[syzbot] general protection fault in kvm_arch_vcpu_ioctl

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: aab35c3d5112 Add linux-next specific files for 20220627
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=129388e0080000
kernel config: https://syzkaller.appspot.com/x/.config?x=6a874f114a1e4a6b
dashboard link: https://syzkaller.appspot.com/bug?extid=8cdad6430c24f396f158
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10840388080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15793588080000

Bisection is inconclusive: the first bad commit could be any of:

987f625e0799 KVM: x86: Add APIC_LVTx() macro.
4b903561ec49 KVM: x86: Add Corrected Machine Check Interrupt (CMCI) emulation to lapic.

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1395cb88080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8cdad6...@syzkaller.appspotmail.com

L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
CPU: 0 PID: 3601 Comm: syz-executor163 Not tainted 5.19.0-rc4-next-20220627-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kvm_vcpu_ioctl_x86_setup_mce arch/x86/kvm/x86.c:4899 [inline]
RIP: 0010:kvm_arch_vcpu_ioctl+0x10d1/0x3d40 arch/x86/kvm/x86.c:5608
Code: 80 3c 02 00 0f 85 91 28 00 00 4d 8b ac 24 b0 02 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d bd ec 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 62
RSP: 0018:ffffc90002eaf960 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: 0000000000000006 RCX: 0000000000000000
RDX: 000000000000001d RSI: ffffffff8110c6ee RDI: 00000000000000ec
RBP: ffffc90002eafd20 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 1ffffffff1fc765f R12: ffff888078e10000
R13: 0000000000000000 R14: 1ffff920005d5f36 R15: dffffc0000000000
FS: 0000555556de0300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc02f8affb8 CR3: 0000000075d2c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kvm_vcpu_ioctl+0x973/0xf30 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4200
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fc02f868b69
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcc8febd88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc02f868b69
RDX: 0000000020000040 RSI: 000000004008ae9c RDI: 0000000000000005
RBP: 00007fc02f82cd10 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc02f82cda0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:kvm_vcpu_ioctl_x86_setup_mce arch/x86/kvm/x86.c:4899 [inline]
RIP: 0010:kvm_arch_vcpu_ioctl+0x10d1/0x3d40 arch/x86/kvm/x86.c:5608
Code: 80 3c 02 00 0f 85 91 28 00 00 4d 8b ac 24 b0 02 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d bd ec 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 62
RSP: 0018:ffffc90002eaf960 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: 0000000000000006 RCX: 0000000000000000
RDX: 000000000000001d RSI: ffffffff8110c6ee RDI: 00000000000000ec
RBP: ffffc90002eafd20 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 1ffffffff1fc765f R12: ffff888078e10000
R13: 0000000000000000 R14: 1ffff920005d5f36 R15: dffffc0000000000
FS: 0000555556de0300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056206923aa70 CR3: 0000000075d2c000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
4: 0f 85 91 28 00 00 jne 0x289b
a: 4d 8b ac 24 b0 02 00 mov 0x2b0(%r12),%r13
11: 00
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 49 8d bd ec 00 00 00 lea 0xec(%r13),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2e: 48 89 f8 mov %rdi,%rax
31: 83 e0 07 and $0x7,%eax
34: 83 c0 03 add $0x3,%eax
37: 38 d0 cmp %dl,%al
39: 7c 08 jl 0x43
3b: 84 d2 test %dl,%dl
3d: 0f .byte 0xf
3e: 85 .byte 0x85
3f: 62 .byte 0x62


