syzbot


kernel BUG at security/keys/keyring.c:LINE!

Status: fixed on 2019/03/06 07:43
Subsystems: keyrings lsm
[Documentation on labels]
Reported-by: syzbot+ec24e95ea483de0a24da@syzkaller.appspotmail.com
Fix commit: ede0fa98a900 KEYS: always initialize keyring_index_key::desc_len
First crash: 2082d, last: 1923d
Discussions (12)
Title Replies (including bot) Last reply
[PATCH] drm/i915: Fix i915_error_state_store error defination 5 (5) 2020/01/17 14:13
[PATCH 3.16 000/202] 3.16.66-rc1 review 205 (205) 2019/04/28 15:45
[PATCH 3.18 000/134] 3.18.137-stable review 149 (149) 2019/03/28 13:21
[PATCH 4.4 000/230] 4.4.177-stable review 235 (235) 2019/03/24 12:02
[PATCH 4.20 000/183] 4.20.13-stable review 198 (198) 2019/02/27 09:05
[PATCH 4.9 00/63] 4.9.161-stable review 69 (69) 2019/02/26 18:18
[PATCH 4.19 000/152] 4.19.26-stable review 157 (157) 2019/02/26 17:47
[PATCH 4.14 00/71] 4.14.104-stable review 77 (77) 2019/02/26 17:46
[PATCH] KEYS: always initialize keyring_index_key::desc_len 1 (1) 2019/02/22 15:36
[PATCH v2] KEYS: always initialize keyring_index_key::desc_len 6 (6) 2019/02/19 23:04
[PATCH] KEYS: always initialize keyring_index_key::desc_len 2 (2) 2018/11/03 01:57
kernel BUG at security/keys/keyring.c:LINE! 0 (1) 2018/10/05 11:16
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 kernel BUG at security/keys/keyring.c:LINE! C 3 1966d 1835d 0/1 public: reported C repro on 2019/04/10 16:04
android-49 kernel BUG at security/keys/keyring.c:LINE! C 3 1966d 1832d 0/3 public: reported C repro on 2019/04/14 08:51

Sample crash report:
audit: type=1400 audit(1543605253.577:35): avc:  denied  { map } for  pid=6177 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
audit: type=1400 audit(1543605275.257:36): avc:  denied  { map } for  pid=6190 comm="syz-executor926" path="/root/syz-executor926109541" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
------------[ cut here ]------------
kernel BUG at security/keys/keyring.c:1214!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 6190 Comm: syz-executor926 Not tainted 4.20.0-rc4+ #136
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__key_link_begin+0x23a/0x300 security/keys/keyring.c:1214
Code: fe 48 c7 c7 c0 bb 87 89 e8 03 1f 1f fe eb ac e8 5c 27 3e fe 48 c7 c7 c0 bb 87 89 e8 e0 ea 99 04 e9 e3 fe ff ff e8 46 27 3e fe <0f> 0b e8 3f 27 3e fe 48 8d bb ce 00 00 00 48 b8 00 00 00 00 00 fc
RSP: 0018:ffff8881ce1afb10 EFLAGS: 00010293
RAX: ffff8881cddd2400 RBX: ffff8881d4088080 RCX: ffffffff834161cf
RDX: 0000000000000000 RSI: ffffffff834163ba RDI: 0000000000000007
RBP: ffff8881ce1afb40 R08: ffff8881cddd2400 R09: fffffbfff130f658
R10: fffffbfff130f658 R11: ffffffff8987b2c3 R12: ffff8881ce1afc48
R13: 0000000000000000 R14: ffff8881d4088200 R15: ffff8881d4088080
FS:  0000000000e9a880(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020cab000 CR3: 00000001cddb9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 construct_alloc_key security/keys/request_key.c:389 [inline]
 construct_key_and_link security/keys/request_key.c:480 [inline]
 request_key_and_link+0x737/0x17a0 security/keys/request_key.c:593
 __do_sys_request_key security/keys/keyctl.c:213 [inline]
 __se_sys_request_key security/keys/keyctl.c:158 [inline]
 __x64_sys_request_key+0x305/0x400 security/keys/keyctl.c:158
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440139
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffecaee4828 EFLAGS: 00000217 ORIG_RAX: 00000000000000f9
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440139
RDX: 0000000020000200 RSI: 0000000020000040 RDI: 0000000020000000
RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 000000003bd9541f R11: 0000000000000217 R12: 00000000004019c0
R13: 0000000000401a50 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 88c784dfe345762a ]---
RIP: 0010:__key_link_begin+0x23a/0x300 security/keys/keyring.c:1214
Code: fe 48 c7 c7 c0 bb 87 89 e8 03 1f 1f fe eb ac e8 5c 27 3e fe 48 c7 c7 c0 bb 87 89 e8 e0 ea 99 04 e9 e3 fe ff ff e8 46 27 3e fe <0f> 0b e8 3f 27 3e fe 48 8d bb ce 00 00 00 48 b8 00 00 00 00 00 fc
RSP: 0018:ffff8881ce1afb10 EFLAGS: 00010293
RAX: ffff8881cddd2400 RBX: ffff8881d4088080 RCX: ffffffff834161cf
RDX: 0000000000000000 RSI: ffffffff834163ba RDI: 0000000000000007
RBP: ffff8881ce1afb40 R08: ffff8881cddd2400 R09: fffffbfff130f658
R10: fffffbfff130f658 R11: ffffffff8987b2c3 R12: ffff8881ce1afc48
R13: 0000000000000000 R14: ffff8881d4088200 R15: ffff8881d4088080
FS:  0000000000e9a880(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020cab000 CR3: 00000001cddb9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/30 19:18 upstream 94f371cb7394 ade12e91 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2018/11/30 11:05 upstream f92a2ebb3d55 66071e27 .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/11/30 11:04 upstream f92a2ebb3d55 66071e27 .config console log report syz C ci-upstream-kasan-gce-root
2018/10/05 10:23 upstream befad944e231 8b311eaf .config console log report syz C ci-upstream-kasan-gce-selinux-root
2018/10/05 09:48 upstream befad944e231 8b311eaf .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/10/05 09:43 upstream befad944e231 8b311eaf .config console log report syz C ci-upstream-kasan-gce-root
2018/10/05 09:45 linux-next 12ffaa1197f5 8b311eaf .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/12/01 06:25 linux-next 442b8cea2477 d8988561 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/01/12 10:31 upstream 4b3c31c8d4dd c3f3344c .config console log report ci-upstream-kasan-gce-root
2018/10/16 20:21 upstream b955a910d7fd 1ba7fd7e .config console log report ci-upstream-kasan-gce-smack-root
2018/08/06 20:12 upstream 1ffaddd029c8 1beb8136 .config console log report ci-upstream-kasan-gce-root
2019/01/13 04:30 linux-next b808822a75a3 c3f3344c .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.