[syzbot] BUG: unable to handle kernel paging request in p9_client_disconnect

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a77d28d13789 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=113a41f9880000
kernel config: https://syzkaller.appspot.com/x/.config?x=c4c990190d758078
dashboard link: https://syzkaller.appspot.com/bug?extid=ea8b28e8dca42fc3bcbe
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7c4b04ddbeb3/disk-a77d28d1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3ecedb0cf6ca/vmlinux-a77d28d1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/44c59c4393c7/Image-a77d28d1.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ea8b28...@syzkaller.appspotmail.com

Unable to handle kernel paging request at virtual address 0032503900080052
Mem abort info:
ESR = 0x0000000096000044
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000044
CM = 0, WnR = 1
[0032503900080052] address between user and kernel address ranges
Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3127 Comm: syz-executor.1 Not tainted 6.1.0-rc6-syzkaller-32651-ga77d28d13789 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : p9_client_disconnect+0x1c/0x30 net/9p/client.c:1067
lr : p9_client_disconnect+0x18/0x30 net/9p/client.c:1065
sp : ffff800013c43ca0
x29: ffff800013c43ca0 x28: ffff0000f2cc8000 x27: 0000000000000000
x26: 00000000000000c0 x25: 0000000000000002 x24: ffff80000d3ad050
x23: ffff80000d3a9000 x22: 0000000000000000 x21: 0000000000000000
x20: ffff000105870300 x19: 3032503900080002 x18: 0000000000000369
x17: 53006964623d4d45 x16: ffff80000dc18158 x15: ffff0000f2cc8000
x14: 0000000000000008 x13: 00000000ffffffff x12: ffff0000f2cc8000
x11: ff8080000be9c0e0 x10: 0000000000000000 x9 : ffff80000be9c0e0
x8 : 0000000000000002 x7 : ffff80000c058c98 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0000f2cc8000 x1 : ffff80000cede3e6 x0 : 3032503900080002
Call trace:
p9_client_disconnect+0x1c/0x30
v9fs_session_cancel+0x20/0x30 fs/9p/v9fs.c:530
v9fs_kill_super+0x2c/0x50 fs/9p/vfs_super.c:225
deactivate_locked_super+0x70/0xe8 fs/super.c:332
deactivate_super+0xd0/0xd4 fs/super.c:363
cleanup_mnt+0x184/0x1c0 fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x100/0x148 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
do_notify_resume+0x174/0x1f0 arch/arm64/kernel/signal.c:1127
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x150 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
Code: 910003fd aa0003f3 9710261f 52800048 (b9005268)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 910003fd mov x29, sp
4: aa0003f3 mov x19, x0
8: 9710261f bl 0xfffffffffc409884
c: 52800048 mov w8, #0x2 // #2
* 10: b9005268 str w8, [x19, #80] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 247f34f7b803 Linux 6.1-rc2

git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

console output: https://syzkaller.appspot.com/x/log.txt?x=145dcb52480000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa9bed8d6a8992a0

dashboard link: https://syzkaller.appspot.com/bug?extid=ea8b28e8dca42fc3bcbe
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1360a90c480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1580e9e6480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/05f9a7fca332/disk-247f34f7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ec50c3ad7d48/vmlinux-247f34f7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1446f94b11ed/Image-247f34f7.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ea8b28...@syzkaller.appspotmail.com

Unable to handle kernel paging request at virtual address 0032503900080052
Mem abort info:
ESR = 0x0000000096000044
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000044
CM = 0, WnR = 1
[0032503900080052] address between user and kernel address ranges
Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 PID: 3076 Comm: syz-executor424 Not tainted 6.1.0-rc2-syzkaller-154433-g247f34f7b803 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : p9_client_disconnect+0x1c/0x30 net/9p/client.c:1067
lr : p9_client_disconnect+0x18/0x30 net/9p/client.c:1065

sp : ffff800012e43ca0
x29: ffff800012e43ca0 x28: ffff0000cb48cec0 x27: 0000000000000000
x26: 00000000000000c0 x25: 0000000000000002 x24: ffff80000d37d050
x23: ffff80000d379000 x22: 0000000000000000 x21: 0000000000000000
x20: ffff0000cc82cf00 x19: 3032503900080002 x18: 0000000000000035
x17: 4553006964623d4d x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: ffff0000c5860c18 x12: ffff0000ccb854d8
x11: ff8080000be7a520 x10: 0000000000000000 x9 : ffff80000be7a520
x8 : 0000000000000002 x7 : 0000000000000000 x6 : ffff80000c0374d8
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0000cb48cec0 x1 : 0000000000000000 x0 : 3032503900080002

Call trace:
p9_client_disconnect+0x1c/0x30
v9fs_session_cancel+0x20/0x30 fs/9p/v9fs.c:530
v9fs_kill_super+0x2c/0x50 fs/9p/vfs_super.c:225

deactivate_locked_super+0x70/0xe8 fs/super.c:331
deactivate_super+0xd0/0xd4 fs/super.c:362

cleanup_mnt+0x184/0x1c0 fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x100/0x148 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
do_notify_resume+0x174/0x1f0 arch/arm64/kernel/signal.c:1127
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]

el0_svc+0x9c/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: 910003fd aa0003f3 9710b2fd 52800048 (b9005268)

---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 910003fd mov x29, sp
4: aa0003f3 mov x19, x0

8: 9710b2fd bl 0xfffffffffc42cbfc

[Hillf Danton]

On 05 Jan 2023 21:38:48 -0800

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 247f34f7b803 Linux 6.1-rc2
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1580e9e6480000

Make v9ses->clnt valid after create.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 247f34f7b803

--- x/fs/9p/v9fs.c
+++ y/fs/9p/v9fs.c
@@ -408,6 +408,7 @@ struct p9_fid *v9fs_session_init(struct
v9ses->clnt = p9_client_create(dev_name, data);
if (IS_ERR(v9ses->clnt)) {
rc = PTR_ERR(v9ses->clnt);
+ v9ses->clnt = NULL;
p9_debug(P9_DEBUG_ERROR, "problem initializing 9p client\n");
goto err_names;
}
@@ -486,6 +487,7 @@ err_clnt:
kfree(v9ses->cachetag);
#endif
p9_client_destroy(v9ses->clnt);
+ v9ses->clnt = NULL;
err_names:
kfree(v9ses->uname);
kfree(v9ses->aname);
@@ -527,6 +529,8 @@ void v9fs_session_close(struct v9fs_sess
void v9fs_session_cancel(struct v9fs_session_info *v9ses)
{
p9_debug(P9_DEBUG_ERROR, "cancel session %p\n", v9ses);
+ if (!v9ses->clnt)
+ return;
p9_client_disconnect(v9ses->clnt);
}

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel paging request in p9_client_disconnect

Unable to handle kernel paging request at virtual address 0032503900080052
Mem abort info:
ESR = 0x0000000096000044
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000044
CM = 0, WnR = 1
[0032503900080052] address between user and kernel address ranges
Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
Modules linked in:

CPU: 0 PID: 3496 Comm: syz-executor.0 Not tainted 6.1.0-rc2-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : p9_client_disconnect+0x1c/0x30 net/9p/client.c:1067
lr : p9_client_disconnect+0x18/0x30 net/9p/client.c:1065

sp : ffff800010f83ca0
x29: ffff800010f83ca0 x28: ffff0000c684cec0 x27: 0000000000000000

x26: 00000000000000c0 x25: 0000000000000002 x24: ffff80000d37d050
x23: ffff80000d379000 x22: 0000000000000000 x21: 0000000000000000

x20: ffff0000cfaf5f00 x19: 3032503900080002 x18: 00000000000002aa
x17: ffff80000c0cd83c x16: 00000000000003fa x15: 0000000000000150
x14: 0000000001ef2008 x13: 0000000000000120 x12: 0000000000000000
x11: ff8080000be79558 x10: 0000000000000000 x9 : ffff80000be79558
x8 : 0000000000000002 x7 : 0000000000000000 x6 : ffff80000c036518

x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000

x2 : ffff0000c684cec0 x1 : 0000000000000000 x0 : 3032503900080002
Call trace:
p9_client_disconnect+0x1c/0x30
v9fs_session_cancel+0x2c/0x44 fs/9p/v9fs.c:534

v9fs_kill_super+0x2c/0x50 fs/9p/vfs_super.c:225
deactivate_locked_super+0x70/0xe8 fs/super.c:331
deactivate_super+0xd0/0xd4 fs/super.c:362
cleanup_mnt+0x184/0x1c0 fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x100/0x148 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
do_notify_resume+0x174/0x1f0 arch/arm64/kernel/signal.c:1127
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

Code: 910003fd aa0003f3 9710b6ef 52800048 (b9005268)

---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 910003fd mov x29, sp
4: aa0003f3 mov x19, x0

8: 9710b6ef bl 0xfffffffffc42dbc4

c: 52800048 mov w8, #0x2 // #2
* 10: b9005268 str w8, [x19, #80] <-- trapping instruction

Tested on:

commit: 247f34f7 Linux 6.1-rc2
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15b8a776480000

kernel config: https://syzkaller.appspot.com/x/.config?x=fa9bed8d6a8992a0
dashboard link: https://syzkaller.appspot.com/bug?extid=ea8b28e8dca42fc3bcbe
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=17c64f3a480000

[Hillf Danton]

On 05 Jan 2023 21:38:48 -0800

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 247f34f7b803 Linux 6.1-rc2
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

--- x/fs/9p/vfs_super.c
+++ y/fs/9p/vfs_super.c
@@ -197,6 +197,7 @@ free_session:
return ERR_PTR(retval);

release_sb:
+ goto clunk_fid;
/*
* we will do the session_close and root dentry release
* in the below call. But we need to clunk fid, because we haven't
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

BUG: unable to handle kernel paging request in percpu_ref_get_many

Unable to handle kernel paging request at virtual address 0000ffff64000000
Mem abort info:
ESR = 0x0000000096000004

EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:

ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010e408000
[0000ffff64000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3885 Comm: dhcpcd-run-hook Not tainted 6.1.0-rc2-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __ref_is_percpu include/linux/percpu-refcount.h:174 [inline]
pc : percpu_ref_get_many+0x64/0x140 include/linux/percpu-refcount.h:204
lr : rcu_read_lock include/linux/rcupdate.h:739 [inline]
lr : percpu_ref_get_many+0x2c/0x140 include/linux/percpu-refcount.h:202
sp : ffff800012ddba00
x29: ffff800012ddba00 x28: 0000000000000005 x27: 00000000fffffff8
x26: ffff80000d2de560 x25: ffff80000d37d050 x24: 0000000000000000
x23: ffff0001fefcc560 x22: 0000000000000001 x21: ffff0000d04e0080
x20: 0000ffff64000000 x19: 0000000000000001 x18: fffffffffffffff5
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000002 x12: 0000000000000701
x11: ff808000095d1078 x10: 0000000000000000 x9 : ffff80000d2dd658
x8 : 0000000100000000 x7 : 0000000000000000 x6 : ffff800008579b18
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000000 x1 : ffff80000ce888e3 x0 : 0000000000000001
Call trace:
rcu_read_lock include/linux/rcupdate.h:739 [inline]
percpu_ref_get_many+0x64/0x140 include/linux/percpu-refcount.h:202
percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
obj_cgroup_get include/linux/memcontrol.h:779 [inline]
refill_obj_stock+0x8c/0x254 mm/memcontrol.c:3327
obj_cgroup_uncharge+0x14/0x20 mm/memcontrol.c:3394
memcg_slab_free_hook+0x118/0x188 mm/slab.h:569
slab_free mm/slub.c:3656 [inline]
kmem_cache_free+0xd8/0x3a4 mm/slub.c:3683
vm_area_free+0x38/0xe8 kernel/fork.c:485
remove_vma mm/mmap.c:144 [inline]
exit_mmap+0x1f0/0x390 mm/mmap.c:3108
__mmput+0x90/0x204 kernel/fork.c:1185
mmput+0x64/0xa0 kernel/fork.c:1207
exit_mm+0x16c/0x1c0 kernel/exit.c:516
do_exit+0x264/0xcac kernel/exit.c:807
__arm64_sys_exit_group+0x0/0x18 kernel/exit.c:950
__do_sys_exit_group kernel/exit.c:961 [inline]
__se_sys_exit_group kernel/exit.c:959 [inline]
__wake_up_parent+0x0/0x40 kernel/exit.c:959
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636

el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

Code: 913af042 52805c81 39285909 97f0ad5f (f9400289)

---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):

0: 913af042 add x2, x2, #0xebc
4: 52805c81 mov w1, #0x2e4 // #740
8: 39285909 strb w9, [x8, #2582]
c: 97f0ad5f bl 0xffffffffffc2b588
* 10: f9400289 ldr x9, [x20] <-- trapping instruction

Tested on:

commit: 247f34f7 Linux 6.1-rc2
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=1695d26e480000

kernel config: https://syzkaller.appspot.com/x/.config?x=fa9bed8d6a8992a0
dashboard link: https://syzkaller.appspot.com/bug?extid=ea8b28e8dca42fc3bcbe
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=1606acd2480000

[Hillf Danton]

On 05 Jan 2023 21:38:48 -0800

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 247f34f7b803 Linux 6.1-rc2
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

--- x/mm/mmap.c
+++ y/mm/mmap.c
@@ -3102,13 +3102,13 @@ void exit_mmap(struct mm_struct *mm)
* enabled, without holding any MM locks besides the unreachable
* mmap_write_lock.
*/
- do {
+ while ((vma = mas_find(&mas, ULONG_MAX)) != NULL) {
if (vma->vm_flags & VM_ACCOUNT)
nr_accounted += vma_pages(vma);
remove_vma(vma);
count++;
cond_resched();
- } while ((vma = mas_find(&mas, ULONG_MAX)) != NULL);
+ }

BUG_ON(count != mm->map_count);

--

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

_idle_ns: 19112604462750000 ns
[ 0.145941][ T1] futex hash table entries: 512 (order: 4, 65536 bytes, linear)
[ 0.153846][ T12] Callback from call_rcu_tasks_trace() invoked.
[ 0.162653][ T1] SMBIOS 3.4.0 present.
[ 0.162677][ T1] DMI: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 0.165306][ T1] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.167194][ T1] DMA: preallocated 1024 KiB GFP_KERNEL pool for atomic allocations
[ 0.167351][ T1] DMA: preallocated 1024 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[ 0.168428][ T1] DMA: preallocated 1024 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[ 0.168529][ T1] audit: initializing netlink subsys (disabled)
[ 0.168770][ T26] audit: type=2000 audit(0.160:1): state=initialized audit_enabled=0 res=1
[ 0.173355][ T1] thermal_sys: Registered thermal governor 'step_wise'
[ 0.173365][ T1] thermal_sys: Registered thermal governor 'power_allocator'
[ 0.173462][ T1] cpuidle: using governor menu
[ 0.173489][ T1] NET: Registered PF_QIPCRTR protocol family
[ 0.173821][ T1] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[ 0.173920][ T1] ASID allocator initialised with 65536 entries
[ 0.173945][ T1] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
[ 0.174119][ T1] Serial: AMBA PL011 UART driver
[ 0.267352][ T1] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
[ 0.267362][ T1] HugeTLB: 16380 KiB vmemmap can be freed for a 1.00 GiB page
[ 0.267372][ T1] HugeTLB: registered 32.0 MiB page size, pre-allocated 0 pages
[ 0.267380][ T1] HugeTLB: 508 KiB vmemmap can be freed for a 32.0 MiB page
[ 0.267389][ T1] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[ 0.267396][ T1] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[ 0.267406][ T1] HugeTLB: registered 64.0 KiB page size, pre-allocated 0 pages
[ 0.267413][ T1] HugeTLB: 0 KiB vmemmap can be freed for a 64.0 KiB page
[ 0.435009][ T11] Callback from call_rcu_tasks() invoked.
[ 0.435038][ T1] raid6: neonx8 gen() 6167 MB/s
[ 0.605099][ T1] raid6: neonx4 gen() 5716 MB/s
[ 0.775312][ T1] raid6: neonx2 gen() 5058 MB/s
[ 0.945507][ T1] raid6: neonx1 gen() 3461 MB/s
[ 1.115682][ T1] raid6: int64x8 gen() 4604 MB/s
[ 1.285876][ T1] raid6: int64x4 gen() 4521 MB/s
[ 1.456022][ T1] raid6: int64x2 gen() 2718 MB/s
[ 1.626187][ T1] raid6: int64x1 gen() 1947 MB/s
[ 1.626196][ T1] raid6: using algorithm neonx8 gen() 6167 MB/s
[ 1.796401][ T1] raid6: .... xor() 3991 MB/s, rmw enabled
[ 1.796408][ T1] raid6: using neon recovery algorithm
[ 1.797126][ T1] ACPI: Added _OSI(Module Device)
[ 1.797136][ T1] ACPI: Added _OSI(Processor Device)
[ 1.797145][ T1] ACPI: Added _OSI(3.0 _SCP Extensions)
[ 1.797155][ T1] ACPI: Added _OSI(Processor Aggregator Device)
[ 1.804470][ T1] ACPI: 2 ACPI AML tables successfully acquired and loaded
[ 1.807824][ T1] ACPI: Interpreter enabled
[ 1.807830][ T1] ACPI: Using GIC for interrupt routing
[ 1.807911][ T1] ACPI: MCFG table detected, 1 entries
[ 1.822240][ T1] ARMH0011:00: ttyAMA0 at MMIO 0x9000000 (irq = 12, base_baud = 0) is a SBSA
[ 2.114413][ T1] printk: console [ttyAMA0] enabled
[ 2.118289][ T1] ARMH0011:01: ttyAMA1 at MMIO 0x9001000 (irq = 13, base_baud = 0) is a SBSA
[ 2.122577][ T1] ARMH0011:02: ttyAMA2 at MMIO 0x9002000 (irq = 14, base_baud = 0) is a SBSA
[ 2.126853][ T1] ARMH0011:03: ttyAMA3 at MMIO 0x9003000 (irq = 15, base_baud = 0) is a SBSA
[ 2.131890][ T1] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-0f])
[ 2.133622][ T1] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3]
[ 2.136536][ T1] acpi PNP0A08:00: _OSC: platform does not support [LTR]
[ 2.139330][ T1] acpi PNP0A08:00: _OSC: OS now controls [PCIeHotplug PME AER PCIeCapability]
[ 2.142523][ T1] acpi PNP0A08:00: ECAM area [mem 0x3f000000-0x3fffffff] reserved by PNP0C02:00
[ 2.144915][ T1] acpi PNP0A08:00: ECAM at [mem 0x3f000000-0x3fffffff] for [bus 00-0f]
[ 2.146937][ T1] ACPI: Remapped I/O 0x000000003eff0000 to [io 0x0000-0xffff window]
[ 2.149516][ T1] PCI host bridge to bus 0000:00
[ 2.150611][ T1] pci_bus 0000:00: root bus resource [mem 0x10000000-0x3efeffff window]
[ 2.152451][ T1] pci_bus 0000:00: root bus resource [io 0x0000-0xffff window]
[ 2.154158][ T1] pci_bus 0000:00: root bus resource [mem 0x8000000000-0xffffffffff window]
[ 2.156180][ T1] pci_bus 0000:00: root bus resource [bus 00-0f]
[ 2.158027][ T1] pci 0000:00:00.0: [1ae0:0042] type 00 class 0x020000
[ 2.162051][ T1] pci 0000:00:00.0: reg 0x10: [mem 0x10203000-0x10203fff]
[ 2.164772][ T1] pci 0000:00:00.0: reg 0x14: [mem 0x10202000-0x1020203f]
[ 2.167519][ T1] pci 0000:00:00.0: reg 0x18: [mem 0x10100000-0x101fffff]
[ 2.169988][ T1] pci 0000:00:01.0: [1af4:1005] type 00 class 0x00ff00
[ 2.174885][ T1] pci 0000:00:01.0: reg 0x10: [io 0x0000-0x001f]
[ 2.178422][ T1] pci 0000:00:01.0: reg 0x14: [mem 0x10201000-0x1020103f]
[ 2.187023][ T1] pci 0000:00:02.0: [1ae0:001f] type 00 class 0x010802
[ 2.195507][ T1] pci 0000:00:02.0: reg 0x10: [mem 0x10000000-0x10003fff 64bit]
[ 2.201196][ T1] pci 0000:00:02.0: reg 0x20: [mem 0x10200000-0x1020003f]
[ 2.205888][ T1] pci 0000:00:00.0: BAR 2: assigned [mem 0x10000000-0x100fffff]
[ 2.208238][ T1] pci 0000:00:02.0: BAR 0: assigned [mem 0x8000000000-0x8000003fff 64bit]
[ 2.212164][ T1] pci 0000:00:00.0: BAR 0: assigned [mem 0x10100000-0x10100fff]
[ 2.214485][ T1] pci 0000:00:00.0: BAR 1: assigned [mem 0x10101000-0x1010103f]
[ 2.216701][ T1] pci 0000:00:01.0: BAR 1: assigned [mem 0x10101040-0x1010107f]
[ 2.219099][ T1] pci 0000:00:02.0: BAR 4: assigned [mem 0x10101080-0x101010bf]
[ 2.221381][ T1] pci 0000:00:01.0: BAR 0: assigned [io 0x1000-0x101f]
[ 2.223779][ T1] pci_bus 0000:00: resource 4 [mem 0x10000000-0x3efeffff window]
[ 2.225489][ T1] pci_bus 0000:00: resource 5 [io 0x0000-0xffff window]
[ 2.227050][ T1] pci_bus 0000:00: resource 6 [mem 0x8000000000-0xffffffffff window]
[ 2.229280][ T1] ACPI: PCI: Interrupt link GSI0 configured for IRQ 35
[ 2.230931][ T1] ACPI: PCI: Interrupt link GSI1 configured for IRQ 36
[ 2.232544][ T1] ACPI: PCI: Interrupt link GSI2 configured for IRQ 37
[ 2.234175][ T1] ACPI: PCI: Interrupt link GSI3 configured for IRQ 38
[ 2.236654][ T1] iommu: Default domain type: Translated
[ 2.237970][ T1] iommu: DMA domain TLB invalidation policy: strict mode
[ 2.240686][ T1] SCSI subsystem initialized
[ 2.247822][ T1] ACPI: bus type USB registered
[ 2.249117][ T1] usbcore: registered new interface driver usbfs
[ 2.250631][ T1] usbcore: registered new interface driver hub
[ 2.252080][ T1] usbcore: registered new device driver usb
[ 2.253854][ T1] mc: Linux media interface: v0.10
[ 2.255083][ T1] videodev: Linux video capture interface: v2.00
[ 2.256625][ T1] pps_core: LinuxPPS API ver. 1 registered
[ 2.257922][ T1] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giom...@linux.it>
[ 2.260272][ T1] PTP clock support registered
[ 2.261702][ T1] EDAC MC: Ver: 3.0.0
[ 2.263527][ T1] Registered efivars operations
[ 2.267725][ T1] Advanced Linux Sound Architecture Driver Initialized.
[ 2.275977][ T1] Bluetooth: Core ver 2.22
[ 2.277053][ T1] NET: Registered PF_BLUETOOTH protocol family
[ 2.278430][ T1] Bluetooth: HCI device and connection manager initialized
[ 2.281883][ T1] Bluetooth: HCI socket layer initialized
[ 2.283177][ T1] Bluetooth: L2CAP socket layer initialized
[ 2.284536][ T1] Bluetooth: SCO socket layer initialized
[ 2.285863][ T1] NET: Registered PF_ATMPVC protocol family
[ 2.287177][ T1] NET: Registered PF_ATMSVC protocol family
[ 2.288601][ T1] NetLabel: Initializing
[ 2.289545][ T1] NetLabel: domain hash size = 128
[ 2.290692][ T1] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
[ 2.292282][ T1] NetLabel: unlabeled traffic allowed by default
[ 2.294406][ T1] nfc: nfc_init: NFC Core ver 0.1
[ 2.295626][ T1] NET: Registered PF_NFC protocol family
[ 2.297230][ T1] vgaarb: loaded
[ 2.298450][ T1] clocksource: Switched to clocksource arch_sys_counter
[ 2.300886][ T1] VFS: Disk quotas dquot_6.6.0
[ 2.302050][ T1] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[ 2.304109][ T1] FS-Cache: Loaded
[ 2.305439][ T1] CacheFiles: Loaded
[ 2.306559][ T1] TOMOYO: 2.6.0
[ 2.307343][ T1] Mandatory Access Control activated.
[ 2.308814][ T1] pnp: PnP ACPI init
[ 2.310414][ T1] system 00:00: [mem 0x3f000000-0x3fffffff window] could not be reserved
[ 2.312652][ T1] pnp: PnP ACPI: found 1 devices
[ 2.328790][ T1] NET: Registered PF_INET protocol family
[ 2.330287][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 2.334837][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 6, 294912 bytes, linear)
[ 2.337070][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 2.339191][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 2.343832][ T1] TCP bind hash table entries: 65536 (order: 11, 9437184 bytes, vmalloc)
[ 2.347508][ T1] TCP: Hash tables configured (established 65536 bind 65536)
[ 2.349781][ T1] MPTCP token hash table entries: 8192 (order: 7, 720896 bytes, linear)
[ 2.352221][ T1] UDP hash table entries: 4096 (order: 7, 655360 bytes, linear)
[ 2.354420][ T1] UDP-Lite hash table entries: 4096 (order: 7, 655360 bytes, linear)
[ 2.356557][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 2.358770][ T1] RPC: Registered named UNIX socket transport module.
[ 2.360302][ T1] RPC: Registered udp transport module.
[ 2.361528][ T1] RPC: Registered tcp transport module.
[ 2.362754][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 2.365056][ T1] NET: Registered PF_XDP protocol family
[ 2.366399][ T1] PCI: CLS 0 bytes, default 64
[ 2.367541][ T1] ACPI: bus type thunderbolt registered
[ 2.369586][ T1] kvm [1]: HYP mode not available
[ 2.372486][ T54] ------------[ cut here ]------------
[ 2.373725][ T54] kernel BUG at mm/mmap.c:3113!
[ 2.374836][ T54] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[ 2.376532][ T54] Modules linked in:
[ 2.377394][ T54] CPU: 1 PID: 54 Comm: kworker/u4:1 Not tainted 6.1.0-rc2-syzkaller-dirty #0
[ 2.378680][ T56] ------------[ cut here ]------------
[ 2.379407][ T54] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 2.380637][ T56] kernel BUG at mm/mmap.c:3113!
[ 2.383014][ T54] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 2.385925][ T54] pc : exit_mmap+0x384/0x3b8
[ 2.386997][ T54] lr : exit_mmap+0x384/0x3b8
[ 2.388046][ T54] sp : ffff80000f743c80
[ 2.388995][ T54] x29: ffff80000f743d50 x28: 0000000000000008 x27: 0000000000000000
[ 2.390858][ T54] x26: ffff0000c0e6cec0 x25: 0000000000000000 x24: ffff80000cbe686a
[ 2.392727][ T54] x23: 00000000fffffffe x22: 0000000000000001 x21: 0000000000000000
[ 2.394598][ T54] x20: ffff0000c0e140d8 x19: ffff0000c0e14000 x18: 00000000000000c0
[ 2.396453][ T54] x17: ffff80000dda9198 x16: 0000000000000000 x15: 0000000000000000
[ 2.398296][ T54] x14: 0000000000000000 x13: 0000000000000002 x12: ffff80000d93a6a8
[ 2.400164][ T54] x11: ff80800008497ac4 x10: 0000000000000000 x9 : ffff800008497ac4
[ 2.402002][ T54] x8 : ffff0000c0e6cec0 x7 : ffff8000084c08bc x6 : 0000000000000000
[ 2.403846][ T54] x5 : ffff80000dff9ad0 x4 : 0000000000000000 x3 : 0000000000000000
[ 2.405671][ T54] x2 : ffffffffffffffff x1 : 0000000000000001 x0 : 0000000000000000
[ 2.407536][ T54] Call trace:
[ 2.408290][ T54] exit_mmap+0x384/0x3b8
[ 2.409269][ T54] __mmput+0x90/0x204
[ 2.410190][ T54] mmput+0x64/0xa0
[ 2.411070][ T54] free_bprm+0xac/0x19c
[ 2.412027][ T54] kernel_execve+0x4ec/0x540
[ 2.413089][ T54] call_usermodehelper_exec_async+0x10c/0x214
[ 2.414481][ T54] ret_from_fork+0x10/0x20
[ 2.415496][ T54] Code: aa1303e0 97ff561d 17ffff64 97f83d94 (d4210000)
[ 2.417094][ T54] ---[ end trace 0000000000000000 ]---
[ 2.418343][ T54] Kernel panic - not syncing: Oops - BUG: Fatal exception
[ 2.420007][ T54] SMP: stopping secondary CPUs
[ 3.500390][ T54] SMP: failed to stop secondary CPUs 0-1
[ 3.501773][ T54] Kernel Offset: disabled
[ 3.502802][ T54] CPU features: 0x00000,02070084,26017203
[ 3.504126][ T54] Memory Limit: none
[ 3.505051][ T54] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build4137696923=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at 1dac8c7a0
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1dac8c7a01e2bdd35cb04eb4901ddb157291ac2d -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230103-123455'" "-tags=syz_target syz_os_linux syz_arch_arm64 " -o ./bin/linux_arm64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1dac8c7a01e2bdd35cb04eb4901ddb157291ac2d -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230103-123455'" "-tags=syz_target syz_os_linux syz_arch_arm64 " -o ./bin/linux_arm64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=arm64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1dac8c7a01e2bdd35cb04eb4901ddb157291ac2d -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230103-123455'" "-tags=syz_target syz_os_linux syz_arch_arm64 " -o ./bin/linux_arm64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_arm64
aarch64-linux-gnu-gcc -o ./bin/linux_arm64/syz-executor executor/executor.cc \
-O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_arm64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"1dac8c7a01e2bdd35cb04eb4901ddb157291ac2d\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=14f971d6480000

