BUG: unable to handle kernel paging request in bpf_trace_run4

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 63d1c2f0 ANDROID: mm: add generic __va_function and __pa_f..
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=100ca0d3900000
kernel config: https://syzkaller.appspot.com/x/.config?x=a189fc0e5a79868a
dashboard link: https://syzkaller.appspot.com/bug?extid=8eff18beca8f96a2ffac
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8eff18...@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: ffffc90000166030
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1da89e067 P4D 1da89e067 PUD 1da89f067 PMD 1da8a4067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 477 Comm: syz-executor.3 Tainted: G W 5.4.65-syzkaller-00175-g63d1c2f0b547 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bpf_call_func include/linux/filter.h:608 [inline]
RIP: 0010:__bpf_trace_run kernel/trace/bpf_trace.c:1334 [inline]
RIP: 0010:bpf_trace_run4+0x14b/0x280 kernel/trace/bpf_trace.c:1374
Code: 7e 01 0f 1f 44 00 00 e8 83 0e f9 ff 49 8d 7e 30 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 7c c2 26 00 49 8d 76 38 4c 89 e7 <41> ff 56 30 e9 b3 00 00 00 e8 57 0e f9 ff e8 32 22 bf ff 49 89 c7
RSP: 0018:ffff8881d6ba7880 EFLAGS: 00010246
RAX: 1ffff9200002cc06 RBX: dffffc0000000000 RCX: 0000000000040000
RDX: ffffc9000404d000 RSI: ffffc90000166038 RDI: ffff8881d6ba78c0
RBP: ffff8881d6ba7948 R08: ffffffff819be0e8 R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881d6ba78c0
R13: dffffc0000000000 R14: ffffc90000166000 R15: ffff8881d6578000
FS: 00007f00381a8700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000166030 CR3: 00000001c6f54006 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_ext4_journal_start include/trace/events/ext4.h:1747 [inline]
__ext4_journal_start_sb+0x12a/0x420 fs/ext4/ext4_jbd2.c:73
__ext4_new_inode+0x1368/0x5ce0 fs/ext4/ialloc.c:929
ext4_mkdir+0x41e/0x1530 fs/ext4/namei.c:2889
vfs_mkdir+0x420/0x5f0 fs/namei.c:3894
do_mkdirat+0x1e0/0x320 fs/namei.c:3917
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d597
Code: 1f 40 00 b8 5a 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 0d be fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ed bd fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f00381a7a88 EFLAGS: 00000213 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00007f00381a7b20 RCX: 000000000045d597
RDX: 0000000000000003 RSI: 00000000000001ff RDI: 0000000020000100
RBP: 00007f00381a7ae0 R08: 0000000020000218 R09: 0000000000000000
R10: 0000000000000400 R11: 0000000000000213 R12: 0000000020000000
R13: 0000000020000100 R14: 0000000020000200 R15: 0000000020013b00
Modules linked in:
CR2: ffffc90000166030
---[ end trace 456adf7b2de4013a ]---
RIP: 0010:bpf_call_func include/linux/filter.h:608 [inline]
RIP: 0010:__bpf_trace_run kernel/trace/bpf_trace.c:1334 [inline]
RIP: 0010:bpf_trace_run4+0x14b/0x280 kernel/trace/bpf_trace.c:1374
Code: 7e 01 0f 1f 44 00 00 e8 83 0e f9 ff 49 8d 7e 30 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 7c c2 26 00 49 8d 76 38 4c 89 e7 <41> ff 56 30 e9 b3 00 00 00 e8 57 0e f9 ff e8 32 22 bf ff 49 89 c7
RSP: 0018:ffff8881d6ba7880 EFLAGS: 00010246
RAX: 1ffff9200002cc06 RBX: dffffc0000000000 RCX: 0000000000040000
RDX: ffffc9000404d000 RSI: ffffc90000166038 RDI: ffff8881d6ba78c0
RBP: ffff8881d6ba7948 R08: ffffffff819be0e8 R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881d6ba78c0
R13: dffffc0000000000 R14: ffffc90000166000 R15: ffff8881d6578000
FS: 00007f00381a8700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000166030 CR3: 00000001c6f54006 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 63d1c2f0 ANDROID: mm: add generic __va_function and __pa_f..
git tree: android-5.4

console output: https://syzkaller.appspot.com/x/log.txt?x=14216f8b900000

kernel config: https://syzkaller.appspot.com/x/.config?x=a189fc0e5a79868a
dashboard link: https://syzkaller.appspot.com/bug?extid=8eff18beca8f96a2ffac
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=136bc8d3900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16cd2c81900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8eff18...@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: ffffc90000069030

#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1da89e067 P4D 1da89e067 PUD 1da89f067 PMD 1da8a4067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN

CPU: 0 PID: 194 Comm: rs:main Q:Reg Tainted: G W 5.4.65-syzkaller-00175-g63d1c2f0b547 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bpf_call_func include/linux/filter.h:608 [inline]
RIP: 0010:__bpf_trace_run kernel/trace/bpf_trace.c:1334 [inline]
RIP: 0010:bpf_trace_run4+0x14b/0x280 kernel/trace/bpf_trace.c:1374
Code: 7e 01 0f 1f 44 00 00 e8 83 0e f9 ff 49 8d 7e 30 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 7c c2 26 00 49 8d 76 38 4c 89 e7 <41> ff 56 30 e9 b3 00 00 00 e8 57 0e f9 ff e8 32 22 bf ff 49 89 c7

RSP: 0018:ffff8881d90e75e0 EFLAGS: 00010246
RAX: 1ffff9200000d206 RBX: dffffc0000000000 RCX: ffff8881da31cd80
RDX: 0000000000000000 RSI: ffffc90000069038 RDI: ffff8881d90e7620
RBP: ffff8881d90e76a8 R08: ffffffff81a09f7d R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881d90e7620
R13: dffffc0000000000 R14: ffffc90000069000 R15: ffff8881d6585000
FS: 00007ff6979e3700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: ffffc90000069030 CR3: 00000001c8a4f002 CR4: 00000000001606f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_ext4_journal_start include/trace/events/ext4.h:1747 [inline]
__ext4_journal_start_sb+0x12a/0x420 fs/ext4/ext4_jbd2.c:73

__ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
ext4_da_write_begin+0xb0d/0xfb0 fs/ext4/inode.c:3107
generic_perform_write+0x271/0x530 mm/filemap.c:3284
__generic_file_write_iter+0x232/0x460 mm/filemap.c:3413
ext4_file_write_iter+0x515/0x1250 fs/ext4/file.c:270
call_write_iter include/linux/fs.h:1958 [inline]
new_sync_write fs/read_write.c:483 [inline]
__vfs_write+0x579/0x700 fs/read_write.c:496
vfs_write+0x217/0x4f0 fs/read_write.c:558
ksys_write+0x168/0x2a0 fs/read_write.c:611
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7ff69a4271cd
Code: c2 20 00 00 75 10 b8 01 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ae fc ff ff 48 89 04 24 b8 01 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 f7 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ff6979e2590 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff68c003a50 RCX: 00007ff69a4271cd
RDX: 0000000000000d61 RSI: 00007ff68c003a50 RDI: 0000000000000006
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007ff68c0037b0
R13: 00007ff6979e25b0 R14: 00005653d4f88360 R15: 0000000000000d61
Modules linked in:
CR2: ffffc90000069030
---[ end trace ae8d229e5a7b1e8b ]---

RIP: 0010:bpf_call_func include/linux/filter.h:608 [inline]
RIP: 0010:__bpf_trace_run kernel/trace/bpf_trace.c:1334 [inline]
RIP: 0010:bpf_trace_run4+0x14b/0x280 kernel/trace/bpf_trace.c:1374
Code: 7e 01 0f 1f 44 00 00 e8 83 0e f9 ff 49 8d 7e 30 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 7c c2 26 00 49 8d 76 38 4c 89 e7 <41> ff 56 30 e9 b3 00 00 00 e8 57 0e f9 ff e8 32 22 bf ff 49 89 c7

RSP: 0018:ffff8881d90e75e0 EFLAGS: 00010246
RAX: 1ffff9200000d206 RBX: dffffc0000000000 RCX: ffff8881da31cd80
RDX: 0000000000000000 RSI: ffffc90000069038 RDI: ffff8881d90e7620
RBP: ffff8881d90e76a8 R08: ffffffff81a09f7d R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881d90e7620
R13: dffffc0000000000 R14: ffffc90000069000 R15: ffff8881d6585000
FS: 00007ff6979e3700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: ffffc90000069030 CR3: 00000001c8a4f002 CR4: 00000000001606f0

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.