syzbot

 sign-in | mailing list | source | docs
🐞 Open [70]
🐞 Fixed [22]
🐞 Invalid [333]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: user-memory-access Write in profile_hits

Status: auto-closed as invalid on 2022/05/08 09:48
Reported-by: syzbot+96ab1e06853f1a181a75@syzkaller.appspotmail.com
First crash: 1050d, last: 1050d
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: user-memory-access Write in profile_hits (2) 1 775d 775d 0/2 auto-obsoleted due to no activity on 2023/02/07 02:54
upstream KMSAN: uninit-value in profile_hits (2) kernel 4 1086d 1097d 0/28 auto-closed as invalid on 2022/03/03 02:13
upstream KMSAN: uninit-value in profile_hits (3) kernel C 1529 118d 332d 27/28 fixed on 2024/08/23 02:59
upstream KMSAN: uninit-value in profile_hits kernel C 43 1223d 1223d 0/28 closed as invalid on 2021/07/19 13:31

Sample crash report:
==================================================================
BUG: KASAN: user-memory-access in atomic_add include/asm-generic/atomic-instrumented.h:62 [inline]
BUG: KASAN: user-memory-access in do_profile_hits kernel/profile.c:324 [inline]
BUG: KASAN: user-memory-access in profile_hits+0x90a/0xb00 kernel/profile.c:398
Write of size 4 at addr 00000007fffc4420 by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.4.147-syzkaller-00015-g5b673be0c6b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18e/0x1de lib/dump_stack.c:118
 __kasan_report+0x178/0x260 mm/kasan/report.c:520
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 check_memory_region_inline mm/kasan/generic.c:141 [inline]
 check_memory_region+0x2a5/0x2e0 mm/kasan/generic.c:191
 atomic_add include/asm-generic/atomic-instrumented.h:62 [inline]
 do_profile_hits kernel/profile.c:324 [inline]
 profile_hits+0x90a/0xb00 kernel/profile.c:398
 tick_sched_handle kernel/time/tick-sched.c:172 [inline]
 tick_sched_timer+0x268/0x410 kernel/time/tick-sched.c:1296
 __run_hrtimer+0x187/0x7b0 kernel/time/hrtimer.c:1581
 __hrtimer_run_queues kernel/time/hrtimer.c:1643 [inline]
 hrtimer_interrupt+0x557/0x10d0 kernel/time/hrtimer.c:1705
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1123 [inline]
 smp_apic_timer_interrupt+0x109/0x420 arch/x86/kernel/apic/apic.c:1148
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:831
 </IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x45/0x60 kernel/locking/spinlock.c:199
Code: 08 00 74 0c 48 c7 c7 10 d4 ca 85 e8 d5 8a 69 fd 48 83 3d ad 71 a6 01 00 74 29 48 89 df e8 d3 8a 25 fd 66 90 fb bf 01 00 00 00 <e8> 26 20 1f fd 65 8b 05 0b 8b dd 7b 85 c0 74 02 5b c3 e8 e4 dd db
RSP: 0018:ffff8881f5defd80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: ffff8881f6f4dc80 RCX: dffffc0000000000
RDX: 0000000040000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff8881f5defde0 R08: ffffffff821f7b34 R09: ffffed103bd7adc9
R10: ffffed103bd7adc9 R11: 0000000000000000 R12: ffff8881f6f4dc80
R13: ffff8881f5dc6e40 R14: dffffc0000000000 R15: 0000000000000000
 finish_lock_switch kernel/sched/core.c:3340 [inline]
 finish_task_switch+0x130/0x550 kernel/sched/core.c:3440
 context_switch kernel/sched/core.c:3604 [inline]
 __schedule+0x886/0x1020 kernel/sched/core.c:4300
 schedule_idle+0x60/0x90 kernel/sched/core.c:4396
 do_idle+0x509/0x530 kernel/sched/idle.c:288
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:356
 start_secondary+0x304/0x380 arch/x86/kernel/smpboot.c:264
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
==================================================================
BUG: unable to handle page fault for address: 00000007fffc4420
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 1edd6f067 P4D 1edd6f067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G    B             5.4.147-syzkaller-00015-g5b673be0c6b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_atomic_add arch/x86/include/asm/atomic.h:55 [inline]
RIP: 0010:atomic_add include/asm-generic/atomic-instrumented.h:63 [inline]
RIP: 0010:do_profile_hits kernel/profile.c:324 [inline]
RIP: 0010:profile_hits+0x90e/0xb00 kernel/profile.c:398
Code: 00 00 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 1d 14 69 85 05 4a 8d 3c a3 be 04 00 00 00 e8 b6 94 3c 00 8b 44 24 24 <f0> 42 01 04 a3 49 83 c7 04 b8 ff 01 00 00 48 89 04 24 49 bd 00 00
RSP: 0018:ffff8881f6f09d28 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 0000000000000010 RCX: 0000000000010004
