
RBP: 0000000000000915 R08: 0000000000000000 R09: 000000000330c940
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 00007ffe51ce6560 R14: 00000000000d736d R15: 00007ffe51ce6570
Modules linked in:
---[ end trace 4e4b7f5d940f91d4 ]---
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/paravirt.h:794 [inline]
RIP: 0010:exit_to_usermode_loop+0x1a4/0x2c0 arch/x86/entry/common.c:175
PGD 9e786067 
Code: 85 db 0f 85 87 00 00 00 e8 89 3c 71 00 48 c7 c0 b0 89 63 89 48 c1 e8 03 80 3c 28 00 0f 85 e3 00 00 00 48 83 3d 3c 00 00 00 00 <00> 70 07 00 00 00 00 00 00 70 07 00 07 07 07 07 00 00 00 00 00 00
P4D 9e786067 
RSP: 0018:ffff88808fb47ef0 EFLAGS: 00010282
PUD 9e787067 
PMD 0 
RAX: 1ffffffff12c7136 RBX: 0000000000000000 RCX: ffffffff8100864a
RDX: 0000000000000000 RSI: ffffffff81008657 RDI: 0000000000000005
Oops: 0000 [#3] PREEMPT SMP KASAN
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
CPU: 0 PID: 25517 Comm: syz-executor.0 Tainted: G      D W         4.19.146-syzkaller #0
R10: 0000000000000005 R11: 0000000000000000 R12: ffff88808fb47f58
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
R13: ffffed1011f67078 R14: ffff88808fb383c0 R15: ffff88808fb383c0
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
RIP: 0010:do_syscall_64+0x336/0x670 arch/x86/entry/common.c:296
FS:  000000000330c940(0000) GS:ffff8880ae300000(0000) knlGS:0000000000000000
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 c9 02 00 00 4c 8b 2b 31 ff 45 89 ec 41 81 e4 0e 38 00 00 44 89 e6 e8 fa 1c 71 00 <45> 85 00 00 00 00 00 00 00 00 00 70 07 00 00 70 07 00 00 00 00 00
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
RSP: 0018:ffff88808635ff28 EFLAGS: 00010093
CR2: 0000000000745138 CR3: 0000000086a80000 CR4: 00000000001406e0
RAX: 0000000000000000 RBX: ffff88809e434240 RCX: ffffffff8100a756
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
RDX: 0000000000000000 RSI: ffff88809e434240 RDI: 0000000000000005
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
RBP: ffff88808635ff58 R08: 0000000000000000 R09: 0000000000000000

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/09/21 00:17 linux-4.19.y 015e94d0e37b 9564d2e9 .config console log report info ci2-linux-4-19
* Struck through repros no longer work on HEAD.