[syzbot] [mm?] BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
25 views
Skip to first unread message
syzbot
Feb 7, 2024, 2:16:34 AMFeb 7
to ak...@linux-foundation.org, b...@alien8.de, b...@suse.de, dave....@linux.intel.com, h...@zytor.com, linux-...@vger.kernel.org, linu...@kvack.org, lu...@kernel.org, mi...@redhat.com, net...@vger.kernel.org, pet...@infradead.org, syzkall...@googlegroups.com, tg...@linutronix.de, x...@kernel.org
Hello,
syzbot found the following issue on:
HEAD commit: 6fb3f72702fb Merge branch 'improvements-for-tracking-scala..
git tree: bpf-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1356a9b7e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1b95408789b2ce1a
dashboard link: https://syzkaller.appspot.com/bug?extid=a0fa177e13690b663c74
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=121231e4180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15419118180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/df63acb4ac9d/disk-6fb3f727.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/62f12d4789e3/vmlinux-6fb3f727.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3390f746a855/bzImage-6fb3f727.xz
The issue was bisected to:
commit ca247283781d754216395a41c5e8be8ec79a5f1c
Author: Andy Lutomirski <lu...@kernel.org>
Date: Wed Feb 10 02:33:45 2021 +0000
x86/fault: Don't run fixups for SMAP violations
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14ab3c9fe80000
final oops: https://syzkaller.appspot.com/x/report.txt?x=16ab3c9fe80000
console output: https://syzkaller.appspot.com/x/log.txt?x=12ab3c9fe80000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a0fa17...@syzkaller.appspotmail.com
Fixes: ca247283781d ("x86/fault: Don't run fixups for SMAP violations")
BUG: unable to handle page fault for address: ffffffffff600000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD df36067 P4D df36067 PUD df38067 PMD df5b067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 PID: 5064 Comm: syz-executor171 Not tainted 6.8.0-rc1-syzkaller-00523-g6fb3f72702fb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
RIP: 0010:strncpy_from_kernel_nofault+0x8d/0x1d0 mm/maccess.c:91
Code: 00 48 89 d0 48 c1 e8 03 48 89 44 24 10 0f b6 04 28 84 c0 48 89 14 24 0f 85 d9 00 00 00 ff 02 45 31 f6 49 89 df 48 8b 54 24 08 <42> 8a 1c 33 4a 8d 3c 32 48 89 f8 48 c1 e8 03 49 89 ec 0f b6 04 28
RSP: 0018:ffffc90003b5f888 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffffff600000 RCX: ffff88801871d940
RDX: ffffc90003b5f900 RSI: ffffffffff600000 RDI: ffffffffff600000
RBP: dffffc0000000000 R08: ffffffff8141da1d R09: 1ffffffff2591484
R10: dffffc0000000000 R11: ffffffffa0001f90 R12: ffffffffff600000
R13: 0000000000000005 R14: 0000000000000000 R15: ffffffffff600000
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000000df32000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bpf_probe_read_kernel_str_common kernel/trace/bpf_trace.c:266 [inline]
____bpf_probe_read_kernel_str kernel/trace/bpf_trace.c:275 [inline]
bpf_probe_read_kernel_str+0x2a/0x70 kernel/trace/bpf_trace.c:272
bpf_prog_ef3a4661c9d1378e+0x4a/0x4c
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:651 [inline]
bpf_prog_run include/linux/filter.h:658 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0x28e/0x380 mm/slub.c:4396
vma_numab_state_free include/linux/mm.h:638 [inline]
__vm_area_free+0x42/0x110 kernel/fork.c:505
remove_vma mm/mmap.c:146 [inline]
exit_mmap+0x6a9/0xd40 mm/mmap.c:3301
__mmput+0x115/0x3c0 kernel/fork.c:1343
exit_mm+0x21f/0x310 kernel/exit.c:569
do_exit+0x9af/0x2740 kernel/exit.c:858
do_group_exit+0x206/0x2c0 kernel/exit.c:1020
__do_sys_exit_group kernel/exit.c:1031 [inline]
__se_sys_exit_group kernel/exit.c:1029 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1029
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7fddca0c0c89
Code: Unable to access opcode bytes at 0x7fddca0c0c5f.
RSP: 002b:00007fff7476ad38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fddca0c0c89
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007fddca13b290 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fddca13b290
R13: 0000000000000000 R14: 00007fddca13bce0 R15: 00007fddca091ec0
</TASK>
Modules linked in:
CR2: ffffffffff600000
---[ end trace 0000000000000000 ]---
RIP: 0010:strncpy_from_kernel_nofault+0x8d/0x1d0 mm/maccess.c:91
Code: 00 48 89 d0 48 c1 e8 03 48 89 44 24 10 0f b6 04 28 84 c0 48 89 14 24 0f 85 d9 00 00 00 ff 02 45 31 f6 49 89 df 48 8b 54 24 08 <42> 8a 1c 33 4a 8d 3c 32 48 89 f8 48 c1 e8 03 49 89 ec 0f b6 04 28
RSP: 0018:ffffc90003b5f888 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffffff600000 RCX: ffff88801871d940
RDX: ffffc90003b5f900 RSI: ffffffffff600000 RDI: ffffffffff600000
RBP: dffffc0000000000 R08: ffffffff8141da1d R09: 1ffffffff2591484
R10: dffffc0000000000 R11: ffffffffa0001f90 R12: ffffffffff600000
R13: 0000000000000005 R14: 0000000000000000 R15: ffffffffff600000
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000000df32000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 48 89 add %cl,-0x77(%rax)
3: d0 48 c1 rorb -0x3f(%rax)
6: e8 03 48 89 44 call 0x4489480e
b: 24 10 and $0x10,%al
d: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
11: 84 c0 test %al,%al
13: 48 89 14 24 mov %rdx,(%rsp)
17: 0f 85 d9 00 00 00 jne 0xf6
1d: ff 02 incl (%rdx)
1f: 45 31 f6 xor %r14d,%r14d
22: 49 89 df mov %rbx,%r15
25: 48 8b 54 24 08 mov 0x8(%rsp),%rdx
* 2a: 42 8a 1c 33 mov (%rbx,%r14,1),%bl <-- trapping instruction
2e: 4a 8d 3c 32 lea (%rdx,%r14,1),%rdi
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 49 89 ec mov %rbp,%r12
3c: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 6fb3f72702fb Merge branch 'improvements-for-tracking-scala..
git tree: bpf-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1356a9b7e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1b95408789b2ce1a
dashboard link: https://syzkaller.appspot.com/bug?extid=a0fa177e13690b663c74
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=121231e4180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15419118180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/df63acb4ac9d/disk-6fb3f727.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/62f12d4789e3/vmlinux-6fb3f727.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3390f746a855/bzImage-6fb3f727.xz
The issue was bisected to:
commit ca247283781d754216395a41c5e8be8ec79a5f1c
Author: Andy Lutomirski <lu...@kernel.org>
Date: Wed Feb 10 02:33:45 2021 +0000
x86/fault: Don't run fixups for SMAP violations
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14ab3c9fe80000
final oops: https://syzkaller.appspot.com/x/report.txt?x=16ab3c9fe80000
console output: https://syzkaller.appspot.com/x/log.txt?x=12ab3c9fe80000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a0fa17...@syzkaller.appspotmail.com
Fixes: ca247283781d ("x86/fault: Don't run fixups for SMAP violations")
BUG: unable to handle page fault for address: ffffffffff600000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD df36067 P4D df36067 PUD df38067 PMD df5b067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 PID: 5064 Comm: syz-executor171 Not tainted 6.8.0-rc1-syzkaller-00523-g6fb3f72702fb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
RIP: 0010:strncpy_from_kernel_nofault+0x8d/0x1d0 mm/maccess.c:91
Code: 00 48 89 d0 48 c1 e8 03 48 89 44 24 10 0f b6 04 28 84 c0 48 89 14 24 0f 85 d9 00 00 00 ff 02 45 31 f6 49 89 df 48 8b 54 24 08 <42> 8a 1c 33 4a 8d 3c 32 48 89 f8 48 c1 e8 03 49 89 ec 0f b6 04 28
RSP: 0018:ffffc90003b5f888 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffffff600000 RCX: ffff88801871d940
RDX: ffffc90003b5f900 RSI: ffffffffff600000 RDI: ffffffffff600000
RBP: dffffc0000000000 R08: ffffffff8141da1d R09: 1ffffffff2591484
R10: dffffc0000000000 R11: ffffffffa0001f90 R12: ffffffffff600000
R13: 0000000000000005 R14: 0000000000000000 R15: ffffffffff600000
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000000df32000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bpf_probe_read_kernel_str_common kernel/trace/bpf_trace.c:266 [inline]
____bpf_probe_read_kernel_str kernel/trace/bpf_trace.c:275 [inline]
bpf_probe_read_kernel_str+0x2a/0x70 kernel/trace/bpf_trace.c:272
bpf_prog_ef3a4661c9d1378e+0x4a/0x4c
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:651 [inline]
bpf_prog_run include/linux/filter.h:658 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0x28e/0x380 mm/slub.c:4396
vma_numab_state_free include/linux/mm.h:638 [inline]
__vm_area_free+0x42/0x110 kernel/fork.c:505
remove_vma mm/mmap.c:146 [inline]
exit_mmap+0x6a9/0xd40 mm/mmap.c:3301
__mmput+0x115/0x3c0 kernel/fork.c:1343
exit_mm+0x21f/0x310 kernel/exit.c:569
do_exit+0x9af/0x2740 kernel/exit.c:858
do_group_exit+0x206/0x2c0 kernel/exit.c:1020
__do_sys_exit_group kernel/exit.c:1031 [inline]
__se_sys_exit_group kernel/exit.c:1029 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1029
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7fddca0c0c89
Code: Unable to access opcode bytes at 0x7fddca0c0c5f.
RSP: 002b:00007fff7476ad38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fddca0c0c89
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007fddca13b290 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fddca13b290
R13: 0000000000000000 R14: 00007fddca13bce0 R15: 00007fddca091ec0
</TASK>
Modules linked in:
CR2: ffffffffff600000
---[ end trace 0000000000000000 ]---
RIP: 0010:strncpy_from_kernel_nofault+0x8d/0x1d0 mm/maccess.c:91
Code: 00 48 89 d0 48 c1 e8 03 48 89 44 24 10 0f b6 04 28 84 c0 48 89 14 24 0f 85 d9 00 00 00 ff 02 45 31 f6 49 89 df 48 8b 54 24 08 <42> 8a 1c 33 4a 8d 3c 32 48 89 f8 48 c1 e8 03 49 89 ec 0f b6 04 28
RSP: 0018:ffffc90003b5f888 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffffff600000 RCX: ffff88801871d940
RDX: ffffc90003b5f900 RSI: ffffffffff600000 RDI: ffffffffff600000
RBP: dffffc0000000000 R08: ffffffff8141da1d R09: 1ffffffff2591484
R10: dffffc0000000000 R11: ffffffffa0001f90 R12: ffffffffff600000
R13: 0000000000000005 R14: 0000000000000000 R15: ffffffffff600000
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000000df32000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 48 89 add %cl,-0x77(%rax)
3: d0 48 c1 rorb -0x3f(%rax)
6: e8 03 48 89 44 call 0x4489480e
b: 24 10 and $0x10,%al
d: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
11: 84 c0 test %al,%al
13: 48 89 14 24 mov %rdx,(%rsp)
17: 0f 85 d9 00 00 00 jne 0xf6
1d: ff 02 incl (%rdx)
1f: 45 31 f6 xor %r14d,%r14d
22: 49 89 df mov %rbx,%r15
25: 48 8b 54 24 08 mov 0x8(%rsp),%rdx
* 2a: 42 8a 1c 33 mov (%rbx,%r14,1),%bl <-- trapping instruction
2e: 4a 8d 3c 32 lea (%rdx,%r14,1),%rdi
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 49 89 ec mov %rbp,%r12
3c: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jun 19, 2024, 9:51:27 AMJun 19
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
Author: wojciech...@infogain.com
#syz test: https://linux.googlesource.com/linux/kernel/git/torvalds/linux ee0e39a63b78849f8abbef268b13e4838569f646
The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to it by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken based on it, is strictly prohibited and may be unlawful.
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
Author: wojciech...@infogain.com
#syz test: https://linux.googlesource.com/linux/kernel/git/torvalds/linux ee0e39a63b78849f8abbef268b13e4838569f646
The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to it by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken based on it, is strictly prohibited and may be unlawful.
syzbot
Jun 19, 2024, 9:52:29 AMJun 19
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: Re: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Author: wojciech...@infogain.com
#syz test: https://linux.googlesource.com/linux/kernel/git/torvalds/linux 32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58
syzbot
Jun 19, 2024, 10:50:05 AMJun 19
to linux-...@vger.kernel.org, syzkall...@googlegroups.com, wojciech...@infogain.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RAX: 0000000000000000 RBX: ffffffffff600000 RCX: ffff88807b8f3b80
RDX: ffffc9000318f8a0 RSI: ffffffffff600000 RDI: ffffffffff600000
RBP: dffffc0000000000 R08: ffffffff8141da1d R09: 1ffffffff2590c84
R10: dffffc0000000000 R11: ffffffffa00016e8 R12: ffffffffff600000
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x2b7/0x740 security/tomoyo/file.c:822
tomoyo_path_unlink+0xd0/0x110 security/tomoyo/tomoyo.c:162
security_path_unlink+0xe1/0x140 security/security.c:1851
do_unlinkat+0x3e6/0x830 fs/namei.c:4395
__do_sys_unlink fs/namei.c:4446 [inline]
__se_sys_unlink fs/namei.c:4444 [inline]
__x64_sys_unlink+0x49/0x60 fs/namei.c:4444
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f0b37117da7
Code: f0 ff ff 73 01 c3 48 8b 0d 7e 90 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 51 90 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffeacb64188 EFLAGS: 00000202 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f0b37117da7
RDX: fffffffffffffe60 RSI: 00007ffeacb64260 RDI: 000055bb027950d8
RBP: 000000000000000b R08: 0000000000000007 R09: 2905dc5b2145fa13
R10: c8f27f571a018b9b R11: 0000000000000202 R12: 0000000000000bb8
R13: 0000000200000001 R14: 0000000000000000 R15: 0000000000000000
RAX: 0000000000000000 RBX: ffffffffff600000 RCX: ffff88807b8f3b80
RDX: ffffc9000318f8a0 RSI: ffffffffff600000 RDI: ffffffffff600000
RBP: dffffc0000000000 R08: ffffffff8141da1d R09: 1ffffffff2590c84
R10: dffffc0000000000 R11: ffffffffa00016e8 R12: ffffffffff600000
commit: ee0e39a6 x86/mm: Move is_vsyscall_vaddr() into asm/vsy..
