From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-4116512-1517381877-2-16293876008127927090 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no ("Email failed DMARC policy for domain") X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, FREEMAIL_FORGED_FROMDOMAIN 0.195, FREEMAIL_FROM 0.001, HEADER_FROM_DIFFERENT_DOMAINS 0.001, RCVD_IN_DNSWL_MED -2.3, SPF_PASS -0.001, LANGUAGES daen, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='140.211.166.138', Host='smtp1.osuosl.org', Country='US', FromHeader='com', MailFrom='org' X-Spam-charsets: plain='us-ascii' X-IgnoreVacation: yes ("Email failed DMARC policy for domain") X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: driverdev-devel-bounces@linuxdriverproject.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1517381875; b=cLSyYHLCK3UTk4ruMZMeCw4+Csc/4Vr6xQw4GvvdhYUn7LS WcE0IbCGYlg0wCW5YNFcOF7yQdjC3x+w+/WLWXEH212hCuj13og6byukJLfHOJys IAgBhAY2LsOJATOxBmyEREY9djPyv/Uk40Op+MVJ00axy7G73Fu0iz77f3iH2rvy EVmj+CCYdtE1QOsh+o46XjaBGAwstoWLfb/iDo6JxLXnkXWN1IlQsV5gqItXhSjj kYQamCu2rz8XiF1CNp+2ZTC6LNqYVKycboT/4GRa4yLR0ue5fZ62nNoP5lqvTlsA L0QS6dwPZ7qkQGmtHShWE9sBHc9r1FCJ5+WqwdA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=date:from:to:subject:message-id :references:mime-version:in-reply-to:list-id:list-unsubscribe :list-archive:list-post:list-help:list-subscribe:cc:content-type :content-transfer-encoding:sender; s=arctest; t=1517381875; bh=w DHqkLdRYOYj+HZYm/Eg8AVXwHcd4xrhHhayDCxVRTQ=; b=lBOrP4gs5YU6A+PMG TL+x3OZTfzFuoKfZhXW6vFqaeczNg2hpwVkTY1RgSPOy8HCjvPPSIivdi2UnsPAL hzoiAsJXDt9Y9KzsP1q+o0UrU0x/VWyoWVZZE0TgmUr/dxdnCPLoq/wdX89TTUBq oJ2VdtDCV9ZofByXschtTA1zss1c4p0+TCEiSuH/Kn7LxoV0F9hIx2rzwm4tsxEM IxsJA9tYflFFKO0r+WHWbAZIXbZHLTVuONKUuz+HnWO+JBM4/25y/kkNHumR2dKv T25PNhQsKmZFnkfSB1oz4YgADsoeJP7ViJqmZvsmcsnIXTsKyAcme9pEQhdVmk12 Bwkww== ARC-Authentication-Results: i=1; mx2.messagingengine.com; arc=none (no signatures found); dkim=fail (message has been altered; 2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=oeQ3eERY x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=fail (p=none,has-list-id=yes,d=none) header.from=gmail.com; iprev=pass policy.iprev=140.211.166.138 (smtp1.osuosl.org); spf=pass smtp.mailfrom=driverdev-devel-bounces@linuxdriverproject.org smtp.helo=whitealder.osuosl.org; x-aligned-from=fail; x-google-dkim=fail (message has been altered; 2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=F/TcsnPK; x-ptr=fail x-ptr-helo=whitealder.osuosl.org x-ptr-lookup=smtp1.osuosl.org; x-return-mx=pass smtp.domain=linuxdriverproject.org smtp.result=pass smtp_is_org_domain=yes header.domain=gmail.com header.result=pass header_is_org_domain=yes; x-tls=pass version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128 Authentication-Results: mx2.messagingengine.com; arc=none (no signatures found); dkim=fail (message has been altered; 2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=oeQ3eERY x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=fail (p=none,has-list-id=yes,d=none) header.from=gmail.com; iprev=pass policy.iprev=140.211.166.138 (smtp1.osuosl.org); spf=pass smtp.mailfrom=driverdev-devel-bounces@linuxdriverproject.org smtp.helo=whitealder.osuosl.org; x-aligned-from=fail; x-google-dkim=fail (message has been altered; 2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=F/TcsnPK; x-ptr=fail x-ptr-helo=whitealder.osuosl.org x-ptr-lookup=smtp1.osuosl.org; x-return-mx=pass smtp.domain=linuxdriverproject.org smtp.result=pass smtp_is_org_domain=yes header.domain=gmail.com header.result=pass header_is_org_domain=yes; x-tls=pass version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128 X-Remote-Delivered-To: driverdev-devel@osuosl.org X-Google-Smtp-Source: AH8x224jPMu5AE+iLLekeNkzj6lTev5l98hKSt8N24MVhxA9t4EUZg9H1r3bwOE5pvO9Uv/BRAmrvQ== Date: Tue, 30 Jan 2018 22:57:45 -0800 From: Eric Biggers To: syzbot Subject: Re: BUG: unable to handle kernel NULL pointer dereference in binder_poll Message-ID: <20180131065745.GE2736@zzz.localdomain> References: <001a11445d0a99aecc05609fc34a@google.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <001a11445d0a99aecc05609fc34a@google.com> User-Agent: Mutt/1.9.3 (2018-01-21) X-BeenThere: driverdev-devel@linuxdriverproject.org X-Mailman-Version: 2.1.24 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devel@driverdev.osuosl.org, tkjos@android.com, gregkh@linuxfoundation.org, syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org, arve@android.com, maco@android.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: driverdev-devel-bounces@linuxdriverproject.org Sender: "devel" X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Mon, Dec 18, 2017 at 08:23:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > C reproducer is attached > syzkaller reproducer is attached. See https://goo.gl/kgGztJ > for information about syzkaller reproducers > > > RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000444119 > RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000003 > RBP: 0000000000000005 R08: 0000000000000001 R09: 0000000000000032 > R10: 00000000207a6000 R11: 0000000000000246 R12: 0000000000401e60 > R13: 0000000000401ef0 R14: 0000000000000000 R15: 0000000000000000 > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: binder_poll+0x28/0xf0 drivers/android/binder.c:4371 > PGD 2134c1067 P4D 2134c1067 PUD 214180067 PMD 0 > Oops: 0000 [#1] SMP > Dumping ftrace buffer: > (ftrace buffer empty) > Modules linked in: > CPU: 0 PID: 3117 Comm: syzkaller406906 Not tainted 4.15.0-rc3-next-20171214+ > #67 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > RIP: 0010:binder_poll+0x28/0xf0 drivers/android/binder.c:4371 > RSP: 0018:ffffc900017d3df0 EFLAGS: 00010286 > RAX: 0000000000000000 RBX: ffffc900017d3ef0 RCX: ffffffff820258f3 > RDX: 0000000000000000 RSI: ffffffff83080700 RDI: 0000000000000286 > RBP: ffffc900017d3e20 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900017d3ef0 > R13: ffff8802118fb000 R14: ffffffff82bb9f20 R15: ffff8802140d1c30 > FS: 0000000000deb880(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000000 CR3: 0000000216bbc002 CR4: 00000000001606f0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > ep_item_poll.isra.10+0x49/0xf0 fs/eventpoll.c:885 > ep_insert fs/eventpoll.c:1457 [inline] > SYSC_epoll_ctl fs/eventpoll.c:2104 [inline] > SyS_epoll_ctl+0x884/0x1010 fs/eventpoll.c:1990 > entry_SYSCALL_64_fastpath+0x1f/0x96 > RIP: 0033:0x444119 > RSP: 002b:00007fffbc6b55b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 > RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000444119 > RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000003 > RBP: 0000000000000005 R08: 0000000000000001 R09: 0000000000000032 > R10: 00000000207a6000 R11: 0000000000000246 R12: 0000000000401e60 > R13: 0000000000401ef0 R14: 0000000000000000 R15: 0000000000000000 > Code: ff 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 49 89 fd 53 49 89 f4 48 > 83 ec 08 e8 24 49 29 ff 49 8b bd 90 01 00 00 e8 78 fd ff ff <48> 8b 38 48 89 > c3 be 15 11 00 00 e8 e8 7e ff ff 44 8b 73 34 44 > RIP: binder_poll+0x28/0xf0 drivers/android/binder.c:4371 RSP: > ffffc900017d3df0 > CR2: 0000000000000000 Duplicate of: #syz dup: general protection fault in binder_poll _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel