syzbot


invalid opcode in asm_sysvec_reschedule_ipi

Status: upstream: reported on 2025/06/24 13:51
Reported-by: syzbot+23c6e0a1eb959a1b8b72@syzkaller.appspotmail.com
First crash: 23d, last: 16d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 invalid opcode in asm_sysvec_reschedule_ipi 2 1 67d 67d 0/3 upstream: reported on 2025/05/11 05:41

Sample crash report:
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4687 Comm: syz.1.59 Not tainted 6.1.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:asm_sysvec_reschedule_ipi+0x15/0x20 arch/x86/include/asm/idtentry.h:696
Code: 48 89 c4 48 89 e7 e8 da 9a ef ff e9 95 04 00 00 90 90 90 90 90 0f 01 ca fc 6a ff e8 95 03 00 00 48 89 c4 48 89 e7 e8 da ba ef <ff> e9 75 04 00 00 90 90 90 90 90 0f 01 ca fc 6a ff e8 75 03 00 00
RSP: 0018:ffffc90005dae648 EFLAGS: 00010086
RAX: 1ae43762dfc5a700 RBX: 0000000000000000 RCX: 1ae43762dfc5a700
RDX: dffffc0000000000 RSI: ffffffff8a6bffe0 RDI: ffffffff8abf14a0
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff2117270
R10: fffffbfff2117270 R11: 1ffffffff211726f R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f5f59b116c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000773fa000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
RIP: 0010:readahead_folio+0x2f4/0x5f0 include/linux/pagemap.h:1324
Code: ff 89 ee e8 1e bf d1 ff 84 db 74 19 e8 b5 bc d1 ff 4c 89 f7 e8 ad 2f 00 00 eb 0f e8 a6 bc d1 ff 45 31 f6 eb 05 e8 9c bc d1 ff <4c> 89 f0 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 89 d9 80 e1
RSP: 0018:ffffc90005dae6f8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc90005daeb04 RCX: 0000000000080000
RDX: ffffc9000e45b000 RSI: 0000000000004c4c RDI: 0000000000004c4d
RBP: dffffc0000000000 R08: dffffc0000000000 R09: fffff9400027ac11
R10: fffff9400027ac11 R11: 1ffffd400027ac10 R12: ffffc90005daeaf8
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
 read_pages+0x17b/0x840 mm/readahead.c:167
 page_cache_ra_unbounded+0x690/0x770 mm/readahead.c:270
 page_cache_sync_readahead include/linux/pagemap.h:1248 [inline]
 filemap_get_pages mm/filemap.c:2665 [inline]
 filemap_read+0x5ff/0x2f80 mm/filemap.c:2759
 generic_file_read_iter+0x115/0x670 mm/filemap.c:2914
 __kernel_read+0x2dc/0x6b0 fs/read_write.c:428
 integrity_kernel_read+0x86/0xd0 security/integrity/iint.c:228
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
 ima_calc_file_hash+0x96b/0x17c0 security/integrity/ima/ima_crypto.c:573
 ima_collect_measurement+0x4b3/0xac0 security/integrity/ima/ima_api.c:293
 process_measurement+0xfae/0x1a10 security/integrity/ima/ima_main.c:351
 ima_file_check+0xc2/0x100 security/integrity/ima/ima_main.c:534
 do_open fs/namei.c:3628 [inline]
 path_openat+0x2679/0x2e70 fs/namei.c:3783
 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810
 do_sys_openat2+0x142/0x490 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5f58d8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5f59b11038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f5f58fb6080 RCX: 00007f5f58d8e929
RDX: 0000000000143042 RSI: 00002000000000c0 RDI: ffffffffffffff9c
RBP: 00007f5f58e10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f5f58fb6080 R15: 00007ffcd3394238
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:asm_sysvec_reschedule_ipi+0x15/0x20 arch/x86/include/asm/idtentry.h:696
Code: 48 89 c4 48 89 e7 e8 da 9a ef ff e9 95 04 00 00 90 90 90 90 90 0f 01 ca fc 6a ff e8 95 03 00 00 48 89 c4 48 89 e7 e8 da ba ef <ff> e9 75 04 00 00 90 90 90 90 90 0f 01 ca fc 6a ff e8 75 03 00 00
RSP: 0018:ffffc90005dae648 EFLAGS: 00010086
RAX: 1ae43762dfc5a700 RBX: 0000000000000000 RCX: 1ae43762dfc5a700
RDX: dffffc0000000000 RSI: ffffffff8a6bffe0 RDI: ffffffff8abf14a0
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff2117270
R10: fffffbfff2117270 R11: 1ffffffff211726f R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f5f59b116c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000773fa000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	ff 89 ee e8 1e bf    	decl   -0x40e11712(%rcx)
   6:	d1 ff                	sar    %edi
   8:	84 db                	test   %bl,%bl
   a:	74 19                	je     0x25
   c:	e8 b5 bc d1 ff       	call   0xffd1bcc6
  11:	4c 89 f7             	mov    %r14,%rdi
  14:	e8 ad 2f 00 00       	call   0x2fc6
  19:	eb 0f                	jmp    0x2a
  1b:	e8 a6 bc d1 ff       	call   0xffd1bcc6
  20:	45 31 f6             	xor    %r14d,%r14d
  23:	eb 05                	jmp    0x2a
  25:	e8 9c bc d1 ff       	call   0xffd1bcc6
* 2a:	4c 89 f0             	mov    %r14,%rax <-- trapping instruction
  2d:	48 83 c4 10          	add    $0x10,%rsp
  31:	5b                   	pop    %rbx
  32:	41 5c                	pop    %r12
  34:	41 5d                	pop    %r13
  36:	41 5e                	pop    %r14
  38:	41 5f                	pop    %r15
  3a:	5d                   	pop    %rbp
  3b:	c3                   	ret
  3c:	89 d9                	mov    %ebx,%ecx
  3e:	80                   	.byte 0x80
  3f:	e1                   	.byte 0xe1

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/01 02:03 linux-6.1.y 7e69c33e4858 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan invalid opcode in asm_sysvec_reschedule_ipi
2025/07/01 01:58 linux-6.1.y 7e69c33e4858 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan invalid opcode in asm_sysvec_reschedule_ipi
2025/07/01 01:57 linux-6.1.y 7e69c33e4858 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan invalid opcode in asm_sysvec_reschedule_ipi
2025/06/26 21:09 linux-6.1.y 58485ff1a74f 803ce19b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan invalid opcode in asm_sysvec_reschedule_ipi
2025/06/24 14:00 linux-6.1.y 58485ff1a74f e2f27c35 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan invalid opcode in asm_sysvec_reschedule_ipi
2025/06/24 13:50 linux-6.1.y 58485ff1a74f e2f27c35 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan invalid opcode in asm_sysvec_reschedule_ipi
* Struck through repros no longer work on HEAD.