syzbot


BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer

Status: upstream: reported C repro on 2022/11/16 10:52
Reported-by: syzbot+10257d01dd285b15170a@syzkaller.appspotmail.com
First crash: 13d, last: 4d12h
Patch testing requests:
Created Duration User Patch Repo Result
2022/11/16 13:11 16m linma@zju.edu.cn https://github.com/f0rm2l1n/linux-fix.git master OK log
2022/11/16 12:39 15m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 9500fc6e9e60 OK log

Sample crash report:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010c75b000
[0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rc5-syzkaller-32269-g9500fc6e9e60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 004000c5 (nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __queue_work+0x3c4/0x8b4
lr : __queue_work+0x3c4/0x8b4 kernel/workqueue.c:1458
sp : ffff800008003d60
x29: ffff800008003d60 x28: 0000000000000000 x27: ffff80000d3a9000
x26: ffff80000d3ad050 x25: ffff80000d2fe008 x24: ffff80000db54000
x23: 0000000000000000 x22: 0000000000000023 x21: ffff0000c7a95400
x20: 0000000000000008 x19: ffff0000cd0d20f8 x18: ffff80000db78158
x17: ffff80000ddda198 x16: ffff80000dc18158 x15: ffff80000d3cbc80
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff80000d3cbc80
x11: ff8080000c07dfe4 x10: 0000000000000000 x9 : ffff80000c07dfe4
x8 : ffff80000d3cbc80 x7 : ffff80000813bae8 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff0000c0014c00
Call trace:
 __queue_work+0x3c4/0x8b4 kernel/workqueue.c:1458
 queue_work_on+0xb0/0x15c kernel/workqueue.c:1545
 queue_work include/linux/workqueue.h:503 [inline]
 nci_cmd_timer+0x30/0x40 net/nfc/nci/core.c:615
 call_timer_fn+0x90/0x144 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers+0x280/0x374 kernel/time/timer.c:1790
 run_timer_softirq+0x34/0x5c kernel/time/timer.c:1803
 _stext+0x168/0x37c
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84
 invoke_softirq+0x70/0xbc kernel/softirq.c:452
 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650
 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:580
 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
 default_idle_call+0x48/0xb8 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:191 [inline]
 do_idle+0x110/0x2d4 kernel/sched/idle.c:303
 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:400
 kernel_init+0x0/0x290 init/main.c:729
 start_kernel+0x0/0x620 init/main.c:890
 start_kernel+0x450/0x620 init/main.c:1145
 __primary_switched+0xb4/0xbc arch/arm64/kernel/head.S:471
Code: 94001384 aa0003f7 aa1303e0 9400144a (f94002f8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	94001384 	bl	0x4e10
   4:	aa0003f7 	mov	x23, x0
   8:	aa1303e0 	mov	x0, x19
   c:	9400144a 	bl	0x5134
* 10:	f94002f8 	ldr	x24, [x23] <-- trapping instruction

Crashes (98):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-gce-arm64 2022/11/16 08:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 3a127a31 .config log report syz C BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm32 2022/11/22 21:17 upstream eb7081409f94 1c8e10bc .config log report info BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm32 2022/11/22 07:00 upstream eb7081409f94 1c576c23 .config log report info BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm32 2022/11/19 18:59 upstream fe24a97cf254 5bb70014 .config log report info BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm32 2022/11/19 18:46 upstream fe24a97cf254 5bb70014 .config log report info BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm32 2022/11/19 04:00 upstream 950a9f564aea 5bb70014 .config log report info BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm32 2022/11/18 12:58 upstream 84368d882b96 5bb70014 .config log report info BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm32 2022/11/17 06:00 upstream cc675d22e422 bfcab33d .config log report info BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm32 2022/11/16 02:23 upstream 81e7cfa3a9eb bfcab33d .config log report info BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/24 22:48 upstream c3eb11fbb826 3b903dad .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/24 20:35 upstream c3eb11fbb826 3b903dad .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm32 2022/11/24 11:02 upstream 4312098baf37 ff68ff8f .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm32 2022/11/24 07:33 upstream 4312098baf37 ff68ff8f .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm32 2022/11/23 18:29 upstream eb7081409f94 52fdf57a .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/23 08:42 upstream eb7081409f94 75740b3f .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/22 09:05 upstream eb7081409f94 1c576c23 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/22 07:53 upstream eb7081409f94 1c576c23 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/21 21:05 upstream eb7081409f94 f9a97739 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/21 19:12 upstream eb7081409f94 f9a97739 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm32 2022/11/21 17:50 upstream eb7081409f94 f9a97739 .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm32 2022/11/21 09:36 upstream eb7081409f94 5bb70014 .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm64 2022/11/21 01:14 upstream 77c51ba552a1 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/20 23:46 upstream 77c51ba552a1 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64 2022/11/20 12:59 upstream b6e7fdfd6f6a 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/20 10:53 upstream b6e7fdfd6f6a 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm32 2022/11/20 06:18 upstream b6e7fdfd6f6a 5bb70014 .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/19 22:28 upstream fe24a97cf254 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/19 09:28 upstream ab290eaddc4c 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/19 06:48 upstream ab290eaddc4c 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/19 05:29 upstream ab290eaddc4c 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/18 19:57 upstream 84368d882b96 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64 2022/11/18 18:12 upstream 84368d882b96 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/18 16:40 upstream 84368d882b96 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64 2022/11/18 15:36 upstream 84368d882b96 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64 2022/11/18 14:36 upstream 84368d882b96 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/18 12:36 upstream 84368d882b96 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm32 2022/11/18 12:01 upstream 84368d882b96 5bb70014 .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/18 11:47 upstream 84368d882b96 5bb70014 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/18 01:33 upstream 81ac25651a62 4ba8ab94 .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64 2022/11/17 14:03 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/17 13:27 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/17 13:21 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/17 12:58 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/17 12:56 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm32 2022/11/17 12:41 upstream cc675d22e422 bfcab33d .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm64 2022/11/17 11:41 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64 2022/11/17 11:12 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64 2022/11/17 09:58 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/17 09:38 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm32 2022/11/17 09:06 upstream cc675d22e422 bfcab33d .config log report info BUG: unable to handle kernel paging request in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/17 08:38 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/17 08:28 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/17 08:23 upstream cc675d22e422 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64 2022/11/16 20:19 upstream 59d0d52c30d4 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/16 19:59 upstream 59d0d52c30d4 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
ci-qemu2-arm64-mte 2022/11/16 19:32 upstream 59d0d52c30d4 bfcab33d .config log report info KASAN: use-after-free Read in nci_cmd_timer
* Struck through repros no longer work on HEAD.