[Android 6.1] BUG: unable to handle kernel paging request in __lookup_slow
0 views
Skip to first unread message
syzbot
May 3, 2026, 2:11:31 PM (11 hours ago) May 3
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 1e4e23ff0f90 ANDROID: GKI: update symbol list for xiaomi
git tree: android14-6.1
console output: https://syzkaller.appspot.com/x/log.txt?x=16fad748580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8b77de3a119dd560
dashboard link: https://syzkaller.appspot.com/bug?extid=3dc631faa211d0dce7f0
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bc4a73980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=106e6696580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2693932ac3ae/disk-1e4e23ff.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/80dabae9a6a0/vmlinux-1e4e23ff.xz
kernel image: https://storage.googleapis.com/syzbot-assets/46f266d66e40/bzImage-1e4e23ff.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/29afdc1d7ac6/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1474f76c580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/dd0a22eedb20/mount_4.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=13bfef6c580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3dc631...@syzkaller.appspotmail.com
WARNING: The mand mount option has been deprecated and
and is ignored by this kernel. Remove the mand
option from the mount to silence this warning.
=======================================================
exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
exFAT-fs (loop2): Medium has reported failures. Some data may be lost.
exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe2e35dda, utbl_chksum : 0xe619d30d)
BUG: unable to handle page fault for address: fffffffffffffffc
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 7012067 P4D 7012067 PUD 7014067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:__lookup_slow+0x2ca/0x410 fs/namei.c:1697
Code: 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 2b 6f f4 ff 48 8b 7c 24 08 4c 89 ee 8b 54 24 04 4c 8b 1b 41 ba 4f 27 89 b6 <45> 03 53 fc 74 02 0f 0b 41 ff d3 48 89 c3 43 0f b6 04 26 84 c0 0f
RSP: 0018:ffffc900009d79e0 EFLAGS: 00010246
RAX: 1ffffffff0b6c768 RBX: ffffffff85b63b40 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888111144220 RDI: ffff888123f10d30
RBP: ffffc900009d7ab0 R08: ffffffff87bd1517 R09: 1ffffffff0f7a2a2
R10: 00000000b689274f R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888111144220 R14: 1ffff11022228844 R15: 1ffff9200013af40
FS: 000055555cee3500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffc CR3: 000000012be41000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lookup_one_len+0x19d/0x2e0 fs/namei.c:2747
incfs_lookup_dentry+0x60/0xb0 fs/incfs/data_mgmt.c:210
ioctl_create_file fs/incfs/pseudo_files.c:556 [inline]
pending_reads_dispatch_ioctl+0x1618/0x1e60 fs/incfs/pseudo_files.c:1030
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0x12f/0x1b0 fs/ioctl.c:856
__x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:856
x64_sys_call+0x58b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc7fb59cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeef51d6e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fc7fb815fa0 RCX: 00007fc7fb59cdd9
RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000005
RBP: 00007fc7fb632d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc7fb815fac R14: 00007fc7fb815fa0 R15: 00007fc7fb815fa0
</TASK>
Modules linked in:
CR2: fffffffffffffffc
---[ end trace 0000000000000000 ]---
RIP: 0010:__lookup_slow+0x2ca/0x410 fs/namei.c:1697
Code: 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 2b 6f f4 ff 48 8b 7c 24 08 4c 89 ee 8b 54 24 04 4c 8b 1b 41 ba 4f 27 89 b6 <45> 03 53 fc 74 02 0f 0b 41 ff d3 48 89 c3 43 0f b6 04 26 84 c0 0f
RSP: 0018:ffffc900009d79e0 EFLAGS: 00010246
RAX: 1ffffffff0b6c768 RBX: ffffffff85b63b40 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888111144220 RDI: ffff888123f10d30
RBP: ffffc900009d7ab0 R08: ffffffff87bd1517 R09: 1ffffffff0f7a2a2
R10: 00000000b689274f R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888111144220 R14: 1ffff11022228844 R15: 1ffff9200013af40
FS: 000055555cee3500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffc CR3: 000000012be41000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 d8 mov %ebx,%eax
2: 48 c1 e8 03 shr $0x3,%rax
6: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
b: 74 08 je 0x15
d: 48 89 df mov %rbx,%rdi
10: e8 2b 6f f4 ff call 0xfff46f40
15: 48 8b 7c 24 08 mov 0x8(%rsp),%rdi
1a: 4c 89 ee mov %r13,%rsi
1d: 8b 54 24 04 mov 0x4(%rsp),%edx
21: 4c 8b 1b mov (%rbx),%r11
24: 41 ba 4f 27 89 b6 mov $0xb689274f,%r10d
* 2a: 45 03 53 fc add -0x4(%r11),%r10d <-- trapping instruction
2e: 74 02 je 0x32
30: 0f 0b ud2
32: 41 ff d3 call *%r11
35: 48 89 c3 mov %rax,%rbx
38: 43 0f b6 04 26 movzbl (%r14,%r12,1),%eax
3d: 84 c0 test %al,%al
3f: 0f .byte 0xf
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 1e4e23ff0f90 ANDROID: GKI: update symbol list for xiaomi
git tree: android14-6.1
console output: https://syzkaller.appspot.com/x/log.txt?x=16fad748580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8b77de3a119dd560
dashboard link: https://syzkaller.appspot.com/bug?extid=3dc631faa211d0dce7f0
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bc4a73980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=106e6696580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2693932ac3ae/disk-1e4e23ff.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/80dabae9a6a0/vmlinux-1e4e23ff.xz
kernel image: https://storage.googleapis.com/syzbot-assets/46f266d66e40/bzImage-1e4e23ff.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/29afdc1d7ac6/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1474f76c580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/dd0a22eedb20/mount_4.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=13bfef6c580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3dc631...@syzkaller.appspotmail.com
WARNING: The mand mount option has been deprecated and
and is ignored by this kernel. Remove the mand
option from the mount to silence this warning.
=======================================================
exFAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
exFAT-fs (loop2): Medium has reported failures. Some data may be lost.
exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe2e35dda, utbl_chksum : 0xe619d30d)
BUG: unable to handle page fault for address: fffffffffffffffc
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 7012067 P4D 7012067 PUD 7014067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:__lookup_slow+0x2ca/0x410 fs/namei.c:1697
Code: 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 2b 6f f4 ff 48 8b 7c 24 08 4c 89 ee 8b 54 24 04 4c 8b 1b 41 ba 4f 27 89 b6 <45> 03 53 fc 74 02 0f 0b 41 ff d3 48 89 c3 43 0f b6 04 26 84 c0 0f
RSP: 0018:ffffc900009d79e0 EFLAGS: 00010246
RAX: 1ffffffff0b6c768 RBX: ffffffff85b63b40 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888111144220 RDI: ffff888123f10d30
RBP: ffffc900009d7ab0 R08: ffffffff87bd1517 R09: 1ffffffff0f7a2a2
R10: 00000000b689274f R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888111144220 R14: 1ffff11022228844 R15: 1ffff9200013af40
FS: 000055555cee3500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffc CR3: 000000012be41000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lookup_one_len+0x19d/0x2e0 fs/namei.c:2747
incfs_lookup_dentry+0x60/0xb0 fs/incfs/data_mgmt.c:210
ioctl_create_file fs/incfs/pseudo_files.c:556 [inline]
pending_reads_dispatch_ioctl+0x1618/0x1e60 fs/incfs/pseudo_files.c:1030
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0x12f/0x1b0 fs/ioctl.c:856
__x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:856
x64_sys_call+0x58b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc7fb59cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeef51d6e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fc7fb815fa0 RCX: 00007fc7fb59cdd9
RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000005
RBP: 00007fc7fb632d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc7fb815fac R14: 00007fc7fb815fa0 R15: 00007fc7fb815fa0
</TASK>
Modules linked in:
CR2: fffffffffffffffc
---[ end trace 0000000000000000 ]---
RIP: 0010:__lookup_slow+0x2ca/0x410 fs/namei.c:1697
Code: 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 2b 6f f4 ff 48 8b 7c 24 08 4c 89 ee 8b 54 24 04 4c 8b 1b 41 ba 4f 27 89 b6 <45> 03 53 fc 74 02 0f 0b 41 ff d3 48 89 c3 43 0f b6 04 26 84 c0 0f
RSP: 0018:ffffc900009d79e0 EFLAGS: 00010246
RAX: 1ffffffff0b6c768 RBX: ffffffff85b63b40 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888111144220 RDI: ffff888123f10d30
RBP: ffffc900009d7ab0 R08: ffffffff87bd1517 R09: 1ffffffff0f7a2a2
R10: 00000000b689274f R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888111144220 R14: 1ffff11022228844 R15: 1ffff9200013af40
FS: 000055555cee3500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffc CR3: 000000012be41000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 d8 mov %ebx,%eax
2: 48 c1 e8 03 shr $0x3,%rax
6: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
b: 74 08 je 0x15
d: 48 89 df mov %rbx,%rdi
10: e8 2b 6f f4 ff call 0xfff46f40
15: 48 8b 7c 24 08 mov 0x8(%rsp),%rdi
1a: 4c 89 ee mov %r13,%rsi
1d: 8b 54 24 04 mov 0x4(%rsp),%edx
21: 4c 8b 1b mov (%rbx),%r11
24: 41 ba 4f 27 89 b6 mov $0xb689274f,%r10d
* 2a: 45 03 53 fc add -0x4(%r11),%r10d <-- trapping instruction
2e: 74 02 je 0x32
30: 0f 0b ud2
32: 41 ff d3 call *%r11
35: 48 89 c3 mov %rax,%rbx
38: 43 0f b6 04 26 movzbl (%r14,%r12,1),%eax
3d: 84 c0 test %al,%al
3f: 0f .byte 0xf
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages