kernel BUG at mm/memory.c:LINE!
43 views
Skip to first unread message
syzbot
May 21, 2020, 6:29:15 PM5/21/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 1bab61d3 Linux 4.19.124
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16f0ce5e100000
kernel config: https://syzkaller.appspot.com/x/.config?x=e95e3ce854b90b1b
dashboard link: https://syzkaller.appspot.com/bug?extid=f7b83f3f64369aef5473
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f7b83f...@syzkaller.appspotmail.com
audit: type=1804 audit(1590100101.500:25): pid=8593 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir574420298/syzkaller.GM8jNW/23/file0" dev="sda1" ino=15857 res=1
------------[ cut here ]------------
kernel BUG at mm/memory.c:3947!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8540 Comm: syz-executor.4 Not tainted 4.19.124-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RSP: 0018:ffff88804b8b7ce8 EFLAGS: 00010283
RAX: 0000000000000137 RBX: 0000000000000008 RCX: 0000000000000000
audit: type=1804 audit(1590100101.530:26): pid=8593 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir574420298/syzkaller.GM8jNW/23/file0" dev="sda1" ino=15857 res=1
RDX: 0000000000000000 RSI: ffffffff81534081 RDI: ffffed1009716f78
RBP: 000000003b8000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff8880860a2eb0
R13: 1ffff11009716fa3 R14: 0000000000000001 R15: ffff88804b9e73c0
FS: 00000000015e6940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe5dd65cbc CR3: 00000000a8d74000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
handle_mm_fault+0x436/0xafd mm/memory.c:4202
__do_page_fault+0x6d5/0xde0 arch/x86/mm/fault.c:1412
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x443cd1
Code: 8d 15 b3 1b 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6
RSP: 002b:00007ffe838e22a8 EFLAGS: 00010202
RAX: 00000000200001c0 RBX: 0000000000000000 RCX: 0000000000000063
RDX: 0000000000000013 RSI: 0000000000790808 RDI: 00000000200001c0
RBP: 00000000007907e8 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffe838e2390 R11: 0000000000000246 R12: 00000000007907f0
R13: 000000000003921e R14: fffffffffffffffe R15: 000000000078c04c
Modules linked in:
---[ end trace 5d7c3112d5c9d32b ]---
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RSP: 0018:ffff88804b8b7ce8 EFLAGS: 00010283
RAX: 0000000000000137 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81534081 RDI: ffffed1009716f78
RBP: 000000003b8000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff8880860a2eb0
R13: 1ffff11009716fa3 R14: 0000000000000001 R15: ffff88804b9e73c0
FS: 00000000015e6940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc1b563f97 CR3: 00000000a8d74000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 1bab61d3 Linux 4.19.124
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16f0ce5e100000
kernel config: https://syzkaller.appspot.com/x/.config?x=e95e3ce854b90b1b
dashboard link: https://syzkaller.appspot.com/bug?extid=f7b83f3f64369aef5473
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f7b83f...@syzkaller.appspotmail.com
audit: type=1804 audit(1590100101.500:25): pid=8593 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir574420298/syzkaller.GM8jNW/23/file0" dev="sda1" ino=15857 res=1
------------[ cut here ]------------
kernel BUG at mm/memory.c:3947!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8540 Comm: syz-executor.4 Not tainted 4.19.124-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RSP: 0018:ffff88804b8b7ce8 EFLAGS: 00010283
RAX: 0000000000000137 RBX: 0000000000000008 RCX: 0000000000000000
audit: type=1804 audit(1590100101.530:26): pid=8593 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir574420298/syzkaller.GM8jNW/23/file0" dev="sda1" ino=15857 res=1
RDX: 0000000000000000 RSI: ffffffff81534081 RDI: ffffed1009716f78
RBP: 000000003b8000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff8880860a2eb0
R13: 1ffff11009716fa3 R14: 0000000000000001 R15: ffff88804b9e73c0
FS: 00000000015e6940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe5dd65cbc CR3: 00000000a8d74000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
handle_mm_fault+0x436/0xafd mm/memory.c:4202
__do_page_fault+0x6d5/0xde0 arch/x86/mm/fault.c:1412
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x443cd1
Code: 8d 15 b3 1b 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6
RSP: 002b:00007ffe838e22a8 EFLAGS: 00010202
RAX: 00000000200001c0 RBX: 0000000000000000 RCX: 0000000000000063
RDX: 0000000000000013 RSI: 0000000000790808 RDI: 00000000200001c0
RBP: 00000000007907e8 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffe838e2390 R11: 0000000000000246 R12: 00000000007907f0
R13: 000000000003921e R14: fffffffffffffffe R15: 000000000078c04c
Modules linked in:
---[ end trace 5d7c3112d5c9d32b ]---
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RSP: 0018:ffff88804b8b7ce8 EFLAGS: 00010283
RAX: 0000000000000137 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81534081 RDI: ffffed1009716f78
RBP: 000000003b8000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff8880860a2eb0
R13: 1ffff11009716fa3 R14: 0000000000000001 R15: ffff88804b9e73c0
FS: 00000000015e6940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc1b563f97 CR3: 00000000a8d74000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
May 21, 2020, 6:59:14 PM5/21/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 1bab61d3 Linux 4.19.124
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1197067e100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105b59e6100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f7b83f...@syzkaller.appspotmail.com
next ffff88809adb0da8 prev ffff88809adb0eb0 mm ffff888089e34a00
prot 25 anon_vma 0000000000000000 vm_ops ffffffff87720c20
pgoff 0 file ffff888096293d00 private_data 0000000000000000
flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare)
RBP: 00000000802000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff88809adb0568
R13: 1ffff110114effa3 R14: 0000000000000001 R15: ffff888089e34a00
FS: 00007f12b4789700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
Code: 00 0f 1f 44 00 00 f0 83 2d 68 a7 2d 00 01 4c 89 e7 e8 20 fc ff ff eb af 48 b8 63 67 72 6f 75 70 2e 63 b9 72 73 00 00 45 31 c0 <48> 89 04 25 c0 01 00 20 48 b8 6f 6e 74 72 6f 6c 6c 65 66 89 0c 25
RSP: 002b:00007f12b4788d20 EFLAGS: 00010246
RAX: 632e70756f726763 RBX: 00000000006dbc48 RCX: 0000000000007372
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00000000006dbc4c
RBP: 00000000006dbc40 R08: 0000000000000000 R09: 65732f636f72702f
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc4c
R13: 00007f12b4788d20 R14: 00007f12b4788d20 R15: 00000000006dbc4c
Modules linked in:
---[ end trace 71d9a04397c25329 ]---
RBP: 00000000802000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff88809adb0568
R13: 1ffff110114effa3 R14: 0000000000000001 R15: ffff888089e34a00
FS: 00007f12b4789700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
HEAD commit: 1bab61d3 Linux 4.19.124
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=e95e3ce854b90b1b
dashboard link: https://syzkaller.appspot.com/bug?extid=f7b83f3f64369aef5473
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fd2b81100000
dashboard link: https://syzkaller.appspot.com/bug?extid=f7b83f3f64369aef5473
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105b59e6100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f7b83f...@syzkaller.appspotmail.com
prot 25 anon_vma 0000000000000000 vm_ops ffffffff87720c20
pgoff 0 file ffff888096293d00 private_data 0000000000000000
flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare)
------------[ cut here ]------------
kernel BUG at mm/memory.c:3947!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6449 Comm: syz-executor666 Not tainted 4.19.124-syzkaller #0
kernel BUG at mm/memory.c:3947!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RSP: 0000:ffff88808a77fce8 EFLAGS: 00010283
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RAX: 0000000000000137 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81534081 RDI: ffffed10114eff78
RBP: 00000000802000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff88809adb0568
R13: 1ffff110114effa3 R14: 0000000000000001 R15: ffff888089e34a00
FS: 00007f12b4789700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2ab3094000 CR3: 000000009de53000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
handle_mm_fault+0x436/0xafd mm/memory.c:4202
__do_page_fault+0x6d5/0xde0 arch/x86/mm/fault.c:1412
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x4014b4
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
handle_mm_fault+0x436/0xafd mm/memory.c:4202
__do_page_fault+0x6d5/0xde0 arch/x86/mm/fault.c:1412
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
Code: 00 0f 1f 44 00 00 f0 83 2d 68 a7 2d 00 01 4c 89 e7 e8 20 fc ff ff eb af 48 b8 63 67 72 6f 75 70 2e 63 b9 72 73 00 00 45 31 c0 <48> 89 04 25 c0 01 00 20 48 b8 6f 6e 74 72 6f 6c 6c 65 66 89 0c 25
RSP: 002b:00007f12b4788d20 EFLAGS: 00010246
RAX: 632e70756f726763 RBX: 00000000006dbc48 RCX: 0000000000007372
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00000000006dbc4c
RBP: 00000000006dbc40 R08: 0000000000000000 R09: 65732f636f72702f
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc4c
R13: 00007f12b4788d20 R14: 00007f12b4788d20 R15: 00000000006dbc4c
Modules linked in:
---[ end trace 71d9a04397c25329 ]---
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RSP: 0000:ffff88808a77fce8 EFLAGS: 00010283
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RAX: 0000000000000137 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81534081 RDI: ffffed10114eff78
RBP: 00000000802000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff88809adb0568
R13: 1ffff110114effa3 R14: 0000000000000001 R15: ffff888089e34a00
FS: 00007f12b4789700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002100003f CR3: 000000009de53000 CR4: 00000000001406e0
syzbot
May 21, 2020, 7:25:16 PM5/21/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: a41ba30d Linux 4.14.181
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=173cb09a100000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5458e9cda81cf95
dashboard link: https://syzkaller.appspot.com/bug?extid=c464fddc58432bbf3f44
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c464fd...@syzkaller.appspotmail.com
next ffff8880a196a420 prev ffff88808e47ec60 mm ffff8880941b6000
prot 25 anon_vma (null) vm_ops ffffffff8690c420
pgoff 0 file ffff8880964cd2c0 private_data (null)
CPU: 0 PID: 6582 Comm: syz-executor.0 Not tainted 4.14.181-syzkaller #0
RIP: 0010:wp_huge_pmd mm/memory.c:3895 [inline]
RIP: 0010:__handle_mm_fault+0x213f/0x3700 mm/memory.c:4103
RSP: 0018:ffff888096787d48 EFLAGS: 00010283
RAX: 0000000000000137 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff868c0a40 RDI: ffffed1012cf0f88
RBP: 0000000080a000e5 R08: 0000000000000137 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff11012cf0faf
R13: ffff8880905a6840 R14: 0000000000000080 R15: ffffffff87806758
FS: 0000000000e44940(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
__do_page_fault+0x578/0xb50 arch/x86/mm/fault.c:1442
page_fault+0x45/0x50 arch/x86/entry/entry_64.S:1123
RIP: c4ea:0xfffffffffffffffe
RSP: 0000:0000000000790378 EFLAGS: 00790380
Code: df ff f0 ff 4d 1c 0f 85 ba ed ff ff e8 5b d1 df ff 48 89 ef e8 d3 d4 f6 ff e9 a8 ed ff ff e8 49 d1 df ff 4c 89 ef e8 fd ab fd ff <0f> 0b e8 3a d1 df ff 4c 8d 7c 24 60 4c 89 ff e8 4d b2 0a 00 41
RIP: wp_huge_pmd mm/memory.c:3895 [inline] RSP: ffff888096787d48
RIP: __handle_mm_fault+0x213f/0x3700 mm/memory.c:4103 RSP: ffff888096787d48
---[ end trace 0b180e244032d3c2 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following crash on:
HEAD commit: a41ba30d Linux 4.14.181
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=173cb09a100000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5458e9cda81cf95
dashboard link: https://syzkaller.appspot.com/bug?extid=c464fddc58432bbf3f44
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17ab764a100000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
next ffff8880a196a420 prev ffff88808e47ec60 mm ffff8880941b6000
prot 25 anon_vma (null) vm_ops ffffffff8690c420
pgoff 0 file ffff8880964cd2c0 private_data (null)
flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare)
------------[ cut here ]------------
kernel BUG at mm/memory.c:3895!
------------[ cut here ]------------
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 6582 Comm: syz-executor.0 Not tainted 4.14.181-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880948b06c0 task.stack: ffff888096780000
RIP: 0010:wp_huge_pmd mm/memory.c:3895 [inline]
RIP: 0010:__handle_mm_fault+0x213f/0x3700 mm/memory.c:4103
RSP: 0018:ffff888096787d48 EFLAGS: 00010283
RAX: 0000000000000137 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff868c0a40 RDI: ffffed1012cf0f88
RBP: 0000000080a000e5 R08: 0000000000000137 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff11012cf0faf
R13: ffff8880905a6840 R14: 0000000000000080 R15: ffffffff87806758
FS: 0000000000e44940(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200001c0 CR3: 000000009fd07000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
handle_mm_fault+0x306/0x794 mm/memory.c:4150
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__do_page_fault+0x578/0xb50 arch/x86/mm/fault.c:1442
page_fault+0x45/0x50 arch/x86/entry/entry_64.S:1123
RIP: c4ea:0xfffffffffffffffe
RSP: 0000:0000000000790378 EFLAGS: 00790380
Code: df ff f0 ff 4d 1c 0f 85 ba ed ff ff e8 5b d1 df ff 48 89 ef e8 d3 d4 f6 ff e9 a8 ed ff ff e8 49 d1 df ff 4c 89 ef e8 fd ab fd ff <0f> 0b e8 3a d1 df ff 4c 8d 7c 24 60 4c 89 ff e8 4d b2 0a 00 41
RIP: wp_huge_pmd mm/memory.c:3895 [inline] RSP: ffff888096787d48
RIP: __handle_mm_fault+0x213f/0x3700 mm/memory.c:4103 RSP: ffff888096787d48
---[ end trace 0b180e244032d3c2 ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
https://goo.gl/tpsmEJ#testing-patches
syzbot
Jun 13, 2022, 4:24:23 AM6/13/22
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: b8f3be299d51 Linux 4.14.282
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=126d94fdf00000
kernel config: https://syzkaller.appspot.com/x/.config?x=6f19bc3398ea47b8
dashboard link: https://syzkaller.appspot.com/bug?extid=c464fddc58432bbf3f44
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1666a2a7f00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15c6740ff00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c464fd...@syzkaller.appspotmail.com
next ffff888098173880 prev ffff888098173ca0 mm ffff8880a30fa640
prot 25 anon_vma (null) vm_ops ffffffff8790a960
pgoff 0 file ffff8880b4f8f5c0 private_data (null)
flags: 0x20fe(write|exec|shared|mayread|maywrite|mayexec|mayshare|locked)
------------[ cut here ]------------
kernel BUG at mm/memory.c:4011!
RIP: 0010:wp_huge_pmd mm/memory.c:4011 [inline]
RIP: 0010:__handle_mm_fault+0x259a/0x4620 mm/memory.c:4219
RSP: 0018:ffff8880b3677860 EFLAGS: 00010287
RAX: 0000000000000140 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff878bc600 RDI: ffffed10166ceeeb
RBP: 1ffff110166cef12 R08: 0000000000000140 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 000000008b8000e5
R13: ffff8880b35a5460 R14: 00000000000000e5 R15: ffffffff88cca358
FS: 00007fbb7cf57700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
__do_page_fault+0x549/0xad0 arch/x86/mm/fault.c:1442
page_fault+0x25/0x50 arch/x86/entry/entry_64.S:1123
RIP: 0010:ep_send_events_proc+0x4e6/0x9c0 fs/eventpoll.c:1684
RSP: 0018:ffff8880b3677b40 EFLAGS: 00050246
RAX: 0000000000000004 RBX: ffff8880b43f1318 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffffff8b9c4a00 R09: 0000000000000001
R10: 0000000000000000 R11: ffff888097b803c0 R12: ffff8880b3677c58
R13: ffff8880b43f1320 R14: ffff8880b43f1370 R15: ffff8880b43f1368
ep_scan_ready_list+0x1c6/0x7e0 fs/eventpoll.c:711
ep_send_events fs/eventpoll.c:1723 [inline]
ep_poll+0x234/0xa50 fs/eventpoll.c:1848
SYSC_epoll_wait fs/eventpoll.c:2195 [inline]
SyS_epoll_wait+0x150/0x1a0 fs/eventpoll.c:2160
SYSC_epoll_pwait fs/eventpoll.c:2226 [inline]
SyS_epoll_pwait+0x1e9/0x230 fs/eventpoll.c:2206
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fbb7cfcaf89
RSP: 002b:00007fbb7cf57268 EFLAGS: 00000246 ORIG_RAX: 0000000000000119
RAX: ffffffffffffffda RBX: 00007fbb7d04f430 RCX: 00007fbb7cfcaf89
RDX: 0000000000000001 RSI: 0000000020000100 RDI: 0000000000000008
RBP: 00007fbb7d01c190 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000fffeffff R11: 0000000000000246 R12: 776c613d65677568
R13: 00007ffdc6e2738f R14: 65725f7261656c63 R15: 00007fbb7d04f438
Code: 9d ec f6 ff e9 de e9 ff ff e8 e3 af df ff 4c 89 ef e8 5b 40 02 00 45 31 f6 e9 88 f5 ff ff e8 ce af df ff 4c 89 ef e8 85 0a 8e 05 <0f> 0b e8 bf af df ff 49 8d bc 24 88 00 00 00 48 b8 00 00 00 00
RIP: wp_huge_pmd mm/memory.c:4011 [inline] RSP: ffff8880b3677860
RIP: __handle_mm_fault+0x259a/0x4620 mm/memory.c:4219 RSP: ffff8880b3677860
---[ end trace 11136dc1b37c4477 ]---
HEAD commit: b8f3be299d51 Linux 4.14.282
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=126d94fdf00000
kernel config: https://syzkaller.appspot.com/x/.config?x=6f19bc3398ea47b8
dashboard link: https://syzkaller.appspot.com/bug?extid=c464fddc58432bbf3f44
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1666a2a7f00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15c6740ff00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c464fd...@syzkaller.appspotmail.com
next ffff888098173880 prev ffff888098173ca0 mm ffff8880a30fa640
prot 25 anon_vma (null) vm_ops ffffffff8790a960
pgoff 0 file ffff8880b4f8f5c0 private_data (null)
flags: 0x20fe(write|exec|shared|mayread|maywrite|mayexec|mayshare|locked)
------------[ cut here ]------------
kernel BUG at mm/memory.c:4011!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 7984 Comm: syz-executor428 Not tainted 4.14.282-syzkaller #0
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff888097b803c0 task.stack: ffff8880b3670000
RIP: 0010:wp_huge_pmd mm/memory.c:4011 [inline]
RIP: 0010:__handle_mm_fault+0x259a/0x4620 mm/memory.c:4219
RSP: 0018:ffff8880b3677860 EFLAGS: 00010287
RAX: 0000000000000140 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff878bc600 RDI: ffffed10166ceeeb
RBP: 1ffff110166cef12 R08: 0000000000000140 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 000000008b8000e5
R13: ffff8880b35a5460 R14: 00000000000000e5 R15: ffffffff88cca358
FS: 00007fbb7cf57700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000100 CR3: 0000000099b75000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
handle_mm_fault+0x455/0x9c0 mm/memory.c:4266
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__do_page_fault+0x549/0xad0 arch/x86/mm/fault.c:1442
page_fault+0x25/0x50 arch/x86/entry/entry_64.S:1123
RIP: 0010:ep_send_events_proc+0x4e6/0x9c0 fs/eventpoll.c:1684
RSP: 0018:ffff8880b3677b40 EFLAGS: 00050246
RAX: 0000000000000004 RBX: ffff8880b43f1318 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffffff8b9c4a00 R09: 0000000000000001
R10: 0000000000000000 R11: ffff888097b803c0 R12: ffff8880b3677c58
R13: ffff8880b43f1320 R14: ffff8880b43f1370 R15: ffff8880b43f1368
ep_scan_ready_list+0x1c6/0x7e0 fs/eventpoll.c:711
ep_send_events fs/eventpoll.c:1723 [inline]
ep_poll+0x234/0xa50 fs/eventpoll.c:1848
SYSC_epoll_wait fs/eventpoll.c:2195 [inline]
SyS_epoll_wait+0x150/0x1a0 fs/eventpoll.c:2160
SYSC_epoll_pwait fs/eventpoll.c:2226 [inline]
SyS_epoll_pwait+0x1e9/0x230 fs/eventpoll.c:2206
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fbb7cfcaf89
RSP: 002b:00007fbb7cf57268 EFLAGS: 00000246 ORIG_RAX: 0000000000000119
RAX: ffffffffffffffda RBX: 00007fbb7d04f430 RCX: 00007fbb7cfcaf89
RDX: 0000000000000001 RSI: 0000000020000100 RDI: 0000000000000008
RBP: 00007fbb7d01c190 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000fffeffff R11: 0000000000000246 R12: 776c613d65677568
R13: 00007ffdc6e2738f R14: 65725f7261656c63 R15: 00007fbb7d04f438
Code: 9d ec f6 ff e9 de e9 ff ff e8 e3 af df ff 4c 89 ef e8 5b 40 02 00 45 31 f6 e9 88 f5 ff ff e8 ce af df ff 4c 89 ef e8 85 0a 8e 05 <0f> 0b e8 bf af df ff 49 8d bc 24 88 00 00 00 48 b8 00 00 00 00
RIP: wp_huge_pmd mm/memory.c:4011 [inline] RSP: ffff8880b3677860
RIP: __handle_mm_fault+0x259a/0x4620 mm/memory.c:4219 RSP: ffff8880b3677860
---[ end trace 11136dc1b37c4477 ]---
Reply all
Reply to author
Forward
0 new messages