syzbot


android-4.4 boot error: general protection fault in ion_heap_destroy

Status: auto-closed as invalid on 2020/03/03 10:06
Reported-by: syzbot+959e43d74a35738c41a9@syzkaller.appspotmail.com
First crash: 1875d, last: 1577d

Sample crash report:
hidraw: raw HID events driver (C) Jiri Kosina
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
ion_heap_create: Heap type is disabled: 1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.4.205-syzkaller #0
task: ffff8801da5f0000 task.stack: ffff8801da5f8000
RIP: 0010:[<ffffffff820ae082>]  [<ffffffff820ae082>] ion_heap_destroy+0x32/0xd0 drivers/staging/android/ion/ion_heap.c:363
RSP: 0000:ffff8801da5ffda8  EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000010 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffffffff820ae06c RDI: 000000000000001a
RBP: ffff8801da5ffdb8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffffffffea
R13: ffff8801d7d9f908 R14: dffffc0000000000 R15: ffffffffffffffea
FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88021ffff000 CR3: 0000000002e0a000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 dffffc0000000000 ffffffffffffffea ffff8801da5ffdf0 ffffffff8324d8e0
 ffffffff82e11080 ffff8801d7da4340 dffffc0000000000 ffffffff8324d61f
 ffff8801da5ffeb0 ffff8801da5ffed8 ffffffff810004ab 0000000082ab2920
Call Trace:
 [<ffffffff8324d8e0>] ion_dummy_init+0x2c1/0x36d drivers/staging/android/ion/ion_dummy_driver.c:116
 [<ffffffff810004ab>] do_one_initcall+0x13b/0x260 init/main.c:793
 [<ffffffff831d5b01>] do_initcall_level init/main.c:858 [inline]
 [<ffffffff831d5b01>] do_initcalls init/main.c:866 [inline]
 [<ffffffff831d5b01>] do_basic_setup init/main.c:884 [inline]
 [<ffffffff831d5b01>] kernel_init_freeable+0x2fa/0x3c3 init/main.c:1029
 [<ffffffff82692f74>] kernel_init+0x12/0x15e init/main.c:957
 [<ffffffff826a55c5>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:510
Code: 89 fc 48 83 ec 08 e8 1e d8 24 ff 4d 85 e4 74 53 e8 14 d8 24 ff 49 8d 7c 24 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 00 00 00 41 8b 54 24 30 
RIP  [<ffffffff820ae082>] ion_heap_destroy+0x32/0xd0 drivers/staging/android/ion/ion_heap.c:363
 RSP <ffff8801da5ffda8>
---[ end trace 917ada9a8dd8be47 ]---

