syzbot

 sign-in | mailing list | source | docs
🐞 Open [569] 🐞 Fixed [180] 🐞 Invalid [592] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes

general protection fault in path_openat

Status: fixed on 2020/03/06 21:15
Reported-by: syzbot+c486b6e32d3d23beb4c3@syzkaller.appspotmail.com
Fix commit: 40642747dd9f vfs: fix do_last() regression
First crash: 927d, last: 920d

Fix bisection: fixed by (bisect log) :
commit 40642747dd9feab4912157882166c05722cec7b0
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat Feb 1 16:26:45 2020 +0000

  vfs: fix do_last() regression

similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 general protection fault in path_openat C done 13 921d 926d 1/1 fixed on 2020/03/06 08:34
upstream general protection fault in path_openat C done 7 925d 924d 16/23 fixed on 2020/02/18 14:31
android-54 general protection fault in path_openat syz 26 919d 926d 1/2 fixed on 2021/10/12 13:38

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 8606 Comm: udevd Not tainted 4.14.169-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88809729a1c0 task.stack: ffff888096388000
RIP: 0010:do_last fs/namei.c:3269 [inline]
RIP: 0010:path_openat+0x20b/0x3db0 fs/namei.c:3569
RSP: 0018:ffff88809638f868 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0001020304050608
RDX: 0000000000000000 RSI: 1ffff11012c71efe RDI: 0000000000000004
RBP: ffff88809638f9c0 R08: ffff88809729a1c0 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000003 R12: ffff88809638fa00
R13: ffff88809638fa00 R14: ffff888084c7ab40 R15: 0000000000000000
FS:  00007faee11bf7a0(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 0000000096a3d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_filp_open+0x18e/0x250 fs/namei.c:3603
 do_open_execat+0xe7/0x4a0 fs/exec.c:849
 open_exec+0x37/0x70 fs/exec.c:881
 load_elf_binary+0x77c/0x4d60 fs/binfmt_elf.c:767
 search_binary_handler fs/exec.c:1638 [inline]
 search_binary_handler+0x149/0x6f0 fs/exec.c:1616
 exec_binprm fs/exec.c:1680 [inline]
 do_execveat_common.isra.0+0x1000/0x1dd0 fs/exec.c:1802
 do_execve fs/exec.c:1847 [inline]
 SYSC_execve fs/exec.c:1928 [inline]
 SyS_execve+0x39/0x50 fs/exec.c:1923
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7faee08a3207
RSP: 002b:00007ffd29d6a178 EFLAGS: 00000206 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007faee08a3207
RDX: 0000000001c16e80 RSI: 00007ffd29d6a270 RDI: 00007ffd29d6b280
RBP: 0000000000625500 R08: 0000000000001c7e R09: 0000000000001c7e
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000001c16e80
R13: 0000000000000007 R14: 0000000001bc7030 R15: 0000000000000005
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 03 30 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5e 58 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 
RIP: do_last fs/namei.c:3269 [inline] RSP: ffff88809638f868
RIP: path_openat+0x20b/0x3db0 fs/namei.c:3569 RSP: ffff88809638f868
---[ end trace 2ddd1381135f8f62 ]---

Crashes (40):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-14 2020/02/02 19:34 linux-4.14.y 9fa690a2a016 93e5e335 .config log report syz C
ci2-linux-4-14 2020/02/02 10:54 linux-4.14.y 9fa690a2a016 2274ad39 .config log report syz C
ci2-linux-4-14 2020/01/31 09:07 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report syz C
ci2-linux-4-14 2020/01/30 22:08 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report syz C
ci2-linux-4-14 2020/02/02 17:56 linux-4.14.y 9fa690a2a016 93e5e335 .config log report syz
ci2-linux-4-14 2020/02/02 06:07 linux-4.14.y 9fa690a2a016 2274ad39 .config log report syz
ci2-linux-4-14 2020/01/30 06:55 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report syz
ci2-linux-4-14 2020/02/05 09:45 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/05 04:31 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/04 23:57 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/04 22:26 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/03 22:54 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/03 21:47 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/03 21:15 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/03 19:34 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/03 15:40 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/03 11:04 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/03 05:16 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/03 01:58 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/02 18:02 linux-4.14.y 9fa690a2a016 93e5e335 .config log report
ci2-linux-4-14 2020/02/02 07:33 linux-4.14.y 9fa690a2a016 2274ad39 .config log report
ci2-linux-4-14 2020/02/01 23:42 linux-4.14.y 9fa690a2a016 2274ad39 .config log report
ci2-linux-4-14 2020/02/01 23:30 linux-4.14.y 9fa690a2a016 2274ad39 .config log report
ci2-linux-4-14 2020/02/01 21:09 linux-4.14.y 9fa690a2a016 326d4c78 .config log report
ci2-linux-4-14 2020/02/01 15:16 linux-4.14.y 9fa690a2a016 326d4c78 .config log report
ci2-linux-4-14 2020/02/01 14:45 linux-4.14.y 9fa690a2a016 326d4c78 .config log report
ci2-linux-4-14 2020/02/01 12:43 linux-4.14.y 9fa690a2a016 326d4c78 .config log report
ci2-linux-4-14 2020/01/31 21:36 linux-4.14.y 9fa690a2a016 0eb59c27 .config log report
ci2-linux-4-14 2020/01/31 21:27 linux-4.14.y 9fa690a2a016 0eb59c27 .config log report
ci2-linux-4-14 2020/01/31 17:53 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/31 15:06 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/31 14:19 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/31 11:04 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/31 04:26 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/30 21:23 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/30 19:43 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/30 05:28 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/30 05:20 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/30 04:26 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report
ci2-linux-4-14 2020/01/29 23:13 linux-4.14.y 9fa690a2a016 5ed23f9a .config log report