syzbot


general protection fault in scatterwalk_copychunks

Status: upstream: reported C repro on 2019/06/20 18:59
Reported-by: syzbot+6db79dbcb84d882b32d0@syzkaller.appspotmail.com
First crash: 1105d, last: 7d08h

Fix bisection: failed (bisect log)
similar bugs (8):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in scatterwalk_copychunks (4) C done 104 3d15h 471d 0/22 upstream: reported C repro on 2021/03/16 06:48
upstream general protection fault in scatterwalk_copychunks (3) C 95 1346d 1472d 0/22 closed as invalid on 2019/06/10 23:08
upstream general protection fault in scatterwalk_copychunks (2) C 141 1637d 1664d 3/22 fixed on 2018/01/11 01:23
linux-4.14 general protection fault in scatterwalk_copychunks C error 189 49d 1166d 0/1 upstream: reported C repro on 2019/04/21 07:15
upstream general protection fault in scatterwalk_copychunks C 414 1665d 1674d 3/22 fixed on 2017/12/08 02:32
linux-4.14 KASAN: use-after-free Read in scatterwalk_copychunks C inconclusive 4 511d 1166d 0/1 upstream: reported C repro on 2019/04/21 07:18
linux-4.19 KASAN: use-after-free Read in scatterwalk_copychunks C error 13 7d08h 1001d 0/1 upstream: reported C repro on 2019/10/03 04:34
linux-4.14 KASAN: slab-out-of-bounds Read in scatterwalk_copychunks C inconclusive 6 519d 1023d 0/1 upstream: reported C repro on 2019/09/11 08:57

Sample crash report:
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000034
R10: 0000800100022007 R11: 0000000000000246 R12: 00007fab6baba1f0
R13: 00007fffb57561ff R14: 00007fab6baba300 R15: 0000000000022000
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8124 Comm: syz-executor290 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:73 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:98 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:55
Code: ff df 80 3c 02 00 0f 85 98 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 9f 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffff888094f77238 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 000000000000401d RCX: ffffffff83739e13
RDX: 0000000000000001 RSI: ffffffff83739e63 RDI: 0000000000000007
RBP: 000000000000401d R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000001000 R14: ffff888094f772e8 R15: 0000000000000001
FS:  00007fab6baba700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557f56ad662f CR3: 00000000affdb000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 scatterwalk_map_and_copy crypto/scatterwalk.c:72 [inline]
 scatterwalk_map_and_copy+0x121/0x1a0 crypto/scatterwalk.c:60
 gcmaes_encrypt.constprop.0+0x89f/0xd90 arch/x86/crypto/aesni-intel_glue.c:980
Modules linked in:
---[ end trace a219cb25f9a91091 ]---
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:73 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:98 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:55
Code: ff df 80 3c 02 00 0f 85 98 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 9f 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffff888094f77238 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 000000000000401d RCX: ffffffff83739e13
RDX: 0000000000000001 RSI: ffffffff83739e63 RDI: 0000000000000007
RBP: 000000000000401d R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000001000 R14: ffff888094f772e8 R15: 0000000000000001
FS:  00007fab6baba700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb4464cd000 CR3: 00000000affdb000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 80 3c 02 00 0f    	filds  0xf00023c(%rax)
   6:	85 98 01 00 00 49    	test   %ebx,0x49000001(%rax)
   c:	8d 44 24 08          	lea    0x8(%rsp),%eax
  10:	4d 89 26             	mov    %r12,(%r14)
  13:	48 89 c2             	mov    %rax,%rdx
  16:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
  1b:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  22:	fc ff df
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	74 08                	je     0x39
  31:	3c 03                	cmp    $0x3,%al
  33:	0f 8e 9f 01 00 00    	jle    0x1d8
  39:	48                   	rex.W
  3a:	b8 00 00 00 00       	mov    $0x0,%eax

Crashes (125):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2022/06/23 08:13 linux-4.19.y 3f8a27f9e27b 912f5df7 .config log report syz C general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/06/15 19:25 linux-4.19.y 3f8a27f9e27b 1719ee24 .config log report syz C general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/05/11 23:46 linux-4.19.y 3f8a27f9e27b beb0b407 .config log report syz C general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2019/06/20 18:44 linux-4.19.y 9f31eb60d7a2 34bf9440 .config log report syz C
ci2-linux-4-19 2022/06/17 14:20 linux-4.19.y 3f8a27f9e27b cb58b3b2 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/06/15 21:14 linux-4.19.y 3f8a27f9e27b 1719ee24 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/05/10 10:29 linux-4.19.y 3f8a27f9e27b 8b277b8e .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/04/25 21:21 linux-4.19.y 3f8a27f9e27b 152baedd .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/04/22 10:08 linux-4.19.y 3f8a27f9e27b 2738b391 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/04/22 08:59 linux-4.19.y 3f8a27f9e27b 2738b391 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/04/20 11:22 linux-4.19.y 3f8a27f9e27b 7d7bc738 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/04/02 06:42 linux-4.19.y 3f8a27f9e27b 79a2a8fc .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/03/09 08:40 linux-4.19.y 3f8a27f9e27b 9e8eaa75 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/03/07 00:55 linux-4.19.y 3f8a27f9e27b 7bdd8b2c .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/02/25 21:34 linux-4.19.y 3f8a27f9e27b 45a13a73 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/02/23 19:15 linux-4.19.y 3f8a27f9e27b 6e821dbf .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/02/22 23:46 linux-4.19.y 3f8a27f9e27b 6e821dbf .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/02/01 00:28 linux-4.19.y 3f8a27f9e27b 6b7c57fe .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/01/19 02:59 linux-4.19.y 3f8a27f9e27b 731a2d23 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/01/17 16:42 linux-4.19.y 3f8a27f9e27b 731a2d23 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2022/01/15 12:12 linux-4.19.y 3f8a27f9e27b 723cfaf0 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/12/28 06:39 linux-4.19.y 3f8a27f9e27b 6b3c5e64 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/12/11 04:14 linux-4.19.y 3f8a27f9e27b 49ca1f59 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/11/15 19:35 linux-4.19.y 3f8a27f9e27b 75b04091 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/11/09 17:04 linux-4.19.y 3f8a27f9e27b 59bcaf9a .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/10/28 03:52 linux-4.19.y 3f8a27f9e27b be531bb4 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/10/23 13:33 linux-4.19.y 3f8a27f9e27b 282f03fb .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/10/22 22:19 linux-4.19.y 3f8a27f9e27b 282f03fb .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/10/21 06:45 linux-4.19.y 3f8a27f9e27b f111d03b .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/10/19 21:22 linux-4.19.y 3f8a27f9e27b 466b7db1 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/10/16 10:44 linux-4.19.y 3f8a27f9e27b 0c5d9412 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/10/08 02:23 linux-4.19.y 6db10b4d5efd efe0f24d .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/09/12 04:38 linux-4.19.y b172b44fcb17 3ce60af8 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/09/08 21:11 linux-4.19.y b172b44fcb17 e2776ee4 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/08/28 19:49 linux-4.19.y e23d55af0e1f be2c130d .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/08/16 23:31 linux-4.19.y 59456c9cc40c 6652437d .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/08/14 10:40 linux-4.19.y addba38e7c3b 2489ab88 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/08/01 00:57 linux-4.19.y 53bd76690e27 6c236867 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/07/23 17:17 linux-4.19.y 4938296e03bd bc5f1d88 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/07/02 10:23 linux-4.19.y 9f84340f012e 658ebc66 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/06/18 21:43 linux-4.19.y eb575cd5d7f6 aba2b2fb .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/05/22 08:54 linux-4.19.y 3c8c23092588 3c7fef33 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/04/24 05:27 linux-4.19.y 2965db2e004c 17f0b706 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/04/21 04:18 linux-4.19.y 2965db2e004c c0ced557 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/04/02 08:18 linux-4.19.y 2034d6f0838e 6a81331a .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/03/13 18:47 linux-4.19.y 030194a5b292 4a003785 .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/02/07 20:41 linux-4.19.y 811218eceeaa 2ce644fc .config log report info general protection fault in scatterwalk_copychunks
ci2-linux-4-19 2021/01/11 15:18 linux-4.19.y 610bdbf6a174 2c1f2513 .config log report info