syzbot


general protection fault in remove_waiter

Status: public: reported syz repro on 2019/04/14 08:51
Reported-by: syzbot+3f086a8f0653901d7221@syzkaller.appspotmail.com
First crash: 1975d, last: 1975d

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 2766 Comm: syz-executor0 Not tainted 4.4.165+ #2
task: ffff8801d043c740 task.stack: ffff8801d0448000
RIP: 0010:[<ffffffff8120a2df>]  [<ffffffff8120a2df>] rt_mutex_top_waiter kernel/locking/rtmutex_common.h:53 [inline]
RIP: 0010:[<ffffffff8120a2df>]  [<ffffffff8120a2df>] remove_waiter+0x4f/0x2e0 kernel/locking/rtmutex.c:1082
RSP: 0018:ffff8801d044f940  EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8801d8579410 RCX: 0000000000000001
RDX: 0000000000000007 RSI: ffff8801d040f9e0 RDI: 0000000000000038
RBP: ffff8801d044f978 R08: ffff8801d043d078 R09: ffffffff839fa120
R10: 0000000000015920 R11: ffffffff831a2db8 R12: 00000000ffffffdd
R13: ffff8801d040f9e0 R14: ffff8801d8579450 R15: 0000000000000000
FS:  00007f8f45feb700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8f45feadb8 CR3: 00000001d1985000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801d040fa98 ffff8801d040f9e0 ffff8801d8579410 00000000ffffffdd
 ffff8801d8579458 ffff8801d040f9e0 dffffc0000000000 ffff8801d044f9a8
 ffffffff8120abdd ffff8801d040fa60 ffff8801cd867a60 ffff8801d040fa98
Call Trace:
 [<ffffffff8120abdd>] rt_mutex_start_proxy_lock+0xbd/0x120 kernel/locking/rtmutex.c:1685
 [<ffffffff81290aa2>] futex_requeue+0xbb2/0x16b0 kernel/futex.c:1944
 [<ffffffff812933e4>] do_futex+0x204/0x1a00 kernel/futex.c:3248
 [<ffffffff81294e22>] SYSC_futex kernel/futex.c:3286 [inline]
 [<ffffffff81294e22>] SyS_futex+0x242/0x360 kernel/futex.c:3254
 [<ffffffff827140e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: 53 48 89 fb 48 83 ec 10 80 3c 02 00 0f 85 2d 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 40 49 8d 7f 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 17 02 00 00 49 3b 5f 38 0f 85 f0 01 00 00 48 
RIP  [<ffffffff8120a2df>] rt_mutex_top_waiter kernel/locking/rtmutex_common.h:53 [inline]
RIP  [<ffffffff8120a2df>] remove_waiter+0x4f/0x2e0 kernel/locking/rtmutex.c:1082
 RSP <ffff8801d044f940>
---[ end trace ed510e7d65b825b7 ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/28 21:52 https://android.googlesource.com/kernel/common android-4.4 bc1cf2226ce5 4b6d14f2 .config console log report syz ci-android-44-kasan-gce
2018/11/28 22:27 https://android.googlesource.com/kernel/common android-4.4 bc1cf2226ce5 4b6d14f2 .config console log report syz ci-android-44-kasan-gce-386
2018/11/28 21:02 https://android.googlesource.com/kernel/common android-4.4 bc1cf2226ce5 4b6d14f2 .config console log report ci-android-44-kasan-gce
* Struck through repros no longer work on HEAD.