[batman?] general protection fault in debug_check_no_obj_freed (7)
4 views
Skip to first unread message
syzbot
May 9, 2023, 4:32:54 PM5/9/23
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 83e5775d7afd Add linux-next specific files for 20230505
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14fea884280000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0c6b4b7069d73cf
dashboard link: https://syzkaller.appspot.com/bug?extid=97566d38c4fd36681b16
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
CC: [a...@unstable.cc b.a.t...@lists.open-mesh.org da...@davemloft.net edum...@google.com ku...@kernel.org linux-...@vger.kernel.org marekl...@neomailbox.ch net...@vger.kernel.org pab...@redhat.com sv...@narfation.org s...@simonwunderlich.de]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/95513581563c/disk-83e5775d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a4e06ec61bde/vmlinux-83e5775d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ccebc2ffc0a5/bzImage-83e5775d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+97566d...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0040000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000200000000-0x0000000200000007]
CPU: 0 PID: 5169 Comm: kworker/u4:8 Not tainted 6.3.0-next-20230505-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1012 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1d7/0x420 lib/debugobjects.c:1054
Code: 39 00 0f 85 0f 02 00 00 48 89 45 08 4d 89 30 4c 89 c7 4d 89 68 08 e8 d8 cb ff ff 48 85 ed 74 2c 49 89 e8 4c 89 c0 48 c1 e8 03 <42> 80 3c 38 00 0f 84 2e ff ff ff 4c 89 c7 4c 89 44 24 38 e8 21 dd
RSP: 0018:ffffc90000007d30 EFLAGS: 00010006
RAX: 0000000040000000 RBX: ffff888021cea280 RCX: ffff888046a5a348
RDX: 1ffff11008d4b46a RSI: 1ffff110173071f1 RDI: ffff88805e9a9280
RBP: 0000000200000001 R08: 0000000200000001 R09: 0000000100040048
R10: fffff52000000f94 R11: 0000000000094001 R12: 000000000000000c
R13: dead000000000122 R14: dead000000000100 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100040048 CR3: 000000000c571000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
slab_free_hook mm/slub.c:1756 [inline]
slab_free_freelist_hook+0xeb/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3786 [inline]
kmem_cache_free+0xe9/0x480 mm/slub.c:3808
rcu_do_batch kernel/rcu/tree.c:2115 [inline]
rcu_core+0x806/0x1a70 kernel/rcu/tree.c:2377
__do_softirq+0x1d4/0x905 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x114/0x190 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1106
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__local_bh_enable_ip+0xac/0x130 kernel/softirq.c:403
Code: 1d d1 f2 b5 7e 65 8b 05 ca f2 b5 7e a9 00 ff ff 00 74 45 bf 01 00 00 00 e8 11 6f 0a 00 e8 5c 21 3d 00 fb 65 8b 05 ac f2 b5 7e <85> c0 74 58 5b 5d c3 65 8b 05 72 bd b4 7e 85 c0 75 a2 0f 0b eb 9e
RSP: 0018:ffffc90005597c08 EFLAGS: 00000202
RAX: 0000000080000000 RBX: 00000000fffffe00 RCX: 1ffffffff22b0d66
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff89d9ff2c R08: 0000000000000001 R09: ffffffff91534ddf
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888042ee97a8
R13: ffff888042ee8c80 R14: dffffc0000000000 R15: ffffffff89da0280
spin_unlock_bh include/linux/spinlock.h:395 [inline]
batadv_nc_purge_paths+0x1cc/0x3c0 net/batman-adv/network-coding.c:471
batadv_nc_worker+0x8fa/0xfe0 net/batman-adv/network-coding.c:720
process_one_work+0x99a/0x15e0 kernel/workqueue.c:2405
worker_thread+0x67d/0x10c0 kernel/workqueue.c:2552
kthread+0x344/0x440 kernel/kthread.c:379
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1012 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1d7/0x420 lib/debugobjects.c:1054
Code: 39 00 0f 85 0f 02 00 00 48 89 45 08 4d 89 30 4c 89 c7 4d 89 68 08 e8 d8 cb ff ff 48 85 ed 74 2c 49 89 e8 4c 89 c0 48 c1 e8 03 <42> 80 3c 38 00 0f 84 2e ff ff ff 4c 89 c7 4c 89 44 24 38 e8 21 dd
RSP: 0018:ffffc90000007d30 EFLAGS: 00010006
RAX: 0000000040000000 RBX: ffff888021cea280 RCX: ffff888046a5a348
RDX: 1ffff11008d4b46a RSI: 1ffff110173071f1 RDI: ffff88805e9a9280
RBP: 0000000200000001 R08: 0000000200000001 R09: 0000000100040048
R10: fffff52000000f94 R11: 0000000000094001 R12: 000000000000000c
R13: dead000000000122 R14: dead000000000100 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100040048 CR3: 000000000c571000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 39 00 cmp %eax,(%rax)
2: 0f 85 0f 02 00 00 jne 0x217
8: 48 89 45 08 mov %rax,0x8(%rbp)
c: 4d 89 30 mov %r14,(%r8)
f: 4c 89 c7 mov %r8,%rdi
12: 4d 89 68 08 mov %r13,0x8(%r8)
16: e8 d8 cb ff ff callq 0xffffcbf3
1b: 48 85 ed test %rbp,%rbp
1e: 74 2c je 0x4c
20: 49 89 e8 mov %rbp,%r8
23: 4c 89 c0 mov %r8,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 0f 84 2e ff ff ff je 0xffffff63
35: 4c 89 c7 mov %r8,%rdi
38: 4c 89 44 24 38 mov %r8,0x38(%rsp)
3d: e8 .byte 0xe8
3e: 21 dd and %ebx,%ebp
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 83e5775d7afd Add linux-next specific files for 20230505
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14fea884280000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0c6b4b7069d73cf
dashboard link: https://syzkaller.appspot.com/bug?extid=97566d38c4fd36681b16
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
CC: [a...@unstable.cc b.a.t...@lists.open-mesh.org da...@davemloft.net edum...@google.com ku...@kernel.org linux-...@vger.kernel.org marekl...@neomailbox.ch net...@vger.kernel.org pab...@redhat.com sv...@narfation.org s...@simonwunderlich.de]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/95513581563c/disk-83e5775d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a4e06ec61bde/vmlinux-83e5775d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ccebc2ffc0a5/bzImage-83e5775d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+97566d...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0040000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000200000000-0x0000000200000007]
CPU: 0 PID: 5169 Comm: kworker/u4:8 Not tainted 6.3.0-next-20230505-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1012 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1d7/0x420 lib/debugobjects.c:1054
Code: 39 00 0f 85 0f 02 00 00 48 89 45 08 4d 89 30 4c 89 c7 4d 89 68 08 e8 d8 cb ff ff 48 85 ed 74 2c 49 89 e8 4c 89 c0 48 c1 e8 03 <42> 80 3c 38 00 0f 84 2e ff ff ff 4c 89 c7 4c 89 44 24 38 e8 21 dd
RSP: 0018:ffffc90000007d30 EFLAGS: 00010006
RAX: 0000000040000000 RBX: ffff888021cea280 RCX: ffff888046a5a348
RDX: 1ffff11008d4b46a RSI: 1ffff110173071f1 RDI: ffff88805e9a9280
RBP: 0000000200000001 R08: 0000000200000001 R09: 0000000100040048
R10: fffff52000000f94 R11: 0000000000094001 R12: 000000000000000c
R13: dead000000000122 R14: dead000000000100 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100040048 CR3: 000000000c571000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
slab_free_hook mm/slub.c:1756 [inline]
slab_free_freelist_hook+0xeb/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3786 [inline]
kmem_cache_free+0xe9/0x480 mm/slub.c:3808
rcu_do_batch kernel/rcu/tree.c:2115 [inline]
rcu_core+0x806/0x1a70 kernel/rcu/tree.c:2377
__do_softirq+0x1d4/0x905 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x114/0x190 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1106
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__local_bh_enable_ip+0xac/0x130 kernel/softirq.c:403
Code: 1d d1 f2 b5 7e 65 8b 05 ca f2 b5 7e a9 00 ff ff 00 74 45 bf 01 00 00 00 e8 11 6f 0a 00 e8 5c 21 3d 00 fb 65 8b 05 ac f2 b5 7e <85> c0 74 58 5b 5d c3 65 8b 05 72 bd b4 7e 85 c0 75 a2 0f 0b eb 9e
RSP: 0018:ffffc90005597c08 EFLAGS: 00000202
RAX: 0000000080000000 RBX: 00000000fffffe00 RCX: 1ffffffff22b0d66
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff89d9ff2c R08: 0000000000000001 R09: ffffffff91534ddf
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888042ee97a8
R13: ffff888042ee8c80 R14: dffffc0000000000 R15: ffffffff89da0280
spin_unlock_bh include/linux/spinlock.h:395 [inline]
batadv_nc_purge_paths+0x1cc/0x3c0 net/batman-adv/network-coding.c:471
batadv_nc_worker+0x8fa/0xfe0 net/batman-adv/network-coding.c:720
process_one_work+0x99a/0x15e0 kernel/workqueue.c:2405
worker_thread+0x67d/0x10c0 kernel/workqueue.c:2552
kthread+0x344/0x440 kernel/kthread.c:379
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1012 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1d7/0x420 lib/debugobjects.c:1054
Code: 39 00 0f 85 0f 02 00 00 48 89 45 08 4d 89 30 4c 89 c7 4d 89 68 08 e8 d8 cb ff ff 48 85 ed 74 2c 49 89 e8 4c 89 c0 48 c1 e8 03 <42> 80 3c 38 00 0f 84 2e ff ff ff 4c 89 c7 4c 89 44 24 38 e8 21 dd
RSP: 0018:ffffc90000007d30 EFLAGS: 00010006
RAX: 0000000040000000 RBX: ffff888021cea280 RCX: ffff888046a5a348
RDX: 1ffff11008d4b46a RSI: 1ffff110173071f1 RDI: ffff88805e9a9280
RBP: 0000000200000001 R08: 0000000200000001 R09: 0000000100040048
R10: fffff52000000f94 R11: 0000000000094001 R12: 000000000000000c
R13: dead000000000122 R14: dead000000000100 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100040048 CR3: 000000000c571000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 39 00 cmp %eax,(%rax)
2: 0f 85 0f 02 00 00 jne 0x217
8: 48 89 45 08 mov %rax,0x8(%rbp)
c: 4d 89 30 mov %r14,(%r8)
f: 4c 89 c7 mov %r8,%rdi
12: 4d 89 68 08 mov %r13,0x8(%r8)
16: e8 d8 cb ff ff callq 0xffffcbf3
1b: 48 85 ed test %rbp,%rbp
1e: 74 2c je 0x4c
20: 49 89 e8 mov %rbp,%r8
23: 4c 89 c0 mov %r8,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 0f 84 2e ff ff ff je 0xffffff63
35: 4c 89 c7 mov %r8,%rdi
38: 4c 89 44 24 38 mov %r8,0x38(%rsp)
3d: e8 .byte 0xe8
3e: 21 dd and %ebx,%ebp
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Sep 24, 2023, 2:05:44 AM9/24/23
to syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages