syzbot


panic: runtime error: slice bounds out of range [:NUM] with capacity NUM (2)

Status: fixed on 2023/02/24 03:02
Fix commit: 5817f4cc64e4 Fix FUSE how handles malformed INIT requests.
First crash: 645d, last: 643d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: runtime error: slice bounds out of range [:NUM] with capacity NUM C 196 1025d 1033d 14/26 fixed on 2022/11/14 20:25
gvisor panic: runtime error: slice bounds out of range [:LINE] with capacity 0 2 1205d 1206d 14/26 fixed on 2021/09/27 21:02

Sample crash report:
panic: runtime error: slice bounds out of range [:4] with capacity 0

goroutine 322 [running]:
panic({0x3f4ee0, 0xc000358540})
	GOROOT/src/runtime/panic.go:987 +0x3bb fp=0xc000c0ac70 sp=0xc000c0abb0 pc=0x11a129b
runtime.goPanicSliceAcap(0x4, 0x0)
	GOROOT/src/runtime/panic.go:139 +0x7f fp=0xc000c0acb0 sp=0xc000c0ac70 pc=0x119f4df
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.(*fuseInitRes).UnmarshalBytes(0xc0006e0000, {0xc0006df240, 0x0, 0x0})
	pkg/sentry/fsimpl/fuse/request_response.go:50 +0xa13 fp=0xc000c0ad18 sp=0xc000c0acb0 pc=0x207e3f3
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.(*fuseInitRes).UnmarshalUnsafe(0xc0006e0000?, {0xc0006df240, 0x0, 0x0})
	bazel-out/k8-fastbuild-ST-3dcbe13c9b87/bin/pkg/sentry/fsimpl/fuse/fuse_abi_autogen_unsafe.go:30 +0x65 fp=0xc000c0ad68 sp=0xc000c0ad18 pc=0x2084905
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.(*Response).UnmarshalPayload(0xc000c0af88, {0x73a770, 0xc0006e0000})
	pkg/sentry/fsimpl/fuse/request_response.go:225 +0x27a fp=0xc000c0add8 sp=0xc000c0ad68 pc=0x207f1fa
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.(*connection).InitRecv(0xc000d00d20?, 0xc00089ea80?, 0x0?)
	pkg/sentry/fsimpl/fuse/connection_control.go:100 +0x125 fp=0xc000c0ae98 sp=0xc000c0add8 pc=0x2064725
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.(*DeviceFD).asyncCallBack(0xc0001ce460, {0x73d9f8, 0xc00089ea80}, 0xc000c0af88)
	pkg/sentry/fsimpl/fuse/dev.go:363 +0x112 fp=0xc000c0aee8 sp=0xc000c0ae98 pc=0x2068ad2
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.(*DeviceFD).sendResponse(0xc0001ce460, {0x73d9f8, 0xc00089ea80}, 0xc000ad3f80)
	pkg/sentry/fsimpl/fuse/dev.go:326 +0x2c6 fp=0xc000c0afc8 sp=0xc000c0aee8 pc=0x20685a6
gvisor.dev/gvisor/pkg/sentry/fsimpl/fuse.(*DeviceFD).Write(0xc0001ce460, {0x73d9f8, 0xc00089ea80}, {{0x738090, 0xc000c3e000}, {0x0, 0x1, 0x200000c0, 0x10}, {0x0, ...}}, ...)
	pkg/sentry/fsimpl/fuse/dev.go:250 +0x616 fp=0xc000c0b1d0 sp=0xc000c0afc8 pc=0x20675f6
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write(0xc0001ce460, {0x73d9f8, 0xc00089ea80}, {{0x738090, 0xc000c3e000}, {0x0, 0x1, 0x200000c0, 0x10}, {0x0, ...}}, ...)
	pkg/sentry/vfs/file_description.go:674 +0x152 fp=0xc000c0b298 sp=0xc000c0b1d0 pc=0x1717592
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.write(0xc000012480?, 0x4c8bbb?, {{0x738090, 0xc000c3e000}, {0x0, 0x1, 0x200000c0, 0x10}, {0x0, 0x1}}, ...)
	pkg/sentry/syscalls/linux/sys_read_write.go:347 +0xae fp=0xc000c0b428 sp=0xc000c0b298 pc=0x1d00e6e
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Write(0xc00089ea80, {{0x3}, {0x200000c0}, {0x10}, {0x7fda18357e78}, {0x7fda18357e78}, {0x7fda18357e78}})
	pkg/sentry/syscalls/linux/sys_read_write.go:316 +0x34f fp=0xc000c0b5c8 sp=0xc000c0b428 pc=0x1d0040f
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc00089ea80, 0x1, {{0x3}, {0x200000c0}, {0x10}, {0x7fda18357e78}, {0x7fda18357e78}, {0x7fda18357e78}})
	pkg/sentry/kernel/task_syscall.go:142 +0xab7 fp=0xc000c0b9e0 sp=0xc000c0b5c8 pc=0x1ac5c57
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc00089ea80, 0x1?, {{0x3}, {0x200000c0}, {0x10}, {0x7fda18357e78}, {0x7fda18357e78}, {0x7fda18357e78}})
	pkg/sentry/kernel/task_syscall.go:322 +0x8e fp=0xc000c0ba80 sp=0xc000c0b9e0 pc=0x1ac7d6e
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc0006ce0f0?, 0xc000c0bbaf?, {{0x3}, {0x200000c0}, {0x10}, {0x7fda18357e78}, {0x7fda18357e78}, {0x7fda18357e78}})
	pkg/sentry/kernel/task_syscall.go:282 +0xc5 fp=0xc000c0baf8 sp=0xc000c0ba80 pc=0x1ac7665
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc00089ea80)
	pkg/sentry/kernel/task_syscall.go:257 +0x53b fp=0xc000c0bc20 sp=0xc000c0baf8 pc=0x1ac717b
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc00089ea80?, 0xc00089ea80)
	pkg/sentry/kernel/task_run.go:259 +0x2074 fp=0xc000c0bec0 sp=0xc000c0bc20 pc=0x1aafef4
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc00089ea80, 0xe)
	pkg/sentry/kernel/task_run.go:94 +0x2cc fp=0xc000c0bfb0 sp=0xc000c0bec0 pc=0x1aad4ac
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
	pkg/sentry/kernel/task_start.go:377 +0x48 fp=0xc000c0bfe0 sp=0xc000c0bfb0 pc=0x1ac3348
runtime.goexit()
	src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000c0bfe8 sp=0xc000c0bfe0 pc=0x11da141
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:377 +0x1da

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/02/22 09:11 gvisor 6a4908b26239 42a4d508 .config console log report syz C ci-gvisor-ptrace-1-race-cover panic: runtime error: slice bounds out of range [:NUM] with capacity NUM
2023/02/22 08:40 gvisor 6a4908b26239 42a4d508 .config console log report syz C ci-gvisor-ptrace-1-race-cover panic: runtime error: slice bounds out of range [:NUM] with capacity NUM
2023/02/22 01:15 gvisor 3f8d2bbee19c ec0a9fe9 .config console log report syz C ci-gvisor-ptrace-1-race-cover panic: runtime error: slice bounds out of range [:NUM] with capacity NUM
2023/02/22 00:23 gvisor 3f8d2bbee19c ec0a9fe9 .config console log report syz C ci-gvisor-ptrace-1-race-cover panic: runtime error: slice bounds out of range [:NUM] with capacity NUM
2023/02/21 01:10 gvisor 028cf757bbef 4f5f5209 .config console log report syz C ci-gvisor-ptrace-2-race-cover panic: runtime error: slice bounds out of range [:NUM] with capacity NUM
2023/02/21 00:39 gvisor 028cf757bbef 4f5f5209 .config console log report syz C ci-gvisor-ptrace-2-race-cover panic: runtime error: slice bounds out of range [:NUM] with capacity NUM
2023/02/20 13:43 gvisor 028cf757bbef bcdf85f8 .config console log report syz C ci-gvisor-ptrace-2-race-cover panic: runtime error: slice bounds out of range [:NUM] with capacity NUM
* Struck through repros no longer work on HEAD.