syzbot


general protection fault in vsscanf

Status: public: reported C repro on 2019/04/14 00:00
Reported-by: syzbot+0136c277278a6ab86abe@syzkaller.appspotmail.com
First crash: 2116d, last: 2065d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in vsscanf v9fs C 7 2085d 2115d 8/26 fixed on 2018/09/03 14:47

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
FAT-fs (loop0): bogus number of reserved sectors
FAT-fs (loop0): Can't find a valid FAT filesystem
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3630 Comm: syz-executor234 Not tainted 4.9.119-g92e8704 #22
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801c66a6000 task.stack: ffff8801c5040000
RIP: 0010:[<ffffffff81edc6af>]  [<ffffffff81edc6af>] vsscanf+0x33f/0x2430 lib/vsprintf.c:2680
RSP: 0018:ffff8801c50474e8  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffff841a3c41 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81edc6a2 RDI: ffffffff841a3c40
RBP: ffff8801c5047698 R08: ffff8801c5047860 R09: ffff8801c5047864
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff841a3c41
R13: 0000000000000064 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000001101880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000413720 CR3: 00000001c6daa000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801c66a6000 fffffbfff07c4739 1ffff10038a08ea6 0000000000000000
 00000000000002ff 00000000c5047530 ffffffff8123ffff ffff8801c50476c8
 ffffffff841a3c64 0000000041b58ab3 ffffffff843e4e98 ffffffff81edc370
Call Trace:
 [<ffffffff81ede84b>] sscanf+0xab/0xe0 lib/vsprintf.c:2885
 [<ffffffff839c8927>] valid_ipaddr4 net/9p/trans_fd.c:900 [inline]
 [<ffffffff839c8927>] p9_fd_create_tcp+0x127/0x430 net/9p/trans_fd.c:940
 [<ffffffff839b71ff>] p9_client_create+0x6ff/0x10a0 net/9p/client.c:1036
 [<ffffffff8195b613>] v9fs_session_init+0x333/0x13a0 fs/9p/v9fs.c:343
 [<ffffffff8194cf0d>] v9fs_mount+0x7d/0x810 fs/9p/vfs_super.c:130
 [<ffffffff8157e65c>] mount_fs+0x28c/0x370 fs/super.c:1206
 [<ffffffff815dde81>] vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991
 [<ffffffff815e57a9>] vfs_kern_mount fs/namespace.c:973 [inline]
 [<ffffffff815e57a9>] do_new_mount fs/namespace.c:2513 [inline]
 [<ffffffff815e57a9>] do_mount+0x3c9/0x2740 fs/namespace.c:2835
 [<ffffffff815e84fe>] SYSC_mount fs/namespace.c:3051 [inline]
 [<ffffffff815e84fe>] SyS_mount+0xfe/0x110 fs/namespace.c:3028
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839fccd3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: ff 45 84 ed 0f 84 c9 fe ff ff e8 3d 24 48 ff 41 80 fd 6e 0f 84 34 02 00 00 e8 2e 24 48 ff 4c 89 f8 4c 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 30 38 d0 7f 08 84 c0 0f 85 dd 17 00 00 41 80 3f 00 
RIP  [<ffffffff81edc6af>] vsscanf+0x33f/0x2430 lib/vsprintf.c:2680
 RSP <ffff8801c50474e8>
---[ end trace f16d0719c81dd740 ]---

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/08/09 21:54 https://android.googlesource.com/kernel/common android-4.9 92e87041ed2d 1fb62d58 .config console log report syz C ci-android-49-kasan-gce-root
2018/07/10 17:40 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 9fa03fa5 .config console log report syz C ci-android-49-kasan-gce-root
2018/07/10 01:25 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 f25e5770 .config console log report syz C ci-android-49-kasan-gce
2018/07/10 01:12 https://android.googlesource.com/kernel/common android-4.9 03c70feafdb2 f25e5770 .config console log report syz C ci-android-49-kasan-gce-386
2018/08/29 07:06 https://android.googlesource.com/kernel/common android-4.9 09eb2ba5ed0c 53ff8784 .config console log report ci-android-49-kasan-gce-root
2018/08/09 03:23 https://android.googlesource.com/kernel/common android-4.9 856452b4f22e 2eeda842 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.