BUG: unable to handle kernel paging request in z_erofs_decompress_pcluster
9 views
Skip to first unread message
syzbot
Nov 1, 2022, 11:29:40 PM11/1/22
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 0118fb827bc7 Merge branch 'android12-5.10' into branch 'an..
git tree: android12-5.10-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=145c87b6880000
kernel config: https://syzkaller.appspot.com/x/.config?x=585a67b78cadff5
dashboard link: https://syzkaller.appspot.com/bug?extid=95082e4560bd0460034d
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=174590a9880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f09ff2880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cc18609231c0/disk-0118fb82.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d1a695e1b6f/vmlinux-0118fb82.xz
kernel image: https://storage.googleapis.com/syzbot-assets/05f981b5731d/bzImage-0118fb82.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/931a33851306/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+95082e...@syzkaller.appspotmail.com
attempt to access beyond end of device
loop0: rw=0, want=2201354232, limit=264192
BUG: unable to handle page fault for address: fffff52100164e27
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffef067 P4D 23ffef067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 371 Comm: syz-executor209 Not tainted 5.10.149-syzkaller-01350-g0118fb827bc7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
RIP: 0010:z_erofs_decompress_pcluster+0x7a0/0x1d70 fs/erofs/zdata.c:914
Code: 00 e8 b4 1b 85 ff 41 8a 04 1e 84 c0 0f 85 13 02 00 00 41 8b 07 c1 f8 02 89 c0 48 8b 4c 24 58 4c 8d 34 c1 4d 89 f7 49 c1 ef 03 <41> 80 3c 1f 00 74 08 4c 89 f7 e8 91 19 85 ff 4d 8b 26 4d 85 e4 0f
RSP: 0018:ffffc90000b27060 EFLAGS: 00010a06
RAX: 00000000ffffffff RBX: dffffc0000000000 RCX: ffffc90000b27140
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea000477cd68
RBP: ffffc90000b27570 R08: dffffc0000000000 R09: fffff940008ef9ae
R10: fffff940008ef9ae R11: 1ffffd40008ef9ad R12: ffffea000477cd40
R13: 0000000000000000 R14: ffffc90800b27138 R15: 1ffff92100164e27
FS: 0000555555cc0300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffff52100164e27 CR3: 000000011c15d000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
z_erofs_decompress_queue fs/erofs/zdata.c:1059 [inline]
z_erofs_runqueue+0xbbb/0xcd0 fs/erofs/zdata.c:1380
z_erofs_readpage+0x2fc/0x5f0 fs/erofs/zdata.c:1398
do_read_cache_page+0x717/0x8f0 mm/filemap.c:3156
read_cache_page+0x4d/0x70 mm/filemap.c:3255
read_mapping_page include/linux/pagemap.h:498 [inline]
find_target_block_classic+0x133/0xa30 fs/erofs/namei.c:105
erofs_namei+0x1c0/0x9e0 fs/erofs/namei.c:185
erofs_lookup+0x141/0x3b0 fs/erofs/namei.c:229
__lookup_hash+0x141/0x290 fs/namei.c:1531
filename_create+0x207/0x770 fs/namei.c:3547
user_path_create fs/namei.c:3604 [inline]
do_mknodat+0x15f/0x430 fs/namei.c:3667
__do_sys_mknodat fs/namei.c:3702 [inline]
__se_sys_mknodat fs/namei.c:3699 [inline]
__x64_sys_mknodat+0x9b/0xb0 fs/namei.c:3699
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7fa7ffe6de19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff54649de8 EFLAGS: 00000246 ORIG_RAX: 0000000000000103
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa7ffe6de19
RDX: 0000000000000004 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 00007fa7ffe2d610 R08: 0000555555cc02c0 R09: 0000000000000000
R10: 0000000000000700 R11: 0000000000000246 R12: 00007fa7ffe2d6a0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: fffff52100164e27
---[ end trace d4694d95192b3555 ]---
RIP: 0010:z_erofs_decompress_pcluster+0x7a0/0x1d70 fs/erofs/zdata.c:914
Code: 00 e8 b4 1b 85 ff 41 8a 04 1e 84 c0 0f 85 13 02 00 00 41 8b 07 c1 f8 02 89 c0 48 8b 4c 24 58 4c 8d 34 c1 4d 89 f7 49 c1 ef 03 <41> 80 3c 1f 00 74 08 4c 89 f7 e8 91 19 85 ff 4d 8b 26 4d 85 e4 0f
RSP: 0018:ffffc90000b27060 EFLAGS: 00010a06
RAX: 00000000ffffffff RBX: dffffc0000000000 RCX: ffffc90000b27140
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea000477cd68
RBP: ffffc90000b27570 R08: dffffc0000000000 R09: fffff940008ef9ae
R10: fffff940008ef9ae R11: 1ffffd40008ef9ad R12: ffffea000477cd40
R13: 0000000000000000 R14: ffffc90800b27138 R15: 1ffff92100164e27
FS: 0000555555cc0300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffff52100164e27 CR3: 000000011c15d000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 e8 add %ch,%al
2: b4 1b mov $0x1b,%ah
4: 85 ff test %edi,%edi
6: 41 8a 04 1e mov (%r14,%rbx,1),%al
a: 84 c0 test %al,%al
c: 0f 85 13 02 00 00 jne 0x225
12: 41 8b 07 mov (%r15),%eax
15: c1 f8 02 sar $0x2,%eax
18: 89 c0 mov %eax,%eax
1a: 48 8b 4c 24 58 mov 0x58(%rsp),%rcx
1f: 4c 8d 34 c1 lea (%rcx,%rax,8),%r14
23: 4d 89 f7 mov %r14,%r15
26: 49 c1 ef 03 shr $0x3,%r15
* 2a: 41 80 3c 1f 00 cmpb $0x0,(%r15,%rbx,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 91 19 85 ff callq 0xff8519ca
39: 4d 8b 26 mov (%r14),%r12
3c: 4d 85 e4 test %r12,%r12
3f: 0f .byte 0xf
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 0118fb827bc7 Merge branch 'android12-5.10' into branch 'an..
git tree: android12-5.10-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=145c87b6880000
kernel config: https://syzkaller.appspot.com/x/.config?x=585a67b78cadff5
dashboard link: https://syzkaller.appspot.com/bug?extid=95082e4560bd0460034d
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=174590a9880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11f09ff2880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cc18609231c0/disk-0118fb82.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d1a695e1b6f/vmlinux-0118fb82.xz
kernel image: https://storage.googleapis.com/syzbot-assets/05f981b5731d/bzImage-0118fb82.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/931a33851306/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+95082e...@syzkaller.appspotmail.com
attempt to access beyond end of device
loop0: rw=0, want=2201354232, limit=264192
BUG: unable to handle page fault for address: fffff52100164e27
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffef067 P4D 23ffef067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 371 Comm: syz-executor209 Not tainted 5.10.149-syzkaller-01350-g0118fb827bc7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
RIP: 0010:z_erofs_decompress_pcluster+0x7a0/0x1d70 fs/erofs/zdata.c:914
Code: 00 e8 b4 1b 85 ff 41 8a 04 1e 84 c0 0f 85 13 02 00 00 41 8b 07 c1 f8 02 89 c0 48 8b 4c 24 58 4c 8d 34 c1 4d 89 f7 49 c1 ef 03 <41> 80 3c 1f 00 74 08 4c 89 f7 e8 91 19 85 ff 4d 8b 26 4d 85 e4 0f
RSP: 0018:ffffc90000b27060 EFLAGS: 00010a06
RAX: 00000000ffffffff RBX: dffffc0000000000 RCX: ffffc90000b27140
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea000477cd68
RBP: ffffc90000b27570 R08: dffffc0000000000 R09: fffff940008ef9ae
R10: fffff940008ef9ae R11: 1ffffd40008ef9ad R12: ffffea000477cd40
R13: 0000000000000000 R14: ffffc90800b27138 R15: 1ffff92100164e27
FS: 0000555555cc0300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffff52100164e27 CR3: 000000011c15d000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
z_erofs_decompress_queue fs/erofs/zdata.c:1059 [inline]
z_erofs_runqueue+0xbbb/0xcd0 fs/erofs/zdata.c:1380
z_erofs_readpage+0x2fc/0x5f0 fs/erofs/zdata.c:1398
do_read_cache_page+0x717/0x8f0 mm/filemap.c:3156
read_cache_page+0x4d/0x70 mm/filemap.c:3255
read_mapping_page include/linux/pagemap.h:498 [inline]
find_target_block_classic+0x133/0xa30 fs/erofs/namei.c:105
erofs_namei+0x1c0/0x9e0 fs/erofs/namei.c:185
erofs_lookup+0x141/0x3b0 fs/erofs/namei.c:229
__lookup_hash+0x141/0x290 fs/namei.c:1531
filename_create+0x207/0x770 fs/namei.c:3547
user_path_create fs/namei.c:3604 [inline]
do_mknodat+0x15f/0x430 fs/namei.c:3667
__do_sys_mknodat fs/namei.c:3702 [inline]
__se_sys_mknodat fs/namei.c:3699 [inline]
__x64_sys_mknodat+0x9b/0xb0 fs/namei.c:3699
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7fa7ffe6de19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff54649de8 EFLAGS: 00000246 ORIG_RAX: 0000000000000103
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa7ffe6de19
RDX: 0000000000000004 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 00007fa7ffe2d610 R08: 0000555555cc02c0 R09: 0000000000000000
R10: 0000000000000700 R11: 0000000000000246 R12: 00007fa7ffe2d6a0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: fffff52100164e27
---[ end trace d4694d95192b3555 ]---
RIP: 0010:z_erofs_decompress_pcluster+0x7a0/0x1d70 fs/erofs/zdata.c:914
Code: 00 e8 b4 1b 85 ff 41 8a 04 1e 84 c0 0f 85 13 02 00 00 41 8b 07 c1 f8 02 89 c0 48 8b 4c 24 58 4c 8d 34 c1 4d 89 f7 49 c1 ef 03 <41> 80 3c 1f 00 74 08 4c 89 f7 e8 91 19 85 ff 4d 8b 26 4d 85 e4 0f
RSP: 0018:ffffc90000b27060 EFLAGS: 00010a06
RAX: 00000000ffffffff RBX: dffffc0000000000 RCX: ffffc90000b27140
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea000477cd68
RBP: ffffc90000b27570 R08: dffffc0000000000 R09: fffff940008ef9ae
R10: fffff940008ef9ae R11: 1ffffd40008ef9ad R12: ffffea000477cd40
R13: 0000000000000000 R14: ffffc90800b27138 R15: 1ffff92100164e27
FS: 0000555555cc0300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffff52100164e27 CR3: 000000011c15d000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 e8 add %ch,%al
2: b4 1b mov $0x1b,%ah
4: 85 ff test %edi,%edi
6: 41 8a 04 1e mov (%r14,%rbx,1),%al
a: 84 c0 test %al,%al
c: 0f 85 13 02 00 00 jne 0x225
12: 41 8b 07 mov (%r15),%eax
15: c1 f8 02 sar $0x2,%eax
18: 89 c0 mov %eax,%eax
1a: 48 8b 4c 24 58 mov 0x58(%rsp),%rcx
1f: 4c 8d 34 c1 lea (%rcx,%rax,8),%r14
23: 4d 89 f7 mov %r14,%r15
26: 49 c1 ef 03 shr $0x3,%r15
* 2a: 41 80 3c 1f 00 cmpb $0x0,(%r15,%rbx,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 91 19 85 ff callq 0xff8519ca
39: 4d 8b 26 mov (%r14),%r12
3c: 4d 85 e4 test %r12,%r12
3f: 0f .byte 0xf
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Jun 7, 2023, 10:37:40 PM6/7/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages