BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
32 views
Skip to first unread message
syzbot
Nov 18, 2018, 1:49:04 PM11/18/18
to a...@kernel.org, dan...@iogearbox.net, linux-...@vger.kernel.org, net...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 592ee43faf86 bpf: fix null pointer dereference on pointer ..
git tree: bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1211f2d5400000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e5cbc38ae27657e
dashboard link: https://syzkaller.appspot.com/bug?extid=66d6b1d3055f1d9ee4f3
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e4ec25400000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+66d6b1...@syzkaller.appspotmail.com
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1126bc8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1126d40 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#2] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b11264d8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1126650 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#3] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1125de8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1125f60 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#4] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b11256f8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1125870 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#5] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1125008 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1125180 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#6] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1124918 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1124a90 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#7] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1124228 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b11243a0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#8] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1123b38 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1123cb0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#9] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1123448 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b11235c0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#10] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1122d58 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1122ed0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#11] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1122668 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b11227e0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#12] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1121f78 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b11220f0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#13] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1121888 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1121a00 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#14] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1121198 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1121310 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#15] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1120aa8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1120c20 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
------------[ cut here ]------------
kernel BUG at mm/slab.c:4425!
invalid opcode: 0000 [#16] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__check_heap_object+0xa7/0xb5 mm/slab.c:4450
Code: 48 c7 c7 d5 b7 14 89 e8 97 e3 0a 00 5d c3 41 8b 91 04 01 00 00 48 29
c7 48 39 d7 77 be 48 01 d0 48 29 c8 48 39 f0 72 b3 5d c3 <0f> 0b 48 c7 c7
d5 b7 14 89 e8 fd eb 0a 00 44 89 e9 48 c7 c7 90 b8
RSP: 0018:ffff8801b111fd38 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 1ffff10036223fae RCX: 000000000000000c
RDX: ffff8801b111ed80 RSI: 0000000000000001 RDI: ffff8801b111ff18
RBP: ffff8801b111fd38 R08: ffff8801c2ac4040 R09: ffff8801da980e00
R10: 0000000000000f86 R11: 0000000000000000 R12: ffff8801b111ff18
R13: 0000000000000001 R14: ffffea0006c44780 R15: 0000000000000001
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#17] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b111f880 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b111f9f8 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
------------[ cut here ]------------
kernel BUG at mm/slab.c:4425!
invalid opcode: 0000 [#18] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__check_heap_object+0xa7/0xb5 mm/slab.c:4450
Code: 48 c7 c7 d5 b7 14 89 e8 97 e3 0a 00 5d c3 41 8b 91 04 01 00 00 48 29
c7 48 39 d7 77 be 48 01 d0 48 29 c8 48 39 f0 72 b3 5d c3 <0f> 0b 48 c7 c7
d5 b7 14 89 e8 fd eb 0a 00 44 89 e9 48 c7 c7 90 b8
RSP: 0018:ffff8801b111d300 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 1ffff10036223a67 RCX: 000000000000000c
RDX: ffff8801b111c200 RSI: 0000000000000002 RDI: ffff8801b111d4a8
RBP: ffff8801b111d300 R08: ffff8801c2ac4040 R09: ffff8801da980e00
R10: 0000000000001076 R11: 0000000000000000 R12: ffff8801b111d4a8
R13: 0000000000000002 R14: ffffea0006c44700 R15: 0000000000000001
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace 53dd6c86d14a98c0 ]---
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1126bc8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1126d40 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following crash on:
HEAD commit: 592ee43faf86 bpf: fix null pointer dereference on pointer ..
git tree: bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1211f2d5400000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e5cbc38ae27657e
dashboard link: https://syzkaller.appspot.com/bug?extid=66d6b1d3055f1d9ee4f3
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e4ec25400000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+66d6b1...@syzkaller.appspotmail.com
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1126bc8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1126d40 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#2] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b11264d8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1126650 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#3] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1125de8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1125f60 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#4] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b11256f8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1125870 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#5] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1125008 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1125180 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#6] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1124918 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1124a90 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#7] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1124228 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b11243a0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#8] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1123b38 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1123cb0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#9] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1123448 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b11235c0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#10] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1122d58 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1122ed0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#11] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1122668 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b11227e0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#12] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1121f78 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b11220f0 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#13] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1121888 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1121a00 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Oops: 0000 [#14] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1121198 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1121310 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#15] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1120aa8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1120c20 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
------------[ cut here ]------------
kernel BUG at mm/slab.c:4425!
invalid opcode: 0000 [#16] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__check_heap_object+0xa7/0xb5 mm/slab.c:4450
Code: 48 c7 c7 d5 b7 14 89 e8 97 e3 0a 00 5d c3 41 8b 91 04 01 00 00 48 29
c7 48 39 d7 77 be 48 01 d0 48 29 c8 48 39 f0 72 b3 5d c3 <0f> 0b 48 c7 c7
d5 b7 14 89 e8 fd eb 0a 00 44 89 e9 48 c7 c7 90 b8
RSP: 0018:ffff8801b111fd38 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 1ffff10036223fae RCX: 000000000000000c
RDX: ffff8801b111ed80 RSI: 0000000000000001 RDI: ffff8801b111ff18
RBP: ffff8801b111fd38 R08: ffff8801c2ac4040 R09: ffff8801da980e00
R10: 0000000000000f86 R11: 0000000000000000 R12: ffff8801b111ff18
R13: 0000000000000001 R14: ffffea0006c44780 R15: 0000000000000001
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001933030
PGD 1da95a067 P4D 1da95a067 PUD 1da95b067 PMD 1d4203067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#17] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b111f880 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b111f9f8 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
------------[ cut here ]------------
kernel BUG at mm/slab.c:4425!
invalid opcode: 0000 [#18] PREEMPT SMP KASAN
CPU: 0 PID: 13017 Comm: blkid Not tainted 4.20.0-rc1+ #144
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__check_heap_object+0xa7/0xb5 mm/slab.c:4450
Code: 48 c7 c7 d5 b7 14 89 e8 97 e3 0a 00 5d c3 41 8b 91 04 01 00 00 48 29
c7 48 39 d7 77 be 48 01 d0 48 29 c8 48 39 f0 72 b3 5d c3 <0f> 0b 48 c7 c7
d5 b7 14 89 e8 fd eb 0a 00 44 89 e9 48 c7 c7 90 b8
RSP: 0018:ffff8801b111d300 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 1ffff10036223a67 RCX: 000000000000000c
RDX: ffff8801b111c200 RSI: 0000000000000002 RDI: ffff8801b111d4a8
RBP: ffff8801b111d300 R08: ffff8801c2ac4040 R09: ffff8801da980e00
R10: 0000000000001076 R11: 0000000000000000 R12: ffff8801b111d4a8
R13: 0000000000000002 R14: ffffea0006c44700 R15: 0000000000000001
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace 53dd6c86d14a98c0 ]---
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:885 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:438 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:512
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801b1126bc8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801d54e0a30 RCX: ffffffff818c0a21
RDX: 1ffff92000326606 RSI: 0000000000000008 RDI: ffffc90001933002
RBP: ffff8801b1126d40 R08: ffff8801c2ac4040 R09: 0000000000000000
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: ffffc90001933000 R14: dffffc0000000000 R15: ffff8801d54e0a30
FS: 00007fe237cd5740(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001933030 CR3: 00000001b96da000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Mar 26, 2019, 1:44:01 AM3/26/19
to a...@fb.com, a...@kernel.org, dan...@iogearbox.net, john.fa...@gmail.com, linux-...@vger.kernel.org, net...@vger.kernel.org, syzkall...@googlegroups.com
syzbot has bisected this bug to:
commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941
Author: Alexei Starovoitov <a...@fb.com>
Date: Fri Dec 15 01:55:06 2017 +0000
bpf: introduce function calls (verification)
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17b5a0cd200000
start commit: 592ee43f bpf: fix null pointer dereference on pointer offl..
git tree: bpf-next
final crash: https://syzkaller.appspot.com/x/report.txt?x=1475a0cd200000
console output: https://syzkaller.appspot.com/x/log.txt?x=1075a0cd200000
Reported-by: syzbot+66d6b1...@syzkaller.appspotmail.com
Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941
Author: Alexei Starovoitov <a...@fb.com>
Date: Fri Dec 15 01:55:06 2017 +0000
bpf: introduce function calls (verification)
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17b5a0cd200000
start commit: 592ee43f bpf: fix null pointer dereference on pointer offl..
git tree: bpf-next
final crash: https://syzkaller.appspot.com/x/report.txt?x=1475a0cd200000
console output: https://syzkaller.appspot.com/x/log.txt?x=1075a0cd200000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e5cbc38ae27657e
dashboard link: https://syzkaller.appspot.com/bug?extid=66d6b1d3055f1d9ee4f3
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e4ec25400000
dashboard link: https://syzkaller.appspot.com/bug?extid=66d6b1d3055f1d9ee4f3
Reported-by: syzbot+66d6b1...@syzkaller.appspotmail.com
Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot
Mar 26, 2019, 9:17:02 AM3/26/19
to dan...@iogearbox.net, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer still triggered
crash:
KASAN: use-after-free Read in bpf_prog_kallsyms_del
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
==================================================================
BUG: KASAN: use-after-free in __list_del_entry_valid+0xe6/0xf5
lib/list_debug.c:51
Read of size 8 at addr ffff8881ccf387e8 by task syz-executor3/8217
CPU: 0 PID: 8217 Comm: syz-executor3 Not tainted 5.0.0+ #1
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
__list_del_entry_valid+0xe6/0xf5 lib/list_debug.c:51
__list_del_entry include/linux/list.h:117 [inline]
list_del_rcu include/linux/rculist.h:130 [inline]
bpf_prog_ksym_node_del kernel/bpf/core.c:634 [inline]
bpf_prog_kallsyms_del kernel/bpf/core.c:665 [inline]
bpf_prog_kallsyms_del+0x143/0x290 kernel/bpf/core.c:659
bpf_prog_kallsyms_del_subprogs+0xd6/0x170 kernel/bpf/core.c:512
bpf_prog_kallsyms_del_all+0x16/0x30 kernel/bpf/core.c:517
__bpf_prog_put kernel/bpf/syscall.c:1272 [inline]
__bpf_prog_put+0x100/0x250 kernel/bpf/syscall.c:1266
bpf_prog_put kernel/bpf/syscall.c:1283 [inline]
bpf_prog_release+0x3c/0x50 kernel/bpf/syscall.c:1291
__fput+0x2e5/0x8d0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x411021
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 84 1a 00 00 c3 48
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffce1fb3890 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000411021
RDX: 0000000000000000 RSI: 00000000007309d0 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffce1fb37c0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000017 R15: 0000000000000003
Allocated by task 8216:
save_stack+0x45/0xd0 mm/kasan/common.c:75
set_track mm/kasan/common.c:87 [inline]
__kasan_kmalloc mm/kasan/common.c:497 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:470
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:511
kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3621
kmalloc include/linux/slab.h:545 [inline]
kzalloc include/linux/slab.h:740 [inline]
bpf_prog_alloc_no_stats+0xe6/0x2b0 kernel/bpf/core.c:92
bpf_prog_alloc+0x31/0x230 kernel/bpf/core.c:114
bpf_prog_load+0x4fc/0x14a0 kernel/bpf/syscall.c:1572
__do_sys_bpf+0x117a/0x3e50 kernel/bpf/syscall.c:2710
__se_sys_bpf kernel/bpf/syscall.c:2672 [inline]
__x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:2672
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 3619:
save_stack+0x45/0xd0 mm/kasan/common.c:75
set_track mm/kasan/common.c:87 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:459
kasan_slab_free+0xe/0x10 mm/kasan/common.c:467
__cache_free mm/slab.c:3498 [inline]
kfree+0xcf/0x230 mm/slab.c:3821
__bpf_prog_free+0x87/0xc0 kernel/bpf/core.c:262
bpf_prog_unlock_free include/linux/filter.h:792 [inline]
bpf_prog_free_deferred kernel/bpf/core.c:1985 [inline]
bpf_prog_free_deferred+0x272/0x3e0 kernel/bpf/core.c:1969
process_one_work+0x98e/0x1790 kernel/workqueue.c:2269
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x357/0x430 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881ccf38780
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 104 bytes inside of
512-byte region [ffff8881ccf38780, ffff8881ccf38980)
The buggy address belongs to the page:
page:ffffea000733ce00 count:1 mapcount:0 mapping:ffff8881da800940
index:0xffff8881ccf38a00
flags: 0x2fffc0000000200(slab)
raw: 02fffc0000000200 ffff8881da801738 ffffea00072adbc8 ffff8881da800940
raw: ffff8881ccf38a00 ffff8881ccf38000 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881ccf38680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ccf38700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881ccf38780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881ccf38800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ccf38880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: 1da6c4d9 bpf: fix use after free in bpf_evict_inode
git tree: bpf
console output: https://syzkaller.appspot.com/x/log.txt?x=17a0f643200000
kernel config: https://syzkaller.appspot.com/x/.config?x=2c0e2e5323f513ea
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syzbot has tested the proposed patch but the reproducer still triggered
crash:
KASAN: use-after-free Read in bpf_prog_kallsyms_del
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
==================================================================
BUG: KASAN: use-after-free in __list_del_entry_valid+0xe6/0xf5
lib/list_debug.c:51
Read of size 8 at addr ffff8881ccf387e8 by task syz-executor3/8217
CPU: 0 PID: 8217 Comm: syz-executor3 Not tainted 5.0.0+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
Google 01/01/2011
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
__list_del_entry_valid+0xe6/0xf5 lib/list_debug.c:51
__list_del_entry include/linux/list.h:117 [inline]
list_del_rcu include/linux/rculist.h:130 [inline]
bpf_prog_ksym_node_del kernel/bpf/core.c:634 [inline]
bpf_prog_kallsyms_del kernel/bpf/core.c:665 [inline]
bpf_prog_kallsyms_del+0x143/0x290 kernel/bpf/core.c:659
bpf_prog_kallsyms_del_subprogs+0xd6/0x170 kernel/bpf/core.c:512
bpf_prog_kallsyms_del_all+0x16/0x30 kernel/bpf/core.c:517
__bpf_prog_put kernel/bpf/syscall.c:1272 [inline]
__bpf_prog_put+0x100/0x250 kernel/bpf/syscall.c:1266
bpf_prog_put kernel/bpf/syscall.c:1283 [inline]
bpf_prog_release+0x3c/0x50 kernel/bpf/syscall.c:1291
__fput+0x2e5/0x8d0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x411021
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 84 1a 00 00 c3 48
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffce1fb3890 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000411021
RDX: 0000000000000000 RSI: 00000000007309d0 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffce1fb37c0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000017 R15: 0000000000000003
Allocated by task 8216:
save_stack+0x45/0xd0 mm/kasan/common.c:75
set_track mm/kasan/common.c:87 [inline]
__kasan_kmalloc mm/kasan/common.c:497 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:470
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:511
kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3621
kmalloc include/linux/slab.h:545 [inline]
kzalloc include/linux/slab.h:740 [inline]
bpf_prog_alloc_no_stats+0xe6/0x2b0 kernel/bpf/core.c:92
bpf_prog_alloc+0x31/0x230 kernel/bpf/core.c:114
bpf_prog_load+0x4fc/0x14a0 kernel/bpf/syscall.c:1572
__do_sys_bpf+0x117a/0x3e50 kernel/bpf/syscall.c:2710
__se_sys_bpf kernel/bpf/syscall.c:2672 [inline]
__x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:2672
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 3619:
save_stack+0x45/0xd0 mm/kasan/common.c:75
set_track mm/kasan/common.c:87 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:459
kasan_slab_free+0xe/0x10 mm/kasan/common.c:467
__cache_free mm/slab.c:3498 [inline]
kfree+0xcf/0x230 mm/slab.c:3821
__bpf_prog_free+0x87/0xc0 kernel/bpf/core.c:262
bpf_prog_unlock_free include/linux/filter.h:792 [inline]
bpf_prog_free_deferred kernel/bpf/core.c:1985 [inline]
bpf_prog_free_deferred+0x272/0x3e0 kernel/bpf/core.c:1969
process_one_work+0x98e/0x1790 kernel/workqueue.c:2269
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x357/0x430 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
The buggy address belongs to the object at ffff8881ccf38780
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 104 bytes inside of
512-byte region [ffff8881ccf38780, ffff8881ccf38980)
The buggy address belongs to the page:
page:ffffea000733ce00 count:1 mapcount:0 mapping:ffff8881da800940
index:0xffff8881ccf38a00
flags: 0x2fffc0000000200(slab)
raw: 02fffc0000000200 ffff8881da801738 ffffea00072adbc8 ffff8881da800940
raw: ffff8881ccf38a00 ffff8881ccf38000 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881ccf38680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ccf38700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881ccf38780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881ccf38800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ccf38880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: 1da6c4d9 bpf: fix use after free in bpf_evict_inode
git tree: bpf
console output: https://syzkaller.appspot.com/x/log.txt?x=17a0f643200000
kernel config: https://syzkaller.appspot.com/x/.config?x=2c0e2e5323f513ea
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Reply all
Reply to author
Forward
0 new messages