syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

divide error in fbcon_switch

Status: fixed on 2020/09/01 18:34
Reported-by: syzbot+b8d8702856cf4c98144f@syzkaller.appspotmail.com
Fix commit: 74752b81eae8 vt: Reject zero-sized screen buffer size.
First crash: 1605d, last: 1365d
Fix bisection: fixed by (bisect log) :
commit 74752b81eae8ae64e97de222320026367e92c4b5
Author: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Sun Jul 12 11:10:12 2020 +0000

  vt: Reject zero-sized screen buffer size.

  
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream divide error in fbcon_switch fbdev C inconclusive done 326 1398d 1604d 0/26 closed as dup on 2020/07/27 22:47
linux-4.14 divide error in fbcon_switch C error 282 608d 1604d 0/1 upstream: reported C repro on 2019/12/03 01:21

Sample crash report:
audit: type=1400 audit(1595366579.088:8): avc:  denied  { execmem } for  pid=6445 comm="syz-executor086" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 4.19.133-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events console_callback
RIP: 0010:fbcon_update_softback drivers/video/fbdev/core/fbcon.c:360 [inline]
RIP: 0010:fbcon_switch+0x1fe/0x1d26 drivers/video/fbdev/core/fbcon.c:2217
Code: 2d 57 18 b3 08 48 89 2d d0 17 b3 08 38 ca 7c 08 84 c9 0f 85 0d 1b 00 00 41 8b 9c 24 3c 03 00 00 44 89 f0 31 d2 bf 05 00 00 00 <f7> f3 41 89 c6 89 c6 e8 26 3c e9 fd 41 83 fe 05 0f 8e 8d 0e 00 00
RSP: 0018:ffff8880a9f7f9c8 EFLAGS: 00010246
RAX: 0000000000008000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff83806d9d RDI: 0000000000000005
RBP: ffff8880a57d0040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888089e70100
R13: ffff8880a56f0e80 R14: 0000000000008000 R15: ffffffff87cf5ea0
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3fd5f4be78 CR3: 000000009331a000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 redraw_screen+0x37d/0x870 drivers/tty/vt/vt.c:1015
 complete_change_console+0xf9/0x610 drivers/tty/vt/vt_ioctl.c:1284
 change_console+0x196/0x560 drivers/tty/vt/vt_ioctl.c:1409
 console_callback+0x393/0x3f0 drivers/tty/vt/vt.c:2830
 process_one_work+0x864/0x1570 kernel/workqueue.c:2155
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
 kthread+0x30b/0x410 kernel/kthread.c:246
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace ae3797ceae826729 ]---
RIP: 0010:fbcon_update_softback drivers/video/fbdev/core/fbcon.c:360 [inline]
RIP: 0010:fbcon_switch+0x1fe/0x1d26 drivers/video/fbdev/core/fbcon.c:2217
Code: 2d 57 18 b3 08 48 89 2d d0 17 b3 08 38 ca 7c 08 84 c9 0f 85 0d 1b 00 00 41 8b 9c 24 3c 03 00 00 44 89 f0 31 d2 bf 05 00 00 00 <f7> f3 41 89 c6 89 c6 e8 26 3c e9 fd 41 83 fe 05 0f 8e 8d 0e 00 00
RSP: 0018:ffff8880a9f7f9c8 EFLAGS: 00010246
RAX: 0000000000008000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff83806d9d RDI: 0000000000000005
RBP: ffff8880a57d0040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888089e70100
R13: ffff8880a56f0e80 R14: 0000000000008000 R15: ffffffff87cf5ea0
FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3fd5f4be78 CR3: 000000009331a000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (259):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/21 21:24 linux-4.19.y 17a87580a885 e562dd8a .config console log report syz C ci2-linux-4-19
2019/12/02 20:31 linux-4.19.y 174651bdf802 ab342da3 .config console log report syz C ci2-linux-4-19
2020/07/29 07:29 linux-4.19.y 20b3a3dfdf6c 19a8de55 .config console log report ci2-linux-4-19
2020/07/29 02:38 linux-4.19.y 20b3a3dfdf6c cb93dc6a .config console log report ci2-linux-4-19
2020/07/24 11:58 linux-4.19.y 20b3a3dfdf6c 554af388 .config console log report ci2-linux-4-19
2020/07/24 05:37 linux-4.19.y 20b3a3dfdf6c 70c104a1 .config console log report ci2-linux-4-19
2020/07/22 07:06 linux-4.19.y 17a87580a885 21f1765e .config console log report ci2-linux-4-19
2020/07/21 20:56 linux-4.19.y 17a87580a885 e562dd8a .config console log report ci2-linux-4-19
2020/07/20 09:11 linux-4.19.y 17a87580a885 8caeeeb7 .config console log report ci2-linux-4-19
2020/07/20 06:55 linux-4.19.y 17a87580a885 9c812472 .config console log report ci2-linux-4-19
2020/07/17 05:19 linux-4.19.y 17a87580a885 54b3c45e .config console log report ci2-linux-4-19
2020/07/16 00:39 linux-4.19.y dce0f88600e4 ada108d0 .config console log report ci2-linux-4-19
2020/07/14 23:29 linux-4.19.y dce0f88600e4 ada108d0 .config console log report ci2-linux-4-19
2020/07/14 05:09 linux-4.19.y dce0f88600e4 ce4c95b3 .config console log report ci2-linux-4-19
2020/07/06 23:08 linux-4.19.y 399849e4654e ef278c73 .config console log report ci2-linux-4-19
2020/07/06 19:28 linux-4.19.y 399849e4654e ef278c73 .config console log report ci2-linux-4-19
2020/07/06 04:50 linux-4.19.y 399849e4654e 22f87567 .config console log report ci2-linux-4-19
2020/07/04 12:58 linux-4.19.y 399849e4654e 4f739670 .config console log report ci2-linux-4-19
2020/07/03 01:48 linux-4.19.y 399849e4654e f30c14bf .config console log report ci2-linux-4-19
2020/07/01 14:21 linux-4.19.y 399849e4654e 39acb39d .config console log report ci2-linux-4-19
2020/07/01 01:51 linux-4.19.y a39e75458e1c c0383ebe .config console log report ci2-linux-4-19
2020/06/28 08:09 linux-4.19.y a39e75458e1c a2cdad9d .config console log report ci2-linux-4-19
2020/06/26 22:57 linux-4.19.y a39e75458e1c ffec44b5 .config console log report ci2-linux-4-19
2020/06/26 19:29 linux-4.19.y a39e75458e1c 349959fb .config console log report ci2-linux-4-19
2020/06/26 15:13 linux-4.19.y a39e75458e1c 9506ea6d .config console log report ci2-linux-4-19
2020/06/25 23:58 linux-4.19.y a39e75458e1c aea82c00 .config console log report ci2-linux-4-19
2020/06/25 14:41 linux-4.19.y a39e75458e1c c7b4497a .config console log report ci2-linux-4-19
2020/06/25 13:28 linux-4.19.y b3a99fd385fa c7b4497a .config console log report ci2-linux-4-19
2020/06/25 11:35 linux-4.19.y b3a99fd385fa c7b4497a .config console log report ci2-linux-4-19
2020/06/25 10:24 linux-4.19.y b3a99fd385fa c7b4497a .config console log report ci2-linux-4-19
2020/06/24 15:59 linux-4.19.y b3a99fd385fa 41694dbf .config console log report ci2-linux-4-19
2020/06/23 11:54 linux-4.19.y b3a99fd385fa 54566aff .config console log report ci2-linux-4-19
2020/06/22 04:16 linux-4.19.y 3fc898571b97 eabcced4 .config console log report ci2-linux-4-19
2020/06/21 12:04 linux-4.19.y 3fc898571b97 4f2acff9 .config console log report ci2-linux-4-19
2020/06/21 08:58 linux-4.19.y 3fc898571b97 c655ec77 .config console log report ci2-linux-4-19
2020/06/21 07:28 linux-4.19.y 3fc898571b97 c655ec77 .config console log report ci2-linux-4-19
2020/06/20 02:02 linux-4.19.y 3fc898571b97 c655ec77 .config console log report ci2-linux-4-19
2020/06/19 16:02 linux-4.19.y 3fc898571b97 123cf502 .config console log report ci2-linux-4-19
2020/06/18 23:46 linux-4.19.y 3fc898571b97 3ea11d3f .config console log report ci2-linux-4-19
2020/06/17 09:47 linux-4.19.y 3fc898571b97 b9f3810b .config console log report ci2-linux-4-19
2020/06/17 03:24 linux-4.19.y 3fc898571b97 b9f3810b .config console log report ci2-linux-4-19
2020/06/16 23:23 linux-4.19.y 3fc898571b97 b9f3810b .config console log report ci2-linux-4-19
2020/06/16 07:54 linux-4.19.y 3fc898571b97 baca2611 .config console log report ci2-linux-4-19
2020/06/15 19:10 linux-4.19.y 3fc898571b97 8e3ab941 .config console log report ci2-linux-4-19
2020/06/15 09:23 linux-4.19.y 3fc898571b97 8e3ab941 .config console log report ci2-linux-4-19
2020/06/15 02:47 linux-4.19.y 3fc898571b97 2a22c77a .config console log report ci2-linux-4-19
2020/06/14 12:32 linux-4.19.y 3fc898571b97 2a22c77a .config console log report ci2-linux-4-19
2020/06/13 18:20 linux-4.19.y 3fc898571b97 dbce178a .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.