BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
30 views
Skip to first unread message
syzbot
Oct 14, 2019, 2:35:08 AM10/14/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: dafd6344 Linux 4.19.79
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=155d49ab600000
kernel config: https://syzkaller.appspot.com/x/.config?x=f825f73d8fea6b52
dashboard link: https://syzkaller.appspot.com/bug?extid=46636e28a2400d65519f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+46636e...@syzkaller.appspotmail.com
device team0 left promiscuous mode
device team_slave_0 left promiscuous mode
device team_slave_1 left promiscuous mode
BUG: unable to handle kernel paging request at ffffc90001945002
kobject: 'loop4' (000000004e5bf45d): kobject_uevent_env
PGD 12c256067 P4D 12c256067 PUD 21bc31067 PMD a6213067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 10130 Comm: syz-executor.2 Not tainted 4.19.79 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
kobject: 'loop4' (000000004e5bf45d): fill_kobj_path: path
= '/devices/virtual/block/loop4'
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:884 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:383 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:437 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x15d/0x2c0 kernel/bpf/core.c:504
Code: 02 48 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
48 81 e3 00 f0 ff ff 38 ca 7f 08 84 d2 0f 85 0c 01 00 00 <0f> b6 70 02 31
ff 83 e6 01 40 88 75 d0 e8 b1 81 f5 ff 0f b6 75 d0
RSP: 0018:ffff8880420a6640 EFLAGS: 00010246
RAX: ffffc90001945000 RBX: ffffffffa0010000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8175f998 RDI: ffffc90001945002
RBP: ffff8880420a6680 R08: ffff88808360a380 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff8880a8638470
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880a8638470
FS: 00007f9d36a65700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001945002 CR3: 000000004a555000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
is_bpf_text_address+0x78/0x170 kernel/bpf/core.c:546
kernel_text_address+0x73/0xf0 kernel/extable.c:152
__kernel_text_address+0xd/0x40 kernel/extable.c:107
unwind_get_return_address arch/x86/kernel/unwind_frame.c:18 [inline]
unwind_get_return_address+0x61/0xa0 arch/x86/kernel/unwind_frame.c:13
__save_stack_trace+0x99/0x100 arch/x86/kernel/stacktrace.c:45
save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kmem_cache_alloc_node_trace+0x153/0x720 mm/slab.c:3668
__do_kmalloc_node mm/slab.c:3688 [inline]
__kmalloc_node_track_caller+0x3d/0x80 mm/slab.c:3703
__kmalloc_reserve.isra.0+0x40/0xf0 net/core/skbuff.c:137
pskb_expand_head+0x154/0xe20 net/core/skbuff.c:1464
netlink_trim+0x215/0x260 net/netlink/af_netlink.c:1299
netlink_broadcast_filtered+0x64/0xb20 net/netlink/af_netlink.c:1496
netlink_broadcast net/netlink/af_netlink.c:1541 [inline]
nlmsg_multicast include/net/netlink.h:591 [inline]
nlmsg_notify+0x93/0x1c0 net/netlink/af_netlink.c:2497
rtnl_notify net/core/rtnetlink.c:736 [inline]
rtmsg_ifinfo_send net/core/rtnetlink.c:3346 [inline]
rtmsg_ifinfo_event.part.0+0xb0/0xe0 net/core/rtnetlink.c:3361
rtmsg_ifinfo_event net/core/rtnetlink.c:3369 [inline]
rtmsg_ifinfo+0x8d/0xa0 net/core/rtnetlink.c:3367
__dev_notify_flags+0x235/0x2c0 net/core/dev.c:7532
__dev_set_promiscuity+0x1a1/0x220 net/core/dev.c:7309
dev_set_promiscuity+0x57/0xe0 net/core/dev.c:7329
team_change_rx_flags+0x161/0x350 drivers/net/team/team.c:1767
dev_change_rx_flags net/core/dev.c:7262 [inline]
__dev_set_promiscuity.cold+0x2d3/0x343 net/core/dev.c:7306
dev_set_promiscuity+0x57/0xe0 net/core/dev.c:7329
nbp_delete_promisc net/bridge/br_if.c:248 [inline]
del_nbp+0x11f/0xc60 net/bridge/br_if.c:334
br_del_if+0x100/0x470 net/bridge/br_if.c:717
br_del_slave+0x21/0x30 net/bridge/br_device.c:365
do_set_master+0xe7/0x230 net/core/rtnetlink.c:2286
do_setlink+0x95d/0x34c0 net/core/rtnetlink.c:2434
rtnl_setlink+0x271/0x380 net/core/rtnetlink.c:2688
rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:4747
netlink_rcv_skb+0x17d/0x460 net/netlink/af_netlink.c:2454
rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4765
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x537/0x720 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:632
