syzbot
KASAN: user-memory-access Write in n_tty_set_termios
Status:
public: reported syz repro on 2019/04/10 16:04
Reported-by: syzbot+f79f965eb444cb4d361f@syzkaller.appspotmail.com
First crash: 2903d, last: 2771d
Sample crash report:
audit: type=1400 audit(1547337441.890:9): avc: denied { map } for pid=1813 comm="syz-execprog" path="/root/syzkaller-shm745338252" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
==================================================================
BUG: KASAN: user-memory-access in memset include/linux/string.h:329 [inline]
BUG: KASAN: user-memory-access in bitmap_zero include/linux/bitmap.h:197 [inline]
BUG: KASAN: user-memory-access in n_tty_set_termios+0xee/0xcc0 drivers/tty/n_tty.c:1799
Write of size 512 at addr 0000000000001060 by task syz-executor0/9325
CPU: 0 PID: 9325 Comm: syz-executor0 Not tainted 4.14.92+ #5
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x10e lib/dump_stack.c:53
kasan_report_error mm/kasan/report.c:349 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0x1f8/0x2a5 mm/kasan/report.c:393
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 9325 Comm: syz-executor0 Tainted: G B 4.14.92+ #5
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x10e lib/dump_stack.c:53
panic+0x1d9/0x3c2 kernel/panic.c:182
kasan_end_report+0x43/0x49 mm/kasan/report.c:176
kasan_report_error mm/kasan/report.c:356 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa4/0x2a5 mm/kasan/report.c:393
Kernel Offset: 0x1b000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
Rebooting in 86400 seconds..
* Struck through repros no longer work on HEAD.