syzbot


BUG: unable to handle kernel NULL pointer dereference in do_syscall_64

Status: auto-closed as invalid on 2020/02/28 23:04
Reported-by: syzbot+71c6458988bead00c6a0@syzkaller.appspotmail.com
First crash: 975d, last: 975d
similar bugs (6):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in do_syscall_64 (2) C done 4 698d 711d 1/1 fixed on 2020/09/03 09:58
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in do_syscall_64 (3) 2 659d 664d 0/1 auto-closed as invalid on 2021/01/09 06:14
upstream BUG: unable to handle kernel NULL pointer dereference in do_syscall_64 (2) C done 9 744d 848d 0/22 closed as dup on 2020/08/15 13:48
upstream BUG: unable to handle kernel NULL pointer dereference in do_syscall_64 2 1475d 1475d 0/22 auto-closed as invalid on 2019/02/22 10:29
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in do_syscall_64 (2) 7 773d 811d 0/1 auto-closed as invalid on 2020/09/17 05:58
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in do_syscall_64 3 839d 854d 0/1 auto-closed as invalid on 2020/07/13 07:25

Sample crash report:
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x138/0x197 lib/dump_stack.c:53
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0x10f/0x159 lib/fault-inject.c:149
 should_failslab+0xdb/0x130 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc_node mm/slab.c:3297 [inline]
 kmem_cache_alloc_node_trace+0x280/0x770 mm/slab.c:3659
BUG: unable to handle kernel NULL pointer dereference
 __do_kmalloc_node mm/slab.c:3681 [inline]
 __kmalloc_node_track_caller+0x3d/0x80 mm/slab.c:3696
 at           (null)
IP:           (null)
 __kmalloc_reserve.isra.0+0x40/0xe0 net/core/skbuff.c:137
PGD 92e7f067 
 __alloc_skb+0xcf/0x500 net/core/skbuff.c:205
P4D 92e7f067 
PUD 9b63c067 
PMD 0 
 alloc_skb include/linux/skbuff.h:980 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1158 [inline]
 netlink_sendmsg+0x874/0xc60 net/netlink/af_netlink.c:1852
Oops: 0010 [#1] PREEMPT SMP KASAN
Modules linked in:
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xce/0x110 net/socket.c:656
CPU: 0 PID: 14947 Comm: syz-executor.2 Not tainted 4.14.151 #0
 ___sys_sendmsg+0x70a/0x840 net/socket.c:2062
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88808e9c4240 task.stack: ffff888064388000
RIP: 0010:          (null)
RSP: 0018:ffff88806438fd48 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffffff88151060 RCX: ffffc90009e6d000
RDX: 1ffffffff102a223 RSI: 0000000000000000 RDI: ffff888083eaa800
RBP: ffff88806438fd68 R08: 0000000000000001 R09: ffff88808e9c4ae0
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888083eaa800
R13: ffff888083eaa80e R14: 000000000000001c R15: 0000000000000002
FS:  00007f63489a7700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 __sys_sendmsg+0xb9/0x140 net/socket.c:2096
CR2: 0000000000000000 CR3: 000000009fa41000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2103
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 inet_autobind+0xae/0x180 net/ipv4/af_inet.c:181
 inet_dgram_connect+0x136/0x1e0 net/ipv4/af_inet.c:538
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
 SYSC_connect+0x1f6/0x2d0 net/socket.c:1655
RIP: 0033:0x459f49
RSP: 002b:00007f675d6f8c78 EFLAGS: 00000246
 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f675d6f8c90 RCX: 0000000000459f49
 SyS_connect+0x24/0x30 net/socket.c:1636
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f675d6f96d4
R13: 00000000004c7c1c R14: 00000000004ddd80 R15: 0000000000000005
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
kobject: 'loop0' (ffff8880a494e920): kobject_uevent_env
RIP: 0033:0x459f49
RSP: 002b:00007f63489a6c78 EFLAGS: 00000246
kobject: 'loop0' (ffff8880a494e920): fill_kobj_path: path = '/devices/virtual/block/loop0'
 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459f49
RDX: 000000000000001c RSI: 0000000020000000 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f63489a76d4
R13: 00000000004c0671 R14: 00000000004d2d28 R15: 00000000ffffffff
Code:  Bad RIP value.
RIP:           (null) RSP: ffff88806438fd48
CR2: 0000000000000000
---[ end trace 6d29b46400c0d80e ]---
kobject: 'loop3' (ffff8880a4a5aa60): kobject_uevent_env

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-14 2019/10/31 23:03 linux-4.14.y ddef1e8e3f6e a41ca8fa .config log report