syzbot


upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init

Status: upstream: reported on 2025/03/26 12:28
Subsystems: pci
[Documentation on labels]
Reported-by: syzbot+38d72234503f2b05981f@syzkaller.appspotmail.com
First crash: 4d22h, last: 4d01h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [pci?] upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init 0 (1) 2025/03/26 12:28

Sample crash report:
Key type cifs.idmap registered
ntfs3: Enabled Linux POSIX ACLs support
ntfs3: Read-only LZX/Xpress compression included
efs: 1.0a - http://aeschi.ch.eu.org/efs/
romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
QNX4 filesystem 0.2.3 registered.
qnx6: QNX6 filesystem 1.0.0 registered.
fuse: init (API version 7.42)
orangefs_debugfs_init: called with debug mask: :none: :0:
orangefs_init: module version upstream loaded
JFS: nTxBlock = 8192, nTxLock = 65536
SGI XFS with ACLs, security attributes, realtime, quota, no debug enabled
9p: Installing v9fs 9p2000 file system support
NILFS version 2 loaded
befs: version: 0.9.3
ocfs2: Registered cluster interface o2cb
ocfs2: Registered cluster interface user
OCFS2 User DLM kernel interface loaded
gfs2: GFS2 installed
ceph: loaded (mds proto 32)
NET: Registered PF_ALG protocol family
xor: automatically using best checksumming function   avx       
async_tx: api initialized (async)
Key type asymmetric registered
Asymmetric key parser 'x509' registered
Asymmetric key parser 'pkcs8' registered
Key type pkcs7_test registered
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 238)
io scheduler mq-deadline registered
io scheduler kyber registered
io scheduler bfq registered
input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
ACPI: button: Power Button [PWRF]
input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
ACPI: button: Sleep Button [SLPF]
ioatdma: Intel(R) QuickData Technology Driver 5.00
ACPI: \_SB_.LNKC: Enabled at IRQ 11
virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
ACPI: \_SB_.LNKD: Enabled at IRQ 10
virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
ACPI: \_SB_.LNKB: Enabled at IRQ 10
virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
N_HDLC line discipline registered with maxframe=4096
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
Non-volatile memory driver v1.3
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: Oops: 0000 [#1] SMP PTI
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-syzkaller-03565-gf6e0150b2003 #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:msix_setup_msi_descs drivers/pci/msi/msi.c:639 [inline]
RIP: 0010:__msix_setup_interrupts drivers/pci/msi/msi.c:672 [inline]
RIP: 0010:msix_setup_interrupts drivers/pci/msi/msi.c:701 [inline]
RIP: 0010:msix_capability_init+0x95c/0x18c0 drivers/pci/msi/msi.c:743
Code: ff ff ff 48 89 9d 60 fe ff ff 48 89 9d 08 ff ff ff 48 83 bd 30 ff ff ff 00 4c 8b 75 c8 0f 85 1d 02 00 00 48 8b bd 58 ff ff ff <44> 8b 27 b8 00 00 40 00 41 21 c4 e8 64 b0 ad fb 8b 18 44 8b 3a 41
RSP: 0000:ffff888100652fb0 EFLAGS: 00010246
RAX: ffff8880bba53080 RBX: ffffc90000b3f008 RCX: 0000000100253080
RDX: ffff888100253080 RSI: ffff88813fffacc0 RDI: 0000000000000000
RBP: ffff888100653178 R08: ffffea000000000f R09: 0000000000000000
R10: ffff8880bba53020 R11: ffffffff86cfccf9 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888100618b58 R15: 000000000000000b
FS:  0000000000000000(0000) GS:ffff8881ab1b1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000011a80000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __pci_enable_msix_range+0xad9/0xc40 drivers/pci/msi/msi.c:851
 pci_alloc_irq_vectors_affinity+0x111/0x3a0 drivers/pci/msi/api.c:268
 vp_request_msix_vectors drivers/virtio/virtio_pci_common.c:160 [inline]
 vp_find_vqs_msix+0x84d/0x1560 drivers/virtio/virtio_pci_common.c:417
 vp_find_vqs+0x6c/0xa80 drivers/virtio/virtio_pci_common.c:525
 virtio_find_vqs include/linux/virtio_config.h:226 [inline]
 virtio_find_single_vq include/linux/virtio_config.h:237 [inline]
 probe_common+0x3b4/0x970 drivers/char/hw_random/virtio-rng.c:155
 virtrng_probe+0x2d/0x40 drivers/char/hw_random/virtio-rng.c:193
 virtio_dev_probe+0x1640/0x19a0 drivers/virtio/virtio.c:341
 really_probe+0x4dc/0xd90 drivers/base/dd.c:658
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:800
 driver_probe_device+0x72/0x890 drivers/base/dd.c:830
 __driver_attach+0x7ea/0xb50 drivers/base/dd.c:1216
 bus_for_each_dev+0x350/0x540 drivers/base/bus.c:370
 driver_attach+0x51/0x70 drivers/base/dd.c:1234
 bus_add_driver+0x74c/0xdb0 drivers/base/bus.c:678
 driver_register+0x3fb/0x660 drivers/base/driver.c:249
 __register_virtio_driver+0xf1/0x120 drivers/virtio/virtio.c:415
 virtio_rng_driver_init+0x2e/0x40 drivers/char/hw_random/virtio-rng.c:256
 do_one_initcall+0x228/0xbf0 init/main.c:1257
 do_initcall_level+0x140/0x350 init/main.c:1319
 do_initcalls+0x1a6/0x2f0 init/main.c:1335
 do_basic_setup+0x22/0x30 init/main.c:1354
 kernel_init_freeable+0x306/0x4c0 init/main.c:1567
 kernel_init+0x2f/0x800 init/main.c:1457
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
RIP: 1f0f:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0000:0000000000000000 EFLAGS: 841f0f2e66 ORIG_RAX: 1f0f2e6600000000
RAX: 0000000000000000 RBX: 1f0f2e6600000000 RCX: 2e66000000000084
RDX: 0000000000841f0f RSI: 000000841f0f2e66 RDI: 00841f0f2e660000
RBP: 00841f0f2e660000 R08: 00841f0f2e660000 R09: 000000841f0f2e66
R10: 0000000000841f0f R11: 2e66000000000084 R12: 000000841f0f2e66
R13: 0000000000841f0f R14: 2e66000000000084 R15: 1f0f2e6600000000
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:msix_setup_msi_descs drivers/pci/msi/msi.c:639 [inline]
RIP: 0010:__msix_setup_interrupts drivers/pci/msi/msi.c:672 [inline]
RIP: 0010:msix_setup_interrupts drivers/pci/msi/msi.c:701 [inline]
RIP: 0010:msix_capability_init+0x95c/0x18c0 drivers/pci/msi/msi.c:743
Code: ff ff ff 48 89 9d 60 fe ff ff 48 89 9d 08 ff ff ff 48 83 bd 30 ff ff ff 00 4c 8b 75 c8 0f 85 1d 02 00 00 48 8b bd 58 ff ff ff <44> 8b 27 b8 00 00 40 00 41 21 c4 e8 64 b0 ad fb 8b 18 44 8b 3a 41
RSP: 0000:ffff888100652fb0 EFLAGS: 00010246
RAX: ffff8880bba53080 RBX: ffffc90000b3f008 RCX: 0000000100253080
RDX: ffff888100253080 RSI: ffff88813fffacc0 RDI: 0000000000000000
RBP: ffff888100653178 R08: ffffea000000000f R09: 0000000000000000
R10: ffff8880bba53020 R11: ffffffff86cfccf9 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888100618b58 R15: 000000000000000b
FS:  0000000000000000(0000) GS:ffff8881ab1b1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000011a80000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	48 89 9d 60 fe ff ff 	mov    %rbx,-0x1a0(%rbp)
   7:	48 89 9d 08 ff ff ff 	mov    %rbx,-0xf8(%rbp)
   e:	48 83 bd 30 ff ff ff 	cmpq   $0x0,-0xd0(%rbp)
  15:	00
  16:	4c 8b 75 c8          	mov    -0x38(%rbp),%r14
  1a:	0f 85 1d 02 00 00    	jne    0x23d
  20:	48 8b bd 58 ff ff ff 	mov    -0xa8(%rbp),%rdi
* 27:	44 8b 27             	mov    (%rdi),%r12d <-- trapping instruction
  2a:	b8 00 00 40 00       	mov    $0x400000,%eax
  2f:	41 21 c4             	and    %eax,%r12d
  32:	e8 64 b0 ad fb       	call   0xfbadb09b
  37:	8b 18                	mov    (%rax),%ebx
  39:	44 8b 3a             	mov    (%rdx),%r15d
  3c:	41                   	rex.B

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/27 00:20 upstream f6e0150b2003 89d30d73 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 19:23 upstream f6e0150b2003 20510e88 .config console log report [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 18:09 upstream 5e06802b426b 89d30d73 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 17:22 upstream 1e26c5e28ca5 20510e88 .config console log report [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 13:09 upstream 1e26c5e28ca5 89d30d73 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 07:38 upstream 1e26c5e28ca5 89d30d73 .config console log report [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 05:36 upstream 47618bc87540 89d30d73 .config console log report [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 03:36 upstream 61af143fbea4 89d30d73 .config console log report [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 23:05 upstream f6e0150b2003 89d30d73 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
2025/03/26 12:27 upstream 1e26c5e28ca5 89d30d73 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_capability_init
* Struck through repros no longer work on HEAD.