syzbot

 sign-in | mailing list | source | docs
🐞 Open [979] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12499] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in kernfs_add_one

Status: fixed on 2019/11/22 12:17
Reported-by: syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com
Fix commit: ac43432cb1f5 driver core: Fix use-after-free and double free on glue directory
First crash: 2051d, last: 1723d
Cause bisection: introduced by (bisect log) :
commit 726e41097920a73e4c7c33385dcc0debb1281e18
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date: Tue Jul 10 00:29:10 2018 +0000

  drivers: core: Remove glue dirs from sysfs earlier

Crash: WARNING: refcount bug in hci_register_dev (log)
Repro: C syz .config
  
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
general protection fault in kernfs_add_one 5 (7) 2019/11/22 08:10
Reminder: 29 open syzbot bugs in bluetooth subsystem 1 (1) 2019/07/24 01:41
Reminder: 29 open syzbot bugs in bluetooth subsystem 1 (1) 2019/07/09 19:07
Reminder: 27 open syzbot bugs in bluetooth subsystem 1 (1) 2019/06/24 05:14
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in kernfs_add_one C done 5 1727d 1796d 1/1 fixed on 2019/12/03 19:05
android-414 general protection fault in kernfs_add_one 1 1682d 1682d 0/1 auto-closed as invalid on 2020/01/14 07:42
linux-4.19 general protection fault in kernfs_add_one C done 8 1694d 1834d 1/1 fixed on 2019/12/05 10:31

