[syzbot] KASAN: use-after-free Read in exit_mmap
38 views
Skip to first unread message
syzbot
Jul 27, 2022, 10:11:27 AM7/27/22
to ak...@linux-foundation.org, linux-...@vger.kernel.org, linu...@kvack.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: cb71b93c2dc3 Add linux-next specific files for 20220628
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16c0a5ba080000
kernel config: https://syzkaller.appspot.com/x/.config?x=badbc1adb2d582eb
dashboard link: https://syzkaller.appspot.com/bug?extid=99551d8b4d180f6cb1c0
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=117dc816080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12695b26080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+99551d...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in exit_mmap+0x6b1/0x720 mm/mmap.c:3220
Read of size 8 at addr ffff88801fa79cc8 by task syz-executor422/3601
CPU: 0 PID: 3601 Comm: syz-executor422 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xbe/0x1f0 mm/kasan/report.c:495
exit_mmap+0x6b1/0x720 mm/mmap.c:3220
__mmput+0x128/0x4c0 kernel/fork.c:1180
mmput+0x5c/0x70 kernel/fork.c:1201
exit_mm kernel/exit.c:510 [inline]
do_exit+0xa09/0x29f0 kernel/exit.c:782
do_group_exit+0xd2/0x2f0 kernel/exit.c:925
__do_sys_exit_group kernel/exit.c:936 [inline]
__se_sys_exit_group kernel/exit.c:934 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f39b4e776a9
Code: Unable to access opcode bytes at RIP 0x7f39b4e7767f.
RSP: 002b:00007ffe5f9ced98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f39b4eeb270 RCX: 00007f39b4e776a9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f39b4eeb270
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
</TASK>
Allocated by task 3601:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
__kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:736 [inline]
slab_alloc_node mm/slub.c:3243 [inline]
slab_alloc mm/slub.c:3251 [inline]
__kmem_cache_alloc_lru mm/slub.c:3258 [inline]
kmem_cache_alloc+0x2d6/0x4c0 mm/slub.c:3268
vm_area_alloc+0x1c/0xf0 kernel/fork.c:458
mmap_region+0x448/0x1bf0 mm/mmap.c:2667
do_mmap+0x825/0xf50 mm/mmap.c:1483
vm_mmap_pgoff+0x1ab/0x270 mm/util.c:520
ksys_mmap_pgoff+0x79/0x5a0 mm/mmap.c:1529
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 3601:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1754 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780
slab_free mm/slub.c:3534 [inline]
kmem_cache_free+0xeb/0x5b0 mm/slub.c:3551
exit_mmap+0x288/0x720 mm/mmap.c:3222
__mmput+0x128/0x4c0 kernel/fork.c:1180
mmput+0x5c/0x70 kernel/fork.c:1201
exit_mm kernel/exit.c:510 [inline]
do_exit+0xa09/0x29f0 kernel/exit.c:782
do_group_exit+0xd2/0x2f0 kernel/exit.c:925
__do_sys_exit_group kernel/exit.c:936 [inline]
__se_sys_exit_group kernel/exit.c:934 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The buggy address belongs to the object at ffff88801fa79ca8
which belongs to the cache vm_area_struct of size 152
The buggy address is located 32 bytes inside of
152-byte region [ffff88801fa79ca8, ffff88801fa79d40)
The buggy address belongs to the physical page:
page:ffffea00007e9e40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fa79
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888140006b40
raw: 0000000000000000 0000000080120012 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3596, tgid 3596 (sshd), ts 49436343226, free_ts 44111523441
prep_new_page mm/page_alloc.c:2535 [inline]
get_page_from_freelist+0x210d/0x3a30 mm/page_alloc.c:4282
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5506
alloc_pages+0x1aa/0x310 mm/mempolicy.c:2280
alloc_slab_page mm/slub.c:1824 [inline]
allocate_slab+0x27e/0x3d0 mm/slub.c:1969
new_slab mm/slub.c:2029 [inline]
___slab_alloc+0x89d/0xef0 mm/slub.c:3031
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118
slab_alloc_node mm/slub.c:3209 [inline]
slab_alloc mm/slub.c:3251 [inline]
__kmem_cache_alloc_lru mm/slub.c:3258 [inline]
kmem_cache_alloc+0x3fb/0x4c0 mm/slub.c:3268
vm_area_dup+0x81/0x380 kernel/fork.c:466
dup_mmap+0x642/0x1070 kernel/fork.c:640
dup_mm+0x91/0x370 kernel/fork.c:1520
copy_mm kernel/fork.c:1569 [inline]
copy_process+0x3ca8/0x7080 kernel/fork.c:2237
kernel_clone+0xe7/0xab0 kernel/fork.c:2652
__do_sys_clone+0xba/0x100 kernel/fork.c:2786
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1453 [inline]
free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1503
free_unref_page_prepare mm/page_alloc.c:3383 [inline]
free_unref_page_list+0x16f/0xb90 mm/page_alloc.c:3525
release_pages+0xbe8/0x1810 mm/swap.c:1017
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:58
tlb_flush_mmu_free mm/mmu_gather.c:255 [inline]
tlb_flush_mmu mm/mmu_gather.c:262 [inline]
tlb_finish_mmu+0x147/0x7e0 mm/mmu_gather.c:353
exit_mmap+0x1fe/0x720 mm/mmap.c:3212
__mmput+0x128/0x4c0 kernel/fork.c:1180
mmput+0x5c/0x70 kernel/fork.c:1201
exit_mm kernel/exit.c:510 [inline]
do_exit+0xa09/0x29f0 kernel/exit.c:782
do_group_exit+0xd2/0x2f0 kernel/exit.c:925
__do_sys_exit_group kernel/exit.c:936 [inline]
__se_sys_exit_group kernel/exit.c:934 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Memory state around the buggy address:
ffff88801fa79b80: 00 00 fc fc fc fc fc fc fc fc fa fb fb fb fb fb
ffff88801fa79c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
>ffff88801fa79c80: fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb
^
ffff88801fa79d00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88801fa79d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: cb71b93c2dc3 Add linux-next specific files for 20220628
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16c0a5ba080000
kernel config: https://syzkaller.appspot.com/x/.config?x=badbc1adb2d582eb
dashboard link: https://syzkaller.appspot.com/bug?extid=99551d8b4d180f6cb1c0
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=117dc816080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12695b26080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+99551d...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in exit_mmap+0x6b1/0x720 mm/mmap.c:3220
Read of size 8 at addr ffff88801fa79cc8 by task syz-executor422/3601
CPU: 0 PID: 3601 Comm: syz-executor422 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xbe/0x1f0 mm/kasan/report.c:495
exit_mmap+0x6b1/0x720 mm/mmap.c:3220
__mmput+0x128/0x4c0 kernel/fork.c:1180
mmput+0x5c/0x70 kernel/fork.c:1201
exit_mm kernel/exit.c:510 [inline]
do_exit+0xa09/0x29f0 kernel/exit.c:782
do_group_exit+0xd2/0x2f0 kernel/exit.c:925
__do_sys_exit_group kernel/exit.c:936 [inline]
__se_sys_exit_group kernel/exit.c:934 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f39b4e776a9
Code: Unable to access opcode bytes at RIP 0x7f39b4e7767f.
RSP: 002b:00007ffe5f9ced98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f39b4eeb270 RCX: 00007f39b4e776a9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f39b4eeb270
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
</TASK>
Allocated by task 3601:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
__kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:736 [inline]
slab_alloc_node mm/slub.c:3243 [inline]
slab_alloc mm/slub.c:3251 [inline]
__kmem_cache_alloc_lru mm/slub.c:3258 [inline]
kmem_cache_alloc+0x2d6/0x4c0 mm/slub.c:3268
vm_area_alloc+0x1c/0xf0 kernel/fork.c:458
mmap_region+0x448/0x1bf0 mm/mmap.c:2667
do_mmap+0x825/0xf50 mm/mmap.c:1483
vm_mmap_pgoff+0x1ab/0x270 mm/util.c:520
ksys_mmap_pgoff+0x79/0x5a0 mm/mmap.c:1529
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 3601:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1754 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780
slab_free mm/slub.c:3534 [inline]
kmem_cache_free+0xeb/0x5b0 mm/slub.c:3551
exit_mmap+0x288/0x720 mm/mmap.c:3222
__mmput+0x128/0x4c0 kernel/fork.c:1180
mmput+0x5c/0x70 kernel/fork.c:1201
exit_mm kernel/exit.c:510 [inline]
do_exit+0xa09/0x29f0 kernel/exit.c:782
do_group_exit+0xd2/0x2f0 kernel/exit.c:925
__do_sys_exit_group kernel/exit.c:936 [inline]
__se_sys_exit_group kernel/exit.c:934 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The buggy address belongs to the object at ffff88801fa79ca8
which belongs to the cache vm_area_struct of size 152
The buggy address is located 32 bytes inside of
152-byte region [ffff88801fa79ca8, ffff88801fa79d40)
The buggy address belongs to the physical page:
page:ffffea00007e9e40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fa79
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888140006b40
raw: 0000000000000000 0000000080120012 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3596, tgid 3596 (sshd), ts 49436343226, free_ts 44111523441
prep_new_page mm/page_alloc.c:2535 [inline]
get_page_from_freelist+0x210d/0x3a30 mm/page_alloc.c:4282
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5506
alloc_pages+0x1aa/0x310 mm/mempolicy.c:2280
alloc_slab_page mm/slub.c:1824 [inline]
allocate_slab+0x27e/0x3d0 mm/slub.c:1969
new_slab mm/slub.c:2029 [inline]
___slab_alloc+0x89d/0xef0 mm/slub.c:3031
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118
slab_alloc_node mm/slub.c:3209 [inline]
slab_alloc mm/slub.c:3251 [inline]
__kmem_cache_alloc_lru mm/slub.c:3258 [inline]
kmem_cache_alloc+0x3fb/0x4c0 mm/slub.c:3268
vm_area_dup+0x81/0x380 kernel/fork.c:466
dup_mmap+0x642/0x1070 kernel/fork.c:640
dup_mm+0x91/0x370 kernel/fork.c:1520
copy_mm kernel/fork.c:1569 [inline]
copy_process+0x3ca8/0x7080 kernel/fork.c:2237
kernel_clone+0xe7/0xab0 kernel/fork.c:2652
__do_sys_clone+0xba/0x100 kernel/fork.c:2786
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1453 [inline]
free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1503
free_unref_page_prepare mm/page_alloc.c:3383 [inline]
free_unref_page_list+0x16f/0xb90 mm/page_alloc.c:3525
release_pages+0xbe8/0x1810 mm/swap.c:1017
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:58
tlb_flush_mmu_free mm/mmu_gather.c:255 [inline]
tlb_flush_mmu mm/mmu_gather.c:262 [inline]
tlb_finish_mmu+0x147/0x7e0 mm/mmu_gather.c:353
exit_mmap+0x1fe/0x720 mm/mmap.c:3212
__mmput+0x128/0x4c0 kernel/fork.c:1180
mmput+0x5c/0x70 kernel/fork.c:1201
exit_mm kernel/exit.c:510 [inline]
do_exit+0xa09/0x29f0 kernel/exit.c:782
do_group_exit+0xd2/0x2f0 kernel/exit.c:925
__do_sys_exit_group kernel/exit.c:936 [inline]
__se_sys_exit_group kernel/exit.c:934 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Memory state around the buggy address:
ffff88801fa79b80: 00 00 fc fc fc fc fc fc fc fc fa fb fb fb fb fb
ffff88801fa79c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
>ffff88801fa79c80: fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb
^
ffff88801fa79d00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88801fa79d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Jul 27, 2022, 2:02:13 PM7/27/22
to Liam.H...@oracle.com, ak...@linux-foundation.org, ar...@arndb.de, big...@linutronix.de, ccr...@google.com, da...@redhat.com, ebie...@xmission.com, liam.h...@oracle.com, linux-...@vger.kernel.org, linu...@kvack.org, syzkall...@googlegroups.com, tg...@linutronix.de, vba...@suse.cz, wi...@infradead.org
syzbot has bisected this issue to:
commit e23cb70bcbef5c189790042d1d6d89e33308c386
Author: Liam R. Howlett <Liam.H...@Oracle.com>
Date: Tue Jun 21 20:47:14 2022 +0000
mm: remove the vma linked list
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1078f202080000
start commit: cb71b93c2dc3 Add linux-next specific files for 20220628
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=1278f202080000
console output: https://syzkaller.appspot.com/x/log.txt?x=1478f202080000
Fixes: e23cb70bcbef ("mm: remove the vma linked list")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit e23cb70bcbef5c189790042d1d6d89e33308c386
Author: Liam R. Howlett <Liam.H...@Oracle.com>
Date: Tue Jun 21 20:47:14 2022 +0000
mm: remove the vma linked list
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1078f202080000
start commit: cb71b93c2dc3 Add linux-next specific files for 20220628
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=1278f202080000
console output: https://syzkaller.appspot.com/x/log.txt?x=1478f202080000
kernel config: https://syzkaller.appspot.com/x/.config?x=badbc1adb2d582eb
dashboard link: https://syzkaller.appspot.com/bug?extid=99551d8b4d180f6cb1c0
dashboard link: https://syzkaller.appspot.com/bug?extid=99551d8b4d180f6cb1c0
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=117dc816080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12695b26080000
Reported-by: syzbot+99551d...@syzkaller.appspotmail.com
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12695b26080000
Fixes: e23cb70bcbef ("mm: remove the vma linked list")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Jul 27, 2022, 4:48:10 PM7/27/22
to phin...@gmail.com, syzkall...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
em Enabled
[ 3.200443][ T1] pnp: PnP ACPI init
[ 3.221223][ T1] pnp: PnP ACPI: found 7 devices
[ 3.285038][ T1] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 3.287879][ T1] NET: Registered PF_INET protocol family
[ 3.303652][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc)
[ 3.317211][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 6, 294912 bytes, vmalloc)
[ 3.321676][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc)
[ 3.324907][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc)
[ 3.333345][ T1] TCP bind hash table entries: 65536 (order: 10, 4718592 bytes, vmalloc hugepage)
[ 3.341404][ T1] TCP: Hash tables configured (established 65536 bind 65536)
[ 3.346645][ T1] MPTCP token hash table entries: 8192 (order: 7, 720896 bytes, vmalloc)
[ 3.351980][ T1] UDP hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.356294][ T1] UDP-Lite hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.360101][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 3.363796][ T1] RPC: Registered named UNIX socket transport module.
