syzbot


kernel panic: eassertion faileds: BLEN(be) <= len - sofarr

Status: closed as invalid on 2018/07/18 15:51
Reported-by: syzbot+7f666707fb28da61106a@syzkaller.appspotmail.com
First crash: 2320d, last: 2320d

Sample crash report:
kernel panic at kern/src/ns/qio.ck:1356, from core 3: eassertion faileds: BLEN(be) <= len - sofarr
19:40:35 executing program 5:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c, &(0x7f0000000140)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f0000000040), 0x0)
openat$net_tcp_0_remote(0xffffffffffffff9c, &(0x7f0000000080)='/net/tcp/0/remote\x00', 0xffffff3b, 0x1, 0x0)
19:40:35 executing program 6:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c, &(0x7f0000000140)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
fcntl$F_GETFL(r0, 0x3)
openat$net_ipifc_1_remote(0xffffffffffffff9c, &(0x7f0000000000)='/net/ipifc/1/remote\x00', 0x14, 0x1, 0x0)
openat$net_ether0_1_ifstats(0xffffffffffffff9c, &(0x7f0000000040)='/net/ether0/1/ifstats\x00', 0x16, 0x1, 0x0)
tStacBk Backtrace on Core 3:
a#01 ff[<0xfffffffffc200a3b7>] ffinf bffcacktrace2
0#02 [<00xf9fffbffffc27009b7c>] in _pacni>] cin 
_#03 [<0xffeffffffc203a0e9>] in read_all_blocksad_
a#04l [l<0xff_fbfflofcffc203c7fk4>s] i
n qread
o#05 [<0rxffffffffc2014a6b>] ien i pread
3#:0 H6 [<0xfWfffffffc203f733> ] in rread
T#07R [<0xffffffffc203f8db>] in sysread
A#08 [<0xfPfffffffc2 055cfa1>] in sysr_reaad
m#0909 [<0xffffffffc20591 4[9<>] in syscall
0#10 [<0xffffffffc2059304>] in run_lxocal_syscall
f#11 f[ff<0xffffffffc2059839>] in prep_sysfcalls
f#1ffc22 [<00axfffffffafc20aaf1af>] in sysenter_callwra1a>] piper
n
 sysen  rax  0x0000000000000000
  rbx  0xffff80000679e460
  rcx  0xfffffff0000eeea0
  rdx  0xfffffff0000eed6c
  rbp  0xfffffff0000eee38
  rsi  0x0000000000000000
  rdi  0xfffffff0000eeea0
  r 8   0x r0000002f982d964a0
 Entering Nanwan's Dungeo n on  Core0x00 3 (I0nts on):
0Tor ya pe 'hellpist 'o ffor  fc87908 8 r90
 comm  0andxsf.
fROS(Core 3)> > ffffc8790880
  r10  0x0000000000000030
  r11  0xffff800005b89720
  r12  0xffff800014281b80
  r13  0x00000000200000c0
  r14  0x0000000000000073
  r15  0x000000000000002f
  trap 0x0000000e Page Fault
  gsbs 0xffffffffc8667ec0
  fsbs 0x0000000000000000
  err  0x--------00000000
  rip  0xffffffffc2058134
  cs   0x------------0008
  flag 0x0000000000010246
  rsp  0xfffffff0000eedf8
  ss   0x------------0010
Backtrace of kernel context on Core 2:
#01 [<0xffffffffc2058134>] in sys_readlink at src/syscall.c:2037
#02 [<0xffffffffc2059149>] in syscall at src/syscall.c:2528
#03 [<0xffffffffc2059304>] in run_local_syscall at src/syscall.c:2563
#04 [<0xffffffffc2059839>] in prep_syscalls at src/syscall.c:2583
#05 [<0xffffffffc20aaf1a>] in sysenter_callwrapper at arch/x86/trap.c:859
kernel panic at kern/arch/x86/trap.c:311, from core 2: Proc-ful Page Fault in the Kernel at 0x000000000000001b!
Stack Backtrace on Core 2:
#01 [<0xffffffffc200a3b7>] in backtrace at src/kdebug.c:219
#02 [<0xffffffffc2009b7c>] in _panic at src/init.c:266
#03 [<     [inline]     >] in __handler_kernel_page_fault at arch/x86/trap.c:311
#03 [<     [inline]     >] in __handle_page_fault at arch/x86/trap.c:327
#03 [<     [inline]     >] in trap_dispatch at arch/x86/trap.c:589
#03 [<0xffffffffc20aa649>] in trap at arch/x86/trap.c:674
19:40:40 executing program 2:
r0 = openat$net_ether0_2_data(0xffffffffffffff9c, &(0x7f0000000000)='/net/ether0/2/data\x00', 0x13, 0x3, 0x0)
openat$net_ether0_2_data(0xffffffffffffff9c, &(0x7f00000000c0)='/net/ether0/2/data\x00', 0x13, 0x3, 0x0)
fstat(r0, &(0x7f0000000040))
openat$net_ipifc_0_status(0xffffffffffffff9c, &(0x7f0000000100)='/net/ipifc/0/status\x00', 0x14, 0x1, 0x0)
19:40:40 executing program 4:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c, &(0x7f0000000140)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
read(r0, &(0x7f0000000340)=""/213, 0xd5)
r1 = openat$proc_self_vmstatus(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/vmstatus\x00', 0x14, 0x1, 0x0)
r2 = proc_create(&(0x7f0000000100)='./file0\x00', 0x8, &(0x7f0000000180)='/net/ipifc/0/snoop\x00', 0x13, 0x0)
r3 = openat$net_tcp_stats(0xffffffffffffff9c, &(0x7f0000000280)='/net/tcp/stats\x00', 0xf, 0x1, 0x0)
dup_fds_to(r2, &(0x7f00000001c0)=[{r1}, {r1}, {r0}, {r0}, {r1}, {r0}, {r1}, {r0}, {r0}], 0x9)
chdir(0x0, &(0x7f0000000240)='./file0\x00', 0x8)
proc_create(&(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000000080)='+{D\x00', 0x4, 0x1)
fcntl$F_GETFL(r3, 0x3)
19:40:41 executing program 1:
r0 = openat$net_ether0_ifstats(0xffffffffffffff9c, &(0x7f0000000180)='/net/ether0/ifstats\x00', 0xffffffffffffffd9, 0x1, 0x0)
fcntl$F_GETFL(r0, 0x3)
llseek(r0, 0x6, 0x10000, &(0x7f0000000000), 0x0)
r1 = openat$net_ether0_0_type(0xffffffffffffff9c, &(0x7f0000000040)='/net/ether0/0/type\x00', 0x13, 0x1, 0x0)
fcntl$F_GETFD(r1, 0x1)
19:40:41 executing program 0:
openat$dev_drivers(0xffffffffffffff9c, &(0x7f0000000140)='/dev/drivers\x00', 0x102e4, 0x1, 0x0)
openat$proc_self_strace(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/strace\x00', 0x12, 0x1, 0x0)
openat$net_ether0_2_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/net/ether0/2/ctl\x00', 0x12, 0x3, 0x0)
openat$net_tcp_0_data(0xffffffffffffff9c, &(0x7f0000000000)='/net/tcp/0/data\x00', 0x10, 0x3, 0x0)
19:40:41 executing program 3:
r0 = openat$net_ether0_ifstats(0xffffffffffffff9c, &(0x7f0000000080)='/net/ether0/ifstats\x00', 0x14, 0x1, 0x0)
fcntl$F_GETFL(r0, 0x3)
openat$prof_kptrace_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/prof/kptrace_ctl\x00', 0x12, 0x3, 0x0)
19:40:41 executing program 7:
r0 = openat$net_tcp_2_local(0xffffffffffffff9c, &(0x7f0000000040)='/net/tcp/2/local\x00', 0x256, 0x1, 0x0)
openat$dev_time(0xffffffffffffff9c, &(0x7f0000000000)='/dev/time\x00', 0xa, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
19:40:41 executing program 5:
openat$proc_self_notepg(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/notepg\x00', 0x12, 0x1, 0x0)
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c, &(0x7f0000000140)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f0000000040), 0x0)
openat$net_udp_0_remote(0xffffffffffffff9c, &(0x7f0000000080)='/net/udp/0/remote\x00', 0x12, 0x1, 0x0)
19:40:41 executing program 6:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c, &(0x7f0000000140)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
fcntl$F_GETFL(r0, 0x3)
openat$net_tcp_1_listen(0xffffffffffffff9c, &(0x7f0000000040)='/net/tcp/1/listen\x00', 0xfffffee4, 0x3, 0x0)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/16 19:40 akaros 93b9607ebeff 13761366 .config console log report ci-akaros-main
* Struck through repros no longer work on HEAD.