general protection fault in sockfs_setattr

Status: fixed on 2018/08/23 18:23
Fix commit: 6d8c50dcb029 UPSTREAM: socket: close race condition between sock_close() and sockfs_setattr()
First crash: 2946d, last: 2928d
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 general protection fault in sockfs_setattr 2 syz 2 2928d 2694d 0/2 public: reported syz repro on 2019/04/14 08:51

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4077 Comm: syz-executor863 Not tainted 4.9.117-g8b21e85 #71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d91f8000 task.stack: ffff8801d9270000
RIP: 0010:[<ffffffff83017eec>]  [<ffffffff83017eec>] sockfs_setattr+0xbc/0x140 net/socket.c:543
RSP: 0018:ffff8801d9277c48  EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff8801d9277d90 RCX: 0000000000000000
RDX: 0000000000000065 RSI: ffffffff83017e8e RDI: 0000000000000328
RBP: ffff8801d9277c60 R08: ffff8801d91f8938 R09: 0000000000000001
R10: 0000000000000000 R11: 1ffff1003b23f122 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8801cbe951e0 R15: 0000000000000000
FS:  00007f4bd4c4f700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000180 CR3: 00000001c9e80000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 0000000000001846 ffffffff83017e30 ffff8801d9277d90 ffff8801d9277ce0
 ffffffff815d4340 ffff8801bb92ddf0 ffff8801d9277cb8 ffff8801cbe95238
 ffff8801d9277d50 0000000000000004 0000000036fcace8 ffff8801d9922e20
Call Trace:
 [<ffffffff815d4340>] notify_change2+0xac0/0xdf0 fs/attr.c:313
 [<ffffffff81569932>] chown_common+0x482/0x550 fs/open.c:629
 [<ffffffff8156d245>] SYSC_fchownat fs/open.c:659 [inline]
 [<ffffffff8156d245>] SyS_fchownat+0x115/0x1b0 fs/open.c:639
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839fcc13>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 87 00 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 6d f0 49 8d bd 28 03 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 04 3c 03 7e 47 48 8d 7b 08 48 b8 00 00 00 
RIP  [<ffffffff83017eec>] sockfs_setattr+0xbc/0x140 net/socket.c:543
 RSP <ffff8801d9277c48>
---[ end trace efdf73b2c25de416 ]---

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/08/04 11:03 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c df7f6947 .config console log report syz C ci-android-49-kasan-gce
2018/08/22 20:26 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report syz ci-android-49-kasan-gce-root
2018/08/22 13:53 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report syz ci-android-49-kasan-gce
2018/08/22 13:56 https://android.googlesource.com/kernel/common android-4.9 8dd3fc2ed765 95b5c82b .config console log report syz ci-android-49-kasan-gce-386
2018/08/09 04:32 https://android.googlesource.com/kernel/common android-4.9 856452b4f22e 2eeda842 .config console log report ci-android-49-kasan-gce-root
2018/08/06 09:00 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 1beb8136 .config console log report ci-android-49-kasan-gce
2018/08/06 08:33 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 1beb8136 .config console log report ci-android-49-kasan-gce
2018/08/06 04:35 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 1beb8136 .config console log report ci-android-49-kasan-gce
2018/08/05 12:48 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 1beb8136 .config console log report ci-android-49-kasan-gce
2018/08/05 05:37 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c 3476a2df .config console log report ci-android-49-kasan-gce
2018/08/04 10:33 https://android.googlesource.com/kernel/common android-4.9 8b21e85d919c df7f6947 .config console log report ci-android-49-kasan-gce
* Struck through repros no longer work on HEAD.