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

1] CacheFiles: Loaded
[ 3.157016][ T1] TOMOYO: 2.6.0
[ 3.157621][ T1] Mandatory Access Control activated.
[ 3.161836][ T1] AppArmor: AppArmor Filesystem Enabled
[ 3.163373][ T1] pnp: PnP ACPI init
[ 3.184853][ T1] pnp: PnP ACPI: found 7 devices
[ 3.230197][ T1] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 3.232950][ T1] NET: Registered PF_INET protocol family
[ 3.237674][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc)
[ 3.251498][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 6, 294912 bytes, vmalloc)
[ 3.254503][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc)
[ 3.257847][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc)
[ 3.266280][ T1] TCP bind hash table entries: 65536 (order: 10, 4718592 bytes, vmalloc hugepage)
[ 3.274338][ T1] TCP: Hash tables configured (established 65536 bind 65536)
[ 3.279053][ T1] MPTCP token hash table entries: 8192 (order: 7, 720896 bytes, vmalloc)
[ 3.284079][ T1] UDP hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.289687][ T1] UDP-Lite hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.293209][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 3.296904][ T1] RPC: Registered named UNIX socket transport module.
[ 3.299493][ T1] RPC: Registered udp transport module.
[ 3.300994][ T1] RPC: Registered tcp transport module.
[ 3.302948][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 3.308460][ T1] NET: Registered PF_XDP protocol family
[ 3.310402][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 3.312751][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 3.314330][ T1] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 3.317052][ T1] pci_bus 0000:00: resource 7 [mem 0xc0000000-0xfebfefff window]
[ 3.320457][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 3.322754][ T1] PCI: CLS 0 bytes, default 64
[ 3.325438][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 3.327367][ T1] software IO TLB: mapped [mem 0x00000000b5a00000-0x00000000b9a00000] (64MB)
[ 3.330531][ T1] ACPI: bus type thunderbolt registered
[ 3.335054][ T56] kworker/u4:3 (56) used greatest stack depth: 27440 bytes left
[ 3.345002][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 3.348727][ T57] kworker/u4:3 (57) used greatest stack depth: 26936 bytes left
[ 3.375754][ T1] kvm: already loaded vendor module 'kvm_intel'
[ 3.377772][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb6f1c9125, max_idle_ns: 440795292239 ns
[ 3.380378][ T1] clocksource: Switched to clocksource tsc
[ 6.921451][ T1] Initialise system trusted keyrings
[ 6.925220][ T1] workingset: timestamp_bits=40 max_order=21 bucket_order=0
[ 6.967357][ T1] zbud: loaded
[ 6.976751][ T1] DLM installed
[ 6.984123][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 6.995626][ T1] NFS: Registering the id_resolver key type
[ 6.996616][ T1] Key type id_resolver registered
[ 6.997347][ T1] Key type id_legacy registered
[ 6.998543][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 6.999690][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 7.000842][ T1] Installing knfsd (copyright (C) 1996 ok...@monad.swb.de).
[ 7.010499][ T1] Key type cifs.spnego registered
[ 7.011513][ T1] Key type cifs.idmap registered
[ 7.013145][ T1] ntfs: driver 2.1.32 [Flags: R/W].
[ 7.015701][ T1] ntfs3: Max link count 4000
[ 7.016584][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 7.017562][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 7.020392][ T1] efs: 1.0a - http://aeschi.ch.eu.org/efs/
[ 7.022653][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 7.029047][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 7.031189][ T1] QNX4 filesystem 0.2.3 registered.
[ 7.032752][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 7.034516][ T1] fuse: init (API version 7.36)
[ 7.040200][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 7.041913][ T1] orangefs_init: module version upstream loaded
[ 7.044083][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 7.061522][ T1] SGI XFS with ACLs, security attributes, realtime, quota, fatal assert, debug enabled
[ 7.076025][ T1] 9p: Installing v9fs 9p2000 file system support
[ 7.078798][ T1] NILFS version 2 loaded
[ 7.079907][ T1] befs: version: 0.9.3
[ 7.082297][ T1] ocfs2: Registered cluster interface o2cb
[ 7.084127][ T1] ocfs2: Registered cluster interface user
[ 7.086118][ T1] OCFS2 User DLM kernel interface loaded
[ 7.098261][ T1] gfs2: GFS2 installed
[ 7.111577][ T1] ceph: loaded (mds proto 32)
[ 7.126342][ T1] NET: Registered PF_ALG protocol family
[ 7.128062][ T1] xor: automatically using best checksumming function avx
[ 7.129996][ T1] async_tx: api initialized (async)
[ 7.131105][ T1] Key type asymmetric registered
[ 7.131993][ T1] Asymmetric key parser 'x509' registered
[ 7.133436][ T1] Asymmetric key parser 'pkcs8' registered
[ 7.135355][ T1] Key type pkcs7_test registered
[ 7.140399][ T1] alg: self-tests for CTR-KDF (hmac(sha256)) passed
[ 7.142204][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 240)
[ 7.144264][ T1] io scheduler mq-deadline registered
[ 7.145981][ T1] io scheduler kyber registered
[ 7.147506][ T1] io scheduler bfq registered
[ 7.161635][ T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 7.176176][ T1] ACPI: button: Power Button [PWRF]
[ 7.178785][ T1] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
[ 7.181571][ T1] ACPI: button: Sleep Button [SLPF]
[ 7.205681][ T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 7.206664][ T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 7.227194][ T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 7.228909][ T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 7.249299][ T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 7.250297][ T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 7.263576][ T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 7.318608][ T241] kworker/u4:4 (241) used greatest stack depth: 26896 bytes left
[ 7.707179][ T1] N_HDLC line discipline registered with maxframe=4096
[ 7.709435][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 7.711972][ T1] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 7.722074][ T1] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 7.730616][ T1] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 7.738217][ T1] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 7.757971][ T1] Non-volatile memory driver v1.3
[ 7.771132][ T1] Linux agpgart interface v0.103
[ 7.774655][ T1] ACPI: bus type drm_connector registered
[ 7.780967][ T1] [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
[ 7.788578][ T1] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
[ 7.855625][ T1] Console: switching to colour frame buffer device 128x48
[ 7.873838][ T1] platform vkms: [drm] fb0: vkmsdrmfb frame buffer device
[ 7.875754][ T1] usbcore: registered new interface driver udl
[ 7.938730][ T1] brd: module loaded
[ 8.004376][ T1] loop: module loaded
[ 8.089298][ T1] zram: Added device: zram0
[ 8.096872][ T1] null_blk: disk nullb0 created
[ 8.097867][ T1] null_blk: module loaded
[ 8.099386][ T1] Guest personality initialized and is inactive
[ 8.101391][ T1] VMCI host device registered (name=vmci, major=10, minor=119)
[ 8.103049][ T1] Initialized host personality
[ 8.104345][ T1] usbcore: registered new interface driver rtsx_usb
[ 8.107136][ T1] usbcore: registered new interface driver viperboard
[ 8.109259][ T1] usbcore: registered new interface driver dln2
[ 8.111621][ T1] usbcore: registered new interface driver pn533_usb
[ 8.117432][ T1] nfcsim 0.2 initialized
[ 8.119171][ T1] usbcore: registered new interface driver port100
[ 8.121559][ T1] usbcore: registered new interface driver nfcmrvl
[ 8.126846][ T1] Loading iSCSI transport class v2.0-870.
[ 8.162730][ T1] scsi host0: Virtio SCSI HBA
[ 8.208191][ T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[ 8.213034][ T55] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6
[ 8.241968][ T1] Rounding down aligned max_sectors from 4294967295 to 4294967288
[ 8.245229][ T1] db_root: cannot open: /etc/target
[ 8.248004][ T1] slram: not enough parameters.
[ 8.253229][ T1] general protection fault, probably for non-canonical address 0xdffffc00000000ac: 0000 [#1] PREEMPT SMP KASAN
[ 8.254790][ T1] KASAN: null-ptr-deref in range [0x0000000000000560-0x0000000000000567]
[ 8.254790][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc5-next-20220708-syzkaller #0
[ 8.254790][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 8.254790][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.254790][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 c0 67 96 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.254790][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.254790][ T1] RAX: dffffc0000000000 RBX: ffff888146de9000 RCX: 0000000000000000
[ 8.254790][ T1] RDX: 00000000000000ac RSI: ffffffff84e445c0 RDI: 0000000000000560
[ 8.254790][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.254790][ T1] R10: ffffffff89c00000 R11: 0000000000000000 R12: ffff888146de9004
[ 8.254790][ T1] R13: ffff888146de9028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.254790][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.254790][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.254790][ T1] CR2: ffff88823ffff000 CR3: 000000000ba8e000 CR4: 00000000003506f0
[ 8.254790][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.254790][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.254790][ T1] Call Trace:
[ 8.254790][ T1] <TASK>
[ 8.254790][ T1] ? del_mtd_partitions+0x50/0x50
[ 8.254790][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.254790][ T1] ? mtd_erase+0x8e0/0x8e0
[ 8.254790][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.254790][ T1] ? __raw_spin_lock_init+0x36/0x110
[ 8.254790][ T1] mtd_device_parse_register+0x50c/0x850
[ 8.254790][ T1] mtdram_init_device+0x291/0x350
[ 8.254790][ T1] ? init_phram+0x99/0x99
[ 8.254790][ T1] init_mtdram+0xe5/0x177
[ 8.254790][ T1] ? init_phram+0x99/0x99
[ 8.254790][ T1] do_one_initcall+0xfe/0x650
[ 8.254790][ T1] ? trace_event_raw_event_initcall_level+0x1f0/0x1f0
[ 8.254790][ T1] ? parameq+0x130/0x170
[ 8.254790][ T1] kernel_init_freeable+0x6b1/0x73a
[ 8.254790][ T1] ? rest_init+0x270/0x270
[ 8.254790][ T1] kernel_init+0x1a/0x1d0
[ 8.254790][ T1] ? rest_init+0x270/0x270
[ 8.254790][ T1] ret_from_fork+0x1f/0x30
[ 8.254790][ T1] </TASK>
[ 8.254790][ T1] Modules linked in:
[ 8.331075][ C0] vkms_vblank_simulate: vblank timer overrun
[ 8.335032][ T1] ---[ end trace 0000000000000000 ]---
[ 8.336593][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.338555][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 c0 67 96 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.344552][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.347179][ T1] RAX: dffffc0000000000 RBX: ffff888146de9000 RCX: 0000000000000000
[ 8.349293][ T1] RDX: 00000000000000ac RSI: ffffffff84e445c0 RDI: 0000000000000560
[ 8.351978][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.354939][ T1] R10: ffffffff89c00000 R11: 0000000000000000 R12: ffff888146de9004
[ 8.357167][ T1] R13: ffff888146de9028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.359369][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.362251][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.363976][ T1] CR2: ffff88823ffff000 CR3: 000000000ba8e000 CR4: 00000000003506f0
[ 8.366114][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.367589][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.370088][ T1] Kernel panic - not syncing: Fatal exception
[ 8.371829][ T1] Kernel Offset: disabled
[ 8.372782][ T1] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1805758634=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at a371c43c3
nothing to commit, working tree clean


go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"a371c43c33b6f901421f93b655442363c072d251\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=172d0e0c080000


Tested on:

commit: f2528c29 Add linux-next specific files for 20220708
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=12690a05d4f2fc33

dashboard link: https://syzkaller.appspot.com/bug?extid=8cdad6430c24f396f158
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

es)
[ 3.253217][ T1] FS-Cache: Loaded
[ 3.256217][ T1] CacheFiles: Loaded
[ 3.258652][ T1] TOMOYO: 2.6.0
[ 3.259443][ T1] Mandatory Access Control activated.
[ 3.266620][ T1] AppArmor: AppArmor Filesystem Enabled
[ 3.269168][ T1] pnp: PnP ACPI init
[ 3.290602][ T1] pnp: PnP ACPI: found 7 devices
[ 3.354458][ T1] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 3.358126][ T1] NET: Registered PF_INET protocol family
[ 3.363998][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc)
[ 3.379162][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 6, 294912 bytes, vmalloc)
[ 3.383140][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc)
[ 3.386712][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc)
[ 3.395561][ T1] TCP bind hash table entries: 65536 (order: 10, 4718592 bytes, vmalloc hugepage)
[ 3.403442][ T1] TCP: Hash tables configured (established 65536 bind 65536)
[ 3.408852][ T1] MPTCP token hash table entries: 8192 (order: 7, 720896 bytes, vmalloc)
[ 3.414081][ T1] UDP hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.418374][ T1] UDP-Lite hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.421665][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 3.425015][ T1] RPC: Registered named UNIX socket transport module.
[ 3.426139][ T1] RPC: Registered udp transport module.
[ 3.427173][ T1] RPC: Registered tcp transport module.
[ 3.428252][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 3.432359][ T1] NET: Registered PF_XDP protocol family
[ 3.433247][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 3.434353][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 3.435462][ T1] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 3.436635][ T1] pci_bus 0000:00: resource 7 [mem 0xc0000000-0xfebfefff window]
[ 3.439612][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 3.441124][ T1] PCI: CLS 0 bytes, default 64
[ 3.449844][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 3.451309][ T1] software IO TLB: mapped [mem 0x00000000b5a00000-0x00000000b9a00000] (64MB)
[ 3.453352][ T1] ACPI: bus type thunderbolt registered
[ 3.467606][ T56] kworker/u4:1 (56) used greatest stack depth: 27096 bytes left
[ 3.469577][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 3.501346][ T1] kvm: already loaded vendor module 'kvm_intel'
[ 3.502466][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb6bb06dbe, max_idle_ns: 440795305109 ns
[ 3.504215][ T1] clocksource: Switched to clocksource tsc
[ 7.020929][ T1] Initialise system trusted keyrings
[ 7.024019][ T1] workingset: timestamp_bits=40 max_order=21 bucket_order=0
[ 7.065521][ T1] zbud: loaded
[ 7.074592][ T1] DLM installed
[ 7.082173][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 7.094294][ T1] NFS: Registering the id_resolver key type
[ 7.095838][ T1] Key type id_resolver registered
[ 7.096557][ T1] Key type id_legacy registered
[ 7.097777][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 7.099362][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 7.100783][ T1] Installing knfsd (copyright (C) 1996 ok...@monad.swb.de).
[ 7.111226][ T1] Key type cifs.spnego registered
[ 7.112382][ T1] Key type cifs.idmap registered
[ 7.113817][ T1] ntfs: driver 2.1.32 [Flags: R/W].
[ 7.116116][ T1] ntfs3: Max link count 4000
[ 7.116840][ T1] ntfs3: Enabled Linux POSIX ACLs support

[ 7.118164][ T1] ntfs3: Read-only LZX/Xpress compression included

[ 7.121151][ T1] efs: 1.0a - http://aeschi.ch.eu.org/efs/
[ 7.122669][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 7.128299][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 7.129860][ T1] QNX4 filesystem 0.2.3 registered.
[ 7.130896][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 7.133608][ T1] fuse: init (API version 7.36)
[ 7.140433][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 7.142157][ T1] orangefs_init: module version upstream loaded
[ 7.144314][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 7.162264][ T1] SGI XFS with ACLs, security attributes, realtime, quota, fatal assert, debug enabled
[ 7.177557][ T1] 9p: Installing v9fs 9p2000 file system support
[ 7.180306][ T1] NILFS version 2 loaded
[ 7.181390][ T1] befs: version: 0.9.3
[ 7.184357][ T1] ocfs2: Registered cluster interface o2cb
[ 7.185966][ T1] ocfs2: Registered cluster interface user
[ 7.187683][ T1] OCFS2 User DLM kernel interface loaded
[ 7.199949][ T1] gfs2: GFS2 installed
[ 7.213572][ T1] ceph: loaded (mds proto 32)
[ 7.227331][ T1] NET: Registered PF_ALG protocol family
[ 7.228735][ T1] xor: automatically using best checksumming function avx
[ 7.230032][ T1] async_tx: api initialized (async)
[ 7.230777][ T1] Key type asymmetric registered
[ 7.231599][ T1] Asymmetric key parser 'x509' registered
[ 7.232551][ T1] Asymmetric key parser 'pkcs8' registered
[ 7.233747][ T1] Key type pkcs7_test registered
[ 7.238584][ T1] alg: self-tests for CTR-KDF (hmac(sha256)) passed
[ 7.240281][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 240)
[ 7.242184][ T1] io scheduler mq-deadline registered
[ 7.243098][ T1] io scheduler kyber registered
[ 7.244369][ T1] io scheduler bfq registered
[ 7.269785][ T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 7.278739][ T1] ACPI: button: Power Button [PWRF]
[ 7.280877][ T1] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
[ 7.283124][ T1] ACPI: button: Sleep Button [SLPF]
[ 7.309429][ T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 7.310754][ T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 7.329835][ T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 7.330913][ T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 7.352174][ T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 7.353160][ T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 7.369418][ T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 7.800294][ T1] N_HDLC line discipline registered with maxframe=4096
[ 7.801659][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 7.804188][ T1] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 7.815395][ T1] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 7.825098][ T1] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 7.833809][ T1] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 7.852302][ T1] Non-volatile memory driver v1.3
[ 7.866735][ T1] Linux agpgart interface v0.103
[ 7.872119][ T1] ACPI: bus type drm_connector registered
[ 7.877904][ T1] [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
[ 7.885756][ T1] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
[ 7.947157][ T1] Console: switching to colour frame buffer device 128x48
[ 7.965350][ T1] platform vkms: [drm] fb0: vkmsdrmfb frame buffer device
[ 7.967306][ T1] usbcore: registered new interface driver udl
[ 8.032148][ T1] brd: module loaded
[ 8.066338][ T837] kworker/u4:4 (837) used greatest stack depth: 27056 bytes left
[ 8.099393][ T1] loop: module loaded
[ 8.190663][ T1] zram: Added device: zram0
[ 8.199050][ T1] null_blk: disk nullb0 created
[ 8.200133][ T1] null_blk: module loaded
[ 8.201173][ T1] Guest personality initialized and is inactive
[ 8.203266][ T1] VMCI host device registered (name=vmci, major=10, minor=119)
[ 8.205110][ T1] Initialized host personality
[ 8.206306][ T1] usbcore: registered new interface driver rtsx_usb
[ 8.208878][ T1] usbcore: registered new interface driver viperboard
[ 8.211067][ T1] usbcore: registered new interface driver dln2
[ 8.213270][ T1] usbcore: registered new interface driver pn533_usb
[ 8.219751][ T1] nfcsim 0.2 initialized
