syzbot


BUG: unable to handle kernel NULL pointer dereference in syscall_trace_enter

Status: auto-closed as invalid on 2021/01/09 10:09
Reported-by: syzbot+ead7a3b7525ca598b2ac@syzkaller.appspotmail.com
First crash: 1388d, last: 1321d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in syscall_trace_enter kernel 1 1387d 1383d 0/26 closed as dup on 2020/08/15 13:51

Sample crash report:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000007
PGD 0 P4D 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3708 Comm: systemd-udevd Not tainted 4.19.144-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:syscall_trace_enter+0x3ae/0xd60 arch/x86/entry/common.c:132
Code: 4d 85 ed 0f 85 18 02 00 00 e8 ee 2b 69 00 48 8b 14 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 b3 08 00 00 <4c> 8b 77 00 70 07 00 70 00 00 00 00 00 00 00 70 07 00 70 07 77 00
RSP: 0018:ffff88808efefe30 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88808efeff58 RCX: ffffffff810085d4
RDX: 1ffff11011dfdffa RSI: ffffffff810085e2 RDI: 0000000000000007
RBP: ffff88808efe0680 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000000 R12: 1ffff11011dfdfca
R13: 0000000000000000 R14: 000000000000004e R15: 000055711b72ab40
FS:  00007f5c13a028c0(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000007 CR3: 000000008e83f000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_syscall_64+0x486/0x620 arch/x86/entry/common.c:283
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5c1284df2b
Code: fc ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 57 41 56 48 63 ff 41 55 41 54 b8 4e 00 00 00 55 53 48 89 f3 48 83 ec 08 0f 05 <48> 3d 00 f0 ff ff 77 55 48 8d 2c 06 49 89 c4 48 39 ee 73 34 90 44
RSP: 002b:00007ffd5d293050 EFLAGS: 00000206 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 000055711b72ab40 RCX: 00007f5c1284df2b
RDX: 0000000000008000 RSI: 000055711b72ab40 RDI: 0000000000000011
RBP: 000055711b72ab40 R08: 00007f5c12b342e8 R09: 0000000000008040
R10: 00007f5c12b33b58 R11: 0000000000000206 R12: fffffffffffffe50
R13: 0000000000000000 R14: 00000000000000fd R15: 000055711b703860
Modules linked in:
CR2: 0000000000000007
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
CPU: 1 PID: 12788 Comm: syz-executor.5 Tainted: G      D           4.19.144-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:317 [inline]
RIP: 0010:test_ti_thread_flag include/linux/thread_info.h:84 [inline]
RIP: 0010:addr_limit_user_check include/linux/syscalls.h:262 [inline]
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:190 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
RIP: 0010:do_syscall_64+0x22a/0x620 arch/x86/entry/common.c:296
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 31 ff 49 c1 ec <1f> 41 83 e4 01 44 89 e6 e8 c9 18 69 00 45 84 e4 74 71 e8 8f 17 69
RSP: 0018:ffff888060ed7f28 EFLAGS: 00010016
RAX: ffff8880932625ff RBX: 0000000000000000 RCX: ffffffff810099b3
RDX: 0000000000000000 RSI: 0000000081009980 RDI: 0000000000000005
RBP: ffff888060ed7f58 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffff88d25b58 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000001fcb940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f28f4dbadb8 CR3: 0000000060ec5000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45ba81
Code: 75 14 b8 23 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 84 cf fb ff c3 48 83 ec 08 e8 ea 46 00 00 48 89 04 24 b8 23 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 33 47 00 00 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffdfa8b7610 EFLAGS: 00000293 ORIG_RAX: 0000000000000023
RAX: 0000000000000000 RBX: 00000000000e5693 RCX: 000000000045ba81
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffdfa8b7620
RBP: 0000000000000bd9 R08: 0000000000000000 R09: 0000000001fcb940
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000004
R13: 00007ffdfa8b7670 R14: 00000000000e55aa R15: 00007ffdfa8b7680
Modules linked in:
---[ end trace 12bbd67fd81fbede ]---
general protection fault: 0000 [#3] PREEMPT SMP KASAN
RIP: 0010:syscall_trace_enter+0x3ae/0xd60 arch/x86/entry/common.c:132
CPU: 0 PID: 3708 Comm: systemd-udevd Tainted: G      D           4.19.144-syzkaller #0
Code: 4d 85 ed 0f 85 18 02 00 00 e8 ee 2b 69 00 48 8b 14 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 b3 08 00 00 <4c> 8b 77 00 70 07 00 70 00 00 00 00 00 00 00 70 07 00 70 07 77 00
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RSP: 0018:ffff88808efefe30 EFLAGS: 00010246
RIP: 0010:update_vsyscall+0x11/0x370 arch/x86/entry/vsyscall/vsyscall_gtod.c:32
RAX: dffffc0000000000 RBX: ffff88808efeff58 RCX: ffffffff810085d4
Code: 91 8b e8 92 22 9f 00 eb e5 48 c7 c7 80 a8 91 8b e8 84 22 9f 00 eb a1 66 90 41 57 41 56 41 55 41 54 55 48 89 fd 53 48 83 ec 00 <00> 00 00 00 70 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RDX: 1ffff11011dfdffa RSI: ffffffff810085e2 RDI: 0000000000000007
RSP: 0018:ffff8880ae607c38 EFLAGS: 00010082
RBP: ffff88808efe0680 R08: 0000000000000000 R09: 0000000000000000
RAX: dffffc0000000000 RBX: ffffffff8b91ac20 RCX: ffffffff815bc1df
R10: 0000000000000007 R11: 0000000000000000 R12: 1ffff11011dfdfca
RDX: 1ffffffff1723590 RSI: ffffffff815bc1f6 RDI: ffffffff8b91ac20
R13: 0000000000000000 R14: 000000000000004e R15: 000055711b72ab40
RBP: ffffffff8b91ac20 R08: 0000000000000001 R09: 000000003b9ac9ff
FS:  0000000001fcb940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
R10: 0000000000000005 R11: ffffffff8ad3a01b R12: 0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
R13: ffffffff8b91acb0 R14: 0000000036c33fd5 R15: ffffffff8b91ac48
CR2: 00007f28f4dbadb8 CR3: 0000000060ec5000 CR4: 00000000001406e0
FS:  00007f5c13a028c0(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
CR2: 0000000000000007 CR3: 000000008e83f000 CR4: 00000000001406f0

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/09/11 10:09 linux-4.19.y 67957f12548c adfb8b4e .config console log report ci2-linux-4-19
2020/07/06 12:10 linux-4.19.y 399849e4654e ac5a135b .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.