lkml.org 
[lkml]   [2018]   [Oct]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    Subjectkernel BUG at security/keys/keyring.c:LINE!
    From
    Hello,

    syzbot found the following crash on:

    HEAD commit: befad944e231 Merge tag 'drm-fixes-2018-10-05' of git://ano..
    git tree: upstream
    console output: https://syzkaller.appspot.com/x/log.txt?x=161fc976400000
    kernel config: https://syzkaller.appspot.com/x/.config?x=c0af03fe452b65fb
    dashboard link: https://syzkaller.appspot.com/bug?extid=ec24e95ea483de0a24da
    compiler: gcc (GCC) 8.0.1 20180413 (experimental)
    syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10160e3a400000
    C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16995491400000

    IMPORTANT: if you fix the bug, please add the following tag to the commit:
    Reported-by: syzbot+ec24e95ea483de0a24da@syzkaller.appspotmail.com

    ------------[ cut here ]------------
    kernel BUG at security/keys/keyring.c:1214!
    invalid opcode: 0000 [#1] PREEMPT SMP KASAN
    CPU: 0 PID: 5807 Comm: syz-executor226 Not tainted 4.19.0-rc6+ #268
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
    Google 01/01/2011
    RIP: 0010:__key_link_begin+0x23a/0x300 security/keys/keyring.c:1214
    Code: fe 48 c7 c7 20 ae 67 89 e8 b3 36 23 fe eb ac e8 ec 64 42 fe 48 c7 c7
    20 ae 67 89 e8 30 73 73 04 e9 e3 fe ff ff e8 d6 64 42 fe <0f> 0b e8 cf 64
    42 fe 48 8d bb ce 00 00 00 48 b8 00 00 00 00 00 fc
    RSP: 0018:ffff8801bbdc7b10 EFLAGS: 00010293
    RAX: ffff8801d924e2c0 RBX: ffff8801d4e7e080 RCX: ffffffff833c4ebf
    RDX: 0000000000000000 RSI: ffffffff833c50aa RDI: 0000000000000007
    RBP: ffff8801bbdc7b40 R08: ffff8801d924e2c0 R09: fffffbfff12cf4a4
    R10: fffffbfff12cf4a4 R11: ffffffff8967a523 R12: ffff8801bbdc7c48
    R13: 0000000000000000 R14: ffff8801d4e7e200 R15: ffff8801d4e7e080
    FS: 0000000001ce9880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000020cab000 CR3: 00000001d829a000 CR4: 00000000001406f0
    Call Trace:
    construct_alloc_key security/keys/request_key.c:389 [inline]
    construct_key_and_link security/keys/request_key.c:480 [inline]
    request_key_and_link+0x737/0x17a0 security/keys/request_key.c:593
    __do_sys_request_key security/keys/keyctl.c:213 [inline]
    __se_sys_request_key security/keys/keyctl.c:158 [inline]
    __x64_sys_request_key+0x305/0x400 security/keys/keyctl.c:158
    do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x440169
    Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7
    48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
    ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007ffd70324808 EFLAGS: 00000217 ORIG_RAX: 00000000000000f9
    RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440169
    RDX: 00000000200001c0 RSI: 0000000020000180 RDI: 00000000200000c0
    RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
    R10: 00000000111522d3 R11: 0000000000000217 R12: 00000000004019f0
    R13: 0000000000401a80 R14: 0000000000000000 R15: 0000000000000000
    Modules linked in:
    ---[ end trace 40815c4a8f1e2472 ]---
    RIP: 0010:__key_link_begin+0x23a/0x300 security/keys/keyring.c:1214
    Code: fe 48 c7 c7 20 ae 67 89 e8 b3 36 23 fe eb ac e8 ec 64 42 fe 48 c7 c7
    20 ae 67 89 e8 30 73 73 04 e9 e3 fe ff ff e8 d6 64 42 fe <0f> 0b e8 cf 64
    42 fe 48 8d bb ce 00 00 00 48 b8 00 00 00 00 00 fc
    RSP: 0018:ffff8801bbdc7b10 EFLAGS: 00010293
    RAX: ffff8801d924e2c0 RBX: ffff8801d4e7e080 RCX: ffffffff833c4ebf
    RDX: 0000000000000000 RSI: ffffffff833c50aa RDI: 0000000000000007
    RBP: ffff8801bbdc7b40 R08: ffff8801d924e2c0 R09: fffffbfff12cf4a4
    R10: fffffbfff12cf4a4 R11: ffffffff8967a523 R12: ffff8801bbdc7c48
    R13: 0000000000000000 R14: ffff8801d4e7e200 R15: ffff8801d4e7e080
    FS: 0000000001ce9880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000020cab000 CR3: 00000001d829a000 CR4: 00000000001406f0


    ---
    This bug is generated by a bot. It may contain errors.
    See https://goo.gl/tpsmEJ for more information about syzbot.
    syzbot engineers can be reached at syzkaller@googlegroups.com.

    syzbot will keep track of this bug report. See:
    https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
    syzbot.
    syzbot can test patches for this bug, for details see:
    https://goo.gl/tpsmEJ#testing-patches

    \
     
     \ /
      Last update: 2018-10-05 13:16    [W:2.423 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site