[ 8.220846][ T1] usbcore: registered new interface driver port100
[ 8.222751][ T1] usbcore: registered new interface driver nfcmrvl
[ 8.228932][ T1] Loading iSCSI transport class v2.0-870.
[ 8.261989][ T1] scsi host0: Virtio SCSI HBA
[ 8.306473][ T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[ 8.311474][ T86] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6
[ 8.341249][ T1] Rounding down aligned max_sectors from 4294967295 to 4294967288
[ 8.344249][ T1] db_root: cannot open: /etc/target
[ 8.347062][ T1] slram: not enough parameters.
[ 8.353152][ T1] general protection fault, probably for non-canonical address 0xdffffc00000000ac: 0000 [#1] PREEMPT SMP KASAN
[ 8.356328][ T1] KASAN: null-ptr-deref in range [0x0000000000000560-0x0000000000000567]
[ 8.358237][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc6-next-20220715-syzkaller-10906-g6014cfa5bf32 #0
[ 8.358816][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 8.358816][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.358816][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 a0 7d 96 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.358816][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.358816][ T1] RAX: dffffc0000000000 RBX: ffff888147207000 RCX: 0000000000000000
[ 8.358816][ T1] RDX: 00000000000000ac RSI: ffffffff84e522a0 RDI: 0000000000000560
[ 8.358816][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.358816][ T1] R10: ffffffff89e00000 R11: 0000000000000000 R12: ffff888147207004
[ 8.358816][ T1] R13: ffff888147207028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.358816][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.358816][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.358816][ T1] CR2: ffff88823ffff000 CR3: 000000000bc8e000 CR4: 00000000003506f0
[ 8.358816][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.358816][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.358816][ T1] Call Trace:
[ 8.358816][ T1] <TASK>
[ 8.358816][ T1] ? del_mtd_partitions+0x50/0x50
[ 8.358816][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.358816][ T1] ? mtd_erase+0x8e0/0x8e0
[ 8.358816][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.358816][ T1] ? __raw_spin_lock_init+0x36/0x110
[ 8.358816][ T1] mtd_device_parse_register+0x50c/0x850
[ 8.358816][ T1] mtdram_init_device+0x291/0x350
[ 8.358816][ T1] ? init_phram+0x99/0x99
[ 8.358816][ T1] init_mtdram+0xe5/0x177
[ 8.358816][ T1] ? init_phram+0x99/0x99
[ 8.358816][ T1] do_one_initcall+0xfe/0x650
[ 8.358816][ T1] ? trace_event_raw_event_initcall_level+0x1f0/0x1f0
[ 8.358816][ T1] ? parameq+0x150/0x170
[ 8.358816][ T1] kernel_init_freeable+0x6b1/0x73a
[ 8.358816][ T1] ? rest_init+0x270/0x270
[ 8.358816][ T1] kernel_init+0x1a/0x1d0
[ 8.358816][ T1] ? rest_init+0x270/0x270
[ 8.358816][ T1] ret_from_fork+0x1f/0x30
[ 8.358816][ T1] </TASK>
[ 8.358816][ T1] Modules linked in:
[ 8.405618][ C0] vkms_vblank_simulate: vblank timer overrun
[ 8.406786][ T1] ---[ end trace 0000000000000000 ]---
[ 8.410192][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.411492][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 a0 7d 96 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.415252][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.416652][ T1] RAX: dffffc0000000000 RBX: ffff888147207000 RCX: 0000000000000000
[ 8.418567][ T1] RDX: 00000000000000ac RSI: ffffffff84e522a0 RDI: 0000000000000560
[ 8.420225][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.421806][ T1] R10: ffffffff89e00000 R11: 0000000000000000 R12: ffff888147207004
[ 8.423139][ T1] R13: ffff888147207028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.424564][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.426415][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.427945][ T1] CR2: ffff88823ffff000 CR3: 000000000bc8e000 CR4: 00000000003506f0
[ 8.429699][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.431158][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.432661][ T1] Kernel panic - not syncing: Fatal exception
[ 8.434421][ T1] Kernel Offset: disabled
[ 8.435376][ T1] Rebooting in 86400 seconds..

GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3173341448=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at a371c43c3
nothing to commit, working tree clean


go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"a371c43c33b6f901421f93b655442363c072d251\"


Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=14f305d0080000


Tested on:

commit: 6014cfa5 Add linux-next specific files for 20220715
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=ec44a6183620a8ba

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

ndatory Access Control activated.
[ 3.133132][ T1] AppArmor: AppArmor Filesystem Enabled
[ 3.135182][ T1] pnp: PnP ACPI init
[ 3.155912][ T1] pnp: PnP ACPI: found 7 devices
[ 3.201125][ T1] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 3.203778][ T1] NET: Registered PF_INET protocol family
[ 3.208399][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc)
[ 3.222832][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 6, 294912 bytes, vmalloc)
[ 3.225682][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc)
[ 3.229119][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc)
[ 3.236717][ T1] TCP bind hash table entries: 65536 (order: 10, 4718592 bytes, vmalloc hugepage)
[ 3.244099][ T1] TCP: Hash tables configured (established 65536 bind 65536)
[ 3.248493][ T1] MPTCP token hash table entries: 8192 (order: 7, 720896 bytes, vmalloc)
[ 3.252976][ T1] UDP hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.257298][ T1] UDP-Lite hash table entries: 4096 (order: 7, 655360 bytes, vmalloc)
[ 3.260239][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 3.264152][ T1] RPC: Registered named UNIX socket transport module.
[ 3.265579][ T1] RPC: Registered udp transport module.
[ 3.267425][ T1] RPC: Registered tcp transport module.
[ 3.269095][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 3.273589][ T1] NET: Registered PF_XDP protocol family
[ 3.274671][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 3.276305][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 3.277766][ T1] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 3.279238][ T1] pci_bus 0000:00: resource 7 [mem 0xc0000000-0xfebfefff window]
[ 3.282095][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 3.283672][ T1] PCI: CLS 0 bytes, default 64
[ 3.291885][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 3.293384][ T1] software IO TLB: mapped [mem 0x00000000b5a00000-0x00000000b9a00000] (64MB)
[ 3.295268][ T1] ACPI: bus type thunderbolt registered
[ 3.307900][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 3.308540][ T56] kworker/u4:3 (56) used greatest stack depth: 28864 bytes left
[ 3.316156][ T55] kworker/u4:3 (55) used greatest stack depth: 27496 bytes left
[ 3.337728][ T1] kvm: already loaded vendor module 'kvm_intel'
[ 3.338917][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb6f1c9125, max_idle_ns: 440795292239 ns
[ 3.341739][ T1] clocksource: Switched to clocksource tsc
[ 3.350179][ T61] kworker/u4:3 (61) used greatest stack depth: 27056 bytes left
[ 6.908652][ T1] Initialise system trusted keyrings
[ 6.913588][ T1] workingset: timestamp_bits=40 max_order=21 bucket_order=0
[ 6.954403][ T1] zbud: loaded
[ 6.963209][ T1] DLM installed
[ 6.971101][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 6.982474][ T1] NFS: Registering the id_resolver key type
[ 6.983568][ T1] Key type id_resolver registered
[ 6.984810][ T1] Key type id_legacy registered
[ 6.986709][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 6.987958][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 6.989477][ T1] Installing knfsd (copyright (C) 1996 ok...@monad.swb.de).
[ 6.999944][ T1] Key type cifs.spnego registered
[ 7.001402][ T1] Key type cifs.idmap registered
[ 7.003447][ T1] ntfs: driver 2.1.32 [Flags: R/W].
[ 7.006977][ T1] ntfs3: Max link count 4000
[ 7.007969][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 7.008952][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 7.011841][ T1] efs: 1.0a - http://aeschi.ch.eu.org/efs/
[ 7.013444][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 7.018871][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 7.020492][ T1] QNX4 filesystem 0.2.3 registered.
[ 7.021776][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 7.023571][ T1] fuse: init (API version 7.36)
[ 7.028968][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 7.030530][ T1] orangefs_init: module version upstream loaded
[ 7.032739][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 7.050601][ T1] SGI XFS with ACLs, security attributes, realtime, quota, fatal assert, debug enabled
[ 7.064523][ T1] 9p: Installing v9fs 9p2000 file system support
[ 7.067495][ T1] NILFS version 2 loaded
[ 7.068332][ T1] befs: version: 0.9.3
[ 7.070592][ T1] ocfs2: Registered cluster interface o2cb
[ 7.072157][ T1] ocfs2: Registered cluster interface user
[ 7.073790][ T1] OCFS2 User DLM kernel interface loaded
[ 7.086120][ T1] gfs2: GFS2 installed
[ 7.098914][ T1] ceph: loaded (mds proto 32)
[ 7.112576][ T1] NET: Registered PF_ALG protocol family
[ 7.113766][ T1] xor: automatically using best checksumming function avx
[ 7.115072][ T1] async_tx: api initialized (async)
[ 7.116042][ T1] Key type asymmetric registered
[ 7.117069][ T1] Asymmetric key parser 'x509' registered
[ 7.118136][ T1] Asymmetric key parser 'pkcs8' registered
[ 7.119682][ T1] Key type pkcs7_test registered
[ 7.124047][ T1] alg: self-tests for CTR-KDF (hmac(sha256)) passed
[ 7.125304][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 240)
[ 7.127381][ T1] io scheduler mq-deadline registered
[ 7.128287][ T1] io scheduler kyber registered
[ 7.129767][ T1] io scheduler bfq registered
[ 7.154923][ T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 7.166671][ T1] ACPI: button: Power Button [PWRF]
[ 7.168741][ T1] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
[ 7.171029][ T1] ACPI: button: Sleep Button [SLPF]
[ 7.194588][ T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 7.195748][ T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 7.215690][ T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 7.217427][ T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 7.235457][ T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 7.236867][ T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 7.251136][ T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 7.299752][ T227] kworker/u4:0 (227) used greatest stack depth: 27024 bytes left
[ 7.679175][ T1] N_HDLC line discipline registered with maxframe=4096
[ 7.680570][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 7.683166][ T1] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 7.693174][ T1] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 7.701828][ T1] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 7.708686][ T1] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 7.726367][ T1] Non-volatile memory driver v1.3
[ 7.739047][ T1] Linux agpgart interface v0.103
[ 7.744992][ T1] ACPI: bus type drm_connector registered
[ 7.750822][ T1] [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
[ 7.759255][ T1] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
[ 7.820902][ T1] Console: switching to colour frame buffer device 128x48
[ 7.838002][ T1] platform vkms: [drm] fb0: vkmsdrmfb frame buffer device
[ 7.839528][ T1] usbcore: registered new interface driver udl
[ 7.906048][ T1] brd: module loaded
[ 7.970330][ T1] loop: module loaded
[ 8.057901][ T1] zram: Added device: zram0
[ 8.067239][ T1] null_blk: disk nullb0 created
[ 8.068569][ T1] null_blk: module loaded
[ 8.069513][ T1] Guest personality initialized and is inactive
[ 8.071038][ T1] VMCI host device registered (name=vmci, major=10, minor=119)
[ 8.073026][ T1] Initialized host personality
[ 8.074655][ T1] usbcore: registered new interface driver rtsx_usb
[ 8.076650][ T1] usbcore: registered new interface driver viperboard
[ 8.078449][ T1] usbcore: registered new interface driver dln2
[ 8.080273][ T1] usbcore: registered new interface driver pn533_usb
[ 8.087908][ T1] nfcsim 0.2 initialized
[ 8.089564][ T1] usbcore: registered new interface driver port100
[ 8.091249][ T1] usbcore: registered new interface driver nfcmrvl
[ 8.095493][ T1] Loading iSCSI transport class v2.0-870.
[ 8.134030][ T1] scsi host0: Virtio SCSI HBA
[ 8.179965][ T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[ 8.181287][ T38] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6
[ 8.214462][ T1] Rounding down aligned max_sectors from 4294967295 to 4294967288
[ 8.217324][ T1] db_root: cannot open: /etc/target
[ 8.219603][ T1] slram: not enough parameters.
[ 8.224891][ T1] general protection fault, probably for non-canonical address 0xdffffc00000000ac: 0000 [#1] PREEMPT SMP KASAN
[ 8.226558][ T1] KASAN: null-ptr-deref in range [0x0000000000000560-0x0000000000000567]
[ 8.226558][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc6-next-20220715-syzkaller #0
[ 8.226558][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 8.226558][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.226558][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 a0 7d 96 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.226558][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.226558][ T1] RAX: dffffc0000000000 RBX: ffff88801fb6e000 RCX: 0000000000000000
[ 8.226558][ T1] RDX: 00000000000000ac RSI: ffffffff84e522a0 RDI: 0000000000000560
[ 8.226558][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.226558][ T1] R10: ffffffff89e00000 R11: 0000000000000000 R12: ffff88801fb6e004
[ 8.226558][ T1] R13: ffff88801fb6e028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.226558][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.226558][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.226558][ T1] CR2: ffff88823ffff000 CR3: 000000000bc8e000 CR4: 00000000003506f0
[ 8.226558][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.226558][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.226558][ T1] Call Trace:
[ 8.226558][ T1] <TASK>
[ 8.226558][ T1] ? del_mtd_partitions+0x50/0x50
[ 8.226558][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.226558][ T1] ? mtd_erase+0x8e0/0x8e0
[ 8.226558][ T1] ? lockdep_init_map_type+0x21a/0x7f0
[ 8.226558][ T1] ? __raw_spin_lock_init+0x36/0x110
[ 8.226558][ T1] mtd_device_parse_register+0x50c/0x850
[ 8.226558][ T1] mtdram_init_device+0x291/0x350
[ 8.275853][ T1] ? init_phram+0x99/0x99
[ 8.275853][ T1] init_mtdram+0xe5/0x177
[ 8.275853][ T1] ? init_phram+0x99/0x99
[ 8.275853][ T1] do_one_initcall+0xfe/0x650
[ 8.275853][ T1] ? trace_event_raw_event_initcall_level+0x1f0/0x1f0
[ 8.275853][ T1] ? parameq+0x150/0x170
[ 8.275853][ T1] kernel_init_freeable+0x6b1/0x73a
[ 8.275853][ T1] ? rest_init+0x270/0x270
[ 8.275853][ T1] kernel_init+0x1a/0x1d0
[ 8.275853][ T1] ? rest_init+0x270/0x270
[ 8.275853][ T1] ret_from_fork+0x1f/0x30
[ 8.275853][ T1] </TASK>
[ 8.275853][ T1] Modules linked in:
[ 8.292023][ C0] vkms_vblank_simulate: vblank timer overrun
[ 8.293991][ T1] ---[ end trace 0000000000000000 ]---
[ 8.295632][ T1] RIP: 0010:add_mtd_device+0xbc8/0x1520
[ 8.298821][ T1] Code: 48 81 fd 60 fe ff ff 0f 84 90 fd ff ff e8 a0 7d 96 fc 48 8d bd 60 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 da 08 00 00 48 8b ad 60 05 00 00 48 85 ed 0f 84
[ 8.303698][ T1] RSP: 0000:ffffc90000067c98 EFLAGS: 00010206
[ 8.305453][ T1] RAX: dffffc0000000000 RBX: ffff88801fb6e000 RCX: 0000000000000000
[ 8.307978][ T1] RDX: 00000000000000ac RSI: ffffffff84e522a0 RDI: 0000000000000560
[ 8.309956][ T1] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
[ 8.311913][ T1] R10: ffffffff89e00000 R11: 0000000000000000 R12: ffff88801fb6e004
[ 8.313971][ T1] R13: ffff88801fb6e028 R14: 0000000000000000 R15: 0000000005a00000
[ 8.316587][ T1] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 8.318856][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.321155][ T1] CR2: ffff88823ffff000 CR3: 000000000bc8e000 CR4: 00000000003506f0
[ 8.323101][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.325096][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.327799][ T1] Kernel panic - not syncing: Fatal exception
[ 8.329676][ T1] Kernel Offset: disabled
[ 8.330639][ T1] Rebooting in 86400 seconds..

GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2940213143=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at a371c43c3
nothing to commit, working tree clean


go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=a371c43c33b6f901421f93b655442363c072d251 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220624-125309'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"a371c43c33b6f901421f93b655442363c072d251\"


Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=1748cfa4080000