BUG: unable to handle kernel paging request in __schedule
12 views
Skip to first unread message
syzbot
Sep 21, 2020, 3:56:16 PM9/21/20
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 63d1c2f0 ANDROID: mm: add generic __va_function and __pa_f..
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=13a54173900000
kernel config: https://syzkaller.appspot.com/x/.config?x=a189fc0e5a79868a
dashboard link: https://syzkaller.appspot.com/bug?extid=e9c98bdf24a3cce55110
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e9c98b...@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: ffffffffa00f0def
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 4c0f067 P4D 4c0f067 PUD 4c10063 PMD 1d44d5067 PTE 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 11060 Comm: kworker/1:0 Not tainted 5.4.65-syzkaller-00175-g63d1c2f0b547 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: 0x0 (events)
RIP: 0010:0xffffffffa00f0def
Code: Bad RIP value.
RSP: 0018:ffff8881ce2dfbd8 EFLAGS: 00010046
RAX: 1ffff9200003cc06 RBX: ffff8881ce2dfc20 RCX: ffff8881d03e1f00
RDX: 0000000000000000 RSI: ffffc900001e6038 RDI: ffff8881ce2dfc20
RBP: ffff8881ce2dfcb0 R08: dffffc0000000000 R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881ce2dfc20
R13: dffffc0000000000 R14: ffffc900001e6000 R15: 1ffff11039c5bf80
FS: 0000000000000000(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa00f0dc5 CR3: 000000019f63c005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_sched_switch include/trace/events/sched.h:138 [inline]
__schedule+0x599/0xe30 kernel/sched/core.c:4285
schedule+0x126/0x1d0 kernel/sched/core.c:4355
worker_thread+0xf54/0x1430 kernel/workqueue.c:2441
kthread+0x317/0x340 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: ffffffffa00f0def
---[ end trace 765571e2ff456abf ]---
RIP: 0010:0xffffffffa00f0def
Code: Bad RIP value.
RSP: 0018:ffff8881ce2dfbd8 EFLAGS: 00010046
RAX: 1ffff9200003cc06 RBX: ffff8881ce2dfc20 RCX: ffff8881d03e1f00
RDX: 0000000000000000 RSI: ffffc900001e6038 RDI: ffff8881ce2dfc20
RBP: ffff8881ce2dfcb0 R08: dffffc0000000000 R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881ce2dfc20
R13: dffffc0000000000 R14: ffffc900001e6000 R15: 1ffff11039c5bf80
FS: 0000000000000000(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa00f0dc5 CR3: 000000019f63c005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 63d1c2f0 ANDROID: mm: add generic __va_function and __pa_f..
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=13a54173900000
kernel config: https://syzkaller.appspot.com/x/.config?x=a189fc0e5a79868a
dashboard link: https://syzkaller.appspot.com/bug?extid=e9c98bdf24a3cce55110
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e9c98b...@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: ffffffffa00f0def
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 4c0f067 P4D 4c0f067 PUD 4c10063 PMD 1d44d5067 PTE 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 11060 Comm: kworker/1:0 Not tainted 5.4.65-syzkaller-00175-g63d1c2f0b547 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: 0x0 (events)
RIP: 0010:0xffffffffa00f0def
Code: Bad RIP value.
RSP: 0018:ffff8881ce2dfbd8 EFLAGS: 00010046
RAX: 1ffff9200003cc06 RBX: ffff8881ce2dfc20 RCX: ffff8881d03e1f00
RDX: 0000000000000000 RSI: ffffc900001e6038 RDI: ffff8881ce2dfc20
RBP: ffff8881ce2dfcb0 R08: dffffc0000000000 R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881ce2dfc20
R13: dffffc0000000000 R14: ffffc900001e6000 R15: 1ffff11039c5bf80
FS: 0000000000000000(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa00f0dc5 CR3: 000000019f63c005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_sched_switch include/trace/events/sched.h:138 [inline]
__schedule+0x599/0xe30 kernel/sched/core.c:4285
schedule+0x126/0x1d0 kernel/sched/core.c:4355
worker_thread+0xf54/0x1430 kernel/workqueue.c:2441
kthread+0x317/0x340 kernel/kthread.c:268
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: ffffffffa00f0def
---[ end trace 765571e2ff456abf ]---
RIP: 0010:0xffffffffa00f0def
Code: Bad RIP value.
RSP: 0018:ffff8881ce2dfbd8 EFLAGS: 00010046
RAX: 1ffff9200003cc06 RBX: ffff8881ce2dfc20 RCX: ffff8881d03e1f00
RDX: 0000000000000000 RSI: ffffc900001e6038 RDI: ffff8881ce2dfc20
RBP: ffff8881ce2dfcb0 R08: dffffc0000000000 R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881ce2dfc20
R13: dffffc0000000000 R14: ffffc900001e6000 R15: 1ffff11039c5bf80
FS: 0000000000000000(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa00f0dc5 CR3: 000000019f63c005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Oct 12, 2020, 1:38:15 AM10/12/20
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: d0e6eb87 ANDROID: scsi: ufs: split up UFSHCD_QUIRK_NO_KEYS..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=14384fbf900000
kernel config: https://syzkaller.appspot.com/x/.config?x=4bda4a55322c359a
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1664fd84500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e9c98b...@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: ffffffffa0128165
Code: Bad RIP value.
RSP: 0018:ffff8881cdd17ab8 EFLAGS: 00010046
RAX: 1ffff9200000da06 RBX: ffff8881cdd17b00 RCX: ffff8881ce36ec80
RDX: 0000000000000000 RSI: ffffc9000006d038 RDI: ffff8881cdd17b00
RBP: ffff8881cdd17b90 R08: ffffffff81485849 R09: fffffbfff09b258d
R10: fffffbfff09b258d R11: 0000000000000000 R12: ffff8881cdd17b00
R13: dffffc0000000000 R14: ffffc9000006d000 R15: 1ffff11039ba2f5c
FS: 0000000001ea3880(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
schedule+0x126/0x1d0 kernel/sched/core.c:4357
freezable_schedule include/linux/freezer.h:172 [inline]
do_nanosleep+0x1ba/0x6b0 kernel/time/hrtimer.c:1874
hrtimer_nanosleep kernel/time/hrtimer.c:1927 [inline]
__do_sys_nanosleep kernel/time/hrtimer.c:1961 [inline]
__se_sys_nanosleep+0x3b1/0x550 kernel/time/hrtimer.c:1948
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x43fde0
Code: c0 5b 5d c3 66 0f 1f 44 00 00 8b 04 24 48 83 c4 18 5b 5d c3 66 0f 1f 44 00 00 83 3d b1 3d 29 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 f4 20 fc ff c3 48 83 ec 08 e8 ba 41 00 00
RSP: 002b:00007ffc20c5bf48 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: ffffffffffffffda RBX: 0000000000000167 RCX: 000000000043fde0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffc20c5bf50
RBP: 00000000000076a3 R08: 0000000000000158 R09: 0000000001ea3880
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402360
R13: 00000000004023f0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffffffa0128165
---[ end trace 621eb116eb3ce378 ]---
RIP: 0010:0xffffffffa0128165
Code: Bad RIP value.
RSP: 0018:ffff8881cdd17ab8 EFLAGS: 00010046
RAX: 1ffff9200000da06 RBX: ffff8881cdd17b00 RCX: ffff8881ce36ec80
RDX: 0000000000000000 RSI: ffffc9000006d038 RDI: ffff8881cdd17b00
RBP: ffff8881cdd17b90 R08: ffffffff81485849 R09: fffffbfff09b258d
R10: fffffbfff09b258d R11: 0000000000000000 R12: ffff8881cdd17b00
R13: dffffc0000000000 R14: ffffc9000006d000 R15: 1ffff11039ba2f5c
FS: 0000000001ea3880(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
HEAD commit: d0e6eb87 ANDROID: scsi: ufs: split up UFSHCD_QUIRK_NO_KEYS..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=14384fbf900000
kernel config: https://syzkaller.appspot.com/x/.config?x=4bda4a55322c359a
dashboard link: https://syzkaller.appspot.com/bug?extid=e9c98bdf24a3cce55110
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=133f6078500000
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1664fd84500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e9c98b...@syzkaller.appspotmail.com
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 4c0f067 P4D 4c0f067 PUD 4c10063 PMD 1d4fa2067 PTE 0
#PF: error_code(0x0010) - not-present page
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 344 Comm: syz-executor785 Not tainted 5.4.70-syzkaller-00063-gd0e6eb879517 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0xffffffffa0128165
Code: Bad RIP value.
RSP: 0018:ffff8881cdd17ab8 EFLAGS: 00010046
RAX: 1ffff9200000da06 RBX: ffff8881cdd17b00 RCX: ffff8881ce36ec80
RDX: 0000000000000000 RSI: ffffc9000006d038 RDI: ffff8881cdd17b00
RBP: ffff8881cdd17b90 R08: ffffffff81485849 R09: fffffbfff09b258d
R10: fffffbfff09b258d R11: 0000000000000000 R12: ffff8881cdd17b00
R13: dffffc0000000000 R14: ffffc9000006d000 R15: 1ffff11039ba2f5c
FS: 0000000001ea3880(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa012813b CR3: 00000001c584a006 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_sched_switch include/trace/events/sched.h:138 [inline]
__schedule+0x599/0xe30 kernel/sched/core.c:4286
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_sched_switch include/trace/events/sched.h:138 [inline]
schedule+0x126/0x1d0 kernel/sched/core.c:4357
freezable_schedule include/linux/freezer.h:172 [inline]
do_nanosleep+0x1ba/0x6b0 kernel/time/hrtimer.c:1874
hrtimer_nanosleep kernel/time/hrtimer.c:1927 [inline]
__do_sys_nanosleep kernel/time/hrtimer.c:1961 [inline]
__se_sys_nanosleep+0x3b1/0x550 kernel/time/hrtimer.c:1948
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x43fde0
Code: c0 5b 5d c3 66 0f 1f 44 00 00 8b 04 24 48 83 c4 18 5b 5d c3 66 0f 1f 44 00 00 83 3d b1 3d 29 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 f4 20 fc ff c3 48 83 ec 08 e8 ba 41 00 00
RSP: 002b:00007ffc20c5bf48 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: ffffffffffffffda RBX: 0000000000000167 RCX: 000000000043fde0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffc20c5bf50
RBP: 00000000000076a3 R08: 0000000000000158 R09: 0000000001ea3880
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402360
R13: 00000000004023f0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffffffa0128165
---[ end trace 621eb116eb3ce378 ]---
RIP: 0010:0xffffffffa0128165
Code: Bad RIP value.
RSP: 0018:ffff8881cdd17ab8 EFLAGS: 00010046
RAX: 1ffff9200000da06 RBX: ffff8881cdd17b00 RCX: ffff8881ce36ec80
RDX: 0000000000000000 RSI: ffffc9000006d038 RDI: ffff8881cdd17b00
RBP: ffff8881cdd17b90 R08: ffffffff81485849 R09: fffffbfff09b258d
R10: fffffbfff09b258d R11: 0000000000000000 R12: ffff8881cdd17b00
R13: dffffc0000000000 R14: ffffc9000006d000 R15: 1ffff11039ba2f5c
FS: 0000000001ea3880(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa012813b CR3: 00000001c584a006 CR4: 00000000001606e0
syzbot
Apr 17, 2023, 5:57:43 PM4/17/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages