syzbot


general protection fault in show_timer

Status: fixed on 2018/02/01 10:32
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+054c6cd125793643a90db21e4b9ddc71a881f797@syzkaller.appspotmail.com
Fix commit: cef31d9af908 posix-timer: Properly check sigevent->sigev_notify
First crash: 2562d, last: 2543d
Duplicate bugs (3)
duplicates (3):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: unable to handle kernel paging request in show_timer fs C 22 2542d 2559d 0/28 closed as dup on 2017/12/11 23:13
KASAN: global-out-of-bounds Read in show_timer fs C 165 2543d 2561d 0/28 closed as dup on 2017/12/11 23:14
general protection fault in string fs C 40 2542d 2560d 0/28 closed as dup on 2017/12/11 23:11

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3087 Comm: syzkaller620885 Not tainted 4.15.0-rc2+ #210
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:show_timer+0x1c7/0x2b0 fs/proc/base.c:2274
RSP: 0018:ffff8801cb97fac8 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffff8801cbf26e00 RCX: ffffffff81ccd0ee
RDX: 0000000050a6853d RSI: ffffffff85f1a0e0 RDI: 00000002853429e8
RBP: ffff8801cb97faf8 R08: ffffed0039747165 R09: ffffed0039747165
R10: ffff8801cb8d8200 R11: ffffed0039747164 R12: 0000000060000001
R13: ffff8801cbd71a80 R14: ffffffff85341aa0 R15: 0000000000000c0f
FS:  0000000001e9f880(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020b15000 CR3: 00000001cb879000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 seq_read+0x385/0x13d0 fs/seq_file.c:234
 do_loop_readv_writev fs/read_write.c:673 [inline]
 do_iter_read+0x3db/0x5b0 fs/read_write.c:897
 vfs_readv+0x121/0x1c0 fs/read_write.c:959
 do_preadv+0x11b/0x1a0 fs/read_write.c:1043
 SYSC_preadv fs/read_write.c:1093 [inline]
 SyS_preadv+0x30/0x40 fs/read_write.c:1088
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x440159
RSP: 002b:00007fff1f147728 EFLAGS: 00000217 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 00007fff1f147730 RCX: 0000000000440159
RDX: 0000000000000001 RSI: 0000000020b15000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 65732f636f72702f R09: 65732f636f72702f
R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401a20
R13: 0000000000401ab0 R14: 0000000000000000 R15: 0000000000000000
Code: 89 c7 4c 0f 44 f1 41 83 e4 fb 4d 63 e4 e8 f2 26 a3 ff 4a 8d 3c e5 e0 29 34 85 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 00 00 00 4a 8b 14 e5 e0 29 34 85 4c 89 ef 
RIP: show_timer+0x1c7/0x2b0 fs/proc/base.c:2274 RSP: ffff8801cb97fac8
---[ end trace f34776c6bf8284e1 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/07 02:38 upstream e56d565d67ae 5d643f8e .config console log report syz C ci-upstream-kasan-gce
2017/12/04 07:51 upstream ae64f9bd1d36 48359b97 .config console log report syz C ci-upstream-kasan-gce-386
2017/12/08 01:22 linux-next e40fd8d6b4d9 5d643f8e .config console log report syz C ci-upstream-next-kasan-gce
2017/12/04 03:16 mmots 4131d5166185 29b0fd90 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/11 11:21 upstream 50c4c4e268a2 5ad0ce95 .config console log report ci-upstream-kasan-gce
2017/11/29 19:53 upstream 43570f0383d6 34f2c233 .config console log report ci-upstream-kasan-gce-386
2017/12/19 05:15 mmots 82bcf1def3b5 1c4160ef .config console log report ci-upstream-mmots-kasan-gce
2017/12/04 02:48 mmots 4131d5166185 29b0fd90 .config console log report ci-upstream-mmots-kasan-gce
2017/11/30 23:15 linux-next 11fed7829bef 29b0fd90 .config console log report ci-upstream-next-kasan-gce
2017/11/30 16:23 linux-next 11fed7829bef 29b0fd90 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.