From: syzbot <syzbot+f31b0633f7ca73e2d726@syzkaller.appspotmail.com>
To: andriy.shevchenko@linux.intel.com, gregkh@linuxfoundation.org,
linux-kernel@vger.kernel.org, rafael@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] [kernel?] general protection fault in evdev_connect
Date: Mon, 04 Sep 2023 00:28:48 -0700 [thread overview]
Message-ID: <000000000000196cf906048376d5@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: b84acc11b1c9 Merge tag 'fbdev-for-6.6-rc1' of git://git.ke..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=161ae177a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=bbe3c86253fd240a
dashboard link: https://syzkaller.appspot.com/bug?extid=f31b0633f7ca73e2d726
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=146f7e70680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=149489c0680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e001ebb73e5d/disk-b84acc11.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/579905a03237/vmlinux-b84acc11.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bc5b290a4017/bzImage-b84acc11.xz
The issue was bisected to:
commit d21fdd07cea418c0d98c8a15fc95b8b8970801e7
Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Thu Aug 17 09:12:21 2023 +0000
driver core: Return proper error code when dev_set_name() fails
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15100848680000
final oops: https://syzkaller.appspot.com/x/report.txt?x=17100848680000
console output: https://syzkaller.appspot.com/x/log.txt?x=13100848680000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f31b0633f7ca73e2d726@syzkaller.appspotmail.com
Fixes: d21fdd07cea4 ("driver core: Return proper error code when dev_set_name() fails")
RAX: ffffffffffffffda RBX: 00007fffff7eb6b0 RCX: 00007f9419218db9
RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003
RBP: 0000000000000002 R08: 00007fffff7eb436 R09: 00000000000000a0
R10: 0000000000000002 R11: 0000000000000246 R12: 00007fffff7eb6ac
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
</TASK>
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 5036 Comm: syz-executor288 Not tainted 6.5.0-syzkaller-10204-gb84acc11b1c9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:strchr+0x21/0x90 lib/string.c:329
Code: 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 55 41 57 41 56 53 41 89 f6 48 89 fb 49 bf 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 4f 0f b6 03 44 38 f0 74 3d 48 8d 6b 01 84
RSP: 0018:ffffc90003aafa30 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880268c0000
RDX: 0000000000000000 RSI: 0000000000000025 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8abb6929 R09: 0000000000000000
R10: ffffc90003aafb20 R11: fffff52000755f67 R12: dffffc0000000000
R13: 1ffff11005956c27 R14: 0000000000000025 R15: dffffc0000000000
FS: 0000555555f39380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f94192304ec CR3: 0000000078dde000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kvasprintf_const+0x29/0x170 lib/kasprintf.c:45
kobject_set_name_vargs+0x61/0x120 lib/kobject.c:272
kobject_add_varg lib/kobject.c:366 [inline]
kobject_add+0x113/0x210 lib/kobject.c:424
device_add+0x449/0xc90 drivers/base/core.c:3560
cdev_device_add+0x1ec/0x3a0 fs/char_dev.c:556
evdev_connect+0x349/0x3f0 drivers/input/evdev.c:1386
input_attach_handler drivers/input/input.c:1064 [inline]
input_register_device+0xcf0/0x1090 drivers/input/input.c:2396
uinput_create_device+0x40e/0x620 drivers/input/misc/uinput.c:365
uinput_ioctl_handler+0x48b/0x1770 drivers/input/misc/uinput.c:904
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f9419218db9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffff7eb698 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fffff7eb6b0 RCX: 00007f9419218db9
RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003
RBP: 0000000000000002 R08: 00007fffff7eb436 R09: 00000000000000a0
R10: 0000000000000002 R11: 0000000000000246 R12: 00007fffff7eb6ac
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:strchr+0x21/0x90 lib/string.c:329
Code: 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 55 41 57 41 56 53 41 89 f6 48 89 fb 49 bf 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 4f 0f b6 03 44 38 f0 74 3d 48 8d 6b 01 84
RSP: 0018:ffffc90003aafa30 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880268c0000
RDX: 0000000000000000 RSI: 0000000000000025 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8abb6929 R09: 0000000000000000
R10: ffffc90003aafb20 R11: fffff52000755f67 R12: dffffc0000000000
R13: 1ffff11005956c27 R14: 0000000000000025 R15: dffffc0000000000
FS: 0000555555f39380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f94192304ec CR3: 0000000078dde000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 0f 1f 40 00 nopl 0x0(%rax)
8: f3 0f 1e fa endbr64
c: 55 push %rbp
d: 41 57 push %r15
f: 41 56 push %r14
11: 53 push %rbx
12: 41 89 f6 mov %esi,%r14d
15: 48 89 fb mov %rdi,%rbx
18: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
1f: fc ff df
22: 48 89 f8 mov %rdi,%rax
25: 48 c1 e8 03 shr $0x3,%rax
* 29: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 75 4f jne 0x81
32: 0f b6 03 movzbl (%rbx),%eax
35: 44 38 f0 cmp %r14b,%al
38: 74 3d je 0x77
3a: 48 8d 6b 01 lea 0x1(%rbx),%rbp
3e: 84 .byte 0x84
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2023-09-04 7:28 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-04 7:28 syzbot [this message]
2023-09-04 7:56 ` [syzbot] [kernel?] general protection fault in evdev_connect Thomas Weißschuh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000196cf906048376d5@google.com \
--to=syzbot+f31b0633f7ca73e2d726@syzkaller.appspotmail.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.