git tree: https://linux.googlesource.com/linux/kernel/git/torvalds/linux
console output: https://syzkaller.appspot.com/x/log.txt?x=15ab2d41980000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e23375d0c3afdc8
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
BUG: unable to handle page fault for address: ffffffffff600000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD df36067 P4D df36067 PUD df38067 PMD df5b067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 PID: 4523 Comm: udevd Not tainted 6.8.0-rc1-syzkaller-00199-gee0e39a63b78 #0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD df36067 P4D df36067 PUD df38067 PMD df5b067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN PTI
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:strncpy_from_kernel_nofault+0x8d/0x1d0 mm/maccess.c:91
Code: 00 48 89 d0 48 c1 e8 03 48 89 44 24 10 0f b6 04 28 84 c0 48 89 14 24 0f 85 d9 00 00 00 ff 02 45 31 f6 49 89 df 48 8b 54 24 08 <42> 8a 1c 33 4a 8d 3c 32 48 89 f8 48 c1 e8 03 49 89 ec 0f b6 04 28
RSP: 0018:ffffc9000318f828 EFLAGS: 00010246
Code: 00 48 89 d0 48 c1 e8 03 48 89 44 24 10 0f b6 04 28 84 c0 48 89 14 24 0f 85 d9 00 00 00 ff 02 45 31 f6 49 89 df 48 8b 54 24 08 <42> 8a 1c 33 4a 8d 3c 32 48 89 f8 48 c1 e8 03 49 89 ec 0f b6 04 28
RAX: 0000000000000000 RBX: ffffffffff600000 RCX: ffff88807b8f3b80
RDX: ffffc9000318f8a0 RSI: ffffffffff600000 RDI: ffffffffff600000
RBP: dffffc0000000000 R08: ffffffff8141da1d R09: 1ffffffff2590c84
R10: dffffc0000000000 R11: ffffffffa00016e8 R12: ffffffffff600000
R13: 0000000000000005 R14: 0000000000000000 R15: ffffffffff600000
FS: 00007f0b374b1c80(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000002981c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bpf_probe_read_kernel_str_common kernel/trace/bpf_trace.c:266 [inline]
____bpf_probe_read_kernel_str kernel/trace/bpf_trace.c:275 [inline]
bpf_probe_read_kernel_str+0x2a/0x70 kernel/trace/bpf_trace.c:272
bpf_prog_ef3a4661c9d1378e+0x4a/0x4c
bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bpf_probe_read_kernel_str_common kernel/trace/bpf_trace.c:266 [inline]
____bpf_probe_read_kernel_str kernel/trace/bpf_trace.c:275 [inline]
bpf_probe_read_kernel_str+0x2a/0x70 kernel/trace/bpf_trace.c:272
bpf_prog_ef3a4661c9d1378e+0x4a/0x4c
__bpf_prog_run include/linux/filter.h:651 [inline]
bpf_prog_run include/linux/filter.h:658 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0x28e/0x380 mm/slub.c:4396
tomoyo_realpath_from_path+0xc2/0x5e0 security/tomoyo/realpath.c:250
bpf_prog_run include/linux/filter.h:658 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0x28e/0x380 mm/slub.c:4396
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x2b7/0x740 security/tomoyo/file.c:822
tomoyo_path_unlink+0xd0/0x110 security/tomoyo/tomoyo.c:162
security_path_unlink+0xe1/0x140 security/security.c:1851
do_unlinkat+0x3e6/0x830 fs/namei.c:4395
__do_sys_unlink fs/namei.c:4446 [inline]
__se_sys_unlink fs/namei.c:4444 [inline]
__x64_sys_unlink+0x49/0x60 fs/namei.c:4444
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f0b37117da7
Code: f0 ff ff 73 01 c3 48 8b 0d 7e 90 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 51 90 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffeacb64188 EFLAGS: 00000202 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f0b37117da7
RDX: fffffffffffffe60 RSI: 00007ffeacb64260 RDI: 000055bb027950d8
RBP: 000000000000000b R08: 0000000000000007 R09: 2905dc5b2145fa13
R10: c8f27f571a018b9b R11: 0000000000000202 R12: 0000000000000bb8
R13: 0000000200000001 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
CR2: ffffffffff600000
---[ end trace 0000000000000000 ]---
RIP: 0010:strncpy_from_kernel_nofault+0x8d/0x1d0 mm/maccess.c:91
