Hello,
syzbot found the following issue on:
HEAD commit: 9dbc1c03 Merge tag 'xfs-5.10-fixes-3' of git://git.kernel...
git tree: upstream
console output:
https://syzkaller.appspot.com/x/log.txt?x=16ddbdc6500000
kernel config:
https://syzkaller.appspot.com/x/.config?x=42c710ce5e1a8106
dashboard link:
https://syzkaller.appspot.com/bug?extid=de82c3b6b7737ee524de
compiler: clang version 11.0.0 (
https://github.com/llvm/llvm-project.git ca2dcbd030eadbf0aa9b660efe864ff08af6e18b)
CC: [
jmo...@namei.org linux-...@vger.kernel.org linux-secu...@vger.kernel.org penguin...@I-love.SAKURA.ne.jp se...@hallyn.com take...@nttdata.co.jp]
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+de82c3...@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: ffffffffa0050d4c
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD b88f067 P4D b88f067 PUD b890063 PMD 11377067 PTE 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4885 Comm: systemd-udevd Not tainted 5.10.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0xffffffffa0050d4c
Code: Unable to access opcode bytes at RIP 0xffffffffa0050d22.
RSP: 0018:ffffc900013ff868 EFLAGS: 00010046
RAX: 1ffff920001d3006 RBX: ffffc90000e98038 RCX: ffff8880193ccec0
RDX: 0000000000000000 RSI: ffffc90000e98038 RDI: ffffc900013ff870
RBP: ffffc900013ff8d0 R08: ffffffff817df106 R09: fffffbfff1d92a61
R10: fffffbfff1d92a61 R11: 0000000000000000 R12: ffff8880193ccec0
R13: dffffc0000000000 R14: ffff88801e104ec0 R15: ffffc90000e98030
FS: 00007f75546d08c0(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa0050d22 CR3: 0000000012e2a000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__traceiter_sched_switch+0x77/0xa0 include/trace/events/sched.h:138
trace_sched_switch+0x12a/0x150 include/trace/events/sched.h:138
__schedule+0x683/0xcb0 kernel/sched/core.c:4520
preempt_schedule_common kernel/sched/core.c:4682 [inline]
preempt_schedule+0xde/0x120 kernel/sched/core.c:4707
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:40
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
_raw_spin_unlock_irqrestore+0x58/0x60 kernel/locking/spinlock.c:191
__debug_check_no_obj_freed lib/debugobjects.c:997 [inline]
debug_check_no_obj_freed+0x5a2/0x650 lib/debugobjects.c:1018
slab_free_hook mm/slub.c:1536 [inline]
slab_free_freelist_hook+0xc6/0x1a0 mm/slub.c:1577
slab_free mm/slub.c:3142 [inline]
kfree+0xd1/0x280 mm/slub.c:4124
tomoyo_realpath_from_path+0x5d1/0x620 security/tomoyo/realpath.c:291
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x191/0x570 security/tomoyo/file.c:822
security_inode_getattr+0xc0/0x140 security/security.c:1279
vfs_getattr fs/stat.c:121 [inline]
vfs_statx+0xe8/0x320 fs/stat.c:189
vfs_fstatat fs/stat.c:207 [inline]
vfs_lstat include/linux/fs.h:3109 [inline]
__do_sys_newlstat fs/stat.c:362 [inline]
__se_sys_newlstat fs/stat.c:356 [inline]
__x64_sys_newlstat+0x81/0xd0 fs/stat.c:356
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f7553543335
Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89
RSP: 002b:00007ffc1eaffc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 000055acdb4a5960 RCX: 00007f7553543335
RDX: 00007ffc1eaffcb0 RSI: 00007ffc1eaffcb0 RDI: 000055acdb4a4960
RBP: 00007ffc1eaffd70 R08: 00007f75538021e8 R09: 0000000000001010
R10: 00007f7553801b58 R11: 0000000000000246 R12: 000055acdb4a4960
R13: 000055acdb4a4985 R14: 000055acdb49c384 R15: 000055acdb49c385
Modules linked in:
CR2: ffffffffa0050d4c
---[ end trace 94a3107ffe082bfa ]---
RIP: 0010:0xffffffffa0050d4c
Code: Unable to access opcode bytes at RIP 0xffffffffa0050d22.
RSP: 0018:ffffc900013ff868 EFLAGS: 00010046
RAX: 1ffff920001d3006 RBX: ffffc90000e98038 RCX: ffff8880193ccec0
RDX: 0000000000000000 RSI: ffffc90000e98038 RDI: ffffc900013ff870
RBP: ffffc900013ff8d0 R08: ffffffff817df106 R09: fffffbfff1d92a61
R10: fffffbfff1d92a61 R11: 0000000000000000 R12: ffff8880193ccec0
R13: dffffc0000000000 R14: ffff88801e104ec0 R15: ffffc90000e98030
FS: 00007f75546d08c0(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa0050d22 CR3: 0000000012e2a000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.