sock_write_iter+0x27c/0x3e0 net/socket.c:901
call_write_iter include/linux/fs.h:1820 [inline]
do_iter_readv_writev+0x558/0x830 fs/read_write.c:681
do_iter_write fs/read_write.c:960 [inline]
do_iter_write+0x184/0x5f0 fs/read_write.c:941
vfs_writev+0x1b3/0x2f0 fs/read_write.c:1005
do_writev+0x15e/0x370 fs/read_write.c:1040
__do_sys_writev fs/read_write.c:1113 [inline]
__se_sys_writev fs/read_write.c:1110 [inline]
__x64_sys_writev+0x75/0xb0 fs/read_write.c:1110
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a59
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f9d36a64c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459a59
RDX: 0000000000000001 RSI: 00000000200000c0 RDI: 0000000000000006
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9d36a656d4
R13: 00000000004c6fd4 R14: 00000000004e1da8 R15: 00000000ffffffff
Modules linked in:
CR2: ffffc90001945002
---[ end trace 60e2f7f86efdcf85 ]---
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:884 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:383 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:437 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x15d/0x2c0 kernel/bpf/core.c:504
Code: 02 48 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
48 81 e3 00 f0 ff ff 38 ca 7f 08 84 d2 0f 85 0c 01 00 00 <0f> b6 70 02 31
ff 83 e6 01 40 88 75 d0 e8 b1 81 f5 ff 0f b6 75 d0
RSP: 0018:ffff8880420a6640 EFLAGS: 00010246
RAX: ffffc90001945000 RBX: ffffffffa0010000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8175f998 RDI: ffffc90001945002
RBP: ffff8880420a6680 R08: ffff88808360a380 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff8880a8638470
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880a8638470
FS: 00007f9d36a65700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001945002 CR3: 000000004a555000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: dafd6344 Linux 4.19.79
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=155d49ab600000
kernel config: https://syzkaller.appspot.com/x/.config?x=f825f73d8fea6b52
dashboard link: https://syzkaller.appspot.com/bug?extid=46636e28a2400d65519f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+46636e...@syzkaller.appspotmail.com
device team0 left promiscuous mode
device team_slave_0 left promiscuous mode
device team_slave_1 left promiscuous mode
BUG: unable to handle kernel paging request at ffffc90001945002
kobject: 'loop4' (000000004e5bf45d): kobject_uevent_env
PGD 12c256067 P4D 12c256067 PUD 21bc31067 PMD a6213067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 10130 Comm: syz-executor.2 Not tainted 4.19.79 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
kobject: 'loop4' (000000004e5bf45d): fill_kobj_path: path
= '/devices/virtual/block/loop4'
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:884 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:383 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:437 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x15d/0x2c0 kernel/bpf/core.c:504
Code: 02 48 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
48 81 e3 00 f0 ff ff 38 ca 7f 08 84 d2 0f 85 0c 01 00 00 <0f> b6 70 02 31
ff 83 e6 01 40 88 75 d0 e8 b1 81 f5 ff 0f b6 75 d0
RSP: 0018:ffff8880420a6640 EFLAGS: 00010246
RAX: ffffc90001945000 RBX: ffffffffa0010000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8175f998 RDI: ffffc90001945002
RBP: ffff8880420a6680 R08: ffff88808360a380 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff8880a8638470
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880a8638470
FS: 00007f9d36a65700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001945002 CR3: 000000004a555000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
is_bpf_text_address+0x78/0x170 kernel/bpf/core.c:546
kernel_text_address+0x73/0xf0 kernel/extable.c:152
__kernel_text_address+0xd/0x40 kernel/extable.c:107
unwind_get_return_address arch/x86/kernel/unwind_frame.c:18 [inline]
unwind_get_return_address+0x61/0xa0 arch/x86/kernel/unwind_frame.c:13
__save_stack_trace+0x99/0x100 arch/x86/kernel/stacktrace.c:45
save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kmem_cache_alloc_node_trace+0x153/0x720 mm/slab.c:3668
__do_kmalloc_node mm/slab.c:3688 [inline]
__kmalloc_node_track_caller+0x3d/0x80 mm/slab.c:3703
__kmalloc_reserve.isra.0+0x40/0xf0 net/core/skbuff.c:137
pskb_expand_head+0x154/0xe20 net/core/skbuff.c:1464
netlink_trim+0x215/0x260 net/netlink/af_netlink.c:1299
netlink_broadcast_filtered+0x64/0xb20 net/netlink/af_netlink.c:1496
netlink_broadcast net/netlink/af_netlink.c:1541 [inline]
nlmsg_multicast include/net/netlink.h:591 [inline]
nlmsg_notify+0x93/0x1c0 net/netlink/af_netlink.c:2497
rtnl_notify net/core/rtnetlink.c:736 [inline]
rtmsg_ifinfo_send net/core/rtnetlink.c:3346 [inline]
rtmsg_ifinfo_event.part.0+0xb0/0xe0 net/core/rtnetlink.c:3361
rtmsg_ifinfo_event net/core/rtnetlink.c:3369 [inline]
rtmsg_ifinfo+0x8d/0xa0 net/core/rtnetlink.c:3367
__dev_notify_flags+0x235/0x2c0 net/core/dev.c:7532
__dev_set_promiscuity+0x1a1/0x220 net/core/dev.c:7309
dev_set_promiscuity+0x57/0xe0 net/core/dev.c:7329
team_change_rx_flags+0x161/0x350 drivers/net/team/team.c:1767
dev_change_rx_flags net/core/dev.c:7262 [inline]
__dev_set_promiscuity.cold+0x2d3/0x343 net/core/dev.c:7306
dev_set_promiscuity+0x57/0xe0 net/core/dev.c:7329
nbp_delete_promisc net/bridge/br_if.c:248 [inline]
del_nbp+0x11f/0xc60 net/bridge/br_if.c:334
br_del_if+0x100/0x470 net/bridge/br_if.c:717
br_del_slave+0x21/0x30 net/bridge/br_device.c:365
do_set_master+0xe7/0x230 net/core/rtnetlink.c:2286
do_setlink+0x95d/0x34c0 net/core/rtnetlink.c:2434
rtnl_setlink+0x271/0x380 net/core/rtnetlink.c:2688
rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:4747
netlink_rcv_skb+0x17d/0x460 net/netlink/af_netlink.c:2454
rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4765
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x537/0x720 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1908
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:632
sock_write_iter+0x27c/0x3e0 net/socket.c:901
call_write_iter include/linux/fs.h:1820 [inline]
do_iter_readv_writev+0x558/0x830 fs/read_write.c:681
do_iter_write fs/read_write.c:960 [inline]
do_iter_write+0x184/0x5f0 fs/read_write.c:941
vfs_writev+0x1b3/0x2f0 fs/read_write.c:1005
do_writev+0x15e/0x370 fs/read_write.c:1040
__do_sys_writev fs/read_write.c:1113 [inline]
__se_sys_writev fs/read_write.c:1110 [inline]
__x64_sys_writev+0x75/0xb0 fs/read_write.c:1110
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a59
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f9d36a64c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459a59
RDX: 0000000000000001 RSI: 00000000200000c0 RDI: 0000000000000006
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9d36a656d4
R13: 00000000004c6fd4 R14: 00000000004e1da8 R15: 00000000ffffffff
Modules linked in:
CR2: ffffc90001945002
---[ end trace 60e2f7f86efdcf85 ]---
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:884 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:383 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:437 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x15d/0x2c0 kernel/bpf/core.c:504
Code: 02 48 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
48 81 e3 00 f0 ff ff 38 ca 7f 08 84 d2 0f 85 0c 01 00 00 <0f> b6 70 02 31
ff 83 e6 01 40 88 75 d0 e8 b1 81 f5 ff 0f b6 75 d0
RSP: 0018:ffff8880420a6640 EFLAGS: 00010246
RAX: ffffc90001945000 RBX: ffffffffa0010000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8175f998 RDI: ffffc90001945002
RBP: ffff8880420a6680 R08: ffff88808360a380 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff8880a8638470
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880a8638470
FS: 00007f9d36a65700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001945002 CR3: 000000004a555000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Feb 2, 2020, 6:40:12 AM2/2/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 32ee7492 Linux 4.19.101
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16643a4ee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=928a6b2d3f9b21f8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1365a85ee00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+46636e...@syzkaller.appspotmail.com
BUG: unable to handle kernel paging request at ffffc9000192d030
PGD aa41c067 P4D aa41c067 PUD 21bc31067 PMD 219b3f067 PTE 800000008997b163
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:380 [inline]
Code: 03 42 80 3c 28 00 0f 85 49 01 00 00 49 8b 47 50 48 8d 78 30 48 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f 85 4b 01 00 00 48 8d 78 02 <48> 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
RSP: 0018:ffff8880982770f8 EFLAGS: 00010246
RAX: ffffc9000192d000 RBX: 0000000000000000 RCX: ffffffff81759203
RDX: 1ffff92000325a06 RSI: ffffffff81759228 RDI: ffffc9000192d002
RBP: ffff888098277138 R08: ffff888098b32240 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff888097804330
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888097804330
FS: 00000000013c5880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc mm/slab.c:3397 [inline]
kmem_cache_alloc+0x11b/0x700 mm/slab.c:3557
kmem_cache_zalloc include/linux/slab.h:699 [inline]
inode_alloc_security security/selinux/hooks.c:255 [inline]
selinux_inode_alloc_security+0xb6/0x2a0 security/selinux/hooks.c:3007
security_inode_alloc+0x8a/0xd0 security/security.c:444
inode_init_always+0x56e/0xb40 fs/inode.c:168
alloc_inode+0x81/0x190 fs/inode.c:217
new_inode_pseudo+0x19/0xf0 fs/inode.c:910
new_inode+0x1f/0x40 fs/inode.c:939
proc_pid_make_inode+0x22/0x230 fs/proc/base.c:1753
proc_pid_instantiate+0x54/0x160 fs/proc/base.c:3162
proc_pid_lookup+0x18e/0x290 fs/proc/base.c:3197
proc_root_lookup+0x28/0x60 fs/proc/root.c:157
__lookup_slow+0x279/0x500 fs/namei.c:1672
lookup_slow+0x58/0x80 fs/namei.c:1689
walk_component+0x747/0x2000 fs/namei.c:1811
link_path_walk.part.0+0x594/0x1330 fs/namei.c:2139
link_path_walk fs/namei.c:2073 [inline]
path_openat+0x1fc/0x4500 fs/namei.c:3536
do_filp_open+0x1a1/0x280 fs/namei.c:3567
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_open fs/open.c:1106 [inline]
__se_sys_open fs/open.c:1101 [inline]
__x64_sys_open+0x7e/0xc0 fs/open.c:1101
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4010f0
Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d dd 15 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00
RSP: 002b:00007ffdd47f6a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007ffdd47f6a84 RCX: 00000000004010f0
RDX: 00007ffdd47f6a8a RSI: 0000000000080001 RDI: 00000000004a2362
RBP: 00007ffdd47f6a80 R08: 0000000000000000 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402110
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffc9000192d030
---[ end trace 7ad75b5ceab1076e ]---
RIP: 0010:bpf_jit_binary_hdr include/linux/filter.h:699 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:380 [inline]
Code: 03 42 80 3c 28 00 0f 85 49 01 00 00 49 8b 47 50 48 8d 78 30 48 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f 85 4b 01 00 00 48 8d 78 02 <48> 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
RSP: 0018:ffff8880982770f8 EFLAGS: 00010246
RAX: ffffc9000192d000 RBX: 0000000000000000 RCX: ffffffff81759203
RDX: 1ffff92000325a06 RSI: ffffffff81759228 RDI: ffffc9000192d002
RBP: ffff888098277138 R08: ffff888098b32240 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff888097804330
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888097804330
FS: 00000000013c5880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
HEAD commit: 32ee7492 Linux 4.19.101
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16643a4ee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=928a6b2d3f9b21f8
dashboard link: https://syzkaller.appspot.com/bug?extid=46636e28a2400d65519f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16c668b5e00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1365a85ee00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+46636e...@syzkaller.appspotmail.com
PGD aa41c067 P4D aa41c067 PUD 21bc31067 PMD 219b3f067 PTE 800000008997b163
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 11939 Comm: syz-executor892 Not tainted 4.19.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bpf_jit_binary_hdr include/linux/filter.h:699 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:380 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:437 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x134/0x2c0 kernel/bpf/core.c:504
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
Code: 03 42 80 3c 28 00 0f 85 49 01 00 00 49 8b 47 50 48 8d 78 30 48 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f 85 4b 01 00 00 48 8d 78 02 <48> 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
RSP: 0018:ffff8880982770f8 EFLAGS: 00010246
RAX: ffffc9000192d000 RBX: 0000000000000000 RCX: ffffffff81759203
RDX: 1ffff92000325a06 RSI: ffffffff81759228 RDI: ffffc9000192d002
RBP: ffff888098277138 R08: ffff888098b32240 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff888097804330
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888097804330
FS: 00000000013c5880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000192d030 CR3: 000000009758d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
is_bpf_text_address+0x78/0x170 kernel/bpf/core.c:546
kernel_text_address+0x73/0xf0 kernel/extable.c:152
__kernel_text_address+0xd/0x40 kernel/extable.c:107
unwind_get_return_address arch/x86/kernel/unwind_frame.c:18 [inline]
unwind_get_return_address+0x61/0xa0 arch/x86/kernel/unwind_frame.c:13
__save_stack_trace+0x99/0x100 arch/x86/kernel/stacktrace.c:45
save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
is_bpf_text_address+0x78/0x170 kernel/bpf/core.c:546
kernel_text_address+0x73/0xf0 kernel/extable.c:152
__kernel_text_address+0xd/0x40 kernel/extable.c:107
unwind_get_return_address arch/x86/kernel/unwind_frame.c:18 [inline]
unwind_get_return_address+0x61/0xa0 arch/x86/kernel/unwind_frame.c:13
__save_stack_trace+0x99/0x100 arch/x86/kernel/stacktrace.c:45
save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc mm/slab.c:3397 [inline]
kmem_cache_alloc+0x11b/0x700 mm/slab.c:3557
kmem_cache_zalloc include/linux/slab.h:699 [inline]
inode_alloc_security security/selinux/hooks.c:255 [inline]
selinux_inode_alloc_security+0xb6/0x2a0 security/selinux/hooks.c:3007
security_inode_alloc+0x8a/0xd0 security/security.c:444
inode_init_always+0x56e/0xb40 fs/inode.c:168
alloc_inode+0x81/0x190 fs/inode.c:217
new_inode_pseudo+0x19/0xf0 fs/inode.c:910
new_inode+0x1f/0x40 fs/inode.c:939
proc_pid_make_inode+0x22/0x230 fs/proc/base.c:1753
proc_pid_instantiate+0x54/0x160 fs/proc/base.c:3162
proc_pid_lookup+0x18e/0x290 fs/proc/base.c:3197
proc_root_lookup+0x28/0x60 fs/proc/root.c:157
__lookup_slow+0x279/0x500 fs/namei.c:1672
lookup_slow+0x58/0x80 fs/namei.c:1689
walk_component+0x747/0x2000 fs/namei.c:1811
link_path_walk.part.0+0x594/0x1330 fs/namei.c:2139
link_path_walk fs/namei.c:2073 [inline]
path_openat+0x1fc/0x4500 fs/namei.c:3536
do_filp_open+0x1a1/0x280 fs/namei.c:3567
do_sys_open+0x3fe/0x550 fs/open.c:1088
__do_sys_open fs/open.c:1106 [inline]
__se_sys_open fs/open.c:1101 [inline]
__x64_sys_open+0x7e/0xc0 fs/open.c:1101
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4010f0
Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d dd 15 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00
RSP: 002b:00007ffdd47f6a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007ffdd47f6a84 RCX: 00000000004010f0
RDX: 00007ffdd47f6a8a RSI: 0000000000080001 RDI: 00000000004a2362
RBP: 00007ffdd47f6a80 R08: 0000000000000000 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402110
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffc9000192d030
---[ end trace 7ad75b5ceab1076e ]---
RIP: 0010:bpf_jit_binary_hdr include/linux/filter.h:699 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:380 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:437 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x134/0x2c0 kernel/bpf/core.c:504
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
Code: 03 42 80 3c 28 00 0f 85 49 01 00 00 49 8b 47 50 48 8d 78 30 48 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f 85 4b 01 00 00 48 8d 78 02 <48> 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
RSP: 0018:ffff8880982770f8 EFLAGS: 00010246
RAX: ffffc9000192d000 RBX: 0000000000000000 RCX: ffffffff81759203
RDX: 1ffff92000325a06 RSI: ffffffff81759228 RDI: ffffc9000192d002
RBP: ffff888098277138 R08: ffff888098b32240 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff888097804330
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888097804330
FS: 00000000013c5880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000192d030 CR3: 000000009758d000 CR4: 00000000001406f0
Reply all
Reply to author
Forward
0 new messages