Code: 00 48 89 d0 48 c1 e8 03 48 89 44 24 10 0f b6 04 28 84 c0 48 89 14 24 0f 85 d9 00 00 00 ff 02 45 31 f6 49 89 df 48 8b 54 24 08 <42> 8a 1c 33 4a 8d 3c 32 48 89 f8 48 c1 e8 03 49 89 ec 0f b6 04 28
RSP: 0018:ffffc9000318f828 EFLAGS: 00010246
Modules linked in:
CR2: ffffffffff600000
---[ end trace 0000000000000000 ]---
RIP: 0010:strncpy_from_kernel_nofault+0x8d/0x1d0 mm/maccess.c:91
Code: 00 48 89 d0 48 c1 e8 03 48 89 44 24 10 0f b6 04 28 84 c0 48 89 14 24 0f 85 d9 00 00 00 ff 02 45 31 f6 49 89 df 48 8b 54 24 08 <42> 8a 1c 33 4a 8d 3c 32 48 89 f8 48 c1 e8 03 49 89 ec 0f b6 04 28
RAX: 0000000000000000 RBX: ffffffffff600000 RCX: ffff88807b8f3b80
RDX: ffffc9000318f8a0 RSI: ffffffffff600000 RDI: ffffffffff600000
RBP: dffffc0000000000 R08: ffffffff8141da1d R09: 1ffffffff2590c84
R10: dffffc0000000000 R11: ffffffffa00016e8 R12: ffffffffff600000
R13: 0000000000000005 R14: 0000000000000000 R15: ffffffffff600000
FS: 00007f0b374b1c80(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000002981c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 48 89 add %cl,-0x77(%rax)
3: d0 48 c1 rorb -0x3f(%rax)
6: e8 03 48 89 44 call 0x4489480e
b: 24 10 and $0x10,%al
d: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
11: 84 c0 test %al,%al
13: 48 89 14 24 mov %rdx,(%rsp)
17: 0f 85 d9 00 00 00 jne 0xf6
1d: ff 02 incl (%rdx)
1f: 45 31 f6 xor %r14d,%r14d
22: 49 89 df mov %rbx,%r15
25: 48 8b 54 24 08 mov 0x8(%rsp),%rdx
* 2a: 42 8a 1c 33 mov (%rbx,%r14,1),%bl <-- trapping instruction
2e: 4a 8d 3c 32 lea (%rdx,%r14,1),%rdi
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 49 89 ec mov %rbp,%r12
3c: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
Tested on:
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 48 89 add %cl,-0x77(%rax)
3: d0 48 c1 rorb -0x3f(%rax)
6: e8 03 48 89 44 call 0x4489480e
b: 24 10 and $0x10,%al
d: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
11: 84 c0 test %al,%al
13: 48 89 14 24 mov %rdx,(%rsp)
17: 0f 85 d9 00 00 00 jne 0xf6
1d: ff 02 incl (%rdx)
1f: 45 31 f6 xor %r14d,%r14d
22: 49 89 df mov %rbx,%r15
25: 48 8b 54 24 08 mov 0x8(%rsp),%rdx
* 2a: 42 8a 1c 33 mov (%rbx,%r14,1),%bl <-- trapping instruction
2e: 4a 8d 3c 32 lea (%rdx,%r14,1),%rdi
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 49 89 ec mov %rbp,%r12
3c: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
commit: ee0e39a6 x86/mm: Move is_vsyscall_vaddr() into asm/vsy..
git tree: https://linux.googlesource.com/linux/kernel/git/torvalds/linux
console output: https://syzkaller.appspot.com/x/log.txt?x=15ab2d41980000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e23375d0c3afdc8
dashboard link: https://syzkaller.appspot.com/bug?extid=a0fa177e13690b663c74
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syzbot
Jun 19, 2024, 11:14:05 AMJun 19
to linux-...@vger.kernel.org, syzkall...@googlegroups.com, wojciech...@infogain.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+a0fa17...@syzkaller.appspotmail.com
Tested on:
commit: 32019c65 x86/mm: Disallow vsyscall page read for copy_..
git tree: https://linux.googlesource.com/linux/kernel/git/torvalds/linux
console output: https://syzkaller.appspot.com/x/log.txt?x=146e310e980000
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+a0fa17...@syzkaller.appspotmail.com
Tested on:
commit: 32019c65 x86/mm: Disallow vsyscall page read for copy_..
git tree: https://linux.googlesource.com/linux/kernel/git/torvalds/linux
console output: https://syzkaller.appspot.com/x/log.txt?x=146e310e980000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e23375d0c3afdc8
dashboard link: https://syzkaller.appspot.com/bug?extid=a0fa177e13690b663c74
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
dashboard link: https://syzkaller.appspot.com/bug?extid=a0fa177e13690b663c74
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
Reply all
Reply to author
Forward
0 new messages