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9810 Comm: syz-executor556 Not tainted 5.2.0+ #65
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kernfs_add_one+0x343/0x4d0 fs/kernfs/dir.c:813
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 52 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 70 48 8d 7b 08 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1f 01 00 00 8b 5b 08 31 ff 83
RSP: 0018:ffff888098587828 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8733d3b8
RDX: 0000000000000001 RSI: ffffffff81da8c9b RDI: 0000000000000008
RBP: ffff888098587868 R08: 1ffffffff11d3a30 R09: fffffbfff11d3a31
R10: fffffbfff11d3a30 R11: ffffffff88e9d187 R12: ffff8880a75cf8c0
R13: ffff8880a75cf8c0 R14: 0000000000000000 R15: 0000000000000000
FS:  00007fac2da35700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc46a998000 CR3: 0000000096584000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 kernfs_create_dir_ns+0xff/0x160 fs/kernfs/dir.c:1032
 sysfs_create_dir_ns+0x131/0x2a0 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:89 [inline]
 kobject_add_internal lib/kobject.c:255 [inline]
 kobject_add_internal.cold+0x116/0x662 lib/kobject.c:225
 kobject_add_varg lib/kobject.c:390 [inline]
 kobject_add+0x150/0x1c0 lib/kobject.c:442
 device_add+0x3b7/0x17a0 drivers/base/core.c:2062
 hci_register_dev+0x2e8/0x8f0 net/bluetooth/hci_core.c:3307
 __vhci_create_device+0x2c5/0x5d0 drivers/bluetooth/hci_vhci.c:124
 vhci_create_device drivers/bluetooth/hci_vhci.c:148 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:204 [inline]
 vhci_write+0x2d0/0x470 drivers/bluetooth/hci_vhci.c:284
 call_write_iter include/linux/fs.h:1870 [inline]
 new_sync_write+0x4d3/0x770 fs/read_write.c:483
 __vfs_write+0xe1/0x110 fs/read_write.c:496
 vfs_write+0x20c/0x580 fs/read_write.c:558
 ksys_write+0x14f/0x290 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:620
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x447109
Code: e8 ec e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b 06 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fac2da34db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 0000000000447109
RDX: 0000000000000002 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc2c
R13: 00007fff0ed925bf R14: 00007fac2da359c0 R15: 00000000006dcc2c
Modules linked in:
---[ end trace 187fd9b7585db0f0 ]---
RIP: 0010:kernfs_add_one+0x343/0x4d0 fs/kernfs/dir.c:813
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 52 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 70 48 8d 7b 08 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1f 01 00 00 8b 5b 08 31 ff 83
RSP: 0018:ffff888098587828 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8733d3b8
RDX: 0000000000000001 RSI: ffffffff81da8c9b RDI: 0000000000000008
RBP: ffff888098587868 R08: 1ffffffff11d3a30 R09: fffffbfff11d3a31
R10: fffffbfff11d3a30 R11: ffffffff88e9d187 R12: ffff8880a75cf8c0
R13: ffff8880a75cf8c0 R14: 0000000000000000 R15: 0000000000000000
FS:  00007fac2da35700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc46a999000 CR3: 0000000096584000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (98):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/16 21:26 upstream 9637d517347e db842eb6 .config console log report syz C ci-upstream-kasan-gce-root
2019/04/23 00:33 upstream 085b7755808a 53199d6e .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/22 17:00 upstream 085b7755808a 0a77c33c .config console log report syz C ci-upstream-kasan-gce
2019/03/15 20:49 upstream f261c4e529da bab43553 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/03/14 01:13 upstream ebc551f2b8f9 2881fc25 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/03/14 01:01 upstream ebc551f2b8f9 2881fc25 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/03/06 19:36 upstream 3717f613f48d 05cf83bf .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/03/04 22:49 upstream 736706bee329 7c693b52 .config console log report syz C ci-upstream-kasan-gce
2019/02/26 19:03 upstream 7d762d69145a a36ecd98 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/02/19 16:58 upstream b5372fe5dc84 4df543c9 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/01/13 06:02 upstream 66c56cfa64d9 c3f3344c .config console log report syz C ci-upstream-kasan-gce
2018/12/28 20:45 upstream 00c569b567c7 fc6ae81a .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/12/19 18:54 upstream 62393dbcbe0f fe2dc057 .config console log report syz C ci-upstream-kasan-gce
2018/11/25 06:41 upstream e195ca6cb6f2 ecc7c870 .config console log report syz C ci-upstream-kasan-gce
2018/11/16 12:01 upstream da5322e65940 f5e275d1 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2018/11/11 05:28 upstream ab6e1f378f54 f3c4e618 .config console log report syz C ci-upstream-kasan-gce-root
2018/10/31 15:14 upstream 310c7585e830 89781090 .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/10/30 19:54 upstream 11743c56785c 8dbb755a .config console log report syz C ci-upstream-kasan-gce
2018/10/19 06:01 upstream fa520c47eaa1 9aba67b5 .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/09/12 14:28 upstream 5e335542de83 3c88136c .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/02/26 19:07 upstream 7d762d69145a a36ecd98 .config console log report syz C ci-upstream-kasan-gce-386
2019/02/12 11:17 upstream aa0c38cf39de 65a0d619 .config console log report syz C ci-upstream-kasan-gce-386
2018/12/08 17:12 upstream 5f179793f0a7 60562a1d .config console log report syz C ci-upstream-kasan-gce-386
2018/11/02 09:39 upstream e468f5c06b5e 1f38e9ae .config console log report syz C ci-upstream-kasan-gce-386
2019/03/16 13:59 linux-next cf08baa29613 bab43553 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/12/28 15:44 linux-next 6a1d293238c1 fc6ae81a .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/12/26 20:39 linux-next 6a1d293238c1 8a41a0ad .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/11/25 11:30 linux-next 442b8cea2477 3d3ec907 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/11/09 21:48 linux-next 442b8cea2477 f9815aaf .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/10/19 02:48 linux-next 9bab64345e83 9aba67b5 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/08/01 21:11 upstream 1e78030e5e5b 835dffe7 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/03/06 19:32 upstream 3717f613f48d 05cf83bf .config console log report syz ci-upstream-kasan-gce
2019/02/19 16:49 upstream b5372fe5dc84 4df543c9 .config console log report syz ci-upstream-kasan-gce
2019/02/19 05:04 upstream a3b22b9f11d9 59f36113 .config console log report syz ci-upstream-kasan-gce
2019/02/12 09:25 upstream aa0c38cf39de 65a0d619 .config console log report syz ci-upstream-kasan-gce-root
2019/02/12 09:12 upstream aa0c38cf39de 65a0d619 .config console log report syz ci-upstream-kasan-gce-root
2019/04/16 09:00 linux-next de3c659c83ce 505ab413 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/02/27 15:06 linux-next 7b827ff9af88 083cfd0e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/01/13 18:13 linux-next b808822a75a3 c3f3344c .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/08/06 05:20 upstream 0eb0ce0a78e1 6affd8e8 .config console log report ci-upstream-kasan-gce
2019/07/20 03:12 upstream 31cc088a4f5d 1656845f .config console log report ci-upstream-kasan-gce
2019/06/30 04:23 upstream 728254541ebc 7509bf36 .config console log report ci-upstream-kasan-gce-selinux-root
2019/06/29 15:54 upstream 01305db842e1 7509bf36 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/24 05:58 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce
2019/06/08 00:38 upstream 16d72dd4891f ce9107d0 .config console log report ci-upstream-kasan-gce-root
2019/04/20 22:55 upstream 9e5de623a0cb b0e8efcb .config console log report ci-upstream-kasan-gce-root
2019/04/15 22:30 upstream 5512320c9f6f 505ab413 .config console log report ci-upstream-kasan-gce-smack-root
2019/04/15 05:45 upstream dc4060a5dc25 505ab413 .config console log report ci-upstream-kasan-gce
2019/04/11 09:49 upstream 582549e3fbe1 e955ac50 .config console log report ci-upstream-kasan-gce-root
2019/04/08 08:05 upstream fcf88917dd43 c34fde03 .config console log report ci-upstream-kasan-gce
2019/04/04 22:33 upstream 145f47c7381d e5d1b3ac .config console log report ci-upstream-kasan-gce
2019/04/04 14:23 upstream 145f47c7381d 6a475fff .config console log report ci-upstream-kasan-gce
2019/03/25 22:23 upstream 8c2ffd917477 55684ce1 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/21 05:17 upstream 54c490164523 427ea487 .config console log report ci-upstream-kasan-gce
2019/03/18 13:19 upstream 9e98c678c2d6 4656beca .config console log report ci-upstream-kasan-gce
2019/03/08 16:08 upstream 610cd4eadec4 12365b99 .config console log report ci-upstream-kasan-gce
2019/02/27 17:13 upstream 7d762d69145a 083cfd0e .config console log report ci-upstream-kasan-gce
2019/02/27 11:31 upstream 7d762d69145a 083cfd0e .config console log report ci-upstream-kasan-gce
2019/02/19 08:21 upstream b5372fe5dc84 59f36113 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/19 03:36 upstream a3b22b9f11d9 59f36113 .config console log report ci-upstream-kasan-gce
2019/02/13 11:26 upstream 57902dc0670c 1eedba36 .config console log report ci-upstream-kasan-gce
2019/02/05 23:15 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-smack-root
2019/02/01 15:17 upstream 5b4746a03199 0c07abcf .config console log report ci-upstream-kasan-gce
2019/01/24 16:32 upstream 30bac164aca7 ce1ccf97 .config console log report ci-upstream-kasan-gce-root
2019/01/22 07:59 upstream 52e60b754438 badbbeee .config console log report ci-upstream-kasan-gce-root
2019/01/20 19:21 upstream 6e693b3ffecb fd37a550 .config console log report ci-upstream-kasan-gce-selinux-root
2019/01/20 03:38 upstream b0efca46b570 353f32ea .config console log report ci-upstream-kasan-gce-selinux-root
2019/01/19 18:28 upstream 2339e91d0e66 8aa587b0 .config console log report ci-upstream-kasan-gce-selinux-root
2019/01/15 23:39 upstream fe76fc6aaf53 79cb1a7c .config console log report ci-upstream-kasan-gce-root
2019/01/02 23:53 upstream 85f78456f286 06a2b89f .config console log report ci-upstream-kasan-gce
2018/12/29 16:24 upstream 903b77c63167 a40793d7 .config console log report ci-upstream-kasan-gce
2018/12/10 06:35 upstream 0844895a2e51 96cc4c50 .config console log report ci-upstream-kasan-gce
2018/12/05 12:46 upstream 0072a0c14d5b ac6c0578 .config console log report ci-upstream-kasan-gce-selinux-root
2018/11/19 08:14 upstream c67a98c00ea3 adf636a8 .config console log report ci-upstream-kasan-gce-smack-root
2018/11/16 13:28 upstream da5322e65940 f5e275d1 .config console log report ci-upstream-kasan-gce-root
2018/11/16 00:52 upstream da5322e65940 3a41052e .config console log report ci-upstream-kasan-gce-smack-root
2018/11/04 05:31 upstream 83650fd58a93 8bd6bd63 .config console log report ci-upstream-kasan-gce-root
2019/03/15 01:29 upstream 3b319ee220a8 d72db19b .config console log report ci-upstream-kasan-gce-386
2019/02/28 02:53 upstream 7d762d69145a 34ec456b .config console log report ci-upstream-kasan-gce-386
2019/06/17 04:05 linux-next f4788d37bc84 442206d7 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/04/30 08:28 linux-next 3d17a1de96a2 20f16bef .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/25 07:38 linux-next e382d91f5f80 2c86e0a5 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/25 00:04 linux-next e382d91f5f80 acbc5b7d .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/22 09:46 linux-next 32a217bae32c dce6e62f .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/10 16:49 linux-next cf08baa29613 12365b99 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/12/13 17:18 linux-next ca40dc225d19 f3d9d594 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/11/12 07:05 linux-next 442b8cea2477 7b5f8621 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.