KASAN: user-memory-access Write in n_tty_set_termios

Status: public: reported C repro on 2019/04/13 00:00
Reported-by: syzbot+480e1a761deacb965709@syzkaller.appspotmail.com
First crash: 3033d, last: 2795d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 KASAN: user-memory-access Write in n_tty_set_termios 21 syz 24 2774d 2686d 0/1 public: reported syz repro on 2019/04/10 16:04
upstream KASAN: user-memory-access Write in n_tty_set_termios serial 21 syz, C 85 2790d 3060d 11/29 fixed on 2019/01/15 20:25

Sample crash report:
==================================================================
BUG: KASAN: user-memory-access in bitmap_zero include/linux/bitmap.h:197 [inline]
BUG: KASAN: user-memory-access in n_tty_set_termios+0xf6/0xd30 drivers/tty/n_tty.c:1768
Write of size 512 at addr 0000000000001060 by task syz-executor970/3813

CPU: 1 PID: 3813 Comm: syz-executor970 Not tainted 4.9.96-g71fce1e #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d94c7708 ffffffff81eb0b69 0000000000001060 0000000000000200
 0000000000000001 000000000000005d ffff8801d94c7848 ffff8801d94c7750
 ffffffff81565640 ffffffff8211b4f6 0000000000000286 c8781b594e4e9e9e
Call Trace:
 [<ffffffff81eb0b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb0b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81565640>] kasan_report_error mm/kasan/report.c:353 [inline]
 [<ffffffff81565640>] kasan_report.cold.6+0x6d/0x2fe mm/kasan/report.c:412
 [<ffffffff815382ff>] check_memory_region_inline mm/kasan/kasan.c:318 [inline]
 [<ffffffff815382ff>] check_memory_region+0x14f/0x1b0 mm/kasan/kasan.c:325
 [<ffffffff815388b3>] memset+0x23/0x40 mm/kasan/kasan.c:343
 [<ffffffff8211b4f6>] bitmap_zero include/linux/bitmap.h:197 [inline]
 [<ffffffff8211b4f6>] n_tty_set_termios+0xf6/0xd30 drivers/tty/n_tty.c:1768
 [<ffffffff821251d6>] tty_set_termios+0x626/0x8a0 drivers/tty/tty_ioctl.c:562
 [<ffffffff8212623f>] set_termios+0x38f/0x620 drivers/tty/tty_ioctl.c:635
 [<ffffffff82126d92>] tty_mode_ioctl+0x8c2/0x980 drivers/tty/tty_ioctl.c:970
 [<ffffffff82126ef4>] n_tty_ioctl_helper+0x44/0x370 drivers/tty/tty_ioctl.c:1161
 [<ffffffff8211a036>] n_tty_ioctl+0x46/0x2c0 drivers/tty/n_tty.c:2443
 [<ffffffff82113404>] tty_ioctl+0x5a4/0x2270 drivers/tty/tty_io.c:3009
 [<ffffffff815b051c>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff815b051c>] file_ioctl fs/ioctl.c:493 [inline]
 [<ffffffff815b051c>] do_vfs_ioctl+0x1ac/0x11a0 fs/ioctl.c:677
 [<ffffffff815b159f>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff815b159f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f3313>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
==================================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/28 21:14 https://android.googlesource.com/kernel/common android-4.9 71fce1edd26d d5a5d045 .config console log report syz C ci-android-49-kasan-gce-root
2018/11/28 07:26 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 4b6d14f2 .config console log report syz ci-android-49-kasan-gce-root
2018/11/14 07:16 https://android.googlesource.com/kernel/common android-4.9 109a48ed2f69 5f5f6d14 .config console log report syz ci-android-49-kasan-gce-root
2018/10/22 01:32 https://android.googlesource.com/kernel/common android-4.9 03fcc2fe7130 ecb386fe .config console log report syz ci-android-49-kasan-gce-root
2018/09/22 17:40 https://android.googlesource.com/kernel/common android-4.9 1c57ba4f543b 37079712 .config console log report syz ci-android-49-kasan-gce-root
2018/12/23 07:34 https://android.googlesource.com/kernel/common android-4.9 a2f9236e8131 e3bd7ab8 .config console log report ci-android-49-kasan-gce-root
2018/06/07 03:47 https://android.googlesource.com/kernel/common android-4.9 42a730adb6e2 e0e534c6 .config console log report ci-android-49-kasan-gce-root
2018/05/03 00:42 https://android.googlesource.com/kernel/common android-4.9 f679e4d9b77a d5b114b4 .config console log report ci-android-49-kasan-gce-root
2018/05/01 10:53 https://android.googlesource.com/kernel/common android-4.9 2bcbbd5b3924 d5b114b4 .config console log report ci-android-49-kasan-gce-root
2018/04/28 20:53 https://android.googlesource.com/kernel/common android-4.9 71fce1edd26d d5a5d045 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.