[syzbot] [sound?] BUG: unable to handle kernel paging request in snd_hdac_bus_parse_capabilities

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0d8395707651 Merge tag 'soc-fixes-7.2-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10f63e49580000
kernel config: https://syzkaller.appspot.com/x/.config?x=acc0a882b963ae23
dashboard link: https://syzkaller.appspot.com/bug?extid=10cd2d1efe8eeb604bee
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2018c5f56c1d/disk-0d839570.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3bfeae099eec/vmlinux-0d839570.xz
kernel image: https://storage.googleapis.com/syzbot-assets/37bf23e44126/bzImage-0d839570.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+10cd2d...@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: 000000000001c094
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 3b4a3067 P4D 3b4a3067 PUD 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: events azx_probe_work
RIP: 0010:readw arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:snd_hdac_reg_readw include/sound/hdaudio.h:458 [inline]
RIP: 0010:snd_hdac_bus_parse_capabilities+0x42/0x6d0 sound/hda/core/controller.c:412
Code: 98 f8 48 8d 45 20 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f8 05 00 00 48 8b 45 20 <66> 44 8b 68 14 4c 8b 7c 24 10 48 89 e8 45 0f b7 ed 45 31 f6 48 ba
RSP: 0018:ffffc900000e7ab0 EFLAGS: 00010246
RAX: 000000000001c080 RBX: ffff88805268e058 RCX: ffffffff897da916
RDX: 1ffff1100a4d1c0b RSI: ffffffff8971ecda RDI: ffff88805268e038
RBP: ffff88805268e038 R08: 0000000000000005 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000003
R13: ffff88801e6d4f44 R14: ffff888023aca000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888123ded000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000001c094 CR3: 000000009bf8c000 CR4: 00000000003526f0
Call Trace:
<TASK>
azx_first_init sound/hda/controllers/intel.c:1936 [inline]
azx_probe_continue sound/hda/controllers/intel.c:2365 [inline]
azx_probe_work+0x1d8e/0x2640 sound/hda/controllers/intel.c:1737
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
CR2: 000000000001c094
---[ end trace 0000000000000000 ]---
RIP: 0010:readw arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:snd_hdac_reg_readw include/sound/hdaudio.h:458 [inline]
RIP: 0010:snd_hdac_bus_parse_capabilities+0x42/0x6d0 sound/hda/core/controller.c:412
Code: 98 f8 48 8d 45 20 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f8 05 00 00 48 8b 45 20 <66> 44 8b 68 14 4c 8b 7c 24 10 48 89 e8 45 0f b7 ed 45 31 f6 48 ba
RSP: 0018:ffffc900000e7ab0 EFLAGS: 00010246
RAX: 000000000001c080 RBX: ffff88805268e058 RCX: ffffffff897da916
RDX: 1ffff1100a4d1c0b RSI: ffffffff8971ecda RDI: ffff88805268e038
RBP: ffff88805268e038 R08: 0000000000000005 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000003
R13: ffff88801e6d4f44 R14: ffff888023aca000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888123ded000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000001c094 CR3: 000000009bf8c000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 98 cwtl
1: f8 clc
2: 48 8d 45 20 lea 0x20(%rbp),%rax
6: 48 89 c2 mov %rax,%rdx
9: 48 89 44 24 10 mov %rax,0x10(%rsp)
e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
15: fc ff df
18: 48 c1 ea 03 shr $0x3,%rdx
1c: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
20: 0f 85 f8 05 00 00 jne 0x61e
26: 48 8b 45 20 mov 0x20(%rbp),%rax
* 2a: 66 44 8b 68 14 mov 0x14(%rax),%r13w <-- trapping instruction
2f: 4c 8b 7c 24 10 mov 0x10(%rsp),%r15
34: 48 89 e8 mov %rbp,%rax
37: 45 0f b7 ed movzwl %r13w,%r13d
3b: 45 31 f6 xor %r14d,%r14d
3e: 48 rex.W
3f: ba .byte 0xba


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: f5bbbfec59b4 Merge tag 'probes-fixes-v7.2-rc7' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=142eb479580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307

dashboard link: https://syzkaller.appspot.com/bug?extid=10cd2d1efe8eeb604bee
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

C reproducer: https://syzkaller.appspot.com/x/repro.c?x=103a1149580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+10cd2d...@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: 000000000001c0b4

#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: Oops: 0000 [#1] SMP KASAN NOPTI

CPU: 1 UID: 0 PID: 1039 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

Workqueue: events azx_probe_work
RIP: 0010:readw arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:snd_hdac_reg_readw include/sound/hdaudio.h:458 [inline]
RIP: 0010:snd_hdac_bus_parse_capabilities+0x42/0x6d0 sound/hda/core/controller.c:412

Code: 97 f8 48 8d 45 20 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f8 05 00 00 48 8b 45 20 <66> 44 8b 68 14 4c 8b 7c 24 10 48 89 e8 45 0f b7 ed 45 31 f6 48 ba
RSP: 0018:ffffc90005537ab0 EFLAGS: 00010246
RAX: 000000000001c0a0 RBX: ffff888027304058 RCX: ffffffff897e8c06
RDX: 1ffff11004e6080b RSI: ffffffff8972cfca RDI: ffff888027304038
RBP: ffff888027304038 R08: 0000000000000005 R09: 0000000000000003
R10: 0000000000000003 R11: 000000000000759b R12: 0000000000000003
R13: ffff8880294e4f44 R14: ffff888022d6c000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5eec000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000000001c0b4 CR3: 000000005526e000 CR4: 0000000000352ef0

Call Trace:
<TASK>
azx_first_init sound/hda/controllers/intel.c:1936 [inline]
azx_probe_continue sound/hda/controllers/intel.c:2365 [inline]
azx_probe_work+0x1d8e/0x2640 sound/hda/controllers/intel.c:1737
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:

CR2: 000000000001c0b4

---[ end trace 0000000000000000 ]---
RIP: 0010:readw arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:snd_hdac_reg_readw include/sound/hdaudio.h:458 [inline]
RIP: 0010:snd_hdac_bus_parse_capabilities+0x42/0x6d0 sound/hda/core/controller.c:412

Code: 97 f8 48 8d 45 20 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f8 05 00 00 48 8b 45 20 <66> 44 8b 68 14 4c 8b 7c 24 10 48 89 e8 45 0f b7 ed 45 31 f6 48 ba
RSP: 0018:ffffc90005537ab0 EFLAGS: 00010246
RAX: 000000000001c0a0 RBX: ffff888027304058 RCX: ffffffff897e8c06
RDX: 1ffff11004e6080b RSI: ffffffff8972cfca RDI: ffff888027304038
RBP: ffff888027304038 R08: 0000000000000005 R09: 0000000000000003
R10: 0000000000000003 R11: 000000000000759b R12: 0000000000000003
R13: ffff8880294e4f44 R14: ffff888022d6c000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5eec000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000000001c0b4 CR3: 000000005526e000 CR4: 0000000000352ef0

----------------
Code disassembly (best guess):

0: 97 xchg %eax,%edi

1: f8 clc
2: 48 8d 45 20 lea 0x20(%rbp),%rax
6: 48 89 c2 mov %rax,%rdx
9: 48 89 44 24 10 mov %rax,0x10(%rsp)
e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
15: fc ff df
18: 48 c1 ea 03 shr $0x3,%rdx
1c: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
20: 0f 85 f8 05 00 00 jne 0x61e
26: 48 8b 45 20 mov 0x20(%rbp),%rax
* 2a: 66 44 8b 68 14 mov 0x14(%rax),%r13w <-- trapping instruction
2f: 4c 8b 7c 24 10 mov 0x10(%rsp),%r15
34: 48 89 e8 mov %rbp,%rax
37: 45 0f b7 ed movzwl %r13w,%r13d
3b: 45 31 f6 xor %r14d,%r14d
3e: 48 rex.W
3f: ba .byte 0xba


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Takashi Iwai]

So this crash seems happening because syzkaller tries to bind a random
PCI device that has no enough iomap HD-audio wants to access to.
A simple workaround would be to check the PCI BAR length, so that the
driver won't go out of the mapped range. (Here the length 0x200 is no
perfect choice but it covers the least range used for most stuff.)


Takashi

--- a/sound/hda/controllers/intel.c
+++ b/sound/hda/controllers/intel.c
@@ -1899,6 +1899,11 @@ static int azx_first_init(struct azx *chip)
unsigned short gcap;
unsigned int dma_bits = 64;

+ if (pci_resource_len(pci, 0) < 0x200) {
+ dev_err(&pci->dev, "Too small PCI BAR0\n");
+ return -EINVAL;
+ }
+
#if BITS_PER_LONG != 64
/* Fix up base address on ULI M5461 */
if (chip->driver_type == AZX_DRIVER_ULI) {