Crashes (1866):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/04 09:44 android-4.4 516978792f57 0ecb9746 .config console log report ci-android-44-kasan-gce
2019/12/02 21:00 android-4.4 516978792f57 ab342da3 .config console log report ci-android-44-kasan-gce
2019/12/01 22:52 android-4.4 516978792f57 f879db37 .config console log report ci-android-44-kasan-gce
2019/11/30 21:25 android-4.4 516978792f57 a76bf83f .config console log report ci-android-44-kasan-gce
2019/11/29 13:13 android-4.4 516978792f57 d29b9e84 .config console log report ci-android-44-kasan-gce
2019/11/29 11:22 android-4.4 516978792f57 76357d6f .config console log report ci-android-44-kasan-gce
2019/11/27 13:58 android-4.4 40ef73d67ad9 5a38f3f0 .config console log report ci-android-44-kasan-gce
2019/11/25 23:52 android-4.4 40ef73d67ad9 f746151a .config console log report ci-android-44-kasan-gce
2019/11/25 11:22 android-4.4 a4d443b76f66 371caf77 .config console log report ci-android-44-kasan-gce
2019/11/20 20:30 android-4.4 a4d443b76f66 8098ea0f .config console log report ci-android-44-kasan-gce
2019/11/20 02:33 android-4.4 a4d443b76f66 f4b7ed07 .config console log report ci-android-44-kasan-gce
2019/11/19 01:23 android-4.4 a4d443b76f66 5bc70212 .config console log report ci-android-44-kasan-gce
2019/11/18 13:02 android-4.4 a4d443b76f66 1daed50a .config console log report ci-android-44-kasan-gce
2019/11/08 08:15 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 1e35461e .config console log report ci-android-44-kasan-gce
2019/11/08 08:15 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 1e35461e .config console log report ci-android-44-kasan-gce
2019/11/07 18:58 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 f39aff9e .config console log report ci-android-44-kasan-gce
2019/11/05 12:09 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 0f3ec414 .config console log report ci-android-44-kasan-gce
2019/11/04 17:55 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 76630fc9 .config console log report ci-android-44-kasan-gce
2019/11/04 17:55 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 76630fc9 .config console log report ci-android-44-kasan-gce
2019/11/04 12:32 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 18e12644 .config console log report ci-android-44-kasan-gce
2019/11/04 00:28 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 b35fad31 .config console log report ci-android-44-kasan-gce
2019/11/03 13:06 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 c9610487 .config console log report ci-android-44-kasan-gce
2019/10/30 20:52 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 a41ca8fa .config console log report ci-android-44-kasan-gce
2019/02/09 04:56 https://android.googlesource.com/kernel/common android-4.4 363f6f40b1e2 fa6c7b70 .config console log report ci-android-44-kasan-gce
2019/12/03 17:11 android-4.4 516978792f57 ae13a849 .config console log report ci-android-44-kasan-gce-386
2019/11/29 23:53 android-4.4 516978792f57 3a75be00 .config console log report ci-android-44-kasan-gce-386
2019/11/29 11:08 android-4.4 516978792f57 76357d6f .config console log report ci-android-44-kasan-gce-386
2019/11/28 23:31 android-4.4 40ef73d67ad9 76357d6f .config console log report ci-android-44-kasan-gce-386
2019/11/28 11:53 android-4.4 40ef73d67ad9 46869e3e .config console log report ci-android-44-kasan-gce-386
2019/11/27 16:03 android-4.4 40ef73d67ad9 0d63f89c .config console log report ci-android-44-kasan-gce-386
2019/11/27 13:45 android-4.4 40ef73d67ad9 5a38f3f0 .config console log report ci-android-44-kasan-gce-386
2019/11/26 16:26 android-4.4 40ef73d67ad9 1048481f .config console log report ci-android-44-kasan-gce-386
2019/11/25 18:18 android-4.4 40ef73d67ad9 371caf77 .config console log report ci-android-44-kasan-gce-386
2019/11/25 11:09 android-4.4 a4d443b76f66 371caf77 .config console log report ci-android-44-kasan-gce-386
2019/11/22 12:30 android-4.4 a4d443b76f66 598ca6c8 .config console log report ci-android-44-kasan-gce-386
2019/11/19 01:36 android-4.4 a4d443b76f66 5bc70212 .config console log report ci-android-44-kasan-gce-386
2019/11/16 13:20 android-4.4 a4d443b76f66 d5696d51 .config console log report ci-android-44-kasan-gce-386
2019/11/11 17:03 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 048f2d49 .config console log report ci-android-44-kasan-gce-386
2019/11/08 23:40 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 dc438b91 .config console log report ci-android-44-kasan-gce-386
2019/11/07 04:10 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 d797d201 .config console log report ci-android-44-kasan-gce-386
2019/11/06 15:38 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 da505f84 .config console log report ci-android-44-kasan-gce-386
2019/11/06 03:04 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 bc2c6e45 .config console log report ci-android-44-kasan-gce-386
2019/11/02 22:19 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 a41ca8fa .config console log report ci-android-44-kasan-gce-386
2019/10/29 17:16 https://android.googlesource.com/kernel/common android-4.4 a749771ac273 5ea87a66 .config console log report ci-android-44-kasan-gce-386
* Struck through repros no longer work on HEAD.