syzbot

 sign-in | mailing list | source | docs
🐞 Open [1005] ≡ Subsystems 🐞 Fixed [5246] 🐞 Invalid [12543] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel paging request in copy_from_kernel_nofault (2)

Status: upstream: reported C repro on 2024/04/02 05:19
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+186522670e6722692d86@syzkaller.appspotmail.com
Fix commit: arm32, bpf: Reimplement sign-extension mov instruction
Patched on: [ci-upstream-bpf-kasan-gce ci-upstream-linux-next-kasan-gce-root ci-upstream-net-this-kasan-gce], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-net-next-test-gce ci2-upstream-usb]
First crash: 32d, last: 18d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH bpf] arm32, bpf: reimplement sign-extension mov instruction 2 (2) 2024/04/22 11:14
[PATCH bpf] arm32, bpf: Fix sign-extension mov instruction 3 (3) 2024/04/19 18:52
[syzbot] [mm?] BUG: unable to handle kernel paging request in copy_from_kernel_nofault (2) 12 (15) 2024/04/09 14:18
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in copy_from_kernel_nofault mm C done 5 63d 162d 26/26 fixed on 2024/03/29 01:33
linux-5.15 BUG: unable to handle kernel paging request in copy_from_kernel_nofault origin:upstream C done 2 63d 166d 3/3 fixed on 2024/03/28 13:37
linux-6.1 KASAN: stack-out-of-bounds Write in copy_from_kernel_nofault origin:lts-only C unreliable 3 63d 394d 0/3 upstream: reported C repro on 2023/04/02 16:05
android-5-15 BUG: unable to handle kernel paging request in copy_from_kernel_nofault origin:upstream missing-backport C 75 1d00h 166d 0/2 upstream: reported C repro on 2023/11/15 17:36
android-6-1 BUG: unable to handle kernel paging request in copy_from_kernel_nofault origin:upstream missing-backport C done inconclusive 76 1d00h 166d 0/2 upstream: reported C repro on 2023/11/15 17:20
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/04/12 06:20 6m retest repro upstream report log
2024/04/09 11:07 14m puranjay12@gmail.com https://github.com/puranjaymohan/linux.git arm32_movsx_fix report log
2024/04/09 10:03 22m puranjay12@gmail.com https://github.com/puranjaymohan/linux.git arm32_movsx_fix report log

Sample crash report:
8<--- cut here ---
Unable to handle kernel paging request at virtual address ffffffe9 when write
[ffffffe9] *pgd=80000080007003, *pmd=deffd003, *pte=00000000
Internal error: Oops: a07 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 3001 Comm: syz-executor291 Not tainted 6.9.0-rc1-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at copy_from_kernel_nofault mm/maccess.c:38 [inline]
PC is at copy_from_kernel_nofault+0xb8/0x12c mm/maccess.c:24
LR is at copy_from_kernel_nofault+0x24/0x12c mm/maccess.c:31
pc : [<804361f0>]    lr : [<8043615c>]    psr: a0000013
sp : df96dc90  ip : df96dc90  fp : df96dcac
r10: 00000000  r9 : df96dd40  r8 : ffffffe9
r7 : 83d33c00  r6 : 00000005  r5 : ffffffe9  r4 : ffffffe9
r3 : fffffff2  r2 : 00000000  r1 : 00000005  r0 : 00000001
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 8434d080  DAC: 00000000
Register r0 information: non-paged memory
Register r1 information: non-paged memory
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: non-paged memory
Register r5 information: non-paged memory
Register r6 information: non-paged memory
Register r7 information: slab task_struct start 83d33c00 pointer offset 0 size 3072
Register r8 information: non-paged memory
Register r9 information: 2-page vmalloc region starting at 0xdf96c000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Register r10 information: NULL pointer
Register r11 information: 2-page vmalloc region starting at 0xdf96c000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Register r12 information: 2-page vmalloc region starting at 0xdf96c000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Process syz-executor291 (pid: 3001, stack limit = 0xdf96c000)
Stack: (0xdf96dc90 to 0xdf96e000)
dc80:                                     df96ddb8 ffffffe9 00000005 ffffffff
dca0: df96dccc df96dcb0 8037c428 80436144 df96ddb8 00000000 8037c40c ffffffff
dcc0: df96dd64 df96dcd0 7f011aa0 8037c418 ffffffe9 df96dd40 802ff648 81182b54
dce0: df96dd64 df96dd30 35702575 00000000 828c0a94 40000013 00000000 00000000
dd00: df96dcf0 00000000 df96dd74 df96dd18 df96dd2c df96dd20 81182b64 81898a78
dd20: df96dd64 df96dd30 802ff648 81182b54 ffffffe9 df96dd40 00000005 00000000
dd40: df96ddb8 00000000 df969000 842879c0 df969030 df96de30 df96ddfc df96dd68
dd60: 8149c734 7f011a00 804d0184 8089c164 00000000 83d33c00 804b4cdc 804d0124
dd80: 8260ca3c df96de30 00000001 df96de2c 80468494 00000000 df96ddb8 00000000
dda0: 00000001 00000000 19df2b20 00000014 00000000 00000000 df969000 00000000
ddc0: 00000000 00000000 84497800 f655f23e df96ddfc 842879c0 00000000 df96dec0
dde0: 83f79c00 84497800 00000000 0000000e df96de64 df96de00 8149d6a0 8149c5d0
de00: df96de30 00000000 00000000 df96de98 20000080 00000000 df969000 00000000
de20: 828ffe80 82fe0000 8051cdd4 00000000 00000000 f655f23e 80395130 df969000
de40: 00000028 df96de98 0000000a 20000080 00000028 00000000 df96df8c df96de68
de60: 8039c858 8149d388 81c66394 84342c0c fcd9275f 00a00000 20000000 83d33c00
de80: df96dee0 df96dfb0 df96dea4 df96de98 8089c348 df96dee0 20000080 00000000
dea0: 83d33c00 df96ded0 00000008 00000000 00000008 80426e10 df96deec df96dec8
dec0: 00000003 02000000 0000000e 00000055 20000140 00000000 20000380 00000000
dee0: 00000000 04000000 00000000 00000000 00000000 00000000 00000000 00000000
df00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
df20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
df40: 00000000 00000000 00000000 00000000 00000000 00000000 20000000 f655f23e
df60: 80216078 ffffffff 00000000 0008e050 00000182 80200288 83d33c00 00000182
df80: df96dfa4 df96df90 8039dd98 8039b934 20000080 00000000 00000000 df96dfa8
dfa0: 80200060 8039dd78 ffffffff 00000000 0000000a 20000080 00000028 00000000
dfc0: ffffffff 00000000 0008e050 00000182 20000100 00000000 00000001 00003a97
dfe0: 7ec66c70 7ec66c60 00010748 0002e890 00000010 0000000a 00000000 00000000
Call trace: 
[<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (bpf_probe_read_kernel_common include/linux/bpf.h:2909 [inline])
[<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (____bpf_probe_read_kernel kernel/trace/bpf_trace.c:240 [inline])
[<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (bpf_probe_read_kernel+0x1c/0x44 kernel/trace/bpf_trace.c:237)
 r7:ffffffff r6:00000005 r5:ffffffe9 r4:df96ddb8
[<8037c40c>] (bpf_probe_read_kernel) from [<7f011aa0>] (bpf_prog_244768d4818575ac+0xac/0xc0)
 r7:ffffffff r6:8037c40c r5:00000000 r4:df96ddb8
[<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline])
[<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (__bpf_prog_run include/linux/filter.h:657 [inline])
[<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_prog_run include/linux/filter.h:664 [inline])
[<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_test_run+0x170/0x388 net/bpf/test_run.c:425)
 r9:df96de30 r8:df969030 r7:842879c0 r6:df969000 r5:00000000 r4:df96ddb8
[<8149c5c4>] (bpf_test_run) from [<8149d6a0>] (bpf_prog_test_run_skb+0x324/0x6cc net/bpf/test_run.c:1058)
 r10:0000000e r9:00000000 r8:84497800 r7:83f79c00 r6:df96dec0 r5:00000000
 r4:842879c0
[<8149d37c>] (bpf_prog_test_run_skb) from [<8039c858>] (bpf_prog_test_run kernel/bpf/syscall.c:4240 [inline])
[<8149d37c>] (bpf_prog_test_run_skb) from [<8039c858>] (__sys_bpf+0xf30/0x1ef0 kernel/bpf/syscall.c:5649)
 r10:00000000 r9:00000028 r8:20000080 r7:0000000a r6:df96de98 r5:00000028
 r4:df969000
[<8039b928>] (__sys_bpf) from [<8039dd98>] (__do_sys_bpf kernel/bpf/syscall.c:5738 [inline])
[<8039b928>] (__sys_bpf) from [<8039dd98>] (sys_bpf+0x2c/0x48 kernel/bpf/syscall.c:5736)
 r10:00000182 r9:83d33c00 r8:80200288 r7:00000182 r6:0008e050 r5:00000000
 r4:ffffffff
[<8039dd6c>] (sys_bpf) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66)
Exception stack(0xdf96dfa8 to 0xdf96dff0)
dfa0:                   ffffffff 00000000 0000000a 20000080 00000028 00000000
dfc0: ffffffff 00000000 0008e050 00000182 20000100 00000000 00000001 00003a97
dfe0: 7ec66c70 7ec66c60 00010748 0002e890
Code: 9a000007 e3a03000 e4942000 e3530000 (e5852000) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	9a000007 	bls	0x24
   4:	e3a03000 	mov	r3, #0
   8:	e4942000 	ldr	r2, [r4], #0
   c:	e3530000 	cmp	r3, #0
* 10:	e5852000 	str	r2, [r5] <-- trapping instruction

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/29 06:17 upstream 317c7bc0ef03 c52bcb23 .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel paging request in copy_from_kernel_nofault
2024/03/29 05:09 upstream 317c7bc0ef03 c52bcb23 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel paging request in copy_from_kernel_nofault
* Struck through repros no longer work on HEAD.