WARNING in bpf_jit_free

54 views

Skip to first unread message

syzbot

unread,

Jul 16, 2018, 11:18:03 AM7/16/18

to a...@kernel.org, dan...@iogearbox.net, linux-...@vger.kernel.org, net...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot found the following crash on:

HEAD commit: 9d3cce1e8b85 Linux 4.18-rc5
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1127970c400000
kernel config: https://syzkaller.appspot.com/x/.config?x=6d0ccc9273f0e539
dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2ff1e7...@syzkaller.appspotmail.com

WARNING: CPU: 0 PID: 12000 at kernel/bpf/core.c:628 bpf_jit_free+0x2e5/0x3f0
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
panic+0x238/0x4e7 kernel/panic.c:184
__warn.cold.8+0x163/0x1ba kernel/panic.c:536
report_bug+0x252/0x2d0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:bpf_jit_free+0x2e5/0x3f0
Code: 07 38 c8 7f 08 84 c0 0f 85 85 00 00 00 48 b8 00 02 00 00 00 00 ad de
44 0f b6 63 02 48 39 c2 0f 84 d9 fd ff ff e8 db a3 f3 ff <0f> 0b e9 cd fd
ff ff e8 cf a3 f3 ff 4c 89 f0 48 ba 00 00 00 00 00
RSP: 0018:ffff880194267640 EFLAGS: 00010293
RAX: ffff8801aa76e6c0 RBX: ffffc9000192e000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff81886765 RDI: ffff8801d9223768
RBP: ffff8801942676d8 R08: ffff8801aa76eef8 R09: 0000000000000006
R10: ffff8801aa76e6c0 R11: 0000000000000000 R12: 000000000000000f
R13: 1ffff1003284ceca R14: ffffc9000192e002 R15: ffffc9000192e020
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#1] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194266f80 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff8801942670f8 R08: ffff8801aa76e6c0 R09: ffffed003b5c46d6
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#2] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194266818 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194266990 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#3] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801942660a8 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194266220 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#4] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194265938 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194265ab0 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#5] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801942651c8 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194265340 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#6] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194264a58 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194264bd0 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#7] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801942642e8 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194264460 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#8] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194263b78 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194263cf0 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#9] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194263408 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194263580 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#10] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194262c98 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194262e10 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#11] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194262528 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff8801942626a0 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#12] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194261db8 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194261f30 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#13] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194261648 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff8801942617c0 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Oops: 0000 [#14] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x2f8/0x4c0 kernel/bpf/core.c:509
Code: e7 f3 ff 0f 0b e8 38 e7 f3 ff 4c 89 e6 4c 89 ef e8 dd e7 f3 ff 4d 39
e5 0f 82 a0 00 00 00 e8 1f e7 f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 4e 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff880194260ed8 EFLAGS: 00010806
RAX: 1ffffffff4002000 RBX: ffff8801d9223730 RCX: ffffffff81882413
RDX: 0000000000000000 RSI: ffffffff81882421 RDI: 0000000000000006
RBP: ffff880194261050 R08: ffff8801aa76e6c0 R09: 0000000000000001
R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: ffffffffa0010000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801d9223730
FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff4002000 CR3: 00000001817e0000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4002000
PGD 21fbea067 P4D 21fbea067 PUD 21fa5e067 PMD 1c4b80067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#15] SMP KASAN
CPU: 0 PID: 12000 Comm: kworker/0:5 Not tainted 4.18.0-rc5+ #149
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
usercopy: Kernel memory overwrite attempt detected to process stack (offset
0, size 8)!
usercopy: Kernel memory overwrite attempt detected to SLAB
object 'kmalloc-4096' (offset 4120, size 2)!
------------[ cut here ]------------

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

Dmitry Vyukov

unread,

Jul 18, 2018, 7:56:58 AM7/18/18

to Daniel Borkmann, Alexei Starovoitov, syzkaller-bugs

On Wed, Jul 18, 2018 at 1:44 PM, Daniel Borkmann <dan...@iogearbox.net> wrote:
> Hi Dmitry,

>
> On 07/16/2018 05:18 PM, syzbot wrote:
>> Hello,
>>
>> syzbot found the following crash on:
>>
>> HEAD commit: 9d3cce1e8b85 Linux 4.18-rc5
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1127970c400000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=6d0ccc9273f0e539
>> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113
>> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>>
>> Unfortunately, I don't have any reproducer for this crash yet.
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: syzbot+2ff1e7...@syzkaller.appspotmail.com
>>
>> WARNING: CPU: 0 PID: 12000 at kernel/bpf/core.c:628 bpf_jit_free+0x2e5/0x3f0
>> Kernel panic - not syncing: panic_on_warn set ...
>

> Any chance you have some more info or even a reproducer on this one?
> I'll see to do some experiments towards end of this week, perhaps by
> then syzkaller managed again to trigger it.

Hi Daniel,

I don't have any info on top of what's available on the dashboard.

It can be an induced crash due to that bpf map bug too. I don't know
if the fix was already present in the tree or not, but that bug now
causes long tail of assorted one-time induced crashes.

syzbot

unread,

Sep 7, 2018, 7:23:04 PM9/7/18

to a...@kernel.org, dan...@iogearbox.net, linux-...@vger.kernel.org, net...@vger.kernel.org, syzkall...@googlegroups.com

syzbot has found a reproducer for the following crash on:

HEAD commit: 28619527b8a7 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: bpf
console output: https://syzkaller.appspot.com/x/log.txt?x=1339498e400000
kernel config: https://syzkaller.appspot.com/x/.config?x=62e9b447c16085cf

dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=163cc149400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2ff1e7...@syzkaller.appspotmail.com

IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
8021q: adding VLAN 0 to HW filter on device team0
WARNING: CPU: 0 PID: 5391 at kernel/bpf/core.c:628 bpf_jit_free+0x2e5/0x3f0

Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113

panic+0x238/0x4e7 kernel/panic.c:184
__warn.cold.8+0x163/0x1ba kernel/panic.c:536

report_bug+0x254/0x2d0 lib/bug.c:186

fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316

invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:993

RIP: 0010:bpf_jit_free+0x2e5/0x3f0
Code: 07 38 c8 7f 08 84 c0 0f 85 85 00 00 00 48 b8 00 02 00 00 00 00 ad de

44 0f b6 63 02 48 39 c2 0f 84 d9 fd ff ff e8 8b 4b f3 ff <0f> 0b e9 cd fd
ff ff e8 7f 4b f3 ff 4c 89 f0 48 ba 00 00 00 00 00
RSP: 0018:ffff8801b77bf648 EFLAGS: 00010293
RAX: ffff8801d8730500 RBX: ffffc9000192c000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff818b83a5 RDI: ffff8801cdcea6e8
RBP: ffff8801b77bf6e0 R08: ffff8801d8730dc8 R09: 0000000000000006
R10: 0000000000000000 R11: ffff8801d8730500 R12: 000000000000000f
R13: 1ffff10036ef7ecb R14: ffffc9000192c002 R15: ffffc9000192c020
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77bef80 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77bf0f8 R08: ffff8801d8730500 R09: ffffed003b5c4732
R10: ffffed003b5c4732 R11: ffff8801dae23993 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#2] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77be828 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77be9a0 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#3] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77be0c8 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77be240 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#4] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77bd968 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77bdae0 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#5] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77bd208 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77bd380 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#6] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77bcaa8 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77bcc20 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#7] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77bc348 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77bc4c0 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#8] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77bbbe8 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77bbd60 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#9] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77bb488 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77bb600 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#10] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77bad28 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77baea0 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#11] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77ba5c8 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77ba740 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#12] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77b9e68 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77b9fe0 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0
Oops: 0000 [#13] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77b9708 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77b9880 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Thread overran stack, or stack corrupted

Oops: 0000 [#14] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77b8fa8 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77b9120 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Thread overran stack, or stack corrupted

Oops: 0000 [#15] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77b8848 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77b89c0 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
==================================================================
BUG: KASAN: slab-out-of-bounds in do_error_trap+0x3b6/0x4d0
arch/x86/kernel/traps.c:296
Read of size 8 at addr ffff8801b77b7430 by task kworker/0:0/5391

CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
Call Trace:

BUG: unable to handle kernel paging request at fffffbfff4004000
PGD 21ffec067 P4D 21ffec067 PUD 21fe60067 PMD 1c1a04067 PTE 0

Thread overran stack, or stack corrupted

Oops: 0000 [#16] PREEMPT SMP KASAN
CPU: 0 PID: 5391 Comm: kworker/0:0 Not tainted 4.19.0-rc2+ #50

