syzbot


BUG: unable to handle kernel paging request in clear_page_erms (6)

Status: upstream: reported on 2024/09/28 14:29
Subsystems: net virt mm
[Documentation on labels]
Reported-by: syzbot+0a31340d42a1d572f904@syzkaller.appspotmail.com
First crash: 137d, last: 63d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] [virt?] BUG: unable to handle kernel paging request in clear_page_erms (6) 0 (1) 2024/09/28 14:29
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in clear_page_erms (3) mm 2 1308d 1314d 0/28 auto-closed as invalid on 2021/10/09 21:56
upstream BUG: unable to handle kernel paging request in clear_page_erms (4) mm arch 1 1202d 1198d 0/28 auto-closed as invalid on 2022/01/23 00:56
linux-4.19 BUG: unable to handle kernel paging request in clear_page_erms 1 1131d 1131d 0/1 auto-closed as invalid on 2022/05/04 22:20
upstream BUG: unable to handle kernel paging request in clear_page_erms (2) mm 1 1381d 1363d 0/28 auto-closed as invalid on 2021/06/28 09:14
upstream BUG: unable to handle kernel paging request in clear_page_erms (5) mm 4 373d 473d 0/28 auto-obsoleted due to no activity on 2024/05/01 16:11
upstream BUG: unable to handle kernel paging request in clear_page_erms mm 1 1738d 1734d 0/28 auto-closed as invalid on 2020/08/05 10:45

Sample crash report:
BUG: unable to handle page fault for address: ffff888034d73000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 1ae01067 P4D 1ae01067 PUD 1ae02067 PMD 7c2e7063 PTE 800fffffcb28c060
Oops: Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 5800 Comm: syz-executor Not tainted 6.13.0-rc1-syzkaller-00182-gb8f52214c61a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:clear_page_erms+0xb/0x20 arch/x86/lib/clear_page_64.S:50
Code: 48 8d 7f 40 75 d9 90 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa b9 00 10 00 00 31 c0 <f3> aa c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90
RSP: 0018:ffffc900043bf180 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000001000
RDX: ffffea0000d35cc0 RSI: ffff888000000000 RDI: ffff888034d73000
RBP: ffffea0000d35cc0 R08: 0000160000000000 R09: 0000000000000000
R10: ffffed10069ae600 R11: dffffc0000000000 R12: 0000000000000000
R13: ffffea0000d35d00 R14: 0000000000000001 R15: 0000000000000000
FS:  00005555802d0500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888034d73000 CR3: 0000000028aec000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 clear_page arch/x86/include/asm/page_64.h:54 [inline]
 clear_highpage_kasan_tagged include/linux/highmem.h:242 [inline]
 kernel_init_pages mm/page_alloc.c:1040 [inline]
 post_alloc_hook+0x1a3/0x350 mm/page_alloc.c:1554
 prep_new_page mm/page_alloc.c:1564 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474
 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4751
 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265
 get_free_pages_noprof+0xc/0x40 mm/page_alloc.c:4798
 poll_get_entry fs/select.c:168 [inline]
 __pollwait+0x291/0x4c0 fs/select.c:223
 poll_wait include/linux/poll.h:45 [inline]
 pipe_poll+0x4a7/0x8a0 fs/pipe.c:673
 vfs_poll include/linux/poll.h:84 [inline]
 select_poll_one fs/select.c:480 [inline]
 do_select+0xd88/0x17e0 fs/select.c:536
 core_sys_select+0x459/0xb80 fs/select.c:677
 do_pselect.constprop.0+0x1a0/0x1f0 fs/select.c:759
 __do_sys_pselect6 fs/select.c:802 [inline]
 __se_sys_pselect6 fs/select.c:793 [inline]
 __x64_sys_pselect6+0x183/0x240 fs/select.c:793
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8c37b7fc9c
Code: 29 44 24 30 80 3d bb 18 19 00 00 4c 89 4c 24 40 4c 8d 4c 24 40 48 c7 44 24 48 08 00 00 00 74 2e 4c 89 ea b8 0e 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7c 48 8b 54 24 58 64 48 2b 14 25 28 00 00 00
RSP: 002b:00007ffc76c3df30 EFLAGS: 00000202 ORIG_RAX: 000000000000010e
RAX: ffffffffffffffda RBX: 00007ffc76c3e050 RCX: 00007f8c37b7fc9c
RDX: 0000000000000000 RSI: 00007ffc76c3e050 RDI: 0000000000000023
RBP: 00007ffc76c3e4a0 R08: 00007ffc76c3df60 R09: 00007ffc76c3df70
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffc76c3e0e0
R13: 0000000000000000 R14: 00007ffc76c3e370 R15: 585858582e7a7973
 </TASK>
Modules linked in:
CR2: ffff888034d73000
---[ end trace 0000000000000000 ]---
RIP: 0010:clear_page_erms+0xb/0x20 arch/x86/lib/clear_page_64.S:50
Code: 48 8d 7f 40 75 d9 90 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa b9 00 10 00 00 31 c0 <f3> aa c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90
RSP: 0018:ffffc900043bf180 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000001000
RDX: ffffea0000d35cc0 RSI: ffff888000000000 RDI: ffff888034d73000
RBP: ffffea0000d35cc0 R08: 0000160000000000 R09: 0000000000000000
R10: ffffed10069ae600 R11: dffffc0000000000 R12: 0000000000000000
R13: ffffea0000d35d00 R14: 0000000000000001 R15: 0000000000000000
FS:  00005555802d0500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888034d73000 CR3: 0000000028aec000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	48 8d 7f 40          	lea    0x40(%rdi),%rdi
   4:	75 d9                	jne    0xffffffdf
   6:	90                   	nop
   7:	c3                   	ret
   8:	cc                   	int3
   9:	cc                   	int3
   a:	cc                   	int3
   b:	cc                   	int3
   c:	0f 1f 00             	nopl   (%rax)
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	f3 0f 1e fa          	endbr64
  23:	b9 00 10 00 00       	mov    $0x1000,%ecx
  28:	31 c0                	xor    %eax,%eax
* 2a:	f3 aa                	rep stos %al,%es:(%rdi) <-- trapping instruction
  2c:	c3                   	ret
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	66 66 2e 0f 1f 84 00 	data16 cs nopw 0x0(%rax,%rax,1)
  38:	00 00 00 00
  3c:	0f 1f 00             	nopl   (%rax)
  3f:	90                   	nop

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/07 01:46 upstream b8f52214c61a 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root BUG: unable to handle kernel paging request in clear_page_erms
2024/09/24 07:54 upstream abf2050f51fd 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: unable to handle kernel paging request in clear_page_erms
* Struck through repros no longer work on HEAD.