Test for WARNING: bad unlock balance in rxrpc_do_sendmsg
9 views
Skip to first unread message
Hawkins Jiawei
Aug 21, 2022, 5:24:43 AM8/21/22
to syzkall...@googlegroups.com, syzbot+7f0483...@syzkaller.appspotmail.com, hawk
syzbot
Aug 21, 2022, 6:50:18 AM8/21/22
to 18801...@163.com, syzkall...@googlegroups.com, yin3...@gmail.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+7f0483...@syzkaller.appspotmail.com
Tested on:
commit: 15b3f48a Merge tag 'kbuild-fixes-v6.0' of git://git.ke..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=11c98413080000
kernel config: https://syzkaller.appspot.com/x/.config?x=930fc801ca92783a
dashboard link: https://syzkaller.appspot.com/bug?extid=7f0483225d0c94cb3441
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=11286567080000
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+7f0483...@syzkaller.appspotmail.com
Tested on:
commit: 15b3f48a Merge tag 'kbuild-fixes-v6.0' of git://git.ke..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=11c98413080000
kernel config: https://syzkaller.appspot.com/x/.config?x=930fc801ca92783a
dashboard link: https://syzkaller.appspot.com/bug?extid=7f0483225d0c94cb3441
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=11286567080000
Note: testing is done by a robot and is best-effort only.
Khalid Masum
Aug 22, 2022, 12:27:45 AM8/22/22
to syzkall...@googlegroups.com, syzbot+7f0483...@syzkaller.appspotmail.com, Hawkins Jiawei
Retest:
#syz test https://github.com/torvalds/linux.git 568035b01cfb
#syz test https://github.com/torvalds/linux.git 568035b01cfb
syzbot
Aug 22, 2022, 3:26:14 AM8/22/22
to khalid....@gmail.com, syzkall...@googlegroups.com, yin3...@gmail.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
protocol family
[ 12.222351][ T1] Registered RDS/infiniband transport
[ 12.228659][ T1] Registered RDS/tcp transport
[ 12.233635][ T1] tipc: Activated (version 2.0.0)
[ 12.239275][ T1] NET: Registered PF_TIPC protocol family
[ 12.245853][ T1] tipc: Started in single node mode
[ 12.252014][ T1] NET: Registered PF_SMC protocol family
[ 12.257970][ T1] 9pnet: Installing 9P2000 support
[ 12.263689][ T1] NET: Registered PF_CAIF protocol family
[ 12.275243][ T1] NET: Registered PF_IEEE802154 protocol family
[ 12.281930][ T1] Key type dns_resolver registered
[ 12.287096][ T1] Key type ceph registered
[ 12.292253][ T1] libceph: loaded (mon/osd proto 15/24)
[ 12.299486][ T1] batman_adv: B.A.T.M.A.N. advanced 2022.2 (compatibility version 15) loaded
[ 12.308988][ T1] openvswitch: Open vSwitch switching datapath
[ 12.317734][ T1] NET: Registered PF_VSOCK protocol family
[ 12.323866][ T1] mpls_gso: MPLS GSO support
[ 12.340477][ T1] IPI shorthand broadcast: enabled
[ 12.345967][ T1] AVX2 version of gcm_enc/dec engaged.
[ 12.351748][ T1] AES CTR mode by8 optimization enabled
[ 12.361655][ T1] sched_clock: Marking stable (12335901902, 25484567)->(12362208060, -821591)
[ 12.372400][ T1] registered taskstats version 1
[ 12.430748][ T1] Loading compiled-in X.509 certificates
[ 12.442448][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 5f43dd8283545c8458af94a2e3f98a37a210385a'
[ 12.455826][ T1] zswap: loaded using pool lzo/zbud
[ 12.462506][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 14.007566][ T1] Key type ._fscrypt registered
[ 14.012504][ T1] Key type .fscrypt registered
[ 14.017261][ T1] Key type fscrypt-provisioning registered
[ 14.028950][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 14.043117][ T1] Btrfs loaded, crc32c=crc32c-intel, assert=on, zoned=yes, fsverity=yes
[ 14.052646][ T1] Key type big_key registered
[ 14.060201][ T1] Key type encrypted registered
[ 14.065237][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 14.071633][ T1] Loading compiled-in module X.509 certificates
[ 14.081252][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 5f43dd8283545c8458af94a2e3f98a37a210385a'
[ 14.092206][ T1] ima: Allocated hash algorithm: sha256
[ 14.098009][ T1] ima: No architecture policies found
[ 14.103697][ T1] evm: Initialising EVM extended attributes:
[ 14.109660][ T1] evm: security.selinux
[ 14.114038][ T1] evm: security.SMACK64 (disabled)
[ 14.119137][ T1] evm: security.SMACK64EXEC (disabled)
[ 14.124644][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 14.130525][ T1] evm: security.SMACK64MMAP (disabled)
[ 14.136213][ T1] evm: security.apparmor (disabled)
[ 14.141446][ T1] evm: security.ima
[ 14.145270][ T1] evm: security.capability
[ 14.149756][ T1] evm: HMAC attrs: 0x1
[ 14.238285][ T1] PM: Magic number: 2:127:269
[ 14.243304][ T1] video4linux swradio8: hash matches
[ 14.249040][ T1] tty ttyue: hash matches
[ 14.255348][ T1] printk: console [netcon0] enabled
[ 14.260679][ T1] netconsole: network logging started
[ 14.266734][ T1] gtp: GTP module loaded (pdp ctx size 104 bytes)
[ 14.275306][ T1] rdma_rxe: loaded
[ 14.279570][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 14.290762][ T1] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 14.299306][ T14] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 14.309587][ T1] ALSA device list:
[ 14.313654][ T1] #0: Dummy 1
[ 14.317115][ T1] #1: Loopback 1
[ 14.320840][ T1] #2: Virtual MIDI Card 1
[ 14.325431][ T14] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 14.340990][ T1] md: Waiting for all devices to be available before autodetect
[ 14.348727][ T1] md: If you don't use raid, use raid=noautodetect
[ 14.355376][ T1] md: Autodetecting RAID arrays.
[ 14.360400][ T1] md: autorun ...
[ 14.364082][ T1] md: ... autorun DONE.
[ 14.439854][ T1] EXT4-fs (sda1): mounted filesystem with ordered data mode. Quota mode: none.
[ 14.449367][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 14.477033][ T1] devtmpfs: mounted
[ 14.492805][ T1] Freeing unused kernel image (initmem) memory: 2744K
[ 14.499898][ T1] Write protecting the kernel read-only data: 176128k
[ 14.511678][ T1] Freeing unused kernel image (text/rodata gap) memory: 2016K
[ 14.519906][ T1] Freeing unused kernel image (rodata/data gap) memory: 392K
[ 14.532419][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 14.542288][ T1] Run /sbin/init as init process
[ 15.136581][ T1] SELinux: Class mctp_socket not defined in policy.
[ 15.143401][ T1] SELinux: Class anon_inode not defined in policy.
[ 15.149990][ T1] SELinux: Class io_uring not defined in policy.
[ 15.156451][ T1] SELinux: the above unknown classes and permissions will be denied
[ 15.215654][ T1] SELinux: policy capability network_peer_controls=1
[ 15.222529][ T1] SELinux: policy capability open_perms=1
[ 15.228352][ T1] SELinux: policy capability extended_socket_class=1
[ 15.235266][ T1] SELinux: policy capability always_check_network=0
[ 15.241962][ T1] SELinux: policy capability cgroup_seclabel=1
[ 15.248195][ T1] SELinux: policy capability nnp_nosuid_transition=1
[ 15.254995][ T1] SELinux: policy capability genfs_seclabel_symlinks=0
[ 15.261966][ T1] SELinux: policy capability ioctl_skip_cloexec=0
[ 15.760242][ T27] audit: type=1403 audit(1661152650.579:2): auid=4294967295 ses=4294967295 lsm=selinux res=1
[ 15.812014][ T2940] mount (2940) used greatest stack depth: 24664 bytes left
[ 15.860461][ T2941] EXT4-fs (sda1): re-mounted. Quota mode: none.
