On Fri, Oct 27, 2017 at 11:22 AM, syzbot <bot+7fde9fa6e982d17b9acf978961e059b0a5344...@syzkaller.appspotmail.com> wrote: > Hello, > > syzkaller hit the following crash on > 623ce3456671ea842c0ebda79c38655c8c04af74 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached.
A more recent report is on upstream 0787643a5f6aad1f0cdeb305f7fe492b71943ea4 kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 59 Comm: kworker/u4:2 Not tainted 4.14.0-rc5+ #142 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_unbound flush_to_ldisc task: ffff8801d9aa6700 task.stack: ffff8801d9ab0000 RIP: 0010:__read_once_size include/linux/compiler.h:276 [inline] RIP: 0010:n_tty_receive_buf_common+0x154/0x2520 drivers/tty/n_tty.c:1690 RSP: 0018:ffff8801d9ab7130 EFLAGS: 00010202 RAX: 000000000000044c RBX: ffff8801d4cb0400 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff8801d4cb07a8 RDI: 0000000000002260 RBP: ffff8801d9ab72d8 R08: ffffffff82721563 R09: 0000000000000005 R10: ffff8801d9ab6f68 R11: 0000000000000002 R12: ffff8801d28ed27f R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8801d28ed27f FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f97bb6e6330 CR3: 00000001c5959000 CR4: 00000000001426e0 Call Trace: n_tty_receive_buf2+0x33/0x40 drivers/tty/n_tty.c:1746 tty_ldisc_receive_buf+0xa7/0x180 drivers/tty/tty_buffer.c:455 tty_port_default_receive_buf+0x106/0x160 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:474 [inline] flush_to_ldisc+0x3c4/0x590 drivers/tty/tty_buffer.c:523 process_one_work+0xbf0/0x1bc0 kernel/workqueue.c:2119 worker_thread+0x223/0x1860 kernel/workqueue.c:2253 kthread+0x35e/0x430 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Code: 89 85 18 ff ff ff 48 8d 45 98 48 89 85 e0 fe ff ff e8 61 a8 fb fe 48 8b 85 18 ff ff ff c6 00 00 48 8b 85 a0 fe ff ff 48 c1 e8 03 <42> 80 3c 30 00 0f 85 6d 1e 00 00 48 8b 85 28 ff ff ff 4c 8b a8 RIP: __read_once_size include/linux/compiler.h:276 [inline] RSP: ffff8801d9ab7130 RIP: n_tty_receive_buf_common+0x154/0x2520 drivers/tty/n_tty.c:1690 RSP: ffff8801d9ab7130 ---[ end trace b62a8a78df2eb9d9 ]--- > kasan: CONFIG_KASAN_INLINE enabled > kasan: GPF could be caused by NULL-ptr deref or user memory access > general protection fault: 0000 [#1] SMP KASAN > Dumping ftrace buffer: > SELinux: unrecognized netlink message: protocol=4 nlmsg_type=32 > sclass=netlink_tcpdiag_socket pig=18822 comm=syz-executor4 > (ftrace buffer empty) > Modules linked in: > CPU: 0 PID: 3797 Comm: kworker/u4:5 Not tainted 4.13.0-rc4+ #24 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Workqueue: events_unbound flush_to_ldisc > task: ffff8801c6abc340 task.stack: ffff8801c6a08000 > RIP: 0010:__read_once_size include/linux/compiler.h:250 [inline] > RIP: 0010:n_tty_receive_buf_common+0x154/0x2520 drivers/tty/n_tty.c:1690 > RSP: 0018:ffff8801c6a0f130 EFLAGS: 00010202 > RAX: 000000000000044c RBX: ffff8801c8c0f680 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: ffff8801c8c0fa28 RDI: 0000000000002260 > RBP: ffff8801c6a0f2d8 R08: 0000000000000004 R09: 0000000000000005 > R10: ffff8801c6a0ef68 R11: ffffffff8266dad3 R12: ffff8801c73d5b82 > R13: ffff8801c73d5c82 R14: dffffc0000000000 R15: ffff8801c73d5b82 > SELinux: unrecognized netlink message: protocol=4 nlmsg_type=32 > sclass=netlink_tcpdiag_socket pig=18822 comm=syz-executor4 > FS: 0000000000000000(0000) GS:ffff8801dc000000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020000000 CR3: 0000000005021000 CR4: 00000000001406f0 > DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 > Call Trace: > n_tty_receive_buf2+0x33/0x40 drivers/tty/n_tty.c:1746 > tty_ldisc_receive_buf+0xa7/0x180 drivers/tty/tty_buffer.c:429 > tty_port_default_receive_buf+0x106/0x160 drivers/tty/tty_port.c:37 > receive_buf drivers/tty/tty_buffer.c:448 [inline] > flush_to_ldisc+0x3c4/0x590 drivers/tty/tty_buffer.c:497 > process_one_work+0xbf3/0x1bc0 kernel/workqueue.c:2097 > worker_thread+0x223/0x1860 kernel/workqueue.c:2231 > kthread+0x35e/0x430 kernel/kthread.c:231 > ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:425 > Code: 89 85 18 ff ff ff 48 8d 45 98 48 89 85 e0 fe ff ff e8 71 cb 06 ff 48 > 8b 85 18 ff ff ff c6 00 00 48 8b 85 a0 fe ff ff 48 c1 e8 03 <42> 80 3c 30 00 > 0f 85 6d 1e 00 00 48 8b 85 28 ff ff ff 4c 8b a8 > RIP: __read_once_size include/linux/compiler.h:250 [inline] RSP: > ffff8801c6a0f130 > RIP: n_tty_receive_buf_common+0x154/0x2520 drivers/tty/n_tty.c:1690 RSP: > ffff8801c6a0f130 > ---[ end trace 1e2f55861d14ef37 ]--- > Kernel panic - not syncing: Fatal exception > Dumping ftrace buffer: > (ftrace buffer empty) > Kernel Offset: disabled > > > --- > This bug is generated by a dumb bot. It may contain errors. > See https://goo.gl/tpsmEJ for details. > Direct all questions to [email protected]. > > syzbot will keep track of this bug report. > Once a fix for this bug is committed, please reply to this email with: > #syz fix: exact-commit-title > To mark this as a duplicate of another syzbot report, please reply with: > #syz dup: exact-subject-of-another-report > If it's a one-off invalid bug report, please reply with: > #syz invalid > Note: if the crash happens again, it will cause creation of a new bug > report. > > -- > You received this message because you are subscribed to the Google Groups > "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/syzkaller-bugs/001a113a9e244584f1055c83d598%40google.com. > For more options, visit https://groups.google.com/d/optout.
