kernel BUG in assoc_array_insert
18 views
Skip to first unread message
syzbot
Feb 9, 2021, 12:53:16 AM2/9/21
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 5c279c4c Revert "x86/setup: don't remove E820_TYPE_RAM for..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14a10fdcd00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e83e68d0a6aba5f6
dashboard link: https://syzkaller.appspot.com/bug?extid=ca3a281e39f37e81c409
CC: [dhow...@redhat.com jar...@kernel.org jmo...@namei.org keyr...@vger.kernel.org linux-...@vger.kernel.org linux-secu...@vger.kernel.org se...@hallyn.com]
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ca3a28...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at lib/assoc_array.c:652!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2993 Comm: kworker/0:2 Not tainted 5.11.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: afs afs_manage_cell_work
RIP: 0010:assoc_array_insert_into_terminal_node lib/assoc_array.c:652 [inline]
RIP: 0010:assoc_array_insert+0x1e53/0x2e70 lib/assoc_array.c:1001
Code: 0f 84 c4 fe ff ff e8 1c d5 f1 fd e9 ba fe ff ff e8 02 3b af fd 0f 0b e8 fb 3a af fd 0f 0b e8 f4 3a af fd 0f 0b e8 ed 3a af fd <0f> 0b 48 8b 04 24 4c 89 7c 24 50 48 b9 00 00 00 00 00 fc ff df 41
RSP: 0018:ffffc900017077a8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000000
RDX: ffff88801b528040 RSI: ffffffff83c398a3 RDI: ffff88801ae4c250
RBP: ffff88801e9de690 R08: 0000000000000010 R09: 0000000000000000
R10: ffffffff83c39135 R11: 0000000000000000 R12: ffff88801ae4c290
R13: 000000000000000f R14: ffff888023d3a700 R15: ffff88801f7ee000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f54c3fb7000 CR3: 000000006811c000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__key_link_begin+0xec/0x250 security/keys/keyring.c:1314
construct_alloc_key security/keys/request_key.c:404 [inline]
construct_key_and_link security/keys/request_key.c:499 [inline]
request_key_and_link+0x7ac/0x1270 security/keys/request_key.c:637
request_key_tag+0x4e/0xb0 security/keys/request_key.c:701
dns_query+0x257/0x6d0 net/dns_resolver/dns_query.c:128
afs_dns_query+0x122/0x390 fs/afs/addr_list.c:249
afs_update_cell fs/afs/cell.c:402 [inline]
afs_manage_cell fs/afs/cell.c:784 [inline]
afs_manage_cell_work+0xa05/0x11f0 fs/afs/cell.c:840
process_one_work+0x98d/0x15f0 kernel/workqueue.c:2275
worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
kthread+0x3b1/0x4a0 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Modules linked in:
---[ end trace 00cff402f5b0a0cc ]---
RIP: 0010:assoc_array_insert_into_terminal_node lib/assoc_array.c:652 [inline]
RIP: 0010:assoc_array_insert+0x1e53/0x2e70 lib/assoc_array.c:1001
Code: 0f 84 c4 fe ff ff e8 1c d5 f1 fd e9 ba fe ff ff e8 02 3b af fd 0f 0b e8 fb 3a af fd 0f 0b e8 f4 3a af fd 0f 0b e8 ed 3a af fd <0f> 0b 48 8b 04 24 4c 89 7c 24 50 48 b9 00 00 00 00 00 fc ff df 41
RSP: 0018:ffffc900017077a8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000000
RDX: ffff88801b528040 RSI: ffffffff83c398a3 RDI: ffff88801ae4c250
RBP: ffff88801e9de690 R08: 0000000000000010 R09: 0000000000000000
R10: ffffffff83c39135 R11: 0000000000000000 R12: ffff88801ae4c290
R13: 000000000000000f R14: ffff888023d3a700 R15: ffff88801f7ee000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f986500ff20 CR3: 0000000036126000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 5c279c4c Revert "x86/setup: don't remove E820_TYPE_RAM for..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14a10fdcd00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e83e68d0a6aba5f6
dashboard link: https://syzkaller.appspot.com/bug?extid=ca3a281e39f37e81c409
CC: [dhow...@redhat.com jar...@kernel.org jmo...@namei.org keyr...@vger.kernel.org linux-...@vger.kernel.org linux-secu...@vger.kernel.org se...@hallyn.com]
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ca3a28...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at lib/assoc_array.c:652!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2993 Comm: kworker/0:2 Not tainted 5.11.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: afs afs_manage_cell_work
RIP: 0010:assoc_array_insert_into_terminal_node lib/assoc_array.c:652 [inline]
RIP: 0010:assoc_array_insert+0x1e53/0x2e70 lib/assoc_array.c:1001
Code: 0f 84 c4 fe ff ff e8 1c d5 f1 fd e9 ba fe ff ff e8 02 3b af fd 0f 0b e8 fb 3a af fd 0f 0b e8 f4 3a af fd 0f 0b e8 ed 3a af fd <0f> 0b 48 8b 04 24 4c 89 7c 24 50 48 b9 00 00 00 00 00 fc ff df 41
RSP: 0018:ffffc900017077a8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000000
RDX: ffff88801b528040 RSI: ffffffff83c398a3 RDI: ffff88801ae4c250
RBP: ffff88801e9de690 R08: 0000000000000010 R09: 0000000000000000
R10: ffffffff83c39135 R11: 0000000000000000 R12: ffff88801ae4c290
R13: 000000000000000f R14: ffff888023d3a700 R15: ffff88801f7ee000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f54c3fb7000 CR3: 000000006811c000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__key_link_begin+0xec/0x250 security/keys/keyring.c:1314
construct_alloc_key security/keys/request_key.c:404 [inline]
construct_key_and_link security/keys/request_key.c:499 [inline]
request_key_and_link+0x7ac/0x1270 security/keys/request_key.c:637
request_key_tag+0x4e/0xb0 security/keys/request_key.c:701
dns_query+0x257/0x6d0 net/dns_resolver/dns_query.c:128
afs_dns_query+0x122/0x390 fs/afs/addr_list.c:249
afs_update_cell fs/afs/cell.c:402 [inline]
afs_manage_cell fs/afs/cell.c:784 [inline]
afs_manage_cell_work+0xa05/0x11f0 fs/afs/cell.c:840
process_one_work+0x98d/0x15f0 kernel/workqueue.c:2275
worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
kthread+0x3b1/0x4a0 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Modules linked in:
---[ end trace 00cff402f5b0a0cc ]---
RIP: 0010:assoc_array_insert_into_terminal_node lib/assoc_array.c:652 [inline]
RIP: 0010:assoc_array_insert+0x1e53/0x2e70 lib/assoc_array.c:1001
Code: 0f 84 c4 fe ff ff e8 1c d5 f1 fd e9 ba fe ff ff e8 02 3b af fd 0f 0b e8 fb 3a af fd 0f 0b e8 f4 3a af fd 0f 0b e8 ed 3a af fd <0f> 0b 48 8b 04 24 4c 89 7c 24 50 48 b9 00 00 00 00 00 fc ff df 41
RSP: 0018:ffffc900017077a8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000000
RDX: ffff88801b528040 RSI: ffffffff83c398a3 RDI: ffff88801ae4c250
RBP: ffff88801e9de690 R08: 0000000000000010 R09: 0000000000000000
R10: ffffffff83c39135 R11: 0000000000000000 R12: ffff88801ae4c290
R13: 000000000000000f R14: ffff888023d3a700 R15: ffff88801f7ee000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f986500ff20 CR3: 0000000036126000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
May 6, 2021, 1:49:13 AM5/6/21
to syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages