syzbot

 sign-in | mailing list | source | docs
🐞 Open [712]
🐞 Fixed [297]
🐞 Invalid [838]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find

Status: upstream: reported C repro on 2019/10/14 06:35
Reported-by: syzbot+46636e28a2400d65519f@syzkaller.appspotmail.com
First crash: 1895d, last: 1557d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find bpf syz done inconclusive 3 2150d 2224d 12/28 fixed on 2019/09/06 20:45
▶ ▼ Fix bisection attempts (8)
Created Duration User Patch Repo Result
2020/10/16 13:59 4m bisect fix linux-4.19.y error job log
2020/09/16 13:34 25m bisect fix linux-4.19.y OK (0) job log log
2020/08/17 11:18 30m bisect fix linux-4.19.y OK (0) job log log
2020/07/13 04:27 26m bisect fix linux-4.19.y OK (0) job log log
2020/06/13 03:59 27m bisect fix linux-4.19.y OK (0) job log log
2020/05/14 03:30 29m bisect fix linux-4.19.y OK (0) job log log
2020/04/14 03:02 27m bisect fix linux-4.19.y OK (0) job log log
2020/03/15 02:30 32m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
BUG: unable to handle kernel paging request at ffffc9000192d030
PGD aa41c067 P4D aa41c067 PUD 21bc31067 PMD 219b3f067 PTE 800000008997b163
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 11939 Comm: syz-executor892 Not tainted 4.19.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bpf_jit_binary_hdr include/linux/filter.h:699 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:380 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:437 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x134/0x2c0 kernel/bpf/core.c:504
Code: 03 42 80 3c 28 00 0f 85 49 01 00 00 49 8b 47 50 48 8d 78 30 48 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f 85 4b 01 00 00 48 8d 78 02 <48> 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
RSP: 0018:ffff8880982770f8 EFLAGS: 00010246
RAX: ffffc9000192d000 RBX: 0000000000000000 RCX: ffffffff81759203
RDX: 1ffff92000325a06 RSI: ffffffff81759228 RDI: ffffc9000192d002
RBP: ffff888098277138 R08: ffff888098b32240 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff888097804330
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888097804330
FS:  00000000013c5880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000192d030 CR3: 000000009758d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 is_bpf_text_address+0x78/0x170 kernel/bpf/core.c:546
 kernel_text_address+0x73/0xf0 kernel/extable.c:152
 __kernel_text_address+0xd/0x40 kernel/extable.c:107
 unwind_get_return_address arch/x86/kernel/unwind_frame.c:18 [inline]
 unwind_get_return_address+0x61/0xa0 arch/x86/kernel/unwind_frame.c:13
 __save_stack_trace+0x99/0x100 arch/x86/kernel/stacktrace.c:45
 save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc mm/kasan/kasan.c:553 [inline]
 kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:445 [inline]
 slab_alloc mm/slab.c:3397 [inline]
 kmem_cache_alloc+0x11b/0x700 mm/slab.c:3557
 kmem_cache_zalloc include/linux/slab.h:699 [inline]
 inode_alloc_security security/selinux/hooks.c:255 [inline]
 selinux_inode_alloc_security+0xb6/0x2a0 security/selinux/hooks.c:3007
 security_inode_alloc+0x8a/0xd0 security/security.c:444
 inode_init_always+0x56e/0xb40 fs/inode.c:168
 alloc_inode+0x81/0x190 fs/inode.c:217
 new_inode_pseudo+0x19/0xf0 fs/inode.c:910
 new_inode+0x1f/0x40 fs/inode.c:939
 proc_pid_make_inode+0x22/0x230 fs/proc/base.c:1753
 proc_pid_instantiate+0x54/0x160 fs/proc/base.c:3162
 proc_pid_lookup+0x18e/0x290 fs/proc/base.c:3197
 proc_root_lookup+0x28/0x60 fs/proc/root.c:157
 __lookup_slow+0x279/0x500 fs/namei.c:1672
 lookup_slow+0x58/0x80 fs/namei.c:1689
 walk_component+0x747/0x2000 fs/namei.c:1811
 link_path_walk.part.0+0x594/0x1330 fs/namei.c:2139
 link_path_walk fs/namei.c:2073 [inline]
 path_openat+0x1fc/0x4500 fs/namei.c:3536
 do_filp_open+0x1a1/0x280 fs/namei.c:3567
 do_sys_open+0x3fe/0x550 fs/open.c:1088
 __do_sys_open fs/open.c:1106 [inline]
 __se_sys_open fs/open.c:1101 [inline]
 __x64_sys_open+0x7e/0xc0 fs/open.c:1101
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4010f0
Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d dd 15 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00
RSP: 002b:00007ffdd47f6a58 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007ffdd47f6a84 RCX: 00000000004010f0
RDX: 00007ffdd47f6a8a RSI: 0000000000080001 RDI: 00000000004a2362
RBP: 00007ffdd47f6a80 R08: 0000000000000000 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402110
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffc9000192d030
---[ end trace 7ad75b5ceab1076e ]---
RIP: 0010:bpf_jit_binary_hdr include/linux/filter.h:699 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:380 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:437 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:511 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x134/0x2c0 kernel/bpf/core.c:504
Code: 03 42 80 3c 28 00 0f 85 49 01 00 00 49 8b 47 50 48 8d 78 30 48 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f 85 4b 01 00 00 48 8d 78 02 <48> 8b 58 30 48 89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 2a
RSP: 0018:ffff8880982770f8 EFLAGS: 00010246
RAX: ffffc9000192d000 RBX: 0000000000000000 RCX: ffffffff81759203
RDX: 1ffff92000325a06 RSI: ffffffff81759228 RDI: ffffc9000192d002
RBP: ffff888098277138 R08: ffff888098b32240 R09: ffffed1015d04733
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: ffff888097804330
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888097804330
FS:  00000000013c5880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000192d030 CR3: 000000009758d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/02 11:39 linux-4.19.y 32ee7492f104 2274ad39 .config console log report syz C ci2-linux-4-19
2020/07/18 11:18 linux-4.19.y 17a87580a885 9c812472 .config console log report ci2-linux-4-19
2020/02/14 01:42 linux-4.19.y 357668399cf7 5d7b90f1 .config console log report ci2-linux-4-19
2020/02/02 09:36 linux-4.19.y 32ee7492f104 2274ad39 .config console log report ci2-linux-4-19
2019/10/20 02:43 linux-4.19.y c3038e718a19 8c88c9c1 .config console log report ci2-linux-4-19
2019/10/14 05:34 linux-4.19.y dafd634415a7 2f661ec4 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.