[Android 5.10] BUG: unable to handle kernel paging request in swake_up_locked
0 views
Skip to first unread message
syzbot
May 5, 2024, 7:32:27 PMMay 5
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 70b6ab09a34b Revert "hrtimer: Report offline hrtimer enque..
git tree: android13-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=14e04338980000
kernel config: https://syzkaller.appspot.com/x/.config?x=32ace1916c4b73d8
dashboard link: https://syzkaller.appspot.com/bug?extid=72bba07d68718e0acd0c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124b897f180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b21dc4980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c2e16761410a/disk-70b6ab09.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d0874dd2861d/vmlinux-70b6ab09.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4e2f94cb7466/bzImage-70b6ab09.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+72bba0...@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: fffffffffffffff8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 6612067 P4D 6612067 PUD 6614067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 310 Comm: syz-executor938 Not tainted 5.10.210-syzkaller-00394-g70b6ab09a34b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:swake_up_locked+0x57/0x120 kernel/sched/swait.c:30
Code: 89 df e8 bc 57 59 00 4c 8b 3b 49 39 df 0f 84 ca 00 00 00 49 8d 7f f8 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 99 57 59 00 <49> 8b 7f f8 e8 10 e1 f9 ff 4c 89 ff e8 b8 96 07 01 84 c0 74 6a 49
RSP: 0018:ffffc900022a7d30 EFLAGS: 00010046
RAX: 1fffffffffffffff RBX: ffffc90001fe7aa0 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: fffffffffffffff8
RBP: ffffc900022a7d58 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff52000454f98 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffc90001fe7a90 R14: 0000000000000246 R15: 0000000000000000
FS: 00005555562213c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff8 CR3: 0000000116159000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
complete+0x5c/0xb0 kernel/sched/completion.c:36
uinput_flush_requests drivers/input/misc/uinput.c:213 [inline]
uinput_destroy_device+0x164/0x950 drivers/input/misc/uinput.c:298
uinput_release+0x3e/0x50 drivers/input/misc/uinput.c:744
__fput+0x309/0x760 fs/file_table.c:281
____fput+0x15/0x20 fs/file_table.c:314
task_work_run+0x129/0x190 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_user_mode_loop+0xbf/0xd0 kernel/entry/common.c:172
exit_to_user_mode_prepare kernel/entry/common.c:199 [inline]
syscall_exit_to_user_mode+0xc5/0x1d0 kernel/entry/common.c:274
do_syscall_64+0x40/0x70 arch/x86/entry/common.c:56
entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7fb6af562a8a
Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 53 81 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 b3 81 02 00 8b 44 24
RSP: 002b:00007ffe50aa0df0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007fb6af562a8a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000dde3b R08: 0000000000000000 R09: 00007ffe50aa0ed0
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000003e8
R13: 00007fb6af5ea1bc R14: 00000000000dde6d R15: 00007fb6af5ea1a0
Modules linked in:
CR2: fffffffffffffff8
---[ end trace 7f3ef19fc4eed330 ]---
RIP: 0010:swake_up_locked+0x57/0x120 kernel/sched/swait.c:30
Code: 89 df e8 bc 57 59 00 4c 8b 3b 49 39 df 0f 84 ca 00 00 00 49 8d 7f f8 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 99 57 59 00 <49> 8b 7f f8 e8 10 e1 f9 ff 4c 89 ff e8 b8 96 07 01 84 c0 74 6a 49
RSP: 0018:ffffc900022a7d30 EFLAGS: 00010046
RAX: 1fffffffffffffff RBX: ffffc90001fe7aa0 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: fffffffffffffff8
RBP: ffffc900022a7d58 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff52000454f98 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffc90001fe7a90 R14: 0000000000000246 R15: 0000000000000000
FS: 00005555562213c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff8 CR3: 0000000116159000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 df mov %ebx,%edi
2: e8 bc 57 59 00 call 0x5957c3
7: 4c 8b 3b mov (%rbx),%r15
a: 49 39 df cmp %rbx,%r15
d: 0f 84 ca 00 00 00 je 0xdd
13: 49 8d 7f f8 lea -0x8(%r15),%rdi
17: 48 89 f8 mov %rdi,%rax
1a: 48 c1 e8 03 shr $0x3,%rax
1e: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
23: 74 05 je 0x2a
25: e8 99 57 59 00 call 0x5957c3
* 2a: 49 8b 7f f8 mov -0x8(%r15),%rdi <-- trapping instruction
2e: e8 10 e1 f9 ff call 0xfff9e143
33: 4c 89 ff mov %r15,%rdi
36: e8 b8 96 07 01 call 0x10796f3
3b: 84 c0 test %al,%al
3d: 74 6a je 0xa9
3f: 49 rex.WB
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 70b6ab09a34b Revert "hrtimer: Report offline hrtimer enque..
git tree: android13-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=14e04338980000
kernel config: https://syzkaller.appspot.com/x/.config?x=32ace1916c4b73d8
dashboard link: https://syzkaller.appspot.com/bug?extid=72bba07d68718e0acd0c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124b897f180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b21dc4980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c2e16761410a/disk-70b6ab09.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d0874dd2861d/vmlinux-70b6ab09.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4e2f94cb7466/bzImage-70b6ab09.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+72bba0...@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: fffffffffffffff8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 6612067 P4D 6612067 PUD 6614067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 310 Comm: syz-executor938 Not tainted 5.10.210-syzkaller-00394-g70b6ab09a34b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:swake_up_locked+0x57/0x120 kernel/sched/swait.c:30
Code: 89 df e8 bc 57 59 00 4c 8b 3b 49 39 df 0f 84 ca 00 00 00 49 8d 7f f8 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 99 57 59 00 <49> 8b 7f f8 e8 10 e1 f9 ff 4c 89 ff e8 b8 96 07 01 84 c0 74 6a 49
RSP: 0018:ffffc900022a7d30 EFLAGS: 00010046
RAX: 1fffffffffffffff RBX: ffffc90001fe7aa0 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: fffffffffffffff8
RBP: ffffc900022a7d58 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff52000454f98 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffc90001fe7a90 R14: 0000000000000246 R15: 0000000000000000
FS: 00005555562213c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff8 CR3: 0000000116159000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
complete+0x5c/0xb0 kernel/sched/completion.c:36
uinput_flush_requests drivers/input/misc/uinput.c:213 [inline]
uinput_destroy_device+0x164/0x950 drivers/input/misc/uinput.c:298
uinput_release+0x3e/0x50 drivers/input/misc/uinput.c:744
__fput+0x309/0x760 fs/file_table.c:281
____fput+0x15/0x20 fs/file_table.c:314
task_work_run+0x129/0x190 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_user_mode_loop+0xbf/0xd0 kernel/entry/common.c:172
exit_to_user_mode_prepare kernel/entry/common.c:199 [inline]
syscall_exit_to_user_mode+0xc5/0x1d0 kernel/entry/common.c:274
do_syscall_64+0x40/0x70 arch/x86/entry/common.c:56
entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7fb6af562a8a
Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 53 81 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 b3 81 02 00 8b 44 24
RSP: 002b:00007ffe50aa0df0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007fb6af562a8a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000dde3b R08: 0000000000000000 R09: 00007ffe50aa0ed0
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000003e8
R13: 00007fb6af5ea1bc R14: 00000000000dde6d R15: 00007fb6af5ea1a0
Modules linked in:
CR2: fffffffffffffff8
---[ end trace 7f3ef19fc4eed330 ]---
RIP: 0010:swake_up_locked+0x57/0x120 kernel/sched/swait.c:30
Code: 89 df e8 bc 57 59 00 4c 8b 3b 49 39 df 0f 84 ca 00 00 00 49 8d 7f f8 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 99 57 59 00 <49> 8b 7f f8 e8 10 e1 f9 ff 4c 89 ff e8 b8 96 07 01 84 c0 74 6a 49
RSP: 0018:ffffc900022a7d30 EFLAGS: 00010046
RAX: 1fffffffffffffff RBX: ffffc90001fe7aa0 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: fffffffffffffff8
RBP: ffffc900022a7d58 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff52000454f98 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffc90001fe7a90 R14: 0000000000000246 R15: 0000000000000000
FS: 00005555562213c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff8 CR3: 0000000116159000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 df mov %ebx,%edi
2: e8 bc 57 59 00 call 0x5957c3
7: 4c 8b 3b mov (%rbx),%r15
a: 49 39 df cmp %rbx,%r15
d: 0f 84 ca 00 00 00 je 0xdd
13: 49 8d 7f f8 lea -0x8(%r15),%rdi
17: 48 89 f8 mov %rdi,%rax
1a: 48 c1 e8 03 shr $0x3,%rax
1e: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
23: 74 05 je 0x2a
25: e8 99 57 59 00 call 0x5957c3
* 2a: 49 8b 7f f8 mov -0x8(%r15),%rdi <-- trapping instruction
2e: e8 10 e1 f9 ff call 0xfff9e143
33: 4c 89 ff mov %r15,%rdi
36: e8 b8 96 07 01 call 0x10796f3
3b: 84 c0 test %al,%al
3d: 74 6a je 0xa9
3f: 49 rex.WB
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages