[moderation] [arm?] BUG: unable to handle kernel NULL pointer dereference in __run_timers
1 view
Skip to first unread message
syzbot
Jun 2, 2024, 6:06:31 AMJun 2
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: e0cce98fe279 Merge tag 'tpmdd-next-6.10-rc2' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=127f8206980000
kernel config: https://syzkaller.appspot.com/x/.config?x=bd6024aedb15e15c
dashboard link: https://syzkaller.appspot.com/bug?extid=de2eafe1c40a407c890e
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
CC: [catalin...@arm.com linux-ar...@lists.infradead.org linux-...@vger.kernel.org wi...@kernel.org]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-e0cce98f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/57317d5558d6/vmlinux-e0cce98f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e78d15a47f70/Image-e0cce98f.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+de2eaf...@syzkaller.appspotmail.com
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088
Mem abort info:
ESR = 0x0000000096000045
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000045, ISS2 = 0x00000000
CM = 0, WnR = 1, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 52-bit VAs, pgdp=0000000043998180
[0000000000000088] pgd=0800000046771003, p4d=080000004cbff003, pud=0000000000000000
Internal error: Oops: 0000000096000045 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3207 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: linux,dummy-virt (DT)
pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __hlist_del include/linux/list.h:990 [inline]
pc : detach_timer kernel/time/timer.c:934 [inline]
pc : expire_timers kernel/time/timer.c:1826 [inline]
pc : __run_timers+0x1ec/0x254 kernel/time/timer.c:2417
lr : __run_timers+0x198/0x254 kernel/time/timer.c:2414
sp : ffff800080003e50
x29: ffff800080003e50 x28: ffff800080003ed8 x27: ffff8000825d79c0
x26: fff000007f8cd6e8 x25: fff000007f8cd6a8 x24: ffff800080003ec8
x23: 0000000000000002 x22: dead000000000122 x21: ffff8000825b2d48
x20: fff000007f8cd680 x19: fcf000000d93abd8 x18: 0000000000000001
x17: fff07ffffd319000 x16: ffff800080000000 x15: 00004c4b40000000
x14: 000000000000021f x13: 000000000000021f x12: 0000000000000001
x11: 0000000000000009 x10: 0000000000000004 x9 : 0000000000000b56
x8 : 0000000000000001 x7 : ffff800080003ee0 x6 : 00000000000000bf
x5 : 000000000028a24d x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000100002fc1 x1 : ffff800080003ed8 x0 : 0000000000000080
Call trace:
__hlist_del include/linux/list.h:989 [inline]
detach_timer kernel/time/timer.c:934 [inline]
expire_timers kernel/time/timer.c:1826 [inline]
__run_timers+0x1ec/0x254 kernel/time/timer.c:2417
__run_timer_base kernel/time/timer.c:2428 [inline]
__run_timer_base kernel/time/timer.c:2421 [inline]
run_timer_base kernel/time/timer.c:2437 [inline]
run_timer_softirq+0x8c/0xfc kernel/time/timer.c:2447
handle_softirqs+0x10c/0x240 kernel/softirq.c:554
__do_softirq+0x14/0x20 kernel/softirq.c:588
____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:81
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:86
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbc/0xd8 kernel/softirq.c:649
__el1_irq arch/arm64/kernel/entry-common.c:537 [inline]
el1_interrupt+0x38/0x64 arch/arm64/kernel/entry-common.c:551
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
__list_del_entry_valid include/linux/list.h:124 [inline]
__list_del_entry include/linux/list.h:215 [inline]
list_del include/linux/list.h:229 [inline]
__rmqueue_pcplist+0xa8/0xbcc mm/page_alloc.c:2921
rmqueue_pcplist mm/page_alloc.c:2953 [inline]
rmqueue mm/page_alloc.c:2990 [inline]
get_page_from_freelist+0x710/0x1560 mm/page_alloc.c:3399
__alloc_pages_noprof+0x170/0xd58 mm/page_alloc.c:4660
alloc_pages_bulk_noprof+0x370/0x608 mm/page_alloc.c:4608
alloc_pages_bulk_array_mempolicy_noprof+0xbc/0x544 mm/mempolicy.c:2547
vm_area_alloc_pages mm/vmalloc.c:3532 [inline]
__vmalloc_area_node mm/vmalloc.c:3642 [inline]
__vmalloc_node_range_noprof+0x254/0x848 mm/vmalloc.c:3823
__vmalloc_node_noprof mm/vmalloc.c:3888 [inline]
vzalloc_noprof+0x94/0xa4 mm/vmalloc.c:3961
alloc_counters.isra.0+0x20/0x13c net/ipv4/netfilter/arp_tables.c:660
copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:837 [inline]
get_entries net/ipv6/netfilter/ip6_tables.c:1039 [inline]
do_ip6t_get_ctl+0x27c/0x49c net/ipv6/netfilter/ip6_tables.c:1677
nf_getsockopt+0x60/0x8c net/netfilter/nf_sockopt.c:116
ipv6_getsockopt+0x134/0x204 net/ipv6/ipv6_sockglue.c:1494
tcp_getsockopt+0x20/0x48 net/ipv4/tcp.c:4399
sock_common_getsockopt+0x1c/0x28 net/core/sock.c:3699
do_sock_getsockopt+0x13c/0x288 net/socket.c:2374
__sys_getsockopt+0x78/0xd0 net/socket.c:2403
__do_sys_getsockopt net/socket.c:2413 [inline]
__se_sys_getsockopt net/socket.c:2410 [inline]
__arm64_sys_getsockopt+0x24/0x34 net/socket.c:2410
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: f9000693 a9400660 f9000020 b4000040 (f9000401)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: f9000693 str x19, [x20, #8]
4: a9400660 ldp x0, x1, [x19]
8: f9000020 str x0, [x1]
c: b4000040 cbz x0, 0x14
* 10: f9000401 str x1, [x0, #8] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: e0cce98fe279 Merge tag 'tpmdd-next-6.10-rc2' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=127f8206980000
kernel config: https://syzkaller.appspot.com/x/.config?x=bd6024aedb15e15c
dashboard link: https://syzkaller.appspot.com/bug?extid=de2eafe1c40a407c890e
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
CC: [catalin...@arm.com linux-ar...@lists.infradead.org linux-...@vger.kernel.org wi...@kernel.org]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-e0cce98f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/57317d5558d6/vmlinux-e0cce98f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e78d15a47f70/Image-e0cce98f.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+de2eaf...@syzkaller.appspotmail.com
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088
Mem abort info:
ESR = 0x0000000096000045
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000045, ISS2 = 0x00000000
CM = 0, WnR = 1, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 52-bit VAs, pgdp=0000000043998180
[0000000000000088] pgd=0800000046771003, p4d=080000004cbff003, pud=0000000000000000
Internal error: Oops: 0000000096000045 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3207 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: linux,dummy-virt (DT)
pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __hlist_del include/linux/list.h:990 [inline]
pc : detach_timer kernel/time/timer.c:934 [inline]
pc : expire_timers kernel/time/timer.c:1826 [inline]
pc : __run_timers+0x1ec/0x254 kernel/time/timer.c:2417
lr : __run_timers+0x198/0x254 kernel/time/timer.c:2414
sp : ffff800080003e50
x29: ffff800080003e50 x28: ffff800080003ed8 x27: ffff8000825d79c0
x26: fff000007f8cd6e8 x25: fff000007f8cd6a8 x24: ffff800080003ec8
x23: 0000000000000002 x22: dead000000000122 x21: ffff8000825b2d48
x20: fff000007f8cd680 x19: fcf000000d93abd8 x18: 0000000000000001
x17: fff07ffffd319000 x16: ffff800080000000 x15: 00004c4b40000000
x14: 000000000000021f x13: 000000000000021f x12: 0000000000000001
x11: 0000000000000009 x10: 0000000000000004 x9 : 0000000000000b56
x8 : 0000000000000001 x7 : ffff800080003ee0 x6 : 00000000000000bf
x5 : 000000000028a24d x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000100002fc1 x1 : ffff800080003ed8 x0 : 0000000000000080
Call trace:
__hlist_del include/linux/list.h:989 [inline]
detach_timer kernel/time/timer.c:934 [inline]
expire_timers kernel/time/timer.c:1826 [inline]
__run_timers+0x1ec/0x254 kernel/time/timer.c:2417
__run_timer_base kernel/time/timer.c:2428 [inline]
__run_timer_base kernel/time/timer.c:2421 [inline]
run_timer_base kernel/time/timer.c:2437 [inline]
run_timer_softirq+0x8c/0xfc kernel/time/timer.c:2447
handle_softirqs+0x10c/0x240 kernel/softirq.c:554
__do_softirq+0x14/0x20 kernel/softirq.c:588
____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:81
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:86
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbc/0xd8 kernel/softirq.c:649
__el1_irq arch/arm64/kernel/entry-common.c:537 [inline]
el1_interrupt+0x38/0x64 arch/arm64/kernel/entry-common.c:551
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
__list_del_entry_valid include/linux/list.h:124 [inline]
__list_del_entry include/linux/list.h:215 [inline]
list_del include/linux/list.h:229 [inline]
__rmqueue_pcplist+0xa8/0xbcc mm/page_alloc.c:2921
rmqueue_pcplist mm/page_alloc.c:2953 [inline]
rmqueue mm/page_alloc.c:2990 [inline]
get_page_from_freelist+0x710/0x1560 mm/page_alloc.c:3399
__alloc_pages_noprof+0x170/0xd58 mm/page_alloc.c:4660
alloc_pages_bulk_noprof+0x370/0x608 mm/page_alloc.c:4608
alloc_pages_bulk_array_mempolicy_noprof+0xbc/0x544 mm/mempolicy.c:2547
vm_area_alloc_pages mm/vmalloc.c:3532 [inline]
__vmalloc_area_node mm/vmalloc.c:3642 [inline]
__vmalloc_node_range_noprof+0x254/0x848 mm/vmalloc.c:3823
__vmalloc_node_noprof mm/vmalloc.c:3888 [inline]
vzalloc_noprof+0x94/0xa4 mm/vmalloc.c:3961
alloc_counters.isra.0+0x20/0x13c net/ipv4/netfilter/arp_tables.c:660
copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:837 [inline]
get_entries net/ipv6/netfilter/ip6_tables.c:1039 [inline]
do_ip6t_get_ctl+0x27c/0x49c net/ipv6/netfilter/ip6_tables.c:1677
nf_getsockopt+0x60/0x8c net/netfilter/nf_sockopt.c:116
ipv6_getsockopt+0x134/0x204 net/ipv6/ipv6_sockglue.c:1494
tcp_getsockopt+0x20/0x48 net/ipv4/tcp.c:4399
sock_common_getsockopt+0x1c/0x28 net/core/sock.c:3699
do_sock_getsockopt+0x13c/0x288 net/socket.c:2374
__sys_getsockopt+0x78/0xd0 net/socket.c:2403
__do_sys_getsockopt net/socket.c:2413 [inline]
__se_sys_getsockopt net/socket.c:2410 [inline]
__arm64_sys_getsockopt+0x24/0x34 net/socket.c:2410
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: f9000693 a9400660 f9000020 b4000040 (f9000401)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: f9000693 str x19, [x20, #8]
4: a9400660 ldp x0, x1, [x19]
8: f9000020 str x0, [x1]
c: b4000040 cbz x0, 0x14
* 10: f9000401 str x1, [x0, #8] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages