syzbot


KASAN: out-of-bounds Read in exit_to_usermode_loop

Status: auto-closed as invalid on 2021/02/02 15:14
Reported-by: syzbot+25468ef861884b9c0b93@syzkaller.appspotmail.com
First crash: 1465d, last: 1465d

Sample crash report:
IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
==================================================================
BUG: KASAN: out-of-bounds in arch_local_irq_disable arch/x86/include/asm/paravirt.h:784 [inline]
BUG: KASAN: out-of-bounds in exit_to_usermode_loop+0x1cf/0x200 arch/x86/entry/common.c:174
Read of size 8 at addr ffffffff87d16910 by task modprobe/9604

CPU: 1 PID: 9604 Comm: modprobe Not tainted 4.14.198-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 print_address_description.cold+0x5/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
 arch_local_irq_disable arch/x86/include/asm/paravirt.h:784 [inline]
 exit_to_usermode_loop+0x1cf/0x200 arch/x86/entry/common.c:174

The buggy address belongs to the variable:
 pv_irq_ops+0x10/0x30

Memory state around the buggy address:
 ffffffff87d16800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff87d16880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff87d16900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                            ^
 ffffffff87d16980: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
 ffffffff87d16a00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/10/05 15:14 linux-4.14.y cbfa1702aaf6 1880b4a9 .config console log report info ci2-linux-4-14
* Struck through repros no longer work on HEAD.