| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <000000000000620229060a5c8770@google.com>
Date: Fri, 17 Nov 2023 09:33:04 -0800
From: syzbot <syzbot+3779764ddb7a3e19437f@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
tintinm2017@...il.com
Subject: Re: [syzbot] [bpf?] [reiserfs?] WARNING: locking bug in corrupted (2)
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in __hrtimer_run_queues
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5476 Comm: dhcpcd-run-hook Not tainted 6.7.0-rc1-syzkaller-00139-g6bc40e44f1dd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90000007e38 EFLAGS: 00010046
RAX: 0000000080010000 RBX: ffff8880b982b9c0 RCX: ffffffff81767893
RDX: ffff888079589dc0 RSI: ffffffff817678a1 RDI: ffffc90004bcfd90
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000081 R11: ffffc90000007ff8 R12: ffff8880b982b940
R13: 0000000000000081 R14: ffffc90004bcfd90 R15: 0000000000000000
FS: 00007f0750eb5380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007b29c000 CR4: 0000000000350ef0
Call Trace:
<IRQ>
__run_hrtimer kernel/time/hrtimer.c:1688 [inline]
__hrtimer_run_queues+0x647/0xc10 kernel/time/hrtimer.c:1752
hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline]
__sysvec_apic_timer_interrupt+0x105/0x3f0 arch/x86/kernel/apic/apic.c:1082
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1076
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__init_rwsem+0x13/0x1b0 kernel/locking/rwsem.c:312
Code: 18 4c 89 e7 31 ed e8 1c 49 de 08 eb e8 48 89 df e8 52 86 77 00 eb 9e f3 0f 1e fa 41 54 49 89 d4 55 48 89 f5 be 98 00 00 00 53 <48> 89 fb e8 45 c9 00 00 48 8d 7b 70 45 31 c9 31 c9 6a 00 4c 89 e2
RSP: 0018:ffffc900053f7980 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff8880152a1800 RCX: 0000000000000001
RDX: ffffffff90667540 RSI: 0000000000000098 RDI: ffff88802767eaf8
RBP: ffffffff8a8b0a60 R08: ffffc900053f7950 R09: 0000000000000000
R10: ffff88802767eaf8 R11: 0000000000000000 R12: ffffffff90667540
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
vma_lock_alloc kernel/fork.c:463 [inline]
vm_area_dup+0x9d/0x2f0 kernel/fork.c:512
dup_mmap+0x93c/0x1d80 kernel/fork.c:710
dup_mm kernel/fork.c:1691 [inline]
copy_mm kernel/fork.c:1740 [inline]
copy_process+0x6cab/0x7490 kernel/fork.c:2502
kernel_clone+0xe9/0x920 kernel/fork.c:2907
__do_sys_clone+0xba/0x100 kernel/fork.c:3050
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f0750fefa12
Code: 41 5d 41 5e 41 5f c3 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 e7 43 0f 00 f7 d8 64 89 02 48 83
RSP: 002b:00007fffadeb0d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 000055a881dc2901 RCX: 00007f0750fefa12
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 000055a881dc3b70 R08: 0000000000000000 R09: 3c00000000001001
R10: 00007f0750eb5650 R11: 0000000000000246 R12: 000055a881dd0640
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90000007e38 EFLAGS: 00010046
RAX: 0000000080010000 RBX: ffff8880b982b9c0 RCX: ffffffff81767893
RDX: ffff888079589dc0 RSI: ffffffff817678a1 RDI: ffffc90004bcfd90
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000081 R11: ffffc90000007ff8 R12: ffff8880b982b940
R13: 0000000000000081 R14: ffffc90004bcfd90 R15: 0000000000000000
FS: 00007f0750eb5380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007b29c000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 18 4c 89 e7 sbb %cl,-0x19(%rcx,%rcx,4)
4: 31 ed xor %ebp,%ebp
6: e8 1c 49 de 08 call 0x8de4927
b: eb e8 jmp 0xfffffff5
d: 48 89 df mov %rbx,%rdi
10: e8 52 86 77 00 call 0x778667
15: eb 9e jmp 0xffffffb5
17: f3 0f 1e fa endbr64
1b: 41 54 push %r12
1d: 49 89 d4 mov %rdx,%r12
20: 55 push %rbp
21: 48 89 f5 mov %rsi,%rbp
24: be 98 00 00 00 mov $0x98,%esi
29: 53 push %rbx
* 2a: 48 89 fb mov %rdi,%rbx <-- trapping instruction
2d: e8 45 c9 00 00 call 0xc977
32: 48 8d 7b 70 lea 0x70(%rbx),%rdi
36: 45 31 c9 xor %r9d,%r9d
39: 31 c9 xor %ecx,%ecx
3b: 6a 00 push $0x0
3d: 4c 89 e2 mov %r12,%rdx
Tested on:
commit: 6bc40e44 Merge tag 'ovl-fixes-6.7-rc2' of git://git.ke..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=12241877680000
kernel config: https://syzkaller.appspot.com/x/.config?x=50e80fa8ba9f1bd4
dashboard link: https://syzkaller.appspot.com/bug?extid=3779764ddb7a3e19437f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
Powered by blists - more mailing lists