syzbot


BUG: unable to handle kernel NULL pointer dereference in unix_dgram_poll

Status: moderation: reported on 2022/11/24 21:08
Reported-by: syzbot+c04955f226878b5afdc8@syzkaller.appspotmail.com
First crash: 77d, last: 77d

Sample crash report:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f0
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000107a09000
[00000000000000f0] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 2658 Comm: dhcpcd Not tainted 6.1.0-rc5-syzkaller-32269-g9500fc6e9e60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sk_is_readable include/net/sock.h:2974 [inline]
pc : unix_dgram_poll+0xe8/0x314 net/unix/af_unix.c:3209
lr : unix_dgram_poll+0xd4/0x314 net/unix/af_unix.c:3203
sp : ffff800016d438d0
x29: ffff800016d438d0 x28: ffff80000b2413a8 x27: ffff0000c9ee2200
x26: ffff0000c9ee2200 x25: ffff80000b7b61fc x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000008 x21: ffff800016d43ae0
x20: 0000000000000000 x19: ffff0000c9ac0f00 x18: 0000000000000284
x17: 000000000000b67e x16: ffff80000dc18158 x15: ffff0000c5759a40
x14: 0000000000000000 x13: 00000000ffffffff x12: 0000000000000003
x11: ff8080000b7b62d0 x10: 0000000000000000 x9 : 0000000700000000
x8 : 0000000000000008 x7 : ffff8000095f8034 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff800016d43ae0 x1 : 0000000000000000 x0 : 0000000000000003
Call trace:
 unix_dgram_poll+0xe8/0x314 net/unix/af_unix.c:3203
 sock_poll+0x158/0x184 net/socket.c:1353
 vfs_poll include/linux/poll.h:88 [inline]
 do_pollfd fs/select.c:873 [inline]
 do_poll fs/select.c:921 [inline]
 do_sys_poll+0x538/0xa08 fs/select.c:1015
 __do_sys_ppoll fs/select.c:1121 [inline]
 __se_sys_ppoll fs/select.c:1101 [inline]
 __arm64_sys_ppoll+0x14c/0x1b8 fs/select.c:1101
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
Code: f940166a 321c02c8 71000e9f 1a960108 (f9407957) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f940166a 	ldr	x10, [x19, #40]
   4:	321c02c8 	orr	w8, w22, #0x10
   8:	71000e9f 	cmp	w20, #0x3
   c:	1a960108 	csel	w8, w8, w22, eq  // eq = none
* 10:	f9407957 	ldr	x23, [x10, #240] <-- trapping instruction

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-gce-arm64 2022/11/20 20:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 5bb70014 .config console log report info [disk image] [vmlinux] [kernel image] BUG: unable to handle kernel NULL pointer dereference in unix_dgram_poll
* Struck through repros no longer work on HEAD.