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting mqueue on /dev/mqueue failed: No such file or directory
mount: mounting hugetlbfs on /dev/hugepages failed: No such file or directory
mount: mounting fuse.lxcfs on /v[ 15.983290][ T2943] mount (2943) used greatest stack depth: 24232 bytes left
ar/lib/lxcfs failed: No such file or directory
Starting syslogd: OK
[ 16.170650][ T27] audit: type=1400 audit(1661152650.989:3): avc: denied { read write } for pid=2955 comm="syslogd" path="/dev/null" dev="devtmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 16.194581][ T27] audit: type=1400 audit(1661152650.989:4): avc: denied { read } for pid=2955 comm="syslogd" name="log" dev="sda1" ino=1125 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 16.217191][ T27] audit: type=1400 audit(1661152650.989:5): avc: denied { search } for pid=2955 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Starting acpid: [ 16.238645][ T27] audit: type=1400 audit(1661152651.019:6): avc: denied { write } for pid=2955 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 16.261447][ T27] audit: type=1400 audit(1661152651.019:7): avc: denied { add_name } for pid=2955 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 16.282199][ T27] audit: type=1400 audit(1661152651.019:8): avc: denied { create } for pid=2955 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 16.302757][ T27] audit: type=1400 audit(1661152651.019:9): avc: denied { append open } for pid=2955 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 16.325984][ T27] audit: type=1400 audit(1661152651.019:10): avc: denied { getattr } for pid=2955 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 16.354640][ T27] audit: type=1400 audit(1661152651.179:11): avc: denied { use } for pid=2957 comm="acpid" path="/dev/console" dev="rootfs" ino=1094 scontext=system_u:system_r:acpid_t tcontext=system_u:system_r:kernel_t tclass=fd permissive=1
OK
Starting klogd: OK
Running sysctl: [ 16.634787][ T2970] logger (2970) used greatest stack depth: 23840 bytes left
OK
Populating /dev using udev: [ 16.954919][ T2972] udevd[2972]: starting version 3.2.10
[ 17.147072][ T2973] udevd[2973]: starting eudev-3.2.10
[ 17.153141][ T2972] udevd (2972) used greatest stack depth: 22976 bytes left
[ 18.072688][ T2982] ------------[ cut here ]------------
[ 18.078295][ T2982] kernel BUG at arch/x86/mm/physaddr.c:28!
[ 18.085556][ T2982] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 18.091655][ T2982] CPU: 0 PID: 2982 Comm: udevd Not tainted 6.0.0-rc1-syzkaller-dirty #0
[ 18.099999][ T2982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[ 18.110073][ T2982] RIP: 0010:__phys_addr+0xd3/0x140
[ 18.115211][ T2982] Code: e3 44 89 e9 31 ff 48 d3 eb 48 89 de e8 f6 50 44 00 48 85 db 75 0f e8 0c 54 44 00 4c 89 e0 5b 5d 41 5c 41 5d c3 e8 fd 53 44 00 <0f> 0b e8 f6 53 44 00 48 c7 c0 10 50 cb 8b 48 ba 00 00 00 00 00 fc
[ 18.134925][ T2982] RSP: 0018:ffffc900030efdc8 EFLAGS: 00010293
[ 18.141027][ T2982] RAX: 0000000000000000 RBX: ffff0fff0083c481 RCX: 0000000000000000
[ 18.149051][ T2982] RDX: ffff888079b6a0c0 RSI: ffffffff8136e1a3 RDI: 0000000000000006
[ 18.157043][ T2982] RBP: ffff0fff8083c481 R08: 0000000000000006 R09: ffff0fff8083c481
[ 18.165029][ T2982] R10: ffff877f0083c481 R11: 0000000000000000 R12: ffff877f0083c481
[ 18.173028][ T2982] R13: ffff888146b23000 R14: ffff888146b23000 R15: 0000000000000000
[ 18.181027][ T2982] FS: 00007f77bb611840(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 18.190040][ T2982] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 18.196645][ T2982] CR2: 000055a6decbd018 CR3: 0000000020b72000 CR4: 00000000003506f0
[ 18.204639][ T2982] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 18.212626][ T2982] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 18.220613][ T2982] Call Trace:
[ 18.223899][ T2982] <TASK>
[ 18.226840][ T2982] qlist_free_all+0x102/0x1b0
[ 18.231550][ T2982] kasan_quarantine_reduce+0x180/0x200
[ 18.237036][ T2982] __kasan_slab_alloc+0x97/0xb0
[ 18.242003][ T2982] kmem_cache_alloc+0x214/0x520
[ 18.246881][ T2982] getname_flags.part.0+0x50/0x4f0
[ 18.252018][ T2982] ? syscall_enter_from_user_mode+0x22/0xb0
[ 18.257961][ T2982] __x64_sys_unlink+0xb1/0x110
[ 18.262749][ T2982] do_syscall_64+0x35/0xb0
[ 18.267200][ T2982] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 18.273116][ T2982] RIP: 0033:0x7f77bb7272d7
[ 18.277546][ T2982] Code: f0 ff ff 73 01 c3 48 8b 0d 9e db 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 71 db 0c 00 f7 d8 64 89 01 48
[ 18.297183][ T2982] RSP: 002b:00007fffe8195cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 18.305620][ T2982] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f77bb7272d7
[ 18.313611][ T2982] RDX: 0000000000000000 RSI: 000055a6decbe702 RDI: 00007fffe8195d18
[ 18.321599][ T2982] RBP: 000055a6decb1840 R08: 0000000000000000 R09: 000055a6deccfd10
[ 18.329591][ T2982] R10: 00007f77bb7b4fc0 R11: 0000000000000246 R12: 0000000000000000
[ 18.337575][ T2982] R13: 00007fffe8195d18 R14: 000055a6decbe6f0 R15: 000055a6dd053160
[ 18.345567][ T2982] </TASK>
[ 18.348600][ T2982] Modules linked in:
[ 18.359527][ T2982] ---[ end trace 0000000000000000 ]---
[ 18.367128][ T2982] RIP: 0010:__phys_addr+0xd3/0x140
[ 18.373166][ T2982] Code: e3 44 89 e9 31 ff 48 d3 eb 48 89 de e8 f6 50 44 00 48 85 db 75 0f e8 0c 54 44 00 4c 89 e0 5b 5d 41 5c 41 5d c3 e8 fd 53 44 00 <0f> 0b e8 f6 53 44 00 48 c7 c0 10 50 cb 8b 48 ba 00 00 00 00 00 fc
[ 18.393752][ T2982] RSP: 0018:ffffc900030efdc8 EFLAGS: 00010293
[ 18.400544][ T2982] RAX: 0000000000000000 RBX: ffff0fff0083c481 RCX: 0000000000000000
[ 18.409525][ T2982] RDX: ffff888079b6a0c0 RSI: ffffffff8136e1a3 RDI: 0000000000000006
[ 18.418641][ T2982] RBP: ffff0fff8083c481 R08: 0000000000000006 R09: ffff0fff8083c481
[ 18.427558][ T2982] R10: ffff877f0083c481 R11: 0000000000000000 R12: ffff877f0083c481
[ 18.436943][ T2982] R13: ffff888146b23000 R14: ffff888146b23000 R15: 0000000000000000
[ 18.445924][ T2982] FS: 00007f77bb611840(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 18.455926][ T2982] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 18.464380][ T2982] CR2: 000055a6decbd018 CR3: 0000000020b72000 CR4: 00000000003506f0
[ 18.473444][ T2982] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 18.482384][ T2982] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 18.490393][ T2982] Kernel panic - not syncing: Fatal exception
[ 18.496684][ T2982] Kernel Offset: disabled
[ 18.501009][ T2982] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3291580557=/tmp/go-build -gno-record-gcc-switches"
git status (err=<nil>)
HEAD detached at 1434eec0b
nothing to commit, working tree clean
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1434eec0b84075b7246560cfa89f20cdb3d8077f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220629-111539'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1434eec0b84075b7246560cfa89f20cdb3d8077f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220629-111539'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1434eec0b84075b7246560cfa89f20cdb3d8077f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220629-111539'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"1434eec0b84075b7246560cfa89f20cdb3d8077f\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1366e50d080000
Tested on:
commit: 568035b0 Linux 6.0-rc1
git tree: https://github.com/torvalds/linux.git
syzbot tried to test the proposed patch but the build/boot failed:
protocol family
[ 12.222351][ T1] Registered RDS/infiniband transport
[ 12.228659][ T1] Registered RDS/tcp transport
[ 12.233635][ T1] tipc: Activated (version 2.0.0)
[ 12.239275][ T1] NET: Registered PF_TIPC protocol family
[ 12.245853][ T1] tipc: Started in single node mode
[ 12.252014][ T1] NET: Registered PF_SMC protocol family
[ 12.257970][ T1] 9pnet: Installing 9P2000 support
[ 12.263689][ T1] NET: Registered PF_CAIF protocol family
[ 12.275243][ T1] NET: Registered PF_IEEE802154 protocol family
[ 12.281930][ T1] Key type dns_resolver registered
[ 12.287096][ T1] Key type ceph registered
[ 12.292253][ T1] libceph: loaded (mon/osd proto 15/24)
[ 12.299486][ T1] batman_adv: B.A.T.M.A.N. advanced 2022.2 (compatibility version 15) loaded
[ 12.308988][ T1] openvswitch: Open vSwitch switching datapath
[ 12.317734][ T1] NET: Registered PF_VSOCK protocol family
[ 12.323866][ T1] mpls_gso: MPLS GSO support
[ 12.340477][ T1] IPI shorthand broadcast: enabled
[ 12.345967][ T1] AVX2 version of gcm_enc/dec engaged.
[ 12.351748][ T1] AES CTR mode by8 optimization enabled
[ 12.361655][ T1] sched_clock: Marking stable (12335901902, 25484567)->(12362208060, -821591)
[ 12.372400][ T1] registered taskstats version 1
[ 12.430748][ T1] Loading compiled-in X.509 certificates
[ 12.442448][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 5f43dd8283545c8458af94a2e3f98a37a210385a'
[ 12.455826][ T1] zswap: loaded using pool lzo/zbud
[ 12.462506][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 14.007566][ T1] Key type ._fscrypt registered
[ 14.012504][ T1] Key type .fscrypt registered
[ 14.017261][ T1] Key type fscrypt-provisioning registered
[ 14.028950][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 14.043117][ T1] Btrfs loaded, crc32c=crc32c-intel, assert=on, zoned=yes, fsverity=yes
[ 14.052646][ T1] Key type big_key registered
[ 14.060201][ T1] Key type encrypted registered
[ 14.065237][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 14.071633][ T1] Loading compiled-in module X.509 certificates
[ 14.081252][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 5f43dd8283545c8458af94a2e3f98a37a210385a'
[ 14.092206][ T1] ima: Allocated hash algorithm: sha256
[ 14.098009][ T1] ima: No architecture policies found
[ 14.103697][ T1] evm: Initialising EVM extended attributes:
[ 14.109660][ T1] evm: security.selinux
[ 14.114038][ T1] evm: security.SMACK64 (disabled)
[ 14.119137][ T1] evm: security.SMACK64EXEC (disabled)
[ 14.124644][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 14.130525][ T1] evm: security.SMACK64MMAP (disabled)
[ 14.136213][ T1] evm: security.apparmor (disabled)
[ 14.141446][ T1] evm: security.ima
[ 14.145270][ T1] evm: security.capability
[ 14.149756][ T1] evm: HMAC attrs: 0x1
[ 14.238285][ T1] PM: Magic number: 2:127:269
[ 14.243304][ T1] video4linux swradio8: hash matches
[ 14.249040][ T1] tty ttyue: hash matches
[ 14.255348][ T1] printk: console [netcon0] enabled
[ 14.260679][ T1] netconsole: network logging started
[ 14.266734][ T1] gtp: GTP module loaded (pdp ctx size 104 bytes)
[ 14.275306][ T1] rdma_rxe: loaded
[ 14.279570][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 14.290762][ T1] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 14.299306][ T14] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 14.309587][ T1] ALSA device list:
[ 14.313654][ T1] #0: Dummy 1
[ 14.317115][ T1] #1: Loopback 1
[ 14.320840][ T1] #2: Virtual MIDI Card 1
[ 14.325431][ T14] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 14.340990][ T1] md: Waiting for all devices to be available before autodetect
[ 14.348727][ T1] md: If you don't use raid, use raid=noautodetect
[ 14.355376][ T1] md: Autodetecting RAID arrays.
[ 14.360400][ T1] md: autorun ...
[ 14.364082][ T1] md: ... autorun DONE.
[ 14.439854][ T1] EXT4-fs (sda1): mounted filesystem with ordered data mode. Quota mode: none.
[ 14.449367][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 14.477033][ T1] devtmpfs: mounted
[ 14.492805][ T1] Freeing unused kernel image (initmem) memory: 2744K
[ 14.499898][ T1] Write protecting the kernel read-only data: 176128k
[ 14.511678][ T1] Freeing unused kernel image (text/rodata gap) memory: 2016K
[ 14.519906][ T1] Freeing unused kernel image (rodata/data gap) memory: 392K
[ 14.532419][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 14.542288][ T1] Run /sbin/init as init process
[ 15.136581][ T1] SELinux: Class mctp_socket not defined in policy.
[ 15.143401][ T1] SELinux: Class anon_inode not defined in policy.
[ 15.149990][ T1] SELinux: Class io_uring not defined in policy.
[ 15.156451][ T1] SELinux: the above unknown classes and permissions will be denied
[ 15.215654][ T1] SELinux: policy capability network_peer_controls=1
[ 15.222529][ T1] SELinux: policy capability open_perms=1
[ 15.228352][ T1] SELinux: policy capability extended_socket_class=1
[ 15.235266][ T1] SELinux: policy capability always_check_network=0
[ 15.241962][ T1] SELinux: policy capability cgroup_seclabel=1
[ 15.248195][ T1] SELinux: policy capability nnp_nosuid_transition=1
[ 15.254995][ T1] SELinux: policy capability genfs_seclabel_symlinks=0
[ 15.261966][ T1] SELinux: policy capability ioctl_skip_cloexec=0
[ 15.760242][ T27] audit: type=1403 audit(1661152650.579:2): auid=4294967295 ses=4294967295 lsm=selinux res=1
[ 15.812014][ T2940] mount (2940) used greatest stack depth: 24664 bytes left
[ 15.860461][ T2941] EXT4-fs (sda1): re-mounted. Quota mode: none.
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting mqueue on /dev/mqueue failed: No such file or directory
mount: mounting hugetlbfs on /dev/hugepages failed: No such file or directory
mount: mounting fuse.lxcfs on /v[ 15.983290][ T2943] mount (2943) used greatest stack depth: 24232 bytes left
ar/lib/lxcfs failed: No such file or directory
Starting syslogd: OK
[ 16.170650][ T27] audit: type=1400 audit(1661152650.989:3): avc: denied { read write } for pid=2955 comm="syslogd" path="/dev/null" dev="devtmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 16.194581][ T27] audit: type=1400 audit(1661152650.989:4): avc: denied { read } for pid=2955 comm="syslogd" name="log" dev="sda1" ino=1125 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 16.217191][ T27] audit: type=1400 audit(1661152650.989:5): avc: denied { search } for pid=2955 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Starting acpid: [ 16.238645][ T27] audit: type=1400 audit(1661152651.019:6): avc: denied { write } for pid=2955 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 16.261447][ T27] audit: type=1400 audit(1661152651.019:7): avc: denied { add_name } for pid=2955 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 16.282199][ T27] audit: type=1400 audit(1661152651.019:8): avc: denied { create } for pid=2955 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 16.302757][ T27] audit: type=1400 audit(1661152651.019:9): avc: denied { append open } for pid=2955 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 16.325984][ T27] audit: type=1400 audit(1661152651.019:10): avc: denied { getattr } for pid=2955 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 16.354640][ T27] audit: type=1400 audit(1661152651.179:11): avc: denied { use } for pid=2957 comm="acpid" path="/dev/console" dev="rootfs" ino=1094 scontext=system_u:system_r:acpid_t tcontext=system_u:system_r:kernel_t tclass=fd permissive=1
OK
Starting klogd: OK
Running sysctl: [ 16.634787][ T2970] logger (2970) used greatest stack depth: 23840 bytes left
OK
Populating /dev using udev: [ 16.954919][ T2972] udevd[2972]: starting version 3.2.10
[ 17.147072][ T2973] udevd[2973]: starting eudev-3.2.10
[ 17.153141][ T2972] udevd (2972) used greatest stack depth: 22976 bytes left
[ 18.072688][ T2982] ------------[ cut here ]------------
[ 18.078295][ T2982] kernel BUG at arch/x86/mm/physaddr.c:28!
[ 18.085556][ T2982] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 18.091655][ T2982] CPU: 0 PID: 2982 Comm: udevd Not tainted 6.0.0-rc1-syzkaller-dirty #0
[ 18.099999][ T2982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[ 18.110073][ T2982] RIP: 0010:__phys_addr+0xd3/0x140
[ 18.115211][ T2982] Code: e3 44 89 e9 31 ff 48 d3 eb 48 89 de e8 f6 50 44 00 48 85 db 75 0f e8 0c 54 44 00 4c 89 e0 5b 5d 41 5c 41 5d c3 e8 fd 53 44 00 <0f> 0b e8 f6 53 44 00 48 c7 c0 10 50 cb 8b 48 ba 00 00 00 00 00 fc
[ 18.134925][ T2982] RSP: 0018:ffffc900030efdc8 EFLAGS: 00010293
[ 18.141027][ T2982] RAX: 0000000000000000 RBX: ffff0fff0083c481 RCX: 0000000000000000
[ 18.149051][ T2982] RDX: ffff888079b6a0c0 RSI: ffffffff8136e1a3 RDI: 0000000000000006
[ 18.157043][ T2982] RBP: ffff0fff8083c481 R08: 0000000000000006 R09: ffff0fff8083c481
[ 18.165029][ T2982] R10: ffff877f0083c481 R11: 0000000000000000 R12: ffff877f0083c481
[ 18.173028][ T2982] R13: ffff888146b23000 R14: ffff888146b23000 R15: 0000000000000000
[ 18.181027][ T2982] FS: 00007f77bb611840(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 18.190040][ T2982] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 18.196645][ T2982] CR2: 000055a6decbd018 CR3: 0000000020b72000 CR4: 00000000003506f0
[ 18.204639][ T2982] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 18.212626][ T2982] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 18.220613][ T2982] Call Trace:
[ 18.223899][ T2982] <TASK>
[ 18.226840][ T2982] qlist_free_all+0x102/0x1b0
[ 18.231550][ T2982] kasan_quarantine_reduce+0x180/0x200
[ 18.237036][ T2982] __kasan_slab_alloc+0x97/0xb0
[ 18.242003][ T2982] kmem_cache_alloc+0x214/0x520
[ 18.246881][ T2982] getname_flags.part.0+0x50/0x4f0
[ 18.252018][ T2982] ? syscall_enter_from_user_mode+0x22/0xb0
[ 18.257961][ T2982] __x64_sys_unlink+0xb1/0x110
[ 18.262749][ T2982] do_syscall_64+0x35/0xb0
[ 18.267200][ T2982] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 18.273116][ T2982] RIP: 0033:0x7f77bb7272d7
[ 18.277546][ T2982] Code: f0 ff ff 73 01 c3 48 8b 0d 9e db 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 71 db 0c 00 f7 d8 64 89 01 48
[ 18.297183][ T2982] RSP: 002b:00007fffe8195cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
[ 18.305620][ T2982] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f77bb7272d7
[ 18.313611][ T2982] RDX: 0000000000000000 RSI: 000055a6decbe702 RDI: 00007fffe8195d18
[ 18.321599][ T2982] RBP: 000055a6decb1840 R08: 0000000000000000 R09: 000055a6deccfd10
[ 18.329591][ T2982] R10: 00007f77bb7b4fc0 R11: 0000000000000246 R12: 0000000000000000
[ 18.337575][ T2982] R13: 00007fffe8195d18 R14: 000055a6decbe6f0 R15: 000055a6dd053160
[ 18.345567][ T2982] </TASK>
[ 18.348600][ T2982] Modules linked in:
[ 18.359527][ T2982] ---[ end trace 0000000000000000 ]---
[ 18.367128][ T2982] RIP: 0010:__phys_addr+0xd3/0x140
[ 18.373166][ T2982] Code: e3 44 89 e9 31 ff 48 d3 eb 48 89 de e8 f6 50 44 00 48 85 db 75 0f e8 0c 54 44 00 4c 89 e0 5b 5d 41 5c 41 5d c3 e8 fd 53 44 00 <0f> 0b e8 f6 53 44 00 48 c7 c0 10 50 cb 8b 48 ba 00 00 00 00 00 fc
[ 18.393752][ T2982] RSP: 0018:ffffc900030efdc8 EFLAGS: 00010293
[ 18.400544][ T2982] RAX: 0000000000000000 RBX: ffff0fff0083c481 RCX: 0000000000000000
[ 18.409525][ T2982] RDX: ffff888079b6a0c0 RSI: ffffffff8136e1a3 RDI: 0000000000000006
[ 18.418641][ T2982] RBP: ffff0fff8083c481 R08: 0000000000000006 R09: ffff0fff8083c481
[ 18.427558][ T2982] R10: ffff877f0083c481 R11: 0000000000000000 R12: ffff877f0083c481
[ 18.436943][ T2982] R13: ffff888146b23000 R14: ffff888146b23000 R15: 0000000000000000
[ 18.445924][ T2982] FS: 00007f77bb611840(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 18.455926][ T2982] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 18.464380][ T2982] CR2: 000055a6decbd018 CR3: 0000000020b72000 CR4: 00000000003506f0
[ 18.473444][ T2982] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 18.482384][ T2982] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 18.490393][ T2982] Kernel panic - not syncing: Fatal exception
[ 18.496684][ T2982] Kernel Offset: disabled
[ 18.501009][ T2982] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3291580557=/tmp/go-build -gno-record-gcc-switches"
git status (err=<nil>)
HEAD detached at 1434eec0b
nothing to commit, working tree clean
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1434eec0b84075b7246560cfa89f20cdb3d8077f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220629-111539'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1434eec0b84075b7246560cfa89f20cdb3d8077f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220629-111539'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1434eec0b84075b7246560cfa89f20cdb3d8077f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220629-111539'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"1434eec0b84075b7246560cfa89f20cdb3d8077f\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1366e50d080000
Tested on:
commit: 568035b0 Linux 6.0-rc1
git tree: https://github.com/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=930fc801ca92783a
dashboard link: https://syzkaller.appspot.com/bug?extid=7f0483225d0c94cb3441
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=16c8fdc3080000
dashboard link: https://syzkaller.appspot.com/bug?extid=7f0483225d0c94cb3441
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syzbot
Aug 22, 2022, 12:03:16 PM8/22/22
to syzkall...@googlegroups.com, yin3...@gmail.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+7f0483...@syzkaller.appspotmail.com
Tested on:
commit: 1c23f9e6 Linux 6.0-rc2
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+7f0483...@syzkaller.appspotmail.com
Tested on:
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=130fb867080000
kernel config: https://syzkaller.appspot.com/x/.config?x=899e2f3421dd4d9
dashboard link: https://syzkaller.appspot.com/bug?extid=7f0483225d0c94cb3441
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=16f2d6f3080000
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Reply all
Reply to author
Forward
0 new messages