RIP: 0010:bpf_prog_kallsyms_find+0x2fe/0x4a0 kernel/bpf/core.c:509
Code: 8e f3 ff 4c 8b ad b0 fe ff ff 4c 89 e6 4c 89 ef e8 47 8f f3 ff 4d 39
e5 0f 82 a7 00 00 00 e8 89 8e f3 ff 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 30
84 c0 74 08 3c 03 0f 8e 35 01 00 00 41 8b 04 24 4c
RSP: 0018:ffff8801b77b6e58 EFLAGS: 00010806
RAX: 1ffffffff4004000 RBX: ffff8801cdcea6b0 RCX: ffffffff818b4099
RDX: 0000000000000000 RSI: ffffffff818b40a7 RDI: 0000000000000006
RBP: ffff8801b77b6fd0 R08: ffff8801d8730500 R09: 0000000000000001
R10: ffffed003b5c4732 R11: 0000000000000000 R12: ffffffffa0020000
R13: ffffffffffffffff R14: dffffc0000000000 R15: ffff8801cdcea6b0

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0
Call Trace:
Modules linked in:
Dumping ftrace buffer:
(ftrace buffer empty)
CR2: fffffbfff4004000
---[ end trace 89eec6ca57f730dc ]---

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:384 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4004000 CR3: 000000000946a000 CR4: 00000000001406f0

syzbot

unread,

Mar 31, 2019, 2:20:01 PM3/31/19

to air...@linux.ie, a...@kernel.org, b...@vger.kernel.org, dan...@ffwll.ch, dan...@iogearbox.net, da...@davemloft.net, dri-...@lists.freedesktop.org, ha...@kernel.org, jakub.k...@netronome.com, john.fa...@gmail.com, ka...@fb.com, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org, maxime...@bootlin.com, net...@vger.kernel.org, paul.koc...@bootlin.com, songliu...@fb.com, syzkall...@googlegroups.com, we...@csie.org, xdp-n...@vger.kernel.org, y...@fb.com

syzbot has bisected this bug to:

commit 0fff724a33917ac581b5825375d0b57affedee76
Author: Paul Kocialkowski <paul.koc...@bootlin.com>
Date: Fri Jan 18 14:51:13 2019 +0000

drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000
start commit: 0e40da3e Merge tag 'kbuild-fixes-v5.1' of git://git.kernel..
git tree: upstream
final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000
console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000
kernel config: https://syzkaller.appspot.com/x/.config?x=8dcdce25ea72bedf
dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16973653200000

Reported-by: syzbot+2ff1e7...@syzkaller.appspotmail.com
Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for
packed YUV422 check")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

syzbot

unread,

Apr 1, 2019, 6:48:01 AM4/1/19

to dan...@iogearbox.net, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer still triggered
crash:
WARNING in bpf_jit_free

WARNING: CPU: 0 PID: 2852 at kernel/bpf/core.c:854 bpf_jit_free+0x20a/0x2c0

Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x2cb/0x65c kernel/panic.c:214
BUG: unable to handle kernel paging request at fffffbfff4003000
#PF error: [normal kernel read fault]
PGD 21ffee067 P4D 21ffee067 PUD 21ffed067 PMD 969c2067 PTE 0

Oops: 0000 [#1] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda7850 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda7890 R08: ffff88809ffc82c0 R09: ffffed1015d05bc8
R10: ffffed1015d05bc7 R11: ffff8880ae82de3b R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffffff R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: fffffbfff4003000 CR3: 000000008275e000 CR4: 00000000001406f0
Call Trace:
BUG: unable to handle kernel paging request at fffffbfff4003000
#PF error: [normal kernel read fault]
PGD 21ffee067 P4D 21ffee067 PUD 21ffed067 PMD 969c2067 PTE 0

Oops: 0000 [#2] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda7318 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda7358 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffffff R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#3] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda6dd8 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda6e18 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#4] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda6898 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda68d8 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#5] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda6358 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda6398 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#6] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda5e18 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda5e58 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#7] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda58d8 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda5918 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#8] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda5398 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda53d8 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#9] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda4e58 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda4e98 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#10] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda4918 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda4958 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#11] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda43d8 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda4418 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#12] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda3e98 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda3ed8 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#13] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda3958 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda3998 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#14] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda3418 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda3458 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#15] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda2ed8 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda2f18 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Oops: 0000 [#16] PREEMPT SMP KASAN

CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda2998 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda29d8 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda2458 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda2498 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda1f18 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda1f58 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda19d8 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda1a18 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda1498 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda14d8 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred

RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:539 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:602 [inline]

RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]

RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:676 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x1a0/0x2c0 kernel/bpf/core.c:669
Code: 75 07 e8 23 11 f5 ff 0f 0b e8 1c 11 f5 ff 48 89 de 4c 89 f7 e8 31 12
f5 ff 49 39 de 72 71 e8 07 11 f5 ff 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 74 08 3c 03 0f 8e e6 00 00 00 8b 33 4c 89 f7
RSP: 0018:ffff88809fda0f58 EFLAGS: 00010806
RAX: 1ffffffff4003000 RBX: ffffffffa0018000 RCX: ffffffff817b531f
RDX: 0000000000000000 RSI: ffffffff817b5329 RDI: 0000000000000006
RBP: ffff88809fda0f98 R08: ffff88809ffc82c0 R09: 0000000000000001
R10: ffffed1015d05bc7 R11: ffff88809ffc82c0 R12: ffff88808f2b1d78
R13: dffffc0000000000 R14: ffffffffffffff01 R15: ffff88808f2b1d78
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Thread overran stack, or stack corrupted

Oops: 0000 [#22] PREEMPT SMP KASAN
CPU: 0 PID: 2852 Comm: kworker/0:2 Not tainted 5.0.0+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

Tested on:

commit: 8c062e53 bpf, test: fix kallsyms
git tree:
git://git.kernel.org/pub/scm/linux/kernel/git/dborkman/bpf.git kallsyms
console output: https://syzkaller.appspot.com/x/log.txt?x=101d384b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=f05902bca21d8935
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syzbot

unread,

Jun 8, 2019, 7:22:07 AM6/8/19

syzbot has found a reproducer for the following crash on:

HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b
dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000

The bug was bisected to:

commit 0fff724a33917ac581b5825375d0b57affedee76
Author: Paul Kocialkowski <paul.koc...@bootlin.com>
Date: Fri Jan 18 14:51:13 2019 +0000

drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000

final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000
console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2ff1e7...@syzkaller.appspotmail.com

Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for
packed YUV422 check")

WARNING: CPU: 0 PID: 8951 at kernel/bpf/core.c:851 bpf_jit_free+0x157/0x1b0

Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 8951 Comm: kworker/0:0 Not tainted 5.2.0-rc3+ #23

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x2cb/0x744 kernel/panic.c:219
__warn.cold+0x20/0x4d kernel/panic.c:576
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:179 [inline]
fixup_bug arch/x86/kernel/traps.c:174 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986
RIP: 0010:bpf_jit_free+0x157/0x1b0
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5d 48 b8 00 02 00 00
00 00 ad de 48 39 43 70 0f 84 05 ff ff ff e8 f9 b5 f4 ff <0f> 0b e9 f9 fe
ff ff e8 bd 53 2d 00 e9 d9 fe ff ff 48 89 7d e0 e8
RSP: 0018:ffff88808886fcb0 EFLAGS: 00010293
RAX: ffff88808cb6c480 RBX: ffff88809051d280 RCX: ffffffff817ae68d
RDX: 0000000000000000 RSI: ffffffff817bf0f7 RDI: ffff88809051d2f0
RBP: ffff88808886fcd0 R08: 1ffffffff14ccaa8 R09: fffffbfff14ccaa9
R10: fffffbfff14ccaa8 R11: ffffffff8a665547 R12: ffffc90001925000
R13: ffff88809051d2e8 R14: ffff8880a0e43900 R15: ffff8880ae834840
bpf_prog_free_deferred+0x27a/0x350 kernel/bpf/core.c:1984
process_one_work+0x989/0x1790 kernel/workqueue.c:2269
worker_thread+0x98/0xe40 kernel/workqueue.c:2415
kthread+0x354/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

Daniel Vetter

unread,

Jun 11, 2019, 4:04:37 AM6/11/19

to syzbot, air...@linux.ie, a...@kernel.org, b...@vger.kernel.org, dan...@ffwll.ch, dan...@iogearbox.net, da...@davemloft.net, dri-...@lists.freedesktop.org, ha...@kernel.org, jakub.k...@netronome.com, john.fa...@gmail.com, ka...@fb.com, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org, maxime...@bootlin.com, net...@vger.kernel.org, paul.koc...@bootlin.com, songliu...@fb.com, syzkall...@googlegroups.com, we...@csie.org, xdp-n...@vger.kernel.org, y...@fb.com

On Sat, Jun 08, 2019 at 04:22:06AM -0700, syzbot wrote:
> syzbot has found a reproducer for the following crash on:
>
> HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000

Looking at the reproducer I don't see any calls to ioctl which could end
up anywhere in drm.

