[v6.1] BUG: unable to handle kernel paging request in qdisc_tree_reduce_backlog
11 views
Skip to first unread message
syzbot
Jul 10, 2025, 6:10:26 PM7/10/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: dfc486ec9cce Linux 6.1.144
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=126f9bd4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f8c435072b93fddd
dashboard link: https://syzkaller.appspot.com/bug?extid=ce3896e859e1057a1449
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/be2756a32e51/disk-dfc486ec.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb99deb14858/vmlinux-dfc486ec.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c651d3cff1de/Image-dfc486ec.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ce3896...@syzkaller.appspotmail.com
tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
Unable to handle kernel paging request at virtual address dfff800000000004
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 9893 Comm: syz.0.1490 Not tainted 6.1.144-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:802
lr : qdisc_tree_reduce_backlog+0x19c/0x410 net/sched/sch_api.c:794
sp : ffff800022496da0
x29: ffff800022496da0 x28: 0000000000000004 x27: dfff800000000000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000020
x23: 00000000000b0002 x22: ffff80001775e5e0 x21: ffff0000f5dda000
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000bc62ff92
x17: dfff800000000000 x16: ffff8000082d0f50 x15: 0000000000000002
x14: 00000000ffffffff x13: 0000000000ff0100 x12: 0000000000ff0100
x11: ff0080000febb728 x10: 0000000000000002 x9 : ffff0000cdc78000
x8 : 0000000000000000 x7 : ffff80000febbedc x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:802
hhf_change+0x6c4/0xbb8 net/sched/sch_hhf.c:567
hhf_init+0x1b0/0x6fc net/sched/sch_hhf.c:593
qdisc_create+0x6f0/0xe20 net/sched/sch_api.c:1310
tc_modify_qdisc+0x954/0x1718 net/sched/sch_api.c:-1
rtnetlink_rcv_msg+0x734/0xce4 net/core/rtnetlink.c:6153
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2493
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6171
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x600/0x818 net/netlink/af_netlink.c:1337
netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1859
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
___sys_sendmsg net/socket.c:2573 [inline]
__sys_sendmsg+0x25c/0x320 net/socket.c:2602
__do_sys_sendmsg net/socket.c:2611 [inline]
__se_sys_sendmsg net/socket.c:2609 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 14000020 f9400339 91008338 d343ff1c (387b6b88)
---[ end trace 0000000000000000 ]---
pstore: crypto_comp_compress failed, ret = -22!
----------------
Code disassembly (best guess):
0: 14000020 b 0x80
4: f9400339 ldr x25, [x25]
8: 91008338 add x24, x25, #0x20
c: d343ff1c lsr x28, x24, #3
* 10: 387b6b88 ldrb w8, [x28, x27] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: dfc486ec9cce Linux 6.1.144
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=126f9bd4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f8c435072b93fddd
dashboard link: https://syzkaller.appspot.com/bug?extid=ce3896e859e1057a1449
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/be2756a32e51/disk-dfc486ec.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb99deb14858/vmlinux-dfc486ec.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c651d3cff1de/Image-dfc486ec.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ce3896...@syzkaller.appspotmail.com
tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
Unable to handle kernel paging request at virtual address dfff800000000004
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 9893 Comm: syz.0.1490 Not tainted 6.1.144-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:802
lr : qdisc_tree_reduce_backlog+0x19c/0x410 net/sched/sch_api.c:794
sp : ffff800022496da0
x29: ffff800022496da0 x28: 0000000000000004 x27: dfff800000000000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000020
x23: 00000000000b0002 x22: ffff80001775e5e0 x21: ffff0000f5dda000
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000bc62ff92
x17: dfff800000000000 x16: ffff8000082d0f50 x15: 0000000000000002
x14: 00000000ffffffff x13: 0000000000ff0100 x12: 0000000000ff0100
x11: ff0080000febb728 x10: 0000000000000002 x9 : ffff0000cdc78000
x8 : 0000000000000000 x7 : ffff80000febbedc x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:802
hhf_change+0x6c4/0xbb8 net/sched/sch_hhf.c:567
hhf_init+0x1b0/0x6fc net/sched/sch_hhf.c:593
qdisc_create+0x6f0/0xe20 net/sched/sch_api.c:1310
tc_modify_qdisc+0x954/0x1718 net/sched/sch_api.c:-1
rtnetlink_rcv_msg+0x734/0xce4 net/core/rtnetlink.c:6153
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2493
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6171
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x600/0x818 net/netlink/af_netlink.c:1337
netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1859
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
___sys_sendmsg net/socket.c:2573 [inline]
__sys_sendmsg+0x25c/0x320 net/socket.c:2602
__do_sys_sendmsg net/socket.c:2611 [inline]
__se_sys_sendmsg net/socket.c:2609 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 14000020 f9400339 91008338 d343ff1c (387b6b88)
---[ end trace 0000000000000000 ]---
pstore: crypto_comp_compress failed, ret = -22!
----------------
Code disassembly (best guess):
0: 14000020 b 0x80
4: f9400339 ldr x25, [x25]
8: 91008338 add x24, x25, #0x20
c: d343ff1c lsr x28, x24, #3
* 10: 387b6b88 ldrb w8, [x28, x27] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 11, 2025, 8:23:38 AM7/11/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: dfc486ec9cce Linux 6.1.144
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13ae668c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17ae668c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/be2756a32e51/disk-dfc486ec.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb99deb14858/vmlinux-dfc486ec.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c651d3cff1de/Image-dfc486ec.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ce3896...@syzkaller.appspotmail.com
x29: ffff800020d16d80 x28: 0000000000000004 x27: dfff800000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
x17: ffff8000181e6000 x16: ffff8000082d0f50 x15: 0000000000000000
codel_init+0x174/0x340 net/sched/sch_codel.c:196
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: dfc486ec9cce Linux 6.1.144
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=f8c435072b93fddd
dashboard link: https://syzkaller.appspot.com/bug?extid=ce3896e859e1057a1449
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1067468c580000
dashboard link: https://syzkaller.appspot.com/bug?extid=ce3896e859e1057a1449
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17ae668c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/be2756a32e51/disk-dfc486ec.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fb99deb14858/vmlinux-dfc486ec.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c651d3cff1de/Image-dfc486ec.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ce3896...@syzkaller.appspotmail.com
Unable to handle kernel paging request at virtual address dfff800000000004
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4454 Comm: syz.0.16 Not tainted 6.1.144-syzkaller #0
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:802
lr : qdisc_tree_reduce_backlog+0x19c/0x410 net/sched/sch_api.c:794
sp : ffff800020d16d80
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:802
lr : qdisc_tree_reduce_backlog+0x19c/0x410 net/sched/sch_api.c:794
x29: ffff800020d16d80 x28: 0000000000000004 x27: dfff800000000000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000020
x23: 00000000000bffe6 x22: ffff80001775e5e0 x21: ffff0000cd9f1000
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
x17: ffff8000181e6000 x16: ffff8000082d0f50 x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000ff0100 x12: 0000000000ff0100
x11: ff0080000febb728 x10: 0000000000000000 x9 : ffff0000d4a18000
x8 : 0000000000000000 x7 : ffff80000febbedc x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:802
codel_change+0x740/0xb3c net/sched/sch_codel.c:177
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:802
codel_init+0x174/0x340 net/sched/sch_codel.c:196
----------------
Code disassembly (best guess):
0: 14000020 b 0x80
4: f9400339 ldr x25, [x25]
8: 91008338 add x24, x25, #0x20
c: d343ff1c lsr x28, x24, #3
* 10: 387b6b88 ldrb w8, [x28, x27] <-- trapping instruction
---
If you want syzbot to run the reproducer, reply with:
Code disassembly (best guess):
0: 14000020 b 0x80
4: f9400339 ldr x25, [x25]
8: 91008338 add x24, x25, #0x20
c: d343ff1c lsr x28, x24, #3
* 10: 387b6b88 ldrb w8, [x28, x27] <-- trapping instruction
---
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Jul 13, 2025, 6:38:33 AM7/13/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 2f693b607545 Linux 5.15.187
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=141350f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffb429fe3ba39a3c
dashboard link: https://syzkaller.appspot.com/bug?extid=27efb90c117dc054d237
disk image: https://storage.googleapis.com/syzbot-assets/129cdeb1c037/disk-2f693b60.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f163e8700a20/vmlinux-2f693b60.xz
kernel image: https://storage.googleapis.com/syzbot-assets/22c8c0cbe264/Image-2f693b60.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+27efb9...@syzkaller.appspotmail.com
netlink: 8 bytes leftover after parsing attributes in process `syz.3.193'.
lr : qdisc_tree_reduce_backlog+0x19c/0x410 net/sched/sch_api.c:786
sp : ffff80001fe26d20
x29: ffff80001fe26d20 x28: 0000000000000004 x27: dfff800000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000201
x17: 0000000000000002 x16: ffff8000082bf708 x15: 00000000ffffffff
x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000ff0100
x11: 0000000000000201 x10: 0000000000000002 x9 : ffff0000eba3d1c0
x8 : 0000000000000000 x7 : ffff80000f8d3b08 x6 : 0000000000000000
fq_codel_change+0x8b0/0xcf8 net/sched/sch_fq_codel.c:438
fq_codel_init+0x25c/0x768 net/sched/sch_fq_codel.c:475
qdisc_create+0x6e4/0xf24 net/sched/sch_api.c:1260
tc_modify_qdisc+0x8bc/0x1308 net/sched/sch_api.c:-1
rtnetlink_rcv_msg+0x9d4/0xd04 net/core/rtnetlink.c:5650
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2489
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:5668
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x60c/0x89c net/netlink/af_netlink.c:1337
netlink_sendmsg+0x6e8/0x9cc net/netlink/af_netlink.c:1905
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x61c/0x920 net/socket.c:2436
___sys_sendmsg+0x1d0/0x240 net/socket.c:2490
__sys_sendmsg net/socket.c:2519 [inline]
__do_sys_sendmsg net/socket.c:2528 [inline]
__se_sys_sendmsg net/socket.c:2526 [inline]
__arm64_sys_sendmsg+0x1a8/0x254 net/socket.c:2526
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
syzbot found the following issue on:
HEAD commit: 2f693b607545 Linux 5.15.187
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=141350f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffb429fe3ba39a3c
dashboard link: https://syzkaller.appspot.com/bug?extid=27efb90c117dc054d237
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/129cdeb1c037/disk-2f693b60.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f163e8700a20/vmlinux-2f693b60.xz
kernel image: https://storage.googleapis.com/syzbot-assets/22c8c0cbe264/Image-2f693b60.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
netlink: 8 bytes leftover after parsing attributes in process `syz.3.193'.
Unable to handle kernel paging request at virtual address dfff800000000004
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5142 Comm: syz.3.193 Not tainted 5.15.187-syzkaller #0
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:794
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
lr : qdisc_tree_reduce_backlog+0x19c/0x410 net/sched/sch_api.c:786
sp : ffff80001fe26d20
x29: ffff80001fe26d20 x28: 0000000000000004 x27: dfff800000000000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000020
x23: 00000000000afff2 x22: ffff8000162edce0 x21: ffff0000d4d4a000
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000201
x17: 0000000000000002 x16: ffff8000082bf708 x15: 00000000ffffffff
x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000ff0100
x11: 0000000000000201 x10: 0000000000000002 x9 : ffff0000eba3d1c0
x8 : 0000000000000000 x7 : ffff80000f8d3b08 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:794
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
fq_codel_change+0x8b0/0xcf8 net/sched/sch_fq_codel.c:438
fq_codel_init+0x25c/0x768 net/sched/sch_fq_codel.c:475
qdisc_create+0x6e4/0xf24 net/sched/sch_api.c:1260
tc_modify_qdisc+0x8bc/0x1308 net/sched/sch_api.c:-1
rtnetlink_rcv_msg+0x9d4/0xd04 net/core/rtnetlink.c:5650
netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2489
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:5668
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x60c/0x89c net/netlink/af_netlink.c:1337
netlink_sendmsg+0x6e8/0x9cc net/netlink/af_netlink.c:1905
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
____sys_sendmsg+0x61c/0x920 net/socket.c:2436
___sys_sendmsg+0x1d0/0x240 net/socket.c:2490
__sys_sendmsg net/socket.c:2519 [inline]
__do_sys_sendmsg net/socket.c:2528 [inline]
__se_sys_sendmsg net/socket.c:2526 [inline]
__arm64_sys_sendmsg+0x1a8/0x254 net/socket.c:2526
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 14000020 f9400339 91008338 d343ff1c (387b6b88)
---[ end trace 259a85ecd6ff343a ]---
----------------
Code disassembly (best guess):
0: 14000020 b 0x80
4: f9400339 ldr x25, [x25]
8: 91008338 add x24, x25, #0x20
c: d343ff1c lsr x28, x24, #3
* 10: 387b6b88 ldrb w8, [x28, x27] <-- trapping instruction
---
Code disassembly (best guess):
0: 14000020 b 0x80
4: f9400339 ldr x25, [x25]
8: 91008338 add x24, x25, #0x20
c: d343ff1c lsr x28, x24, #3
* 10: 387b6b88 ldrb w8, [x28, x27] <-- trapping instruction
---
syzbot
Jul 13, 2025, 9:33:31 AM7/13/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 2f693b607545 Linux 5.15.187
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1268d0f0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=158b07d4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/129cdeb1c037/disk-2f693b60.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f163e8700a20/vmlinux-2f693b60.xz
kernel image: https://storage.googleapis.com/syzbot-assets/22c8c0cbe264/Image-2f693b60.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+27efb9...@syzkaller.appspotmail.com
x29: ffff80001fd56d20 x28: 0000000000000004 x27: dfff800000000000
---[ end trace 8f888aac76023f6d ]---
HEAD commit: 2f693b607545 Linux 5.15.187
git tree: linux-5.15.y
kernel config: https://syzkaller.appspot.com/x/.config?x=ffb429fe3ba39a3c
dashboard link: https://syzkaller.appspot.com/bug?extid=27efb90c117dc054d237
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1668d0f0580000
dashboard link: https://syzkaller.appspot.com/bug?extid=27efb90c117dc054d237
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=158b07d4580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/129cdeb1c037/disk-2f693b60.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f163e8700a20/vmlinux-2f693b60.xz
kernel image: https://storage.googleapis.com/syzbot-assets/22c8c0cbe264/Image-2f693b60.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+27efb9...@syzkaller.appspotmail.com
Unable to handle kernel paging request at virtual address dfff800000000004
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4177 Comm: syz.0.16 Not tainted 5.15.187-syzkaller #0
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:794
lr : qdisc_tree_reduce_backlog+0x19c/0x410 net/sched/sch_api.c:786
sp : ffff80001fd56d20
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qdisc_tree_reduce_backlog+0x1e8/0x410 net/sched/sch_api.c:794
lr : qdisc_tree_reduce_backlog+0x19c/0x410 net/sched/sch_api.c:786
x29: ffff80001fd56d20 x28: 0000000000000004 x27: dfff800000000000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000020
x23: 00000000000afff2 x22: ffff8000162edce0 x21: ffff0000d6cb5000
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000201
x17: 0000000000000000 x16: ffff8000082bf708 x15: 00000000ffffffff
x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000ff0100
x11: 0000000000000201 x10: 0000000000000000 x9 : ffff0000d17451c0
----------------
Code disassembly (best guess):
0: 14000020 b 0x80
4: f9400339 ldr x25, [x25]
8: 91008338 add x24, x25, #0x20
c: d343ff1c lsr x28, x24, #3
* 10: 387b6b88 ldrb w8, [x28, x27] <-- trapping instruction
---
Code disassembly (best guess):
0: 14000020 b 0x80
4: f9400339 ldr x25, [x25]
8: 91008338 add x24, x25, #0x20
c: d343ff1c lsr x28, x24, #3
* 10: 387b6b88 ldrb w8, [x28, x27] <-- trapping instruction
---
syzbot
Oct 24, 2025, 7:49:24 PM10/24/25
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages