syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in scatterwalk_copychunks

Status: upstream: reported C repro on 2019/06/20 18:59
Reported-by: syzbot+6db79dbcb84d882b32d0@syzkaller.appspotmail.com
First crash: 1769d, last: 438d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (11)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in scatterwalk_copychunks (4) net crypto C done done 1341 123d 1134d 25/26 fixed on 2023/12/22 15:08
upstream general protection fault in scatterwalk_copychunks (3) crypto C 95 2009d 2136d 0/26 closed as invalid on 2019/06/10 23:08
upstream general protection fault in scatterwalk_copychunks (2) crypto C 141 2301d 2327d 3/26 fixed on 2018/01/11 01:23
linux-4.14 general protection fault in scatterwalk_copychunks C error 204 437d 1829d 0/1 upstream: reported C repro on 2019/04/21 07:15
linux-5.15 BUG: unable to handle kernel paging request in scatterwalk_copychunks 3 363d 400d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:08
upstream general protection fault in scatterwalk_copychunks crypto C 414 2329d 2338d 3/26 fixed on 2017/12/08 02:32
upstream general protection fault in scatterwalk_copychunks (5) crypto C done 2920 112d 119d 26/26 fixed on 2024/01/30 15:47
linux-4.14 KASAN: use-after-free Read in scatterwalk_copychunks C inconclusive 4 1175d 1829d 0/1 upstream: reported C repro on 2019/04/21 07:18
linux-4.19 KASAN: use-after-free Read in scatterwalk_copychunks C error 17 449d 1665d 0/1 upstream: reported C repro on 2019/10/03 04:34
linux-4.14 KASAN: slab-out-of-bounds Read in scatterwalk_copychunks C inconclusive 6 1183d 1686d 0/1 upstream: reported C repro on 2019/09/11 08:57
linux-6.1 BUG: unable to handle kernel paging request in scatterwalk_copychunks 1 311d 311d 0/3 auto-obsoleted due to no activity on 2023/09/25 13:18
▶ ▼ Fix bisection attempts (6)
Created Duration User Patch Repo Result
2022/06/11 00:23 11m bisect fix linux-4.19.y error job log (0)
2021/03/09 20:41 22m bisect fix linux-4.19.y job log (0) log
2020/10/11 20:39 25m bisect fix linux-4.19.y job log (0) log
2020/09/07 11:05 28m bisect fix linux-4.19.y job log (0) log
2020/08/08 00:41 25m bisect fix linux-4.19.y job log (0) log
2020/05/01 17:24 26m bisect fix linux-4.19.y job log (0) log

Sample crash report:
RBP: 00007f1aad40c550 R08: 0000000000000001 R09: 0000000000000034
R10: 0000800100020046 R11: 0000000000000246 R12: 00007f1aacb412f0
R13: 00007f1aad4404f8 R14: 8ff294b4e293e0ca R15: 0000000000000001
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8372 Comm: syz-executor273 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:73 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:98 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:55
Code: ff df 80 3c 02 00 0f 85 98 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 9f 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffff8880964a7238 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 000000000000401d RCX: ffffffff83739e13
RDX: 0000000000000001 RSI: ffffffff83739e63 RDI: 0000000000000007
RBP: 000000000000401d R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000001000 R14: ffff8880964a72e8 R15: 0000000000000001
FS:  00007f1aacb41700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c9dcf32160 CR3: 00000000b34bd000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 scatterwalk_map_and_copy crypto/scatterwalk.c:72 [inline]
 scatterwalk_map_and_copy+0x121/0x1a0 crypto/scatterwalk.c:60
 gcmaes_encrypt.constprop.0+0x89f/0xd90 arch/x86/crypto/aesni-intel_glue.c:980
Modules linked in:
Bluetooth: hci0: command 0x0409 tx timeout
---[ end trace 44ea24364e97302e ]---
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:73 [inline]
RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:98 [inline]
RIP: 0010:scatterwalk_copychunks+0x4db/0x6a0 crypto/scatterwalk.c:55
Code: ff df 80 3c 02 00 0f 85 98 01 00 00 49 8d 44 24 08 4d 89 26 48 89 c2 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 9f 01 00 00 48 b8 00 00 00 00
RSP: 0018:ffff8880964a7238 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 000000000000401d RCX: ffffffff83739e13
RDX: 0000000000000001 RSI: ffffffff83739e63 RDI: 0000000000000007
RBP: 000000000000401d R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000001000 R14: ffff8880964a72e8 R15: 0000000000000001
FS:  00007f1aacb41700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c9dcf32160 CR3: 00000000b34bd000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 80 3c 02 00 0f    	filds  0xf00023c(%rax)
   6:	85 98 01 00 00 49    	test   %ebx,0x49000001(%rax)
   c:	8d 44 24 08          	lea    0x8(%rsp),%eax
  10:	4d 89 26             	mov    %r12,(%r14)
  13:	48 89 c2             	mov    %rax,%rdx
  16:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
  1b:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  22:	fc ff df
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	74 08                	je     0x39
  31:	3c 03                	cmp    $0x3,%al
  33:	0f 8e 9f 01 00 00    	jle    0x1d8
  39:	48                   	rex.W
  3a:	b8 00 00 00 00       	mov    $0x0,%eax

Crashes (152):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/01/30 18:41 linux-4.19.y 3f8a27f9e27b b68fb8d6 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/10/28 06:35 linux-4.19.y 3f8a27f9e27b 5c716ff6 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/07/24 13:40 linux-4.19.y 3f8a27f9e27b 22343af4 .config console log report syz C ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/06/23 08:13 linux-4.19.y 3f8a27f9e27b 912f5df7 .config console log report syz C ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/06/15 19:25 linux-4.19.y 3f8a27f9e27b 1719ee24 .config console log report syz C ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/05/11 23:46 linux-4.19.y 3f8a27f9e27b beb0b407 .config console log report syz C ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2019/06/20 18:44 linux-4.19.y 9f31eb60d7a2 34bf9440 .config console log report syz C ci2-linux-4-19
2022/08/05 18:11 linux-4.19.y 3f8a27f9e27b a65a7ce9 .config console log report syz ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2023/02/10 07:54 linux-4.19.y 3f8a27f9e27b 07980f9d .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2023/02/09 09:45 linux-4.19.y 3f8a27f9e27b 14a312c8 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2023/02/01 21:23 linux-4.19.y 3f8a27f9e27b 9a6f477c .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2023/01/18 15:41 linux-4.19.y 3f8a27f9e27b 4620c2d9 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/12/14 05:22 linux-4.19.y 3f8a27f9e27b f6511626 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/12/05 02:11 linux-4.19.y 3f8a27f9e27b e080de16 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/11/23 19:38 linux-4.19.y 3f8a27f9e27b 52fdf57a .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/11/14 05:48 linux-4.19.y 3f8a27f9e27b 7ba4d859 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/10/28 16:48 linux-4.19.y 3f8a27f9e27b 8168b69e .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/10/15 15:48 linux-4.19.y 3f8a27f9e27b 67cb024c .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/10/14 10:58 linux-4.19.y 3f8a27f9e27b 4954e4b2 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/10/12 16:57 linux-4.19.y 3f8a27f9e27b 16a9c9e0 .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/09/30 00:33 linux-4.19.y 3f8a27f9e27b 45fd7169 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/09/24 11:28 linux-4.19.y 3f8a27f9e27b 0042f2b4 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/09/23 09:26 linux-4.19.y 3f8a27f9e27b 0042f2b4 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/09/21 18:21 linux-4.19.y 3f8a27f9e27b 380f82fb .config console log report info [disk image] [vmlinux] ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/09/13 21:40 linux-4.19.y 3f8a27f9e27b b884348d .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/08/18 15:33 linux-4.19.y 3f8a27f9e27b d58e263f .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/08/16 14:06 linux-4.19.y 3f8a27f9e27b 7a7cb304 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/08/08 22:23 linux-4.19.y 3f8a27f9e27b da700653 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/07/22 23:46 linux-4.19.y 3f8a27f9e27b 22343af4 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/07/21 11:50 linux-4.19.y 3f8a27f9e27b 6e67af9d .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/07/19 05:07 linux-4.19.y 3f8a27f9e27b ff988920 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/06/17 14:20 linux-4.19.y 3f8a27f9e27b cb58b3b2 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/06/15 21:14 linux-4.19.y 3f8a27f9e27b 1719ee24 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/05/10 10:29 linux-4.19.y 3f8a27f9e27b 8b277b8e .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/04/25 21:21 linux-4.19.y 3f8a27f9e27b 152baedd .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/04/22 10:08 linux-4.19.y 3f8a27f9e27b 2738b391 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/04/22 08:59 linux-4.19.y 3f8a27f9e27b 2738b391 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/04/20 11:22 linux-4.19.y 3f8a27f9e27b 7d7bc738 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/04/02 06:42 linux-4.19.y 3f8a27f9e27b 79a2a8fc .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/03/09 08:40 linux-4.19.y 3f8a27f9e27b 9e8eaa75 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/03/07 00:55 linux-4.19.y 3f8a27f9e27b 7bdd8b2c .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/02/25 21:34 linux-4.19.y 3f8a27f9e27b 45a13a73 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/02/23 19:15 linux-4.19.y 3f8a27f9e27b 6e821dbf .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/02/22 23:46 linux-4.19.y 3f8a27f9e27b 6e821dbf .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/02/01 00:28 linux-4.19.y 3f8a27f9e27b 6b7c57fe .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/01/19 02:59 linux-4.19.y 3f8a27f9e27b 731a2d23 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/01/17 16:42 linux-4.19.y 3f8a27f9e27b 731a2d23 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2022/01/15 12:12 linux-4.19.y 3f8a27f9e27b 723cfaf0 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2021/12/28 06:39 linux-4.19.y 3f8a27f9e27b 6b3c5e64 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2021/12/11 04:14 linux-4.19.y 3f8a27f9e27b 49ca1f59 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2021/11/15 19:35 linux-4.19.y 3f8a27f9e27b 75b04091 .config console log report info ci2-linux-4-19 general protection fault in scatterwalk_copychunks
2021/01/11 15:18 linux-4.19.y 610bdbf6a174 2c1f2513 .config console log report info ci2-linux-4-19
* Struck through repros no longer work on HEAD.