Tested on:

commit: 247f34f7 Linux 6.1-rc2
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=fa9bed8d6a8992a0
dashboard link: https://syzkaller.appspot.com/bug?extid=ea8b28e8dca42fc3bcbe
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=10ccfc6c480000

[Hillf Danton]

On 05 Jan 2023 21:38:48 -0800

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 247f34f7b803 Linux 6.1-rc2
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

@@ -3078,6 +3078,7 @@ void exit_mmap(struct mm_struct *mm)
mmap_read_unlock(mm);
return;
}
+ count++;

lru_add_drain();
flush_cache_mm(mm);
@@ -3102,13 +3103,13 @@ void exit_mmap(struct mm_struct *mm)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

BUG: unable to handle kernel paging request in rhltable_lookup

Unable to handle kernel paging request at virtual address ffff00082200ccf8
Mem abort info:
ESR = 0x0000000096000005

EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0

FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005

CM = 0, WnR = 0

swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001c54db000
[ffff00082200ccf8] pgd=180000023fff8003, p4d=180000023fff8003, pud=0000000000000000
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 13 Comm: kworker/0:1 Not tainted 6.1.0-rc2-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Workqueue: ipv6_addrconf addrconf_dad_work
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : rht_ptr_rcu include/linux/rhashtable.h:369 [inline]
pc : __rhashtable_lookup include/linux/rhashtable.h:599 [inline]
pc : rhltable_lookup+0xd4/0x398 include/linux/rhashtable.h:688
lr : rht_bucket include/linux/rhashtable.h:290 [inline]
lr : __rhashtable_lookup include/linux/rhashtable.h:597 [inline]
lr : rhltable_lookup+0xc8/0x398 include/linux/rhashtable.h:688
sp : ffff800008003d60
x29: ffff800008003d80 x28: ffff80000d95e000 x27: 0000000000000000
x26: 0000000000000002 x25: 0000000000000000 x24: ffff00082200ccf8
x23: ffff80000d95e000 x22: ffff00082200ccf9 x21: ffff0000c920b800
x20: ffff0000c93597b0 x19: ffff0000cb81b834 x18: 00000000000000c9
x17: ffff8001f1cee000 x16: 0000000000000101 x15: 0000000000000100
x14: 0000000000000000 x13: 000000000000000c x12: ffff80000d65f7d0
x11: ff8080000bce0278 x10: 0000000000000000 x9 : ffff80000bce0278
x8 : ffff00082200cc78 x7 : 0000000000000000 x6 : ffff80000bcd9c94

x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002

x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
rhltable_lookup+0xd4/0x398 include/linux/rhashtable.h:688
sta_info_hash_lookup net/mac80211/sta_info.c:195 [inline]
sta_info_get_by_addrs+0x64/0xf8 net/mac80211/sta_info.c:320
ieee80211_tx_status+0xd8/0x1ac net/mac80211/status.c:1096
ieee80211_tasklet_handler+0x5c/0x110 net/mac80211/main.c:319
tasklet_action_common+0x1d4/0x248
tasklet_action+0x30/0x3c kernel/softirq.c:818
_stext+0x168/0x37c
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:889
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84
do_softirq+0xac/0x108 kernel/softirq.c:472
__local_bh_enable_ip+0x18c/0x1a4 kernel/softirq.c:396
local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33
rcu_read_unlock_bh include/linux/rcupdate.h:808 [inline]
ip6_finish_output2+0xa1c/0xbec net/ipv6/ip6_output.c:135
__ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
ip6_finish_output+0x448/0x4c4 net/ipv6/ip6_output.c:206
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x180/0x2dc net/ipv6/ip6_output.c:227
dst_output include/net/dst.h:445 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ndisc_send_skb+0x6d8/0xa18 net/ipv6/ndisc.c:508
ndisc_send_ns+0x7c/0xf0 net/ipv6/ndisc.c:666
addrconf_dad_work+0x2c8/0x504 net/ipv6/addrconf.c:4171
process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
worker_thread+0x340/0x610 kernel/workqueue.c:2436
kthread+0x12c/0x158 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Code: 97171ba7 8b384ea8 91020118 b2400316 (f940031a)

---[ end trace 0000000000000000 ]---

----------------
Code disassembly (best guess):

0: 97171ba7 bl 0xfffffffffc5c6e9c
4: 8b384ea8 add x8, x21, w24, uxtw #3
8: 91020118 add x24, x8, #0x80
c: b2400316 orr x22, x24, #0x1
* 10: f940031a ldr x26, [x24] <-- trapping instruction

Tested on:

commit: 247f34f7 Linux 6.1-rc2
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=14cef5e6480000

kernel config: https://syzkaller.appspot.com/x/.config?x=fa9bed8d6a8992a0
dashboard link: https://syzkaller.appspot.com/bug?extid=ea8b28e8dca42fc3bcbe
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=17c87de6480000

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.