BUG: unable to handle kernel paging request in sctp_outq

Date	Name	Commit	Repro	Result
2023/05/04	upstream (ToT)	1a5304fecee5	C	Didn't crash

Date

Name

Commit

Repro

Result

2023/05/04

upstream (ToT)

1a5304fecee5

Didn't crash

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-6.1	BUG: unable to handle kernel paging request in sctp_outq_tail origin:lts-only	C		done	2	517d	622d	3/3	fixed on 2023/08/21 17:07
upstream	general protection fault in sctp_outq_tail sctp	C	error		5	597d	609d	22/28	fixed on 2023/06/08 14:41

linux-6.1

BUG: unable to handle kernel paging request in sctp_outq_tail origin:lts-only

done

517d

622d

3/3

fixed on 2023/08/21 17:07

upstream

general protection fault in sctp_outq_tail sctp

error

597d

609d

22/28

fixed on 2023/06/08 14:41


Created	Duration	User	Patch	Repo	Result
2023/05/10 21:27	7h00m	bisect fix		linux-5.15.y	OK (1) job log
2023/04/09 06:53	46m	bisect fix		linux-5.15.y	OK (0) job log log

Unable to handle kernel paging request at virtual address dfff800000000007 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000007] address between user and kernel address ranges Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6011 Comm: syz-executor243 Not tainted 5.15.98-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : list_add_tail include/linux/list.h:100 [inline] pc : sctp_outq_tail_data net/sctp/outqueue.c:91 [inline] pc : sctp_outq_tail+0x270/0xa1c net/sctp/outqueue.c:299 lr : sctp_stream_out include/net/sctp/structs.h:1493 [inline] lr : sctp_outq_tail_data net/sctp/outqueue.c:90 [inline] lr : sctp_outq_tail+0x244/0xa1c net/sctp/outqueue.c:299 sp : ffff800020527290 x29: ffff8000205272a0 x28: 0000000000000007 x27: dfff800000000000 x26: 0000000000000038 x25: 0000000000000030 x24: ffff0000e3212b90 x23: ffff0000e3212b58 x22: ffff0000e3212ba0 x21: ffff0000e3212b40 x20: ffff0000e0c987f0 x19: 1fffe0001c642574 x18: 0000000000000000 x17: ff808000110536ac x16: ffff8000084c28f4 x15: ffff8000110536ac x14: 0000000000000040 x13: ffffffffffffffff x12: 0000000000000000 x11: ff8080000a9a25b8 x10: 0000000000000000 x9 : ffff80000a9a25b8 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f x5 : ffff800020527420 x4 : ffff0000e0ad1400 x3 : ffff800011010344 x2 : ffff0000e0c987f8 x1 : 00000000000000c0 x0 : ffff0000e314b0c0 Call trace: list_add_tail include/linux/list.h:100 [inline] sctp_outq_tail_data net/sctp/outqueue.c:91 [inline] sctp_outq_tail+0x270/0xa1c net/sctp/outqueue.c:299 sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x2858/0x4dc4 net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x98/0xc8 net/sctp/primitive.c:163 sctp_sendmsg_to_asoc+0x1058/0x17dc net/sctp/socket.c:1869 sctp_sendmsg+0x196c/0x2844 net/sctp/socket.c:2027 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:823 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] __sys_sendto+0x388/0x4d0 net/socket.c:2039 __do_sys_sendto net/socket.c:2051 [inline] __se_sys_sendto net/socket.c:2047 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2047 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 <unknown>:584 Code: 910062b7 9100e11a 9100c119 d343ff5c (387b6b89) ---[ end trace b6c276d6bae36334 ]--- ---------------- Code disassembly (best guess): 0: 910062b7 add x23, x21, #0x18 4: 9100e11a add x26, x8, #0x38 8: 9100c119 add x25, x8, #0x30 c: d343ff5c lsr x28, x26, #3 * 10: 387b6b89 ldrb w9, [x28, x27] <-- trapping instruction

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2023/03/08 23:48	linux-5.15.y	d9b4a0c83a2d	4fc6d98d	.config	console log	report	syz	C		[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan-arm64	BUG: unable to handle kernel paging request in sctp_outq_tail
2023/03/10 06:52	linux-5.15.y	d9b4a0c83a2d	f08b59ac	.config	console log	report	syz	C		[disk image] [vmlinux] [kernel image]	ci2-linux-5-15-kasan	general protection fault in sctp_outq_tail

Crashes (2):

Assets (help?)