[ 3.365509][ T1] RPC: Registered udp transport module.
[ 3.366914][ T1] RPC: Registered tcp transport module.
[ 3.368315][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 3.373016][ T1] NET: Registered PF_XDP protocol family
[ 3.374574][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 3.376594][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 3.378223][ T1] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 3.380939][ T1] pci_bus 0000:00: resource 7 [mem 0xc0000000-0xfebfefff window]
[ 3.384899][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 3.386856][ T1] PCI: CLS 0 bytes, default 64
[ 3.394638][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 3.397024][ T1] software IO TLB: mapped [mem 0x00000000b5a00000-0x00000000b9a00000] (64MB)
[ 3.398874][ T1] ACPI: bus type thunderbolt registered
[ 3.412475][ T56] kworker/u4:2 (56) used greatest stack depth: 28864 bytes left
[ 3.414273][ T55] kworker/u4:2 (55) used greatest stack depth: 27896 bytes left
[ 3.416670][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 3.445235][ T1] kvm: already loaded vendor module 'kvm_intel'
[ 3.447060][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb6fb5cc36, max_idle_ns: 440795309794 ns
[ 3.450259][ T1] clocksource: Switched to clocksource tsc
[ 3.490699][ T85] kworker/u4:2 (85) used greatest stack depth: 27416 bytes left
[ 6.821057][ T1] Initialise system trusted keyrings
[ 6.824463][ T1] workingset: timestamp_bits=40 max_order=21 bucket_order=0
[ 6.866339][ T1] zbud: loaded
[ 6.875394][ T1] DLM installed
[ 6.882777][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 6.894882][ T1] NFS: Registering the id_resolver key type
[ 6.896482][ T1] Key type id_resolver registered
[ 6.897546][ T1] Key type id_legacy registered
[ 6.899267][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 6.900935][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 6.902234][ T1] Installing knfsd (copyright (C) 1996 ok...@monad.swb.de).
[ 6.912345][ T1] Key type cifs.spnego registered
[ 6.913583][ T1] Key type cifs.idmap registered
[ 6.914927][ T1] ntfs: driver 2.1.32 [Flags: R/W].
[ 6.917147][ T1] ntfs3: Max link count 4000
[ 6.917955][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 6.918794][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 6.921873][ T1] efs: 1.0a - http://aeschi.ch.eu.org/efs/
[ 6.923488][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 6.928639][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 6.930251][ T1] QNX4 filesystem 0.2.3 registered.
[ 6.931673][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 6.933869][ T1] fuse: init (API version 7.36)
[ 6.939033][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 6.941168][ T1] orangefs_init: module version upstream loaded
[ 6.943092][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 6.960360][ T1] SGI XFS with ACLs, security attributes, realtime, quota, fatal assert, debug enabled
[ 6.973980][ T1] 9p: Installing v9fs 9p2000 file system support
[ 6.976891][ T1] NILFS version 2 loaded
[ 6.977720][ T1] befs: version: 0.9.3
[ 6.979902][ T1] ocfs2: Registered cluster interface o2cb
[ 6.981702][ T1] ocfs2: Registered cluster interface user
[ 6.983498][ T1] OCFS2 User DLM kernel interface loaded
[ 6.996502][ T1] gfs2: GFS2 installed
[ 7.008602][ T1] ceph: loaded (mds proto 32)
[ 7.021856][ T1] NET: Registered PF_ALG protocol family
[ 7.022954][ T1] xor: automatically using best checksumming function avx
[ 7.024141][ T1] async_tx: api initialized (async)
[ 7.025367][ T1] Key type asymmetric registered
[ 7.026270][ T1] Asymmetric key parser 'x509' registered
[ 7.027517][ T1] Asymmetric key parser 'pkcs8' registered
[ 7.028640][ T1] Key type pkcs7_test registered
[ 7.033354][ T1] alg: self-tests for CTR-KDF (hmac(sha256)) passed
[ 7.035138][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 240)
[ 7.037359][ T1] io scheduler mq-deadline registered
[ 7.038544][ T1] io scheduler kyber registered
[ 7.039813][ T1] io scheduler bfq registered
[ 7.055223][ T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 7.081585][ T1] ACPI: button: Power Button [PWRF]
[ 7.083559][ T1] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
[ 7.085880][ T1] ACPI: button: Sleep Button [SLPF]
[ 7.086463][ T168] kworker/u4:1 (168) used greatest stack depth: 27056 bytes left
[ 7.111713][ T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 7.112860][ T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 7.129995][ T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 7.132377][ T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 7.151293][ T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 7.152282][ T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 7.165999][ T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 7.434695][ T504] kworker/u4:3 (504) used greatest stack depth: 26600 bytes left
[ 7.599496][ T1] N_HDLC line discipline registered with maxframe=4096
[ 7.601301][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 7.603919][ T1] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 7.610859][ T1] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 7.617666][ T1] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 7.624445][ T1] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 7.636281][ T1] Non-volatile memory driver v1.3
[ 7.656665][ T1] Linux agpgart interface v0.103
[ 7.659797][ T1] ACPI: bus type drm_connector registered
[ 7.666719][ T1] [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
[ 7.674222][ T1] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
[ 7.736768][ T1] Console: switching to colour frame buffer device 128x48
[ 7.754937][ T1] platform vkms: [drm] fb0: vkmsdrmfb frame buffer device
[ 7.757063][ T1] usbcore: registered new interface driver udl
[ 7.821022][ T1] brd: module loaded
[ 7.888887][ T1] loop: module loaded
[ 7.977666][ T1] zram: Added device: zram0
[ 7.985830][ T1] null_blk: disk nullb0 created
[ 7.986995][ T1] null_blk: module loaded
[ 7.988384][ T1] Guest personality initialized and is inactive
[ 7.990307][ T1] VMCI host device registered (name=vmci, major=10, minor=120)
[ 7.992074][ T1] Initialized host personality
[ 7.993330][ T1] usbcore: registered new interface driver rtsx_usb
[ 7.996402][ T1] usbcore: registered new interface driver viperboard
[ 7.998478][ T1] usbcore: registered new interface driver dln2
[ 8.002015][ T1] usbcore: registered new interface driver pn533_usb
[ 8.008179][ T1] nfcsim 0.2 initialized
[ 8.009421][ T1] usbcore: registered new interface driver port100
[ 8.011221][ T1] usbcore: registered new interface driver nfcmrvl
[ 8.020683][ T1] Loading iSCSI transport class v2.0-870.
[ 8.053367][ T1] scsi host0: Virtio SCSI HBA
[ 8.098522][ T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[ 8.100734][ T91] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6
[ 8.135143][ T1] Rounding down aligned max_sectors from 4294967295 to 4294967288
[ 8.138268][ T1] db_root: cannot open: /etc/target
[ 8.141607][ T1] slram: not enough parameters.
[ 8.147194][ T1] general protection fault, probably for non-canonical address 0xdffffc00000000ac: 0000 [#1] PREEMPT SMP KASAN
[ 8.149478][ T1] KASAN: null-ptr-deref in range [0x0000000000000560-0x0000000000000567]
[ 8.151271][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc8-next-20220727-syzkaller #0
[ 8.153918][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 8.156436][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.156436][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 30 69 99 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.156436][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.156436][ T1] RAX: dffffc0000000000 RBX: ffff88801f9db000 RCX: 0000000000000000
[ 8.156436][ T1] RDX: 00000000000000ac RSI: ffffffff84e299e0 RDI: 0000000000000560
[ 8.156436][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.156436][ T1] R10: ffffffff89e00000 R11: 0000000000000000 R12: ffff88801f9db004
[ 8.156436][ T1] R13: ffff88801f9db028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.156436][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.156436][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.156436][ T1] CR2: ffff88823ffff000 CR3: 000000000bc8e000 CR4: 00000000003506f0
[ 8.156436][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.156436][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.156436][ T1] Call Trace:
[ 8.156436][ T1] <TASK>
[ 8.156436][ T1] ? del_mtd_partitions+0x50/0x50
[ 8.156436][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.156436][ T1] ? mtd_erase+0x8e0/0x8e0
[ 8.156436][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.156436][ T1] ? __raw_spin_lock_init+0x36/0x110
[ 8.156436][ T1] mtd_device_parse_register+0x50c/0x850
[ 8.156436][ T1] mtdram_init_device+0x291/0x350
[ 8.156436][ T1] ? init_phram+0x99/0x99
[ 8.156436][ T1] init_mtdram+0xe5/0x177
[ 8.156436][ T1] ? init_phram+0x99/0x99
[ 8.156436][ T1] do_one_initcall+0xfe/0x650
[ 8.156436][ T1] ? trace_event_raw_event_initcall_level+0x1f0/0x1f0
[ 8.156436][ T1] ? parameq+0xf0/0x170
[ 8.156436][ T1] kernel_init_freeable+0x6b1/0x73a
[ 8.156436][ T1] ? rest_init+0x270/0x270
[ 8.156436][ T1] kernel_init+0x1a/0x1d0
[ 8.156436][ T1] ? rest_init+0x270/0x270
[ 8.156436][ T1] ret_from_fork+0x1f/0x30
[ 8.156436][ T1] </TASK>
[ 8.156436][ T1] Modules linked in:
[ 8.156436][ C0] vkms_vblank_simulate: vblank timer overrun
[ 8.211642][ T1] ---[ end trace 0000000000000000 ]---
[ 8.213050][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.214418][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 30 69 99 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.219307][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.221749][ T1] RAX: dffffc0000000000 RBX: ffff88801f9db000 RCX: 0000000000000000
[ 8.223376][ T1] RDX: 00000000000000ac RSI: ffffffff84e299e0 RDI: 0000000000000560
[ 8.225560][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.227838][ T1] R10: ffffffff89e00000 R11: 0000000000000000 R12: ffff88801f9db004
[ 8.229989][ T1] R13: ffff88801f9db028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.232006][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.234069][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.235819][ T1] CR2: ffff88823ffff000 CR3: 000000000bc8e000 CR4: 00000000003506f0
[ 8.238058][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.240256][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.242233][ T1] Kernel panic - not syncing: Fatal exception
[ 8.244256][ T1] Kernel Offset: disabled
[ 8.245483][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build927176155=/tmp/go-build -gno-record-gcc-switches"
git status (err=<nil>)
HEAD detached at da9d03669
nothing to commit, working tree clean
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=da9d03669ac84e25e303cf11114203051e1454da -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220727-002742'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=da9d03669ac84e25e303cf11114203051e1454da -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220727-002742'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=da9d03669ac84e25e303cf11114203051e1454da -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220727-002742'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"da9d03669ac84e25e303cf11114203051e1454da\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1053f641080000
Tested on:
commit: 9250d2f7 Add linux-next specific files for 20220727
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=99e54588e4e8c6e
syzbot tried to test the proposed patch but the build/boot failed:
em Enabled
[ 3.200443][ T1] pnp: PnP ACPI init
[ 3.221223][ T1] pnp: PnP ACPI: found 7 devices
[ 3.285038][ T1] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 3.287879][ T1] NET: Registered PF_INET protocol family
[ 3.303652][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc)
[ 3.317211][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 6, 294912 bytes, vmalloc)
[ 3.321676][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc)
[ 3.324907][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc)
[ 3.333345][ T1] TCP bind hash table entries: 65536 (order: 10, 4718592 bytes, vmalloc hugepage)
[ 3.341404][ T1] TCP: Hash tables configured (established 65536 bind 65536)
[ 3.346645][ T1] MPTCP token hash table entries: 8192 (order: 7, 720896 bytes, vmalloc)
[ 3.351980][ T1] UDP hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.356294][ T1] UDP-Lite hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.360101][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 3.363796][ T1] RPC: Registered named UNIX socket transport module.
[ 3.365509][ T1] RPC: Registered udp transport module.
[ 3.366914][ T1] RPC: Registered tcp transport module.
[ 3.368315][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 3.373016][ T1] NET: Registered PF_XDP protocol family
[ 3.374574][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 3.376594][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 3.378223][ T1] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 3.380939][ T1] pci_bus 0000:00: resource 7 [mem 0xc0000000-0xfebfefff window]
[ 3.384899][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 3.386856][ T1] PCI: CLS 0 bytes, default 64
[ 3.394638][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 3.397024][ T1] software IO TLB: mapped [mem 0x00000000b5a00000-0x00000000b9a00000] (64MB)
[ 3.398874][ T1] ACPI: bus type thunderbolt registered
[ 3.412475][ T56] kworker/u4:2 (56) used greatest stack depth: 28864 bytes left
[ 3.414273][ T55] kworker/u4:2 (55) used greatest stack depth: 27896 bytes left
[ 3.416670][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 3.445235][ T1] kvm: already loaded vendor module 'kvm_intel'
[ 3.447060][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb6fb5cc36, max_idle_ns: 440795309794 ns
[ 3.450259][ T1] clocksource: Switched to clocksource tsc
[ 3.490699][ T85] kworker/u4:2 (85) used greatest stack depth: 27416 bytes left
[ 6.821057][ T1] Initialise system trusted keyrings
[ 6.824463][ T1] workingset: timestamp_bits=40 max_order=21 bucket_order=0
[ 6.866339][ T1] zbud: loaded
[ 6.875394][ T1] DLM installed
[ 6.882777][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 6.894882][ T1] NFS: Registering the id_resolver key type
[ 6.896482][ T1] Key type id_resolver registered
[ 6.897546][ T1] Key type id_legacy registered
[ 6.899267][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 6.900935][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 6.902234][ T1] Installing knfsd (copyright (C) 1996 ok...@monad.swb.de).
[ 6.912345][ T1] Key type cifs.spnego registered
[ 6.913583][ T1] Key type cifs.idmap registered
[ 6.914927][ T1] ntfs: driver 2.1.32 [Flags: R/W].
[ 6.917147][ T1] ntfs3: Max link count 4000
[ 6.917955][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 6.918794][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 6.921873][ T1] efs: 1.0a - http://aeschi.ch.eu.org/efs/
[ 6.923488][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 6.928639][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 6.930251][ T1] QNX4 filesystem 0.2.3 registered.
[ 6.931673][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 6.933869][ T1] fuse: init (API version 7.36)
[ 6.939033][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 6.941168][ T1] orangefs_init: module version upstream loaded
[ 6.943092][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 6.960360][ T1] SGI XFS with ACLs, security attributes, realtime, quota, fatal assert, debug enabled
[ 6.973980][ T1] 9p: Installing v9fs 9p2000 file system support
[ 6.976891][ T1] NILFS version 2 loaded
[ 6.977720][ T1] befs: version: 0.9.3
[ 6.979902][ T1] ocfs2: Registered cluster interface o2cb
[ 6.981702][ T1] ocfs2: Registered cluster interface user
[ 6.983498][ T1] OCFS2 User DLM kernel interface loaded
[ 6.996502][ T1] gfs2: GFS2 installed
[ 7.008602][ T1] ceph: loaded (mds proto 32)
[ 7.021856][ T1] NET: Registered PF_ALG protocol family
[ 7.022954][ T1] xor: automatically using best checksumming function avx
[ 7.024141][ T1] async_tx: api initialized (async)
[ 7.025367][ T1] Key type asymmetric registered
[ 7.026270][ T1] Asymmetric key parser 'x509' registered
[ 7.027517][ T1] Asymmetric key parser 'pkcs8' registered
[ 7.028640][ T1] Key type pkcs7_test registered
[ 7.033354][ T1] alg: self-tests for CTR-KDF (hmac(sha256)) passed
[ 7.035138][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 240)
[ 7.037359][ T1] io scheduler mq-deadline registered
[ 7.038544][ T1] io scheduler kyber registered
[ 7.039813][ T1] io scheduler bfq registered
[ 7.055223][ T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 7.081585][ T1] ACPI: button: Power Button [PWRF]
[ 7.083559][ T1] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
[ 7.085880][ T1] ACPI: button: Sleep Button [SLPF]
[ 7.086463][ T168] kworker/u4:1 (168) used greatest stack depth: 27056 bytes left
[ 7.111713][ T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 7.112860][ T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 7.129995][ T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 7.132377][ T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 7.151293][ T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 7.152282][ T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 7.165999][ T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 7.434695][ T504] kworker/u4:3 (504) used greatest stack depth: 26600 bytes left
[ 7.599496][ T1] N_HDLC line discipline registered with maxframe=4096
[ 7.601301][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 7.603919][ T1] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 7.610859][ T1] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 7.617666][ T1] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 7.624445][ T1] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 7.636281][ T1] Non-volatile memory driver v1.3
[ 7.656665][ T1] Linux agpgart interface v0.103
[ 7.659797][ T1] ACPI: bus type drm_connector registered
[ 7.666719][ T1] [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
[ 7.674222][ T1] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
[ 7.736768][ T1] Console: switching to colour frame buffer device 128x48
[ 7.754937][ T1] platform vkms: [drm] fb0: vkmsdrmfb frame buffer device
[ 7.757063][ T1] usbcore: registered new interface driver udl
[ 7.821022][ T1] brd: module loaded
[ 7.888887][ T1] loop: module loaded
[ 7.977666][ T1] zram: Added device: zram0
[ 7.985830][ T1] null_blk: disk nullb0 created
[ 7.986995][ T1] null_blk: module loaded
[ 7.988384][ T1] Guest personality initialized and is inactive
[ 7.990307][ T1] VMCI host device registered (name=vmci, major=10, minor=120)
[ 7.992074][ T1] Initialized host personality
[ 7.993330][ T1] usbcore: registered new interface driver rtsx_usb
[ 7.996402][ T1] usbcore: registered new interface driver viperboard
[ 7.998478][ T1] usbcore: registered new interface driver dln2
[ 8.002015][ T1] usbcore: registered new interface driver pn533_usb
[ 8.008179][ T1] nfcsim 0.2 initialized
[ 8.009421][ T1] usbcore: registered new interface driver port100
[ 8.011221][ T1] usbcore: registered new interface driver nfcmrvl
[ 8.020683][ T1] Loading iSCSI transport class v2.0-870.
[ 8.053367][ T1] scsi host0: Virtio SCSI HBA
[ 8.098522][ T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[ 8.100734][ T91] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6
[ 8.135143][ T1] Rounding down aligned max_sectors from 4294967295 to 4294967288
[ 8.138268][ T1] db_root: cannot open: /etc/target
[ 8.141607][ T1] slram: not enough parameters.
