All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+c5c252a500b90d63e07f@syzkaller.appspotmail.com>
To: daniel.vetter@ffwll.ch, gregkh@linuxfoundation.org,
	jslaby@suse.com, linux-kernel@vger.kernel.org, nico@fluxnic.net,
	sam@ravnborg.org, syzkaller-bugs@googlegroups.com
Subject: KASAN: user-memory-access Read in do_con_trol
Date: Fri, 08 May 2020 02:28:12 -0700	[thread overview]
Message-ID: <000000000000c15b0c05a51f9d8c@google.com> (raw)

Hello,

syzbot found the following crash on:

HEAD commit:    3c40cdb0 Merge branch 'linus' of git://git.kernel.org/pub/..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14733d6c100000
kernel config:  https://syzkaller.appspot.com/x/.config?x=b0212dbee046bc1f
dashboard link: https://syzkaller.appspot.com/bug?extid=c5c252a500b90d63e07f
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c5c252a500b90d63e07f@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: user-memory-access in memcpy include/linux/string.h:381 [inline]
BUG: KASAN: user-memory-access in scr_memcpyw include/linux/vt_buffer.h:49 [inline]
BUG: KASAN: user-memory-access in delete_char drivers/tty/vt/vt.c:853 [inline]
BUG: KASAN: user-memory-access in csi_P drivers/tty/vt/vt.c:2008 [inline]
BUG: KASAN: user-memory-access in do_con_trol+0x364/0x5d00 drivers/tty/vt/vt.c:2402
Read of size 398 at addr 00000000fffffe82 by task syz-executor.5/11995

CPU: 1 PID: 11995 Comm: syz-executor.5 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 __kasan_report.cold+0x5/0x4d mm/kasan/report.c:515
 kasan_report+0x33/0x50 mm/kasan/common.c:625
 check_memory_region_inline mm/kasan/generic.c:187 [inline]
 check_memory_region+0x141/0x190 mm/kasan/generic.c:193
 memcpy+0x20/0x60 mm/kasan/common.c:106
 memcpy include/linux/string.h:381 [inline]
 scr_memcpyw include/linux/vt_buffer.h:49 [inline]
 delete_char drivers/tty/vt/vt.c:853 [inline]
 csi_P drivers/tty/vt/vt.c:2008 [inline]
 do_con_trol+0x364/0x5d00 drivers/tty/vt/vt.c:2402
 do_con_write.part.0+0xf34/0x1dc0 drivers/tty/vt/vt.c:2818
 do_con_write drivers/tty/vt/vt.c:2588 [inline]
 con_write+0x41/0xe0 drivers/tty/vt/vt.c:3154
 process_output_block drivers/tty/n_tty.c:595 [inline]
 n_tty_write+0x3f0/0xf90 drivers/tty/n_tty.c:2333
 do_tty_write drivers/tty/tty_io.c:962 [inline]
 tty_write+0x495/0x800 drivers/tty/tty_io.c:1046
 __vfs_write+0x76/0x100 fs/read_write.c:495
 vfs_write+0x268/0x5d0 fs/read_write.c:559
 ksys_write+0x12d/0x250 fs/read_write.c:612
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x45c829
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fe8c3dc7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000000050c660 RCX: 000000000045c829
RDX: 0000000000000320 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000cea R14: 00000000004cf16f R15: 00007fe8c3dc86d4
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

                 reply	other threads:[~2020-05-08  9:28 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=000000000000c15b0c05a51f9d8c@google.com \
    --to=syzbot+c5c252a500b90d63e07f@syzkaller.appspotmail.com \
    --cc=daniel.vetter@ffwll.ch \
    --cc=gregkh@linuxfoundation.org \
    --cc=jslaby@suse.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nico@fluxnic.net \
    --cc=sam@ravnborg.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.