syzbot

 sign-in | mailing list | source | docs
🐞 Open [1169] ≡ Subsystems 🐞 Fixed [4404] 🐞 Invalid [9905] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in cdev_del

Status: fixed on 2020/09/16 22:51
Subsystems: fs (incorrect?)
Reported-by: syzbot+67b2bd0e34f952d0321e@syzkaller.appspotmail.com
Fix commit: e911e99a0770 usb: hso: check for return value in hso_serial_common_create()
First crash: 1398d, last: 929d
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: use-after-free Read in device_del 2 1286d 1391d 0/24 closed as dup on 2019/08/19 18:37
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in cdev_del (2) fs C error 45 634d 912d 22/24 fixed on 2021/11/10 00:50
linux-4.19 general protection fault in cdev_del vfs C 415 19d 1203d 0/1 upstream: reported C repro on 2019/12/09 03:59
linux-4.14 general protection fault in cdev_del vfs C 279 20d 1208d 0/1 upstream: reported C repro on 2019/12/04 03:14
Last patch testing requests:
Created Duration User Patch Repo Result
2020/07/28 04:50 18m rkovhaev@gmail.com patch upstream OK
2020/07/28 02:42 10m rkovhaev@gmail.com patch upstream report log
2020/07/28 01:54 9m rkovhaev@gmail.com patch upstream report log
2020/07/22 19:09 15m rkovhaev@gmail.com upstream report log
2019/08/13 13:03 11m andreyknvl@google.com patch https://github.com/google/kasan.git 69bbe8c7 report log

Sample crash report:
hso 6-1:0.0: Failed to find BULK IN ep
general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:cdev_del+0x22/0x90 fs/char_dev.c:593
Code: cf 0f 1f 80 00 00 00 00 55 48 89 fd 48 83 ec 08 e8 a3 dd d1 ff 48 8d 7d 64 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 4f 48
RSP: 0018:ffff8881da1d7190 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff8881d5250100 RCX: ffffffff821d817e
RDX: 000000000000000c RSI: ffffffff816e5d0d RDI: 0000000000000064
RBP: 0000000000000000 R08: ffff8881da19e300 R09: fffffbfff126c8d6
R10: ffffffff893646af R11: fffffbfff126c8d5 R12: 0000000000000000
R13: ffff8881d531d000 R14: ffff8881cce39000 R15: ffff8881cd390070
FS:  0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043f8b0 CR3: 00000001c90c8000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 tty_unregister_device drivers/tty/tty_io.c:3193 [inline]
 tty_unregister_device+0x10d/0x1a0 drivers/tty/tty_io.c:3188
 hso_serial_tty_unregister drivers/net/usb/hso.c:2232 [inline]
 hso_create_bulk_serial_device drivers/net/usb/hso.c:2678 [inline]
 hso_probe.cold+0x6e/0x15a drivers/net/usb/hso.c:2944
 usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:374
 really_probe+0x290/0xac0 drivers/base/dd.c:527
 driver_probe_device+0x223/0x350 drivers/base/dd.c:701
 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:808
 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431
 __device_attach+0x21a/0x390 drivers/base/dd.c:874
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0x1367/0x1c20 drivers/base/core.c:2533
 usb_set_configuration+0xed4/0x1850 drivers/usb/core/message.c:2025
 usb_generic_driver_probe+0x9d/0xe0 drivers/usb/core/generic.c:241
 usb_probe_device+0xd9/0x230 drivers/usb/core/driver.c:272
 really_probe+0x290/0xac0 drivers/base/dd.c:527
 driver_probe_device+0x223/0x350 drivers/base/dd.c:701
 __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:808
 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431
 __device_attach+0x21a/0x390 drivers/base/dd.c:874
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0x1367/0x1c20 drivers/base/core.c:2533
 usb_new_device.cold+0x552/0xf6e drivers/usb/core/hub.c:2548
 hub_port_connect drivers/usb/core/hub.c:5195 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5335 [inline]
 port_event drivers/usb/core/hub.c:5481 [inline]
 hub_event+0x226d/0x43c0 drivers/usb/core/hub.c:5563
 process_one_work+0x965/0x1630 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x326/0x430 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 076965a4c739303a ]---
RIP: 0010:cdev_del+0x22/0x90 fs/char_dev.c:593
Code: cf 0f 1f 80 00 00 00 00 55 48 89 fd 48 83 ec 08 e8 a3 dd d1 ff 48 8d 7d 64 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 4f 48
RSP: 0018:ffff8881da1d7190 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff8881d5250100 RCX: ffffffff821d817e
RDX: 000000000000000c RSI: ffffffff816e5d0d RDI: 0000000000000064
RBP: 0000000000000000 R08: ffff8881da19e300 R09: fffffbfff126c8d6
R10: ffffffff893646af R11: fffffbfff126c8d5 R12: 0000000000000000
R13: ffff8881d531d000 R14: ffff8881cce39000 R15: ffff8881cd390070
FS:  0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043f8b0 CR3: 00000001c90c8000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (315):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-upstream-usb 2020/05/15 05:20 https://github.com/google/kasan.git usb-fuzzer 059e7e0ff26c 2d572622 .config console log report syz C
ci2-upstream-usb 2020/05/14 14:45 https://github.com/google/kasan.git usb-fuzzer 059e7e0ff26c 2d572622 .config console log report syz C
ci2-upstream-usb 2020/05/14 06:37 https://github.com/google/kasan.git usb-fuzzer 059e7e0ff26c a885920d .config console log report syz C
ci2-upstream-usb 2020/04/08 23:59 https://github.com/google/kasan.git usb-fuzzer 0fa84af850a4 db9bcd4b .config console log report syz C
ci2-upstream-usb 2020/04/04 08:45 https://github.com/google/kasan.git usb-fuzzer 0fa84af850a4 ef26b610 .config console log report syz C
ci2-upstream-usb 2020/03/30 06:35 https://github.com/google/kasan.git usb-fuzzer 0fa84af850a4 05736b29 .config console log report syz C
ci2-upstream-usb 2020/03/19 09:04 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c 2c31c529 .config console log report syz C
ci2-upstream-usb 2020/03/01 19:43 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c c88c7b75 .config console log report syz C
ci2-upstream-usb 2020/02/27 17:14 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c 40bcfdd5 .config console log report syz C
ci2-upstream-usb 2020/02/24 22:49 https://github.com/google/kasan.git usb-fuzzer d6ff8147a51c 59b57593 .config console log report syz C
ci2-upstream-usb 2020/02/15 18:45 https://github.com/google/kasan.git usb-fuzzer 7f0cd6c7c423 5d7b90f1 .config console log report syz C
ci2-upstream-usb 2020/02/08 00:57 https://github.com/google/kasan.git usb-fuzzer e5cd56e94edd 06150bf1 .config console log report syz C
ci2-upstream-usb 2020/02/07 20:44 https://github.com/google/kasan.git usb-fuzzer e5cd56e94edd 06150bf1 .config console log report syz C
ci2-upstream-usb 2020/01/25 09:28 https://github.com/google/kasan.git usb-fuzzer cd234325a5f1 2e95ab33 .config console log report syz C
ci2-upstream-usb 2020/01/23 11:17 https://github.com/google/kasan.git usb-fuzzer 4cc301ee04d9 3334d684 .config console log report syz C
ci2-upstream-usb 2019/12/19 19:16 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 36650b4b .config console log report syz C
ci2-upstream-usb 2019/12/07 12:22 https://github.com/google/kasan.git usb-fuzzer 1f22d15c209f 85f26751 .config console log report syz C
ci2-upstream-usb 2019/12/06 20:01 https://github.com/google/kasan.git usb-fuzzer 1f22d15c209f 85f26751 .config console log report syz C
ci2-upstream-usb 2019/12/01 12:30 https://github.com/google/kasan.git usb-fuzzer 32b5e2b28188 a76bf83f .config console log report syz C
ci2-upstream-usb 2019/11/16 19:17 https://github.com/google/kasan.git usb-fuzzer 46178223c0ca cdac920b .config console log report syz C
ci2-upstream-usb 2019/11/11 09:03 https://github.com/google/kasan.git usb-fuzzer 3183c03757f8 dc438b91 .config console log report syz C
ci2-upstream-usb 2019/11/07 13:05 https://github.com/google/kasan.git usb-fuzzer d60bbfea36c1 d797d201 .config console log report syz C
ci2-upstream-usb 2019/11/05 21:41 https://github.com/google/kasan.git usb-fuzzer b1aa9d834830 af5c522d .config console log report syz C
ci2-upstream-usb 2019/11/05 21:11 https://github.com/google/kasan.git usb-fuzzer b1aa9d834830 af5c522d .config console log report syz C
ci2-upstream-usb 2019/10/26 05:37 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 413926c5 .config console log report syz C
ci2-upstream-usb 2019/10/23 20:04 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 b602d64b .config console log report syz C
ci2-upstream-usb 2019/10/22 22:35 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 4ee855e7 .config console log report syz C
ci2-upstream-usb 2019/10/15 08:56 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 05ad7292 .config console log report syz C
ci2-upstream-usb 2019/10/06 02:46 https://github.com/google/kasan.git usb-fuzzer 58d5f26a5584 f3f7d9c8 .config console log report syz C
ci2-upstream-usb 2019/10/05 03:02 https://github.com/google/kasan.git usb-fuzzer 58d5f26a5584 f3f7d9c8 .config console log report syz C
ci2-upstream-usb 2019/10/03 15:58 https://github.com/google/kasan.git usb-fuzzer 58d5f26a5584 fc17ba49 .config console log report syz C
ci2-upstream-usb 2019/10/02 19:42 https://github.com/google/kasan.git usb-fuzzer 58d5f26a5584 2e29b534 .config console log report syz C
ci2-upstream-usb 2019/09/27 22:37 https://github.com/google/kasan.git usb-fuzzer 2994c07743fe d8074e0b .config console log report syz C
ci2-upstream-usb 2019/09/25 06:20 https://github.com/google/kasan.git usb-fuzzer d9e63adcd16e e38a6630 .config console log report syz C
ci2-upstream-usb 2019/09/22 02:57 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config console log report syz C
ci2-upstream-usb 2019/09/21 07:30 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config console log report syz C
ci2-upstream-usb 2019/09/12 01:24 https://github.com/google/kasan.git usb-fuzzer f0df5c1be1e9 f4e53c10 .config console log report syz C
ci2-upstream-usb 2019/08/31 23:07 https://github.com/google/kasan.git usb-fuzzer eea39f24f4a5 bad3cce2 .config console log report syz C
ci2-upstream-usb 2019/06/06 13:20 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f a547defc .config console log report syz C
ci2-upstream-usb 2019/05/28 02:54 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 6bd61501 .config console log report syz C
ci2-upstream-usb 2019/06/02 09:48 https://github.com/google/kasan.git usb-fuzzer 69bbe8c72e6f 53c81ea5 .config console log report syz
ci-upstream-kasan-gce-smack-root 2020/09/07 08:35 upstream a8205e310011 abf9ba4f .config console log report
ci-upstream-kasan-gce 2020/09/04 19:24 upstream 59126901f200 abf9ba4f .config console log report
ci-upstream-kasan-gce 2020/09/03 19:40 upstream fc3abb53250a abf9ba4f .config console log report
ci-upstream-kasan-gce-root 2020/08/26 05:21 upstream abb3438d69fb 344da168 .config console log report
ci-upstream-kasan-gce 2020/08/25 12:56 upstream 6a9dc5fd6170 344da168 .config console log report
ci-upstream-kasan-gce-smack-root 2020/08/20 11:44 upstream 7eac66d0456f ed282a3a .config console log report
ci-upstream-kasan-gce-root 2020/08/17 03:42 upstream 2cc3c4b3c2e9 424dd8e7 .config console log report
ci-upstream-kasan-gce-smack-root 2020/08/12 00:43 upstream 00e4db51259a bacaf5fa .config console log report
ci-upstream-kasan-gce-smack-root 2020/08/08 22:26 upstream 449dc8c97089 f721e4a0 .config console log report
ci-upstream-kasan-gce-smack-root 2020/08/07 15:58 upstream d6efb3ac3e6c cb436c69 .config console log report
ci-upstream-kasan-gce-smack-root 2020/08/01 15:01 upstream 7dc6fd0f3b84 d895b3be .config console log report
ci-upstream-kasan-gce-smack-root 2020/07/29 21:39 upstream 6ba1b005ffc3 19a8de55 .config console log report
ci-upstream-kasan-gce 2020/07/22 12:59 upstream 4fa640dc5230 128cd85f .config console log report
ci-upstream-kasan-gce-selinux-root 2020/07/22 00:23 upstream 4fa640dc5230 21f1765e .config console log report
ci-upstream-kasan-gce-selinux-root 2020/07/20 03:10 upstream 92188b41f139 9c812472 .config console log report
ci-upstream-kasan-gce 2020/07/19 11:55 upstream f932d58abc38 9c812472 .config console log report
ci-upstream-kasan-gce 2020/07/18 15:19 upstream 6a70f89cc58f 9c812472 .config console log report
ci-upstream-kasan-gce 2020/07/16 01:47 upstream e9919e11e219 f3bec699 .config console log report
ci-upstream-kasan-gce 2020/07/14 10:01 upstream 0dc589da873b ce4c95b3 .config console log report
ci-upstream-kasan-gce-smack-root 2020/07/05 09:54 upstream 7cc2a8ea1048 51095195 .config console log report
ci-upstream-kasan-gce-smack-root 2020/07/01 23:29 upstream 7c30b859a947 39acb39d .config console log report
ci-upstream-kasan-gce 2020/07/01 04:02 upstream 9ebcfadb0610 917afeaa .config console log report
ci-upstream-kasan-gce-selinux-root 2020/06/21 06:58 upstream 7ae77150d94d c655ec77 .config console log report
ci-upstream-kasan-gce-selinux-root 2020/06/19 16:04 upstream 7ae77150d94d bc258b50 .config console log report
ci-upstream-kasan-gce-root 2020/06/18 01:20 upstream 7ae77150d94d b9f3810b .config console log report
ci-upstream-kasan-gce-root 2020/06/17 04:56 upstream 7ae77150d94d 559fbe2d .config console log report
ci-upstream-kasan-gce-386 2020/06/11 00:39 upstream 7ae77150d94d a6f7998d .config console log report
ci-qemu-upstream-386 2020/01/12 22:25 upstream 040a3c33623b 53faa9fe .config console log report
ci-upstream-linux-next-kasan-gce-root 2020/08/07 11:16 linux-next 01830e6c042e cb436c69 .config console log report
ci2-upstream-usb 2020/08/06 01:13 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing e3ee0e740c38 0487ea6f .config console log report
ci2-upstream-usb 2020/08/05 21:32 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing e3ee0e740c38 0487ea6f .config console log report
ci2-upstream-usb 2020/08/04 21:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing e3ee0e740c38 02034dac .config console log report
ci2-upstream-usb 2020/07/30 23:19 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing e3ee0e740c38 8df85ed9 .config console log report
ci2-upstream-usb 2020/07/30 12:16 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing e3ee0e740c38 b0947553 .config console log report
ci2-upstream-usb 2020/07/29 01:23 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fa56dd9152ef cb93dc6a .config console log report
ci2-upstream-usb 2020/07/20 08:46 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing eed3c957dd8c 9c812472 .config console log report
ci2-upstream-usb 2020/07/17 06:18 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 313da01ad524 54b3c45e .config console log report
ci2-upstream-usb 2020/07/15 04:00 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 25051b55a2f6 ada108d0 .config console log report
ci2-upstream-usb 2020/07/14 21:14 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 25051b55a2f6 6f458026 .config console log report
ci2-upstream-usb 2020/07/13 21:51 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 25051b55a2f6 ce4c95b3 .config console log report
ci2-upstream-usb 2020/07/12 21:46 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 25051b55a2f6 9ebcc5b1 .config console log report
ci2-upstream-usb 2020/07/07 22:04 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 768a07412843 08fc4ef1 .config console log report
ci2-upstream-usb 2020/07/07 17:31 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 768a07412843 42723355 .config console log report
ci2-upstream-usb 2020/07/05 01:08 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 768a07412843 24d7f505 .config console log report
ci2-upstream-usb 2020/07/03 03:40 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing c8d141ce1b85 f30c14bf .config console log report
ci2-upstream-usb 2020/07/01 10:28 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9cf6ffae3800 c0383ebe .config console log report
ci-upstream-linux-next-kasan-gce-root 2020/07/01 08:38 linux-next c28e58ee9dad 917afeaa .config console log report
ci2-upstream-usb 2020/06/30 07:10 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9cf6ffae3800 917afeaa .config console log report
ci2-upstream-usb 2020/06/29 21:53 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9cf6ffae3800 ce9ef6f2 .config console log report
ci2-upstream-usb 2020/06/28 09:53 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report
ci2-upstream-usb 2020/06/28 02:04 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report
ci2-upstream-usb 2020/06/27 22:51 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a5ce874c26 a2cdad9d .config console log report
ci2-upstream-usb 2020/06/27 06:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c ffec44b5 .config console log report
ci2-upstream-usb 2020/06/26 16:58 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 9506ea6d .config console log report
ci2-upstream-usb 2020/06/26 05:33 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c aea82c00 .config console log report
ci2-upstream-usb 2020/06/24 20:03 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 9d60b18e .config console log report
ci2-upstream-usb 2020/06/24 17:45 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing fb5746826a0c 41694dbf .config console log report
ci2-upstream-usb 2020/06/16 06:39 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b3a9e3b9622a baca2611 .config console log report
ci2-upstream-usb 2020/06/15 01:56 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b791d1bdf921 2a22c77a .config console log report
ci2-upstream-usb 2020/06/12 13:19 https://github.com/google/kasan.git usb-fuzzer b791d1bdf921 819b58b0 .config console log report
ci2-upstream-usb 2020/06/12 06:04 https://github.com/google/kasan.git usb-fuzzer 2089c6ed5a17 819b58b0 .config console log report
* Struck through repros no longer work on HEAD.