syzbot


general protection fault in ir_raw_event_store_with_filter

Status: upstream: reported C repro on 2020/03/11 13:36
Reported-by: syzbot+34008406ee9a31b13c73@syzkaller.appspotmail.com
First crash: 1000d, last: 4h07m

Cause bisection: failed (bisect log)

Sample crash report:
rc rc0: IR event FIFO is full!
rc rc0: IR event FIFO is full!
general protection fault, probably for non-canonical address 0xdffffc000000021b: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x00000000000010d8-0x00000000000010df]
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.1.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
RIP: 0010:ir_raw_event_store_with_filter+0x424/0x590 drivers/media/rc/rc-ir-raw.c:184
Code: 80 3c 02 00 0f 85 5b 01 00 00 4c 8b a5 b8 05 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 d8 10 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4b 01 00 00 48 ba 00 00 00 00 00 fc ff df 48 89
RSP: 0018:ffffc900001e0940 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: ffffc900001e09b0 RCX: 0000000000000100
RDX: 000000000000021b RSI: ffffffff861d41c9 RDI: 00000000000010d8
RBP: ffff888017615000 R08: 000000000000001e R09: 0000000000000000
R10: 0000000000000101 R11: 203a306372206372 R12: 0000000000000000
R13: ffffc900001e09b5 R14: 0000000000000e80 R15: ffff8880176155b8
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2d9dbe3160 CR3: 000000007281c000 CR4: 0000000000350ee0
Call Trace:
 <IRQ>
 sz_push+0x97/0x1d0 drivers/media/rc/streamzap.c:104
 sz_push_full_space drivers/media/rc/streamzap.c:132 [inline]
 sz_push_half_space drivers/media/rc/streamzap.c:138 [inline]
 streamzap_callback+0x338/0x7b0 drivers/media/rc/streamzap.c:190
 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1671
 usb_hcd_giveback_urb+0x380/0x430 drivers/usb/core/hcd.c:1754
 dummy_timer+0x11ff/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x6a2/0xaf0 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x1f7/0xad8 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:113 [inline]
RIP: 0010:acpi_idle_do_entry+0x1fd/0x2a0 drivers/acpi/processor_idle.c:572
Code: 89 de e8 56 f8 ea f7 84 db 75 ac e8 bd fb ea f7 e8 78 72 f1 f7 eb 0c e8 b1 fb ea f7 0f 00 2d ca fc c2 00 e8 a5 fb ea f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 80 f8 ea f7 48 85 db
RSP: 0018:ffffc90000177d10 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888011a41d40 RSI: ffffffff89919ffb RDI: ffffffff89919fe8
RBP: ffff88801713c064 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff88801713c000 R14: ffff88801713c064 R15: ffff888018433804
 acpi_idle_enter+0x364/0x500 drivers/acpi/processor_idle.c:709
 cpuidle_enter_state+0x1ab/0xd30 drivers/cpuidle/cpuidle.c:239
 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:356
 call_cpuidle kernel/sched/idle.c:155 [inline]
 cpuidle_idle_call kernel/sched/idle.c:236 [inline]
 do_idle+0x3f7/0x590 kernel/sched/idle.c:303
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
 start_secondary+0x252/0x300 arch/x86/kernel/smpboot.c:262
 secondary_startup_64_no_verify+0xce/0xdb
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ir_raw_event_store_with_filter+0x424/0x590 drivers/media/rc/rc-ir-raw.c:184
Code: 80 3c 02 00 0f 85 5b 01 00 00 4c 8b a5 b8 05 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 d8 10 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4b 01 00 00 48 ba 00 00 00 00 00 fc ff df 48 89
RSP: 0018:ffffc900001e0940 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: ffffc900001e09b0 RCX: 0000000000000100
RDX: 000000000000021b RSI: ffffffff861d41c9 RDI: 00000000000010d8
RBP: ffff888017615000 R08: 000000000000001e R09: 0000000000000000
R10: 0000000000000101 R11: 203a306372206372 R12: 0000000000000000
R13: ffffc900001e09b5 R14: 0000000000000e80 R15: ffff8880176155b8
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2d9dbe3160 CR3: 000000007281c000 CR4: 0000000000350ee0
----------------
Code disassembly (best guess):
   0:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   4:	0f 85 5b 01 00 00    	jne    0x165
   a:	4c 8b a5 b8 05 00 00 	mov    0x5b8(%rbp),%r12
  11:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  18:	fc ff df
  1b:	49 8d bc 24 d8 10 00 	lea    0x10d8(%r12),%rdi
  22:	00
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 4b 01 00 00    	jne    0x17f
  34:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  3b:	fc ff df
  3e:	48                   	rex.W
  3f:	89                   	.byte 0x89

Crashes (37):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2022/10/25 01:55 upstream 247f34f7b803 ff2fe65d .config log report syz C general protection fault in ir_raw_event_store_with_filter
ci-upstream-kasan-gce 2022/10/13 16:22 upstream 55be6084c8e0 adf90437 .config log report syz C general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/13 15:55 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d adf90437 .config log report syz C general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2020/03/12 16:23 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c d850e9d0 .config log report syz C
ci2-upstream-usb 2020/03/10 20:54 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c 35f53e45 .config log report syz C
ci2-upstream-usb 2022/12/06 02:27 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 751fbcc59a16 045cbb84 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/19 00:59 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing dd65a243a915 5bb70014 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/15 12:24 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing dd65a243a915 97de9cfc .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/14 18:55 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing dd65a243a915 943f4cb8 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/14 12:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing dd65a243a915 943f4cb8 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/12 13:34 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing dd65a243a915 f42ee5d8 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/12 05:13 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing dd65a243a915 f42ee5d8 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/11 00:33 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing d65e6b6e884a 3ead01ad .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/11 00:06 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing d65e6b6e884a 3ead01ad .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/10 17:47 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing d65e6b6e884a 3ead01ad .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/10 03:18 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing d65e6b6e884a b2488a87 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/07 23:06 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a8bc8cc193c6 a779b11a .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/06 22:26 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a8bc8cc193c6 6d752409 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/06 20:33 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a8bc8cc193c6 6d752409 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/05 06:10 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a8bc8cc193c6 6d752409 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/03 23:16 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a8bc8cc193c6 6d752409 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/11/03 05:51 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing bd707a4f9ebe 7a2ebf95 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/30 17:16 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d 2a71366b .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/30 05:16 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d 2a71366b .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/30 03:52 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d 2a71366b .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/29 17:42 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d 2a71366b .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/29 12:09 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d 899d812a .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/29 11:38 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d 899d812a .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/28 02:25 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d 5c716ff6 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/13 15:05 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a6afa4199d3d adf90437 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/07 04:53 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 00988f70a076 80b58a42 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/10/04 14:10 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 00988f70a076 eab8f949 .config log report info general protection fault in ir_raw_event_store_with_filter
ci-upstream-linux-next-kasan-gce-root 2022/09/30 13:09 linux-next aaa11ce2ffc8 1d385642 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/09/28 22:53 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing bce2b0539933 a41a2080 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/09/24 11:33 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing ad5dbfc123e6 0042f2b4 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/07/02 09:03 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 90557fa89d3e 1434eec0 .config log report info general protection fault in ir_raw_event_store_with_filter
ci2-upstream-usb 2022/09/14 06:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 7eb2bf871454 b884348d .config log report info KASAN: use-after-free Read in ir_raw_event_store_with_filter
* Struck through repros no longer work on HEAD.