>
> The bug was bisected to:
>
> commit 0fff724a33917ac581b5825375d0b57affedee76
> Author: Paul Kocialkowski <paul.koc...@bootlin.com>
> Date: Fri Jan 18 14:51:13 2019 +0000
>
> drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check

And most definitely not in drm/sun4i. You can only hit this if you have
sun4i and run on arm, which per your config isn't the case.

tldr; smells like bisect gone wrong.
-Daniel

--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

Dmitry Vyukov

unread,

Jun 11, 2019, 4:33:33 AM6/11/19

to syzbot, David Airlie, Alexei Starovoitov, bpf, Daniel Borkmann, David Miller, DRI, ha...@kernel.org, Jakub Kicinski, John Fastabend, Martin KaFai Lau, Linux ARM, LKML, maxime...@bootlin.com, netdev, paul.koc...@bootlin.com, Song Liu, syzkaller-bugs, we...@csie.org, xdp-n...@vger.kernel.org, Yonghong Song, Daniel Vetter

On Tue, Jun 11, 2019 at 10:04 AM Daniel Vetter <dan...@ffwll.ch> wrote:
>
> On Sat, Jun 08, 2019 at 04:22:06AM -0700, syzbot wrote:
> > syzbot has found a reproducer for the following crash on:
> >
> > HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b
> > dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000
>
> Looking at the reproducer I don't see any calls to ioctl which could end
> up anywhere in drm.
> >
> > The bug was bisected to:
> >
> > commit 0fff724a33917ac581b5825375d0b57affedee76
> > Author: Paul Kocialkowski <paul.koc...@bootlin.com>
> > Date: Fri Jan 18 14:51:13 2019 +0000
> >
> > drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check
>
> And most definitely not in drm/sun4i. You can only hit this if you have
> sun4i and run on arm, which per your config isn't the case.
>
> tldr; smells like bisect gone wrong.
> -Daniel

From the bisection log it looks like the bug is too hard to trigger
for reliable bisection. So it probably classified one bad commit as
good. But it should got quite close to the right one.

> --
> Daniel Vetter
> Software Engineer, Intel Corporation
> http://blog.ffwll.ch
>

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190611080431.GP21222%40phenom.ffwll.local.
> For more options, visit https://groups.google.com/d/optout.00000000 RSI: ffffffff817bf0f7 RDI: ffff88809051d2f0

Daniel Vetter

unread,

Jun 11, 2019, 4:51:27 AM6/11/19

to Dmitry Vyukov, syzbot, David Airlie, Alexei Starovoitov, bpf, Daniel Borkmann, David Miller, DRI, ha...@kernel.org, Jakub Kicinski, John Fastabend, Martin KaFai Lau, Linux ARM, LKML, maxime...@bootlin.com, netdev, paul.koc...@bootlin.com, Song Liu, syzkaller-bugs, we...@csie.org, xdp-n...@vger.kernel.org, Yonghong Song, Daniel Vetter

Well statistically it'll get close, since there's a fair chance that it's
one of the later bisect results that got mischaracterized.

But you can be equally unlucky, and if it's one of the earliers, then it
can easily be a few thousand commits of. Looking at the log it's mostly
bad, with a few good sprinkled in, which could just be reproduction
failures. So might very well be that the very first "good" result is
wrong. And that very first "good" decision cuts away a big pile of bpf
related commits. The next "good" decision then only cuts away a pile of
drm commits, but at that point you're already off the rails most likely.

I'd say re-test on f90d64483ebd394958841f67f8794ab203b319a7 a few times,
I'm willing to bet that one is actually bad.

Cheers, Daniel

Daniel Vetter

unread,

Jun 11, 2019, 5:01:14 AM6/11/19

btw if this theory is right, we have a 1-in-4 chance of a spurious "good"
with your test. If you get 10 repeated "good" then that should be good
enough to make playing the lottery a better endeavor :-)
-Daniel

Dmitry Vyukov

unread,

Jun 11, 2019, 5:08:33 AM6/11/19

Yes, unfortunately.
We could do more tests, but if bug reproduction chances are lower, we
still the same lottery. And the more tests we do, the higher chances
that we hit and get distracted by unrelated kernel bugs.
When syzbot started bisecting bugs, I analyzed 120 bisections for
correct/not correct and some classification of root causes:
https://groups.google.com/forum/#!msg/syzkaller/sR8aAXaWEF4/tTWYRgvmAwAJ
https://docs.google.com/spreadsheets/d/1WdBAN54-csaZpD3LgmTcIMR7NDFuQoOZZqPZ-CUqQgA/edit#gid=348315157
https://docs.google.com/spreadsheets/d/1WdBAN54-csaZpD3LgmTcIMR7NDFuQoOZZqPZ-CUqQgA/edit#gid=0
Hard to trigger bugs are a problem, but unrelated kernel bugs is even
bigger problem...

Reply all

Reply to author

Forward

0 new messages