syzbot

 sign-in | mailing list | source | docs
🐞 Open [955] ≡ Subsystems 🐞 Fixed [4573] 🐞 Invalid [10554] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KASAN: use-after-free Read in do_general_protection

Status: upstream: reported C repro on 2018/05/26 09:16
Labels: kernel (incorrect?)
Reported-by: syzbot+a1264132fc103340628f@syzkaller.appspotmail.com
First crash: 1839d, last: 1809d

Cause bisection: failed (error log, bisect log)

Fix bisection: failed (error log, bisect log)
▶ ▼ Duplicate bugs (5)
duplicates (5):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: use-after-scope Read in vmx_vcpu_run 1 1884d 1883d 0/24 closed as dup on 2018/05/26 09:26
KASAN: stack-out-of-bounds Read in unwind_next_frame C 929 77d 1814d 0/24 closed as dup on 2018/06/20 07:51
KASAN: stack-out-of-bounds Read in do_general_protection syz 11 1773d 1839d 0/24 closed as dup on 2018/05/26 09:25
KASAN: slab-out-of-bounds Read in vmx_vcpu_run 1 1856d 1852d 0/24 closed as dup on 2018/05/26 09:26
KASAN: stack-out-of-bounds Write in notify_die syz 4 1776d 1839d 0/24 closed as dup on 2018/05/26 09:26
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
Reminder: 25 open syzbot bugs in kvm subsystem 1 (1) 2019/07/24 01:43
Reminder: 25 open syzbot bugs in kvm subsystem 1 (1) 2019/06/24 05:21
KASAN: use-after-free Read in do_general_protection 4 (5) 2018/06/20 07:52
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2023/04/12 14:07 13m retest repro upstream error
2022/12/09 07:31 13m retest repro upstream error
2022/12/08 20:31 22m retest repro upstream OK log
2022/08/30 16:27 7m retest repro upstream error
2022/08/30 16:27 15m retest repro upstream OK log

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
==================================================================
BUG: KASAN: use-after-free in do_general_protection+0x2ac/0x2f0 arch/x86/kernel/traps.c:538
Read of size 8 at addr ffff8801d7187398 by task syz-executor171/4544

CPU: 0 PID: 4544 Comm: syz-executor171 Not tainted 4.17.0-rc6+ #67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

The buggy address belongs to the page:
page:ffffea00075c61c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x2fffc0000000000()
raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 ffffea00075c0101 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d7187280: 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801d7187300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8801d7187380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff8801d7187400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801d7187480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 4544 Comm: syz-executor171 Tainted: G    B             4.17.0-rc6+ #67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Manager Title
2018/05/26 06:25 upstream 62d18ecfa641 f48c20b8 .config console log report syz C ci-upstream-kasan-gce
2018/06/24 20:08 upstream 7daf201d7fe8 2064fc5c .config console log report syz C ci-upstream-kasan-gce-root
* Struck through repros no longer work on HEAD.