[ 8.147194][ T1] general protection fault, probably for non-canonical address 0xdffffc00000000ac: 0000 [#1] PREEMPT SMP KASAN
[ 8.149478][ T1] KASAN: null-ptr-deref in range [0x0000000000000560-0x0000000000000567]
[ 8.151271][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc8-next-20220727-syzkaller #0
[ 8.153918][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 8.156436][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.156436][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 30 69 99 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.156436][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.156436][ T1] RAX: dffffc0000000000 RBX: ffff88801f9db000 RCX: 0000000000000000
[ 8.156436][ T1] RDX: 00000000000000ac RSI: ffffffff84e299e0 RDI: 0000000000000560
[ 8.156436][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.156436][ T1] R10: ffffffff89e00000 R11: 0000000000000000 R12: ffff88801f9db004
[ 8.156436][ T1] R13: ffff88801f9db028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.156436][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.156436][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.156436][ T1] CR2: ffff88823ffff000 CR3: 000000000bc8e000 CR4: 00000000003506f0
[ 8.156436][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.156436][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.156436][ T1] Call Trace:
[ 8.156436][ T1] <TASK>
[ 8.156436][ T1] ? del_mtd_partitions+0x50/0x50
[ 8.156436][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.156436][ T1] ? mtd_erase+0x8e0/0x8e0
[ 8.156436][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.156436][ T1] ? __raw_spin_lock_init+0x36/0x110
[ 8.156436][ T1] mtd_device_parse_register+0x50c/0x850
[ 8.156436][ T1] mtdram_init_device+0x291/0x350
[ 8.156436][ T1] ? init_phram+0x99/0x99
[ 8.156436][ T1] init_mtdram+0xe5/0x177
[ 8.156436][ T1] ? init_phram+0x99/0x99
[ 8.156436][ T1] do_one_initcall+0xfe/0x650
[ 8.156436][ T1] ? trace_event_raw_event_initcall_level+0x1f0/0x1f0
[ 8.156436][ T1] ? parameq+0xf0/0x170
[ 8.156436][ T1] kernel_init_freeable+0x6b1/0x73a
[ 8.156436][ T1] ? rest_init+0x270/0x270
[ 8.156436][ T1] kernel_init+0x1a/0x1d0
[ 8.156436][ T1] ? rest_init+0x270/0x270
[ 8.156436][ T1] ret_from_fork+0x1f/0x30
[ 8.156436][ T1] </TASK>
[ 8.156436][ T1] Modules linked in:
[ 8.156436][ C0] vkms_vblank_simulate: vblank timer overrun
[ 8.211642][ T1] ---[ end trace 0000000000000000 ]---
[ 8.213050][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.214418][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 30 69 99 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.219307][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.221749][ T1] RAX: dffffc0000000000 RBX: ffff88801f9db000 RCX: 0000000000000000
[ 8.223376][ T1] RDX: 00000000000000ac RSI: ffffffff84e299e0 RDI: 0000000000000560
[ 8.225560][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.227838][ T1] R10: ffffffff89e00000 R11: 0000000000000000 R12: ffff88801f9db004
[ 8.229989][ T1] R13: ffff88801f9db028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.232006][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.234069][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.235819][ T1] CR2: ffff88823ffff000 CR3: 000000000bc8e000 CR4: 00000000003506f0
[ 8.238058][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.240256][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.242233][ T1] Kernel panic - not syncing: Fatal exception
[ 8.244256][ T1] Kernel Offset: disabled
[ 8.245483][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build927176155=/tmp/go-build -gno-record-gcc-switches"
git status (err=<nil>)
HEAD detached at da9d03669
nothing to commit, working tree clean
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=da9d03669ac84e25e303cf11114203051e1454da -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220727-002742'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=da9d03669ac84e25e303cf11114203051e1454da -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220727-002742'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=da9d03669ac84e25e303cf11114203051e1454da -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220727-002742'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"da9d03669ac84e25e303cf11114203051e1454da\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1053f641080000
Tested on:
commit: 9250d2f7 Add linux-next specific files for 20220727
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=99e54588e4e8c6e
dashboard link: https://syzkaller.appspot.com/bug?extid=99551d8b4d180f6cb1c0
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Liam Howlett
Jul 28, 2022, 1:53:25 PM7/28/22
to syzbot, ak...@linux-foundation.org, ar...@arndb.de, big...@linutronix.de, ccr...@google.com, da...@redhat.com, ebie...@xmission.com, linux-...@vger.kernel.org, linu...@kvack.org, syzkall...@googlegroups.com, tg...@linutronix.de, vba...@suse.cz, wi...@infradead.org
* syzbot <syzbot+99551d...@syzkaller.appspotmail.com> [220727 14:02]:
Thanks. I tested this against the most recent patches with the above
kernel config and the issue has already been resolved.
kernel config and the issue has already been resolved.
syzbot
Nov 25, 2022, 10:51:34 PM11/25/22
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages