syzbot


invalid opcode in __traceiter_timer_start

Status: upstream: reported C repro on 2025/04/26 13:22
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+5566b966cd8fbf668767@syzkaller.appspotmail.com
First crash: 3d01h, last: 2d19h
Bug presence (2)
Date Name Commit Repro Result
2025/04/27 lts (merge base) 420102835862 C [report] invalid opcode in __traceiter_timer_start
2025/04/27 upstream (ToT) 5bc1018675ec C [report] invalid opcode in __traceiter_timer_start

Sample crash report:
CFI failure at __traceiter_timer_start+0x87/0xe0 include/trace/events/timer.h:53 (target: tp_stub_func+0x0/0x10; expected type: 0x82fbfa63)
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 19 Comm: kworker/0:1 Not tainted 6.1.129-syzkaller-00022-g25fc41bbde8e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: rcu_gp srcu_invoke_callbacks
RIP: 0010:__traceiter_timer_start+0x87/0xe0 include/trace/events/timer.h:53
Code: f8 48 c1 e8 03 80 3c 18 00 74 05 e8 43 3d 53 00 49 8b 7d 08 4c 89 fe 48 8b 55 c8 8b 4d d4 41 ba 9d 05 04 7d 45 03 56 fc 74 02 <0f> 0b 41 ff d6 49 83 c4 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08
RSP: 0018:ffffc90000007838 EFLAGS: 00010017
RAX: 1ffff11021e1a383 RBX: dffffc0000000000 RCX: 0000000002600000
RDX: 00000000ffff9388 RSI: ffffffff86fe6d40 RDI: ffffc900000d9000
RBP: ffffc90000007870 R08: dffffc0000000000 R09: fffffbfff0ee41b6
R10: 0000000022446ca9 R11: 1ffffffff0ee41b5 R12: ffff88810f0d1c10
R13: ffff88810f0d1c10 R14: ffffffff8170fe20 R15: ffffffff86fe6d40
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000124ceb000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 trace_timer_start include/trace/events/timer.h:53 [inline]
 enqueue_timer+0x337/0x480 kernel/time/timer.c:615
 __mod_timer+0x79f/0xb30 kernel/time/timer.c:-1
 add_timer+0x68/0x80 kernel/time/timer.c:1218
 __queue_delayed_work+0x173/0x200 kernel/workqueue.c:1686
 queue_delayed_work_on+0xdb/0x150 kernel/workqueue.c:1711
 queue_delayed_work include/linux/workqueue.h:525 [inline]
 srcu_funnel_gp_start kernel/rcu/srcutree.c:951 [inline]
 srcu_gp_start_if_needed+0xbd8/0xfe0 kernel/rcu/srcutree.c:1151
 __call_srcu kernel/rcu/srcutree.c:1196 [inline]
 call_srcu+0x49/0x50 kernel/rcu/srcutree.c:1219
 rcu_free_old_probes+0x23/0x30 kernel/tracepoint.c:121
 rcu_do_batch+0x515/0xb90 kernel/rcu/tree.c:2297
 rcu_core+0x5a5/0xe70 kernel/rcu/tree.c:2557
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2574
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:624
 __do_softirq+0xb/0xd kernel/softirq.c:662
 do_softirq+0xc6/0x120 kernel/softirq.c:506
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x75/0x80 kernel/softirq.c:430
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 srcu_invoke_callbacks+0x1cf/0x410 kernel/rcu/srcutree.c:1597
 process_one_work+0x71f/0xc40 kernel/workqueue.c:2299
 worker_thread+0xa29/0x11f0 kernel/workqueue.c:2446
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__traceiter_timer_start+0x87/0xe0 include/trace/events/timer.h:53
Code: f8 48 c1 e8 03 80 3c 18 00 74 05 e8 43 3d 53 00 49 8b 7d 08 4c 89 fe 48 8b 55 c8 8b 4d d4 41 ba 9d 05 04 7d 45 03 56 fc 74 02 <0f> 0b 41 ff d6 49 83 c4 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08
RSP: 0018:ffffc90000007838 EFLAGS: 00010017
RAX: 1ffff11021e1a383 RBX: dffffc0000000000 RCX: 0000000002600000
RDX: 00000000ffff9388 RSI: ffffffff86fe6d40 RDI: ffffc900000d9000
RBP: ffffc90000007870 R08: dffffc0000000000 R09: fffffbfff0ee41b6
R10: 0000000022446ca9 R11: 1ffffffff0ee41b5 R12: ffff88810f0d1c10
R13: ffff88810f0d1c10 R14: ffffffff8170fe20 R15: ffffffff86fe6d40
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000124ceb000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/26 15:04 android14-6.1 25fc41bbde8e c6b4fb39 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_timer_start
2025/04/26 14:10 android14-6.1 25fc41bbde8e c6b4fb39 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_timer_start
2025/04/26 13:15 android14-6.1 25fc41bbde8e c6b4fb39 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_timer_start
2025/04/26 09:23 android14-6.1 70d648657b1e c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_timer_start
* Struck through repros no longer work on HEAD.