UBSAN: array-index-out-of-bounds in alloc_pid
================================================================================
UBSAN: array-index-out-of-bounds in kernel/pid.c:244:3
index 1 is out of range for type 'struct upid[1]'
CPU: 1 PID: 4990 Comm: syz-executor.0 Not tainted 6.4.0-syzkaller-08686-ge55e5df193d2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Call Trace:
dump_stack_lvl+0x1b5/0x2a0
__ubsan_handle_out_of_bounds+0xf0/0x120
alloc_pid+0x405/0xc40
copy_process+0x1f6f/0x4390
kernel_clone+0x209/0x7f0
__x64_sys_clone+0x26d/0x2f0
do_syscall_64+0x41/0xc0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f134ec89ddb
Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
RSP: 002b:00007fffcc1a3ae0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007fffcc1a4138 RCX: 00007f134ec89ddb
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000555556d2f400
R10: 0000555556d2f6d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffcc1a3bd0 R14: 00007f134edac9d8 R15: 000000000000000c
================================================================================
Warning: Permanently added '10.128.1.95' (ECDSA) to the list of known hosts.
2023/06/30 17:20:18 fuzzer started
2023/06/30 17:20:18 connecting to host at 10.128.0.163:38891
2023/06/30 17:20:18 checking machine...
2023/06/30 17:20:18 checking revisions...
2023/06/30 17:20:19 testing simple program...
syzkaller login: [ 57.135410][ T4989] cgroup: Unknown subsys name 'net'
[ 57.254319][ T4989] cgroup: Unknown subsys name 'rlimit'
[ 57.352152][ T4982] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4982 'syz-fuzzer'
[ 57.444587][ T4990] ================================================================================
[ 57.455587][ T4990] UBSAN: array-index-out-of-bounds in kernel/pid.c:244:3
[ 57.462728][ T4990] index 1 is out of range for type 'struct upid[1]'
[ 57.470487][ T4990] CPU: 1 PID: 4990 Comm: syz-executor.0 Not tainted 6.4.0-syzkaller-08686-ge55e5df193d2 #0
[ 57.480948][ T4990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 57.491032][ T4990] Call Trace:
[ 57.494413][ T4990]
[ 57.497517][ T4990] dump_stack_lvl+0x1b5/0x2a0
[ 57.502236][ T4990] ? nf_tcp_handle_invalid+0x650/0x650
[ 57.507957][ T4990] ? vsnprintf+0x17f/0x1d80
[ 57.512829][ T4990] ? panic+0x6f0/0x6f0
[ 57.517541][ T4990] ? local_lock_release+0x96/0x170
[ 57.523482][ T4990] ? __lock_acquire+0x7ef0/0x7ef0
[ 57.528726][ T4990] __ubsan_handle_out_of_bounds+0xf0/0x120
[ 57.534761][ T4990] ? _raw_spin_unlock_irq+0x23/0x50
[ 57.540110][ T4990] ? lockdep_hardirqs_on+0x90/0x130
[ 57.545881][ T4990] alloc_pid+0x405/0xc40
[ 57.550661][ T4990] copy_process+0x1f6f/0x4390
[ 57.555462][ T4990] ? verify_lock_unused+0x140/0x140
[ 57.561249][ T4990] ? perf_event_namespaces+0x1f6/0xc60
[ 57.566859][ T4990] ? __pidfd_prepare+0x140/0x140
[ 57.571916][ T4990] kernel_clone+0x209/0x7f0
[ 57.576462][ T4990] ? ksys_unshare+0x8ef/0xb20
[ 57.581486][ T4990] ? create_io_thread+0x1a0/0x1a0
[ 57.586619][ T4990] ? do_raw_spin_lock+0x14d/0x3a0
[ 57.591645][ T4990] ? do_raw_spin_unlock+0x13b/0x8b0
[ 57.596928][ T4990] __x64_sys_clone+0x26d/0x2f0
[ 57.601698][ T4990] ? __do_sys_vfork+0x120/0x120
[ 57.606636][ T4990] ? lockdep_hardirqs_on_prepare+0x418/0x780
[ 57.612707][ T4990] ? syscall_enter_from_user_mode+0x32/0x230
[ 57.619293][ T4990] ? lockdep_hardirqs_on+0x90/0x130
[ 57.624591][ T4990] ? syscall_enter_from_user_mode+0x32/0x230
[ 57.631100][ T4990] do_syscall_64+0x41/0xc0
[ 57.635608][ T4990] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 57.641684][ T4990] RIP: 0033:0x7f134ec89ddb
[ 57.646265][ T4990] Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
[ 57.666479][ T4990] RSP: 002b:00007fffcc1a3ae0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 57.675588][ T4990] RAX: ffffffffffffffda RBX: 00007fffcc1a4138 RCX: 00007f134ec89ddb
[ 57.683725][ T4990] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 57.691779][ T4990] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000555556d2f400
[ 57.700483][ T4990] R10: 0000555556d2f6d0 R11: 0000000000000246 R12: 0000000000000000
[ 57.709040][ T4990] R13: 00007fffcc1a3bd0 R14: 00007f134edac9d8 R15: 000000000000000c
[ 57.717293][ T4990]
[ 57.722333][ T4990] ================================================================================
[ 57.732896][ T4990] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 57.740372][ T4990] CPU: 0 PID: 4990 Comm: syz-executor.0 Not tainted 6.4.0-syzkaller-08686-ge55e5df193d2 #0
[ 57.750636][ T4990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 57.761035][ T4990] Call Trace:
[ 57.764323][ T4990]
[ 57.767271][ T4990] dump_stack_lvl+0x1b5/0x2a0
[ 57.772068][ T4990] ? nf_tcp_handle_invalid+0x650/0x650
[ 57.777755][ T4990] ? panic+0x6f0/0x6f0
[ 57.781831][ T4990] ? vscnprintf+0x5d/0x80
[ 57.786157][ T4990] panic+0x2b4/0x6f0
[ 57.790140][ T4990] ? check_panic_on_warn+0x21/0xa0
[ 57.795269][ T4990] ? __memcpy_flushcache+0x2b0/0x2b0
[ 57.800579][ T4990] ? dump_stack_lvl+0x20f/0x2a0
[ 57.805551][ T4990] ? local_lock_release+0x96/0x170
[ 57.810868][ T4990] ? __lock_acquire+0x7ef0/0x7ef0
[ 57.816419][ T4990] check_panic_on_warn+0x82/0xa0
[ 57.821460][ T4990] __ubsan_handle_out_of_bounds+0x110/0x120
[ 57.827548][ T4990] ? _raw_spin_unlock_irq+0x23/0x50
[ 57.832837][ T4990] ? lockdep_hardirqs_on+0x90/0x130
[ 57.838049][ T4990] alloc_pid+0x405/0xc40
[ 57.842592][ T4990] copy_process+0x1f6f/0x4390
[ 57.847622][ T4990] ? verify_lock_unused+0x140/0x140
[ 57.853012][ T4990] ? perf_event_namespaces+0x1f6/0xc60
[ 57.858553][ T4990] ? __pidfd_prepare+0x140/0x140
[ 57.863587][ T4990] kernel_clone+0x209/0x7f0
[ 57.868266][ T4990] ? ksys_unshare+0x8ef/0xb20
[ 57.873207][ T4990] ? create_io_thread+0x1a0/0x1a0
[ 57.878212][ T4990] ? do_raw_spin_lock+0x14d/0x3a0
[ 57.883573][ T4990] ? do_raw_spin_unlock+0x13b/0x8b0
[ 57.889123][ T4990] __x64_sys_clone+0x26d/0x2f0
[ 57.894131][ T4990] ? __do_sys_vfork+0x120/0x120
[ 57.899136][ T4990] ? lockdep_hardirqs_on_prepare+0x418/0x780
[ 57.905546][ T4990] ? syscall_enter_from_user_mode+0x32/0x230
[ 57.911653][ T4990] ? lockdep_hardirqs_on+0x90/0x130
[ 57.917142][ T4990] ? syscall_enter_from_user_mode+0x32/0x230
[ 57.923851][ T4990] do_syscall_64+0x41/0xc0
[ 57.928492][ T4990] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 57.935555][ T4990] RIP: 0033:0x7f134ec89ddb
[ 57.940285][ T4990] Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
[ 57.963477][ T4990] RSP: 002b:00007fffcc1a3ae0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 57.972436][ T4990] RAX: ffffffffffffffda RBX: 00007fffcc1a4138 RCX: 00007f134ec89ddb
[ 57.980766][ T4990] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 57.990947][ T4990] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000555556d2f400
[ 57.999381][ T4990] R10: 0000555556d2f6d0 R11: 0000000000000246 R12: 0000000000000000
[ 58.008258][ T4990] R13: 00007fffcc1a3bd0 R14: 00007f134edac9d8 R15: 000000000000000c
[ 58.016535][ T4990]
[ 58.019969][ T4990] Kernel Offset: disabled
[ 58.024763][ T4990] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs-2/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs-2/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1528289596=/tmp/go-build -gno-record-gcc-switches"
git status (err=)
HEAD detached at f0036e181
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f0036e181e274023235289be91e334cb7507eaa6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230103-110812'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f0036e181e274023235289be91e334cb7507eaa6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230103-110812'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f0036e181e274023235289be91e334cb7507eaa6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230103-110812'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"f0036e181e274023235289be91e334cb7507eaa6\"