RDX: 0000000000000001 RSI: 0000000000000046 RDI: 0000000000000001
RBP: 0000000000000020 R08: dffffc0000000000 R09: fffffbfff0da7bd1
R10: fffffbfff0da7bd1 R11: 0000000000000000 R12: 00000001ffff1104
R13: ffff8881ebbab000 R14: dffffc0000000000 R15: ffff8881ebbab000
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000007fffc4420 CR3: 00000001d68a7000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 tick_sched_handle kernel/time/tick-sched.c:172 [inline]
 tick_sched_timer+0x268/0x410 kernel/time/tick-sched.c:1296
 __run_hrtimer+0x187/0x7b0 kernel/time/hrtimer.c:1581
 __hrtimer_run_queues kernel/time/hrtimer.c:1643 [inline]
 hrtimer_interrupt+0x557/0x10d0 kernel/time/hrtimer.c:1705
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1123 [inline]
 smp_apic_timer_interrupt+0x109/0x420 arch/x86/kernel/apic/apic.c:1148
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:831
 </IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x45/0x60 kernel/locking/spinlock.c:199
Code: 08 00 74 0c 48 c7 c7 10 d4 ca 85 e8 d5 8a 69 fd 48 83 3d ad 71 a6 01 00 74 29 48 89 df e8 d3 8a 25 fd 66 90 fb bf 01 00 00 00 <e8> 26 20 1f fd 65 8b 05 0b 8b dd 7b 85 c0 74 02 5b c3 e8 e4 dd db
RSP: 0018:ffff8881f5defd80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: ffff8881f6f4dc80 RCX: dffffc0000000000
RDX: 0000000040000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff8881f5defde0 R08: ffffffff821f7b34 R09: ffffed103bd7adc9
R10: ffffed103bd7adc9 R11: 0000000000000000 R12: ffff8881f6f4dc80
R13: ffff8881f5dc6e40 R14: dffffc0000000000 R15: 0000000000000000
 finish_lock_switch kernel/sched/core.c:3340 [inline]
 finish_task_switch+0x130/0x550 kernel/sched/core.c:3440
 context_switch kernel/sched/core.c:3604 [inline]
 __schedule+0x886/0x1020 kernel/sched/core.c:4300
 schedule_idle+0x60/0x90 kernel/sched/core.c:4396
 do_idle+0x509/0x530 kernel/sched/idle.c:288
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:356
 start_secondary+0x304/0x380 arch/x86/kernel/smpboot.c:264
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
Modules linked in:
CR2: 00000007fffc4420
---[ end trace 0e13b355887d5cf7 ]---
RIP: 0010:arch_atomic_add arch/x86/include/asm/atomic.h:55 [inline]
RIP: 0010:atomic_add include/asm-generic/atomic-instrumented.h:63 [inline]
RIP: 0010:do_profile_hits kernel/profile.c:324 [inline]
RIP: 0010:profile_hits+0x90e/0xb00 kernel/profile.c:398
Code: 00 00 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 1d 14 69 85 05 4a 8d 3c a3 be 04 00 00 00 e8 b6 94 3c 00 8b 44 24 24 <f0> 42 01 04 a3 49 83 c7 04 b8 ff 01 00 00 48 89 04 24 49 bd 00 00
RSP: 0018:ffff8881f6f09d28 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 0000000000000010 RCX: 0000000000010004
RDX: 0000000000000001 RSI: 0000000000000046 RDI: 0000000000000001
RBP: 0000000000000020 R08: dffffc0000000000 R09: fffffbfff0da7bd1
R10: fffffbfff0da7bd1 R11: 0000000000000000 R12: 00000001ffff1104
R13: ffff8881ebbab000 R14: dffffc0000000000 R15: ffff8881ebbab000
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000007fffc4420 CR3: 00000001d68a7000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	08 00                	or     %al,(%rax)
   2:	74 0c                	je     0x10
   4:	48 c7 c7 10 d4 ca 85 	mov    $0xffffffff85cad410,%rdi
   b:	e8 d5 8a 69 fd       	callq  0xfd698ae5
  10:	48 83 3d ad 71 a6 01 	cmpq   $0x0,0x1a671ad(%rip)        # 0x1a671c5
  17:	00
  18:	74 29                	je     0x43
  1a:	48 89 df             	mov    %rbx,%rdi
  1d:	e8 d3 8a 25 fd       	callq  0xfd258af5
  22:	66 90                	xchg   %ax,%ax
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 26 20 1f fd       	callq  0xfd1f2055 <-- trapping instruction
  2f:	65 8b 05 0b 8b dd 7b 	mov    %gs:0x7bdd8b0b(%rip),%eax        # 0x7bdd8b41
  36:	85 c0                	test   %eax,%eax
  38:	74 02                	je     0x3c
  3a:	5b                   	pop    %rbx
  3b:	c3                   	retq
  3c:	e8                   	.byte 0xe8
  3d:	e4 dd                	in     $0xdd,%al
  3f:	db                   	.byte 0xdb

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/01/08 09:48 android12-5.4 5b673be0c6b0 2ca0d385 .config console log report info ci2-android-5-4-kasan KASAN: user-memory-access Write in profile_hits
* Struck through repros no longer work on HEAD.