syzbot


kernel BUG in vmf_insert_pfn_prot (2)

Status: upstream: reported C repro on 2023/08/24 07:01
Subsystems: dri
[Documentation on labels]
Reported-by: syzbot+398e17b61dab22cc56bc@syzkaller.appspotmail.com
First crash: 340d, last: 70d
Cause bisection: introduced by (bisect log) :
commit 45d9c8dde4cd8589f9180309ec60f0da2ce486e4
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Thu Aug 12 13:14:12 2021 +0000

  drm/vgem: use shmem helpers

Crash: kernel BUG in vmf_insert_pfn_prot (log)
Repro: C syz .config
  
Fix bisection the fix commit could be any of (bisect log):
  117bbc0e43ad drm/buddy: stop using PAGE_SIZE
  520fb7f183e9 drm/tests/buddy: stop using PAGE_SIZE
  39bc27bd6880 drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
  aed9a1a4f710 drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations
  3e049b6b8f32 Merge tag 'drm-misc-fixes-2024-05-23' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
  
Discussions (7)
Title Replies (including bot) Last reply
[syzbot] Monthly dri report (May 2024) 0 (1) 2024/05/06 13:18
[syzbot] Monthly dri report (Apr 2024) 0 (1) 2024/04/05 12:37
[syzbot] Monthly dri report (Mar 2024) 0 (1) 2024/03/05 11:09
[syzbot] Monthly dri report (Jan 2024) 0 (1) 2024/01/02 13:36
[syzbot] Monthly dri report (Nov 2023) 0 (1) 2023/11/30 20:33
[syzbot] [dri?] kernel BUG in vmf_insert_pfn_prot (2) 0 (3) 2023/11/08 14:46
[syzbot] Monthly dri report (Oct 2023) 0 (1) 2023/10/30 12:59
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 kernel BUG in vmf_insert_pfn_prot origin:lts-only C unreliable 67 96d 495d 0/3 upstream: reported C repro on 2023/03/18 14:33
upstream kernel BUG in vmf_insert_pfn_prot C done done 1933 438d 1042d 22/27 fixed on 2023/06/14 22:21
Last patch testing requests (11)
Created Duration User Patch Repo Result
2024/06/10 20:43 47m retest repro upstream OK log
2024/05/30 17:08 18m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci error
2024/05/30 16:42 30m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci error
2024/05/30 16:42 17m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci error
2024/05/30 16:11 15m retest repro upstream error
2024/05/30 16:11 20m retest repro upstream error
2024/05/30 15:44 23m retest repro upstream error
2024/05/16 14:07 15m retest repro upstream report log
2024/05/16 14:07 21m retest repro upstream report log
2024/04/01 12:53 23m retest repro upstream error
2023/08/24 23:36 18m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master OK log
Cause bisection attempts (2)
Created Duration User Patch Repo Result
2023/11/08 08:08 6h37m bisect upstream OK (1) job log log
2023/10/24 07:18 2h02m bisect upstream error job log

Sample crash report:
------------[ cut here ]------------
kernel BUG at mm/memory.c:2237!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 5074 Comm: syz-executor168 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
RIP: 0010:vmf_insert_pfn_prot+0x24e/0x710 mm/memory.c:2237
Code: 0b e8 46 62 ba ff 49 89 ef bf 20 00 00 00 41 83 e7 28 4c 89 fe e8 42 5d ba ff 49 83 ff 20 0f 85 a4 fe ff ff e8 23 62 ba ff 90 <0f> 0b 48 bd ff ff ff ff ff ff 0f 00 e8 11 62 ba ff 4c 89 f6 48 89
RSP: 0018:ffffc900041d7708 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802d725d00 RCX: ffffffff81d3d9fe
RDX: ffff88801fc08000 RSI: ffffffff81d3da0d RDI: 0000000000000007
RBP: 000000000c040474 R08: 0000000000000007 R09: 0000000000000020
R10: 0000000000000020 R11: 0000000000000009 R12: 0000000020ffd000
R13: 1ffff9200083aee2 R14: 00000000000798b7 R15: 0000000000000020
FS:  00005555820d2480(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020ffd000 CR3: 0000000076184000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 drm_gem_shmem_fault+0x207/0x410 drivers/gpu/drm/drm_gem_shmem_helper.c:531
 __do_fault+0x10d/0x4a0 mm/memory.c:4396
 do_read_fault mm/memory.c:4758 [inline]
 do_fault mm/memory.c:4888 [inline]
 do_pte_missing mm/memory.c:3745 [inline]
 handle_pte_fault mm/memory.c:5164 [inline]
 __handle_mm_fault+0x32c2/0x4920 mm/memory.c:5305
 handle_mm_fault+0x476/0xa00 mm/memory.c:5470
 do_user_addr_fault+0x2e5/0x1080 arch/x86/mm/fault.c:1413
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_movs_alternative+0x5b/0x70 arch/x86/lib/copy_user_64.S:80
Code: 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 eb 05 e9 0f 3d 10 00 48 89 c8 48 c1 e9 03 83 e0 07 <f3> 48 a5 89 c1 85 c9 75 af e9 f7 3c 10 00 48 8d 0c c8 eb a4 90 90
RSP: 0018:ffffc900041d7b10 EFLAGS: 00050246
RAX: 0000000000000000 RBX: 0000000020ffd000 RCX: 0000000000000200
RDX: 0000000000000000 RSI: 0000000020ffd000 RDI: ffff888021bbc000
RBP: 0000000000001000 R08: 0000000000000001 R09: ffffed10043779ff
R10: ffff888021bbcfff R11: 0000000000000000 R12: 0000000020ffe000
R13: ffff888021bbc000 R14: 0000000000000000 R15: 0000000020ffd000
 copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:125 [inline]
 _copy_from_user+0xc6/0xf0 lib/usercopy.c:23
 copy_from_user include/linux/uaccess.h:183 [inline]
 snd_rawmidi_kernel_write1+0x4f9/0x880 sound/core/rawmidi.c:1555
 snd_rawmidi_write+0x26d/0xc00 sound/core/rawmidi.c:1624
 vfs_write+0x29b/0x1100 fs/read_write.c:588
 ksys_write+0x1f8/0x260 fs/read_write.c:643
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f9b07dfe4b9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc12a03518 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9b07dfe4b9
RDX: 00000000fffffd2c RSI: 0000000020000000 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 00007ffc12a03560 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vmf_insert_pfn_prot+0x24e/0x710 mm/memory.c:2237
Code: 0b e8 46 62 ba ff 49 89 ef bf 20 00 00 00 41 83 e7 28 4c 89 fe e8 42 5d ba ff 49 83 ff 20 0f 85 a4 fe ff ff e8 23 62 ba ff 90 <0f> 0b 48 bd ff ff ff ff ff ff 0f 00 e8 11 62 ba ff 4c 89 f6 48 89
RSP: 0018:ffffc900041d7708 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802d725d00 RCX: ffffffff81d3d9fe
RDX: ffff88801fc08000 RSI: ffffffff81d3da0d RDI: 0000000000000007
RBP: 000000000c040474 R08: 0000000000000007 R09: 0000000000000020
R10: 0000000000000020 R11: 0000000000000009 R12: 0000000020ffd000
R13: 1ffff9200083aee2 R14: 00000000000798b7 R15: 0000000000000020
FS:  00005555820d2480(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020ffd000 CR3: 0000000076184000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	8b 06                	mov    (%rsi),%eax
   2:	48 89 07             	mov    %rax,(%rdi)
   5:	48 83 c6 08          	add    $0x8,%rsi
   9:	48 83 c7 08          	add    $0x8,%rdi
   d:	83 e9 08             	sub    $0x8,%ecx
  10:	74 df                	je     0xfffffff1
  12:	83 f9 08             	cmp    $0x8,%ecx
  15:	73 e8                	jae    0xffffffff
  17:	eb c9                	jmp    0xffffffe2
  19:	eb 05                	jmp    0x20
  1b:	e9 0f 3d 10 00       	jmp    0x103d2f
  20:	48 89 c8             	mov    %rcx,%rax
  23:	48 c1 e9 03          	shr    $0x3,%rcx
  27:	83 e0 07             	and    $0x7,%eax
* 2a:	f3 48 a5             	rep movsq %ds:(%rsi),%es:(%rdi) <-- trapping instruction
  2d:	89 c1                	mov    %eax,%ecx
  2f:	85 c9                	test   %ecx,%ecx
  31:	75 af                	jne    0xffffffe2
  33:	e9 f7 3c 10 00       	jmp    0x103d2f
  38:	48 8d 0c c8          	lea    (%rax,%rcx,8),%rcx
  3c:	eb a4                	jmp    0xffffffe2
  3e:	90                   	nop
  3f:	90                   	nop

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/18 07:46 upstream fe46a7dd189e d615901c .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root kernel BUG in vmf_insert_pfn_prot
2023/11/25 08:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 8de1e7afcc1c 5b429f39 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 kernel BUG in vmf_insert_pfn_prot
2023/11/22 08:18 upstream c2d5304e6c64 cb976f63 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root kernel BUG in vmf_insert_pfn_prot
2023/11/15 14:49 upstream c42d9eeef8e5 cb976f63 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root kernel BUG in vmf_insert_pfn_prot
2023/08/20 07:32 upstream 9e6c269de404 d216d8a0 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2023/10/04 06:05 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2e530aeb342b 65faba36 .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 kernel BUG in vmf_insert_pfn_prot
2023/11/06 23:24 upstream d2f51b3516da 78fae24e .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/03/10 13:24 upstream 005f6f34bd47 6ee49f2e .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root kernel BUG in vmf_insert_pfn_prot
2024/05/02 14:01 upstream 0106679839f7 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/05/02 14:01 upstream 0106679839f7 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/27 11:36 upstream 5eb4573ea63d 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/21 00:13 upstream 977b1ef51866 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/11 04:48 upstream 480e035fc4c7 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/10 03:54 upstream 480e035fc4c7 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/10 01:21 upstream 480e035fc4c7 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/09 00:48 upstream 480e035fc4c7 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/09 00:24 upstream 480e035fc4c7 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/08 09:12 upstream 480e035fc4c7 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/05 05:33 upstream 480e035fc4c7 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/04/05 03:24 upstream 480e035fc4c7 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2024/01/09 21:46 upstream 9f8413c4a66f b438bd66 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root kernel BUG in vmf_insert_pfn_prot
2023/11/17 06:46 upstream 7475e51b8796 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root kernel BUG in vmf_insert_pfn_prot
2023/11/06 22:35 upstream d2f51b3516da 78fae24e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
2023/08/20 06:58 upstream 9e6c269de404 d216d8a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in vmf_insert_pfn_prot
* Struck through repros no longer work on HEAD.