BUG: unable to handle kernel paging request in z_erofs_vle_unzip_all
7 views
Skip to first unread message
syzbot
Nov 1, 2022, 11:38:37 PM11/1/22
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: be0138c13b5d BACKPORT: Documentation: kunit: Update Kconfi..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10a6e37e880000
kernel config: https://syzkaller.appspot.com/x/.config?x=587759e0bb2a632a
dashboard link: https://syzkaller.appspot.com/bug?extid=d79323212b822552130a
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=133b4846880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=136f0161880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a4542a7781e9/disk-be0138c1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/12f228822ede/vmlinux-be0138c1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/734cfdf117fa/bzImage-be0138c1.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0113fa76176a/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d79323...@syzkaller.appspotmail.com
erofs: (device loop0): mounted with opts: , root inode @ nid 36.
attempt to access beyond end of device
loop0: rw=0, want=2201354232, limit=264192
BUG: unable to handle page fault for address: ffffed113ba9decb
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23fff3067 P4D 23fff3067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 304 Comm: syz-executor246 Not tainted 5.4.210-syzkaller-00024-gbe0138c13b5d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
RIP: 0010:z_erofs_decompress_pcluster fs/erofs/zdata.c:828 [inline]
RIP: 0010:z_erofs_vle_unzip_all+0x6c5/0x1b50 fs/erofs/zdata.c:973
Code: 20 84 c0 0f 85 10 03 00 00 8b 03 c1 f8 02 89 c0 48 8b 4c 24 48 4c 8d 24 c1 4d 89 e6 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 80 3c 06 00 74 08 4c 89 e7 e8 8c 1d 98 ff 4d 8b 2c 24 4d 85 ed
RSP: 0018:ffff8881dd4ef560 EFLAGS: 00010a02
RAX: dffffc0000000000 RBX: ffffea00077ef2e8 RCX: ffff8881dd4ef660
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea00077ef2e8
RBP: ffff8881dd4ef9a0 R08: dffffc0000000000 R09: fffff94000efde5e
R10: fffff94000efde5e R11: 1ffffd4000efde5d R12: ffff8889dd4ef658
R13: ffffea00077ef2c0 R14: 1ffff1113ba9decb R15: 0000000000000000
FS: 0000555556761300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed113ba9decb CR3: 00000001ddbc9000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
z_erofs_submit_and_unzip+0x134c/0x1400 fs/erofs/zdata.c:1328
z_erofs_vle_normalaccess_readpage+0x24f/0x540 fs/erofs/zdata.c:1347
do_read_cache_page+0x58d/0xa30 mm/filemap.c:2802
read_mapping_page include/linux/pagemap.h:399 [inline]
find_target_block_classic fs/erofs/namei.c:105 [inline]
erofs_namei+0x138/0xfd0 fs/erofs/namei.c:185
erofs_lookup+0xe8/0x350 fs/erofs/namei.c:229
__lookup_hash+0x115/0x240 fs/namei.c:1623
filename_create+0x193/0x6b0 fs/namei.c:3714
user_path_create fs/namei.c:3771 [inline]
do_mknodat+0x10f/0x3b0 fs/namei.c:3832
do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f5df41cee19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc77c6308 EFLAGS: 00000246 ORIG_RAX: 0000000000000103
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5df41cee19
RDX: 0000000000000004 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 00007f5df418e610 R08: 00005555567612c0 R09: 0000000000000000
R10: 0000000000000700 R11: 0000000000000246 R12: 00007f5df418e6a0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffed113ba9decb
---[ end trace 6f641d94771428eb ]---
RIP: 0010:z_erofs_decompress_pcluster fs/erofs/zdata.c:828 [inline]
RIP: 0010:z_erofs_vle_unzip_all+0x6c5/0x1b50 fs/erofs/zdata.c:973
Code: 20 84 c0 0f 85 10 03 00 00 8b 03 c1 f8 02 89 c0 48 8b 4c 24 48 4c 8d 24 c1 4d 89 e6 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 80 3c 06 00 74 08 4c 89 e7 e8 8c 1d 98 ff 4d 8b 2c 24 4d 85 ed
RSP: 0018:ffff8881dd4ef560 EFLAGS: 00010a02
RAX: dffffc0000000000 RBX: ffffea00077ef2e8 RCX: ffff8881dd4ef660
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea00077ef2e8
RBP: ffff8881dd4ef9a0 R08: dffffc0000000000 R09: fffff94000efde5e
R10: fffff94000efde5e R11: 1ffffd4000efde5d R12: ffff8889dd4ef658
R13: ffffea00077ef2c0 R14: 1ffff1113ba9decb R15: 0000000000000000
FS: 0000555556761300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed113ba9decb CR3: 00000001ddbc9000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 20 84 c0 0f 85 10 03 and %al,0x310850f(%rax,%rax,8)
7: 00 00 add %al,(%rax)
9: 8b 03 mov (%rbx),%eax
b: c1 f8 02 sar $0x2,%eax
e: 89 c0 mov %eax,%eax
10: 48 8b 4c 24 48 mov 0x48(%rsp),%rcx
15: 4c 8d 24 c1 lea (%rcx,%rax,8),%r12
19: 4d 89 e6 mov %r12,%r14
1c: 49 c1 ee 03 shr $0x3,%r14
20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
27: fc ff df
* 2a: 41 80 3c 06 00 cmpb $0x0,(%r14,%rax,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 e7 mov %r12,%rdi
34: e8 8c 1d 98 ff callq 0xff981dc5
39: 4d 8b 2c 24 mov (%r12),%r13
3d: 4d 85 ed test %r13,%r13
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: be0138c13b5d BACKPORT: Documentation: kunit: Update Kconfi..
git tree: android12-5.4
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10a6e37e880000
kernel config: https://syzkaller.appspot.com/x/.config?x=587759e0bb2a632a
dashboard link: https://syzkaller.appspot.com/bug?extid=d79323212b822552130a
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=133b4846880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=136f0161880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a4542a7781e9/disk-be0138c1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/12f228822ede/vmlinux-be0138c1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/734cfdf117fa/bzImage-be0138c1.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0113fa76176a/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d79323...@syzkaller.appspotmail.com
erofs: (device loop0): mounted with opts: , root inode @ nid 36.
attempt to access beyond end of device
loop0: rw=0, want=2201354232, limit=264192
BUG: unable to handle page fault for address: ffffed113ba9decb
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23fff3067 P4D 23fff3067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 304 Comm: syz-executor246 Not tainted 5.4.210-syzkaller-00024-gbe0138c13b5d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
RIP: 0010:z_erofs_decompress_pcluster fs/erofs/zdata.c:828 [inline]
RIP: 0010:z_erofs_vle_unzip_all+0x6c5/0x1b50 fs/erofs/zdata.c:973
Code: 20 84 c0 0f 85 10 03 00 00 8b 03 c1 f8 02 89 c0 48 8b 4c 24 48 4c 8d 24 c1 4d 89 e6 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 80 3c 06 00 74 08 4c 89 e7 e8 8c 1d 98 ff 4d 8b 2c 24 4d 85 ed
RSP: 0018:ffff8881dd4ef560 EFLAGS: 00010a02
RAX: dffffc0000000000 RBX: ffffea00077ef2e8 RCX: ffff8881dd4ef660
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea00077ef2e8
RBP: ffff8881dd4ef9a0 R08: dffffc0000000000 R09: fffff94000efde5e
R10: fffff94000efde5e R11: 1ffffd4000efde5d R12: ffff8889dd4ef658
R13: ffffea00077ef2c0 R14: 1ffff1113ba9decb R15: 0000000000000000
FS: 0000555556761300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed113ba9decb CR3: 00000001ddbc9000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
z_erofs_submit_and_unzip+0x134c/0x1400 fs/erofs/zdata.c:1328
z_erofs_vle_normalaccess_readpage+0x24f/0x540 fs/erofs/zdata.c:1347
do_read_cache_page+0x58d/0xa30 mm/filemap.c:2802
read_mapping_page include/linux/pagemap.h:399 [inline]
find_target_block_classic fs/erofs/namei.c:105 [inline]
erofs_namei+0x138/0xfd0 fs/erofs/namei.c:185
erofs_lookup+0xe8/0x350 fs/erofs/namei.c:229
__lookup_hash+0x115/0x240 fs/namei.c:1623
filename_create+0x193/0x6b0 fs/namei.c:3714
user_path_create fs/namei.c:3771 [inline]
do_mknodat+0x10f/0x3b0 fs/namei.c:3832
do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f5df41cee19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc77c6308 EFLAGS: 00000246 ORIG_RAX: 0000000000000103
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5df41cee19
RDX: 0000000000000004 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 00007f5df418e610 R08: 00005555567612c0 R09: 0000000000000000
R10: 0000000000000700 R11: 0000000000000246 R12: 00007f5df418e6a0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffed113ba9decb
---[ end trace 6f641d94771428eb ]---
RIP: 0010:z_erofs_decompress_pcluster fs/erofs/zdata.c:828 [inline]
RIP: 0010:z_erofs_vle_unzip_all+0x6c5/0x1b50 fs/erofs/zdata.c:973
Code: 20 84 c0 0f 85 10 03 00 00 8b 03 c1 f8 02 89 c0 48 8b 4c 24 48 4c 8d 24 c1 4d 89 e6 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 80 3c 06 00 74 08 4c 89 e7 e8 8c 1d 98 ff 4d 8b 2c 24 4d 85 ed
RSP: 0018:ffff8881dd4ef560 EFLAGS: 00010a02
RAX: dffffc0000000000 RBX: ffffea00077ef2e8 RCX: ffff8881dd4ef660
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea00077ef2e8
RBP: ffff8881dd4ef9a0 R08: dffffc0000000000 R09: fffff94000efde5e
R10: fffff94000efde5e R11: 1ffffd4000efde5d R12: ffff8889dd4ef658
R13: ffffea00077ef2c0 R14: 1ffff1113ba9decb R15: 0000000000000000
FS: 0000555556761300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed113ba9decb CR3: 00000001ddbc9000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 20 84 c0 0f 85 10 03 and %al,0x310850f(%rax,%rax,8)
7: 00 00 add %al,(%rax)
9: 8b 03 mov (%rbx),%eax
b: c1 f8 02 sar $0x2,%eax
e: 89 c0 mov %eax,%eax
10: 48 8b 4c 24 48 mov 0x48(%rsp),%rcx
15: 4c 8d 24 c1 lea (%rcx,%rax,8),%r12
19: 4d 89 e6 mov %r12,%r14
1c: 49 c1 ee 03 shr $0x3,%r14
20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
27: fc ff df
* 2a: 41 80 3c 06 00 cmpb $0x0,(%r14,%rax,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 e7 mov %r12,%rdi
34: e8 8c 1d 98 ff callq 0xff981dc5
39: 4d 8b 2c 24 mov (%r12),%r13
3d: 4d 85 ed test %r13,%r13
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Aug 19, 2023, 5:57:42 PM8/19/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages