UBSAN: array-index-out-of-bounds in alloc_pid
================================================================================
UBSAN: array-index-out-of-bounds in kernel/pid.c:244:15
index 1 is out of range for type 'upid [1]'
CPU: 1 PID: 5000 Comm: syz-executor.0 Not tainted 6.4.0-rc2-next-20230517-syzkaller-03030-g065efa589871 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0xd5/0x140 lib/ubsan.c:348
alloc_pid+0xbe5/0xdd0 kernel/pid.c:244
copy_process+0x45da/0x7660 kernel/fork.c:2522
kernel_clone+0xeb/0x890 kernel/fork.c:2914
__do_sys_clone+0xba/0x100 kernel/fork.c:3057
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fdb24689dfb
Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
RSP: 002b:00007fff15d41ba0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007fff15d421f8 RCX: 00007fdb24689dfb
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000000 R08: 0000000000000000 R09: 00005555562e8400
R10: 00005555562e86d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff15d41c90 R14: 00007fdb247ac9d8 R15: 000000000000000c
================================================================================
Warning: Permanently added '10.128.10.25' (ECDSA) to the list of known hosts.
2023/05/17 03:15:51 fuzzer started
2023/05/17 03:15:51 connecting to host at 10.128.0.169:42135
2023/05/17 03:15:51 checking machine...
2023/05/17 03:15:51 checking revisions...
2023/05/17 03:15:51 testing simple program...
syzkaller login: [ 56.603740][ T4999] cgroup: Unknown subsys name 'net'
[ 56.746283][ T4999] cgroup: Unknown subsys name 'rlimit'
[ 56.842464][ T4997] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4997 'syz-fuzzer'
[ 56.947596][ T5000] ================================================================================
[ 56.957140][ T5000] UBSAN: array-index-out-of-bounds in kernel/pid.c:244:15
[ 56.964539][ T5000] index 1 is out of range for type 'upid [1]'
[ 56.970630][ T5000] CPU: 1 PID: 5000 Comm: syz-executor.0 Not tainted 6.4.0-rc2-next-20230517-syzkaller-03030-g065efa589871 #0
[ 56.982213][ T5000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 56.992258][ T5000] Call Trace:
[ 56.995920][ T5000]
[ 56.998957][ T5000] dump_stack_lvl+0x136/0x150
[ 57.003981][ T5000] __ubsan_handle_out_of_bounds+0xd5/0x140
[ 57.009810][ T5000] ? rwsem_down_read_slowpath+0x421/0xae0
[ 57.015596][ T5000] alloc_pid+0xbe5/0xdd0
[ 57.019954][ T5000] ? copy_namespaces+0x1e3/0x500
[ 57.024998][ T5000] copy_process+0x45da/0x7660
[ 57.029709][ T5000] ? pidfd_prepare+0x80/0x80
[ 57.034319][ T5000] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 57.040335][ T5000] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 57.046441][ T5000] kernel_clone+0xeb/0x890
[ 57.050973][ T5000] ? create_io_thread+0xe0/0xe0
[ 57.055861][ T5000] ? ksys_unshare+0x676/0x920
[ 57.060557][ T5000] ? lock_downgrade+0x690/0x690
[ 57.065530][ T5000] ? do_raw_spin_lock+0x124/0x2b0
[ 57.070685][ T5000] ? spin_bug+0x1c0/0x1c0
[ 57.075042][ T5000] __do_sys_clone+0xba/0x100
[ 57.079650][ T5000] ? kernel_clone+0x890/0x890
[ 57.084349][ T5000] ? syscall_enter_from_user_mode+0x26/0x80
[ 57.090303][ T5000] do_syscall_64+0x39/0xb0
[ 57.094729][ T5000] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 57.100630][ T5000] RIP: 0033:0x7fdb24689dfb
[ 57.106878][ T5000] Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
[ 57.127012][ T5000] RSP: 002b:00007fff15d41ba0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 57.135442][ T5000] RAX: ffffffffffffffda RBX: 00007fff15d421f8 RCX: 00007fdb24689dfb
[ 57.143692][ T5000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 57.151663][ T5000] RBP: 0000000000000000 R08: 0000000000000000 R09: 00005555562e8400
[ 57.159901][ T5000] R10: 00005555562e86d0 R11: 0000000000000246 R12: 0000000000000000
[ 57.167959][ T5000] R13: 00007fff15d41c90 R14: 00007fdb247ac9d8 R15: 000000000000000c
[ 57.176120][ T5000]
[ 57.179427][ T5000] ================================================================================
[ 57.188907][ T5000] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 57.196280][ T5000] CPU: 1 PID: 5000 Comm: syz-executor.0 Not tainted 6.4.0-rc2-next-20230517-syzkaller-03030-g065efa589871 #0
[ 57.208257][ T5000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 57.218601][ T5000] Call Trace:
[ 57.221913][ T5000]
[ 57.224837][ T5000] dump_stack_lvl+0xd9/0x150
[ 57.229512][ T5000] panic+0x686/0x730
[ 57.233488][ T5000] ? panic_smp_self_stop+0xa0/0xa0
[ 57.238694][ T5000] ? syslog_print_all+0x3a0/0x3a0
[ 57.244155][ T5000] check_panic_on_warn+0xb1/0xc0
[ 57.249095][ T5000] __ubsan_handle_out_of_bounds+0xfd/0x140
[ 57.255446][ T5000] ? rwsem_down_read_slowpath+0x421/0xae0
[ 57.261282][ T5000] alloc_pid+0xbe5/0xdd0
[ 57.265519][ T5000] ? copy_namespaces+0x1e3/0x500
[ 57.270454][ T5000] copy_process+0x45da/0x7660
[ 57.275140][ T5000] ? pidfd_prepare+0x80/0x80
[ 57.279920][ T5000] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 57.286088][ T5000] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 57.292110][ T5000] kernel_clone+0xeb/0x890
[ 57.296622][ T5000] ? create_io_thread+0xe0/0xe0
[ 57.301578][ T5000] ? ksys_unshare+0x676/0x920
[ 57.306268][ T5000] ? lock_downgrade+0x690/0x690
[ 57.311129][ T5000] ? do_raw_spin_lock+0x124/0x2b0
[ 57.316174][ T5000] ? spin_bug+0x1c0/0x1c0
[ 57.320518][ T5000] __do_sys_clone+0xba/0x100
[ 57.325120][ T5000] ? kernel_clone+0x890/0x890
[ 57.329818][ T5000] ? syscall_enter_from_user_mode+0x26/0x80
[ 57.335751][ T5000] do_syscall_64+0x39/0xb0
[ 57.340175][ T5000] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 57.346161][ T5000] RIP: 0033:0x7fdb24689dfb
[ 57.350583][ T5000] Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
[ 57.371235][ T5000] RSP: 002b:00007fff15d41ba0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 57.379673][ T5000] RAX: ffffffffffffffda RBX: 00007fff15d421f8 RCX: 00007fdb24689dfb
[ 57.387733][ T5000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 57.396083][ T5000] RBP: 0000000000000000 R08: 0000000000000000 R09: 00005555562e8400
[ 57.404431][ T5000] R10: 00005555562e86d0 R11: 0000000000000246 R12: 0000000000000000
[ 57.412968][ T5000] R13: 00007fff15d41c90 R14: 00007fdb247ac9d8 R15: 000000000000000c
[ 57.421495][ T5000]
[ 57.424842][ T5000] Kernel Offset: disabled
[ 57.429406][ T5000] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs-2/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs-2/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build4251821004=/tmp/go-build -gno-record-gcc-switches"
git status (err=)
HEAD detached at 1b2f701aa
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1b2f701aa9a17abb7e27c7c1170d26398febf247 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230203-112454'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1b2f701aa9a17abb7e27c7c1170d26398febf247 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230203-112454'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1b2f701aa9a17abb7e27c7c1170d26398febf247 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230203-112454'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"1b2f701aa9a17abb7e27c7c1170d26398febf247\"