syzbot


invalid opcode in __traceiter_percpu_alloc_percpu

Status: upstream: reported C repro on 2025/05/16 03:57
Bug presence: origin:downstream
[Documentation on labels]
Reported-by: syzbot+644faf47f14bc5ffcb6e@syzkaller.appspotmail.com
First crash: 210d, last: 19d
Bug presence (3)
Date Name Commit Repro Result
2025/05/17 android14-6.1 (ToT) a0fa2316cce1 C [report] invalid opcode in __traceiter_percpu_alloc_percpu
2025/05/17 lts (merge base) 420102835862 C Didn't crash
2025/05/17 upstream (ToT) 172a9d94339c C Didn't crash
Last patch testing requests (10)
Created Duration User Patch Repo Result
2025/12/07 14:01 10m retest repro android14-6.1 error
2025/10/20 05:08 27m retest repro android14-6.1 report log
2025/10/20 05:08 10m retest repro android14-6.1 report log
2025/10/20 05:08 7m retest repro android14-6.1 report log
2025/10/04 17:31 7m retest repro android14-6.1 report log
2025/08/10 18:19 16m retest repro android14-6.1 report log
2025/08/10 18:19 16m retest repro android14-6.1 report log
2025/08/10 18:19 13m retest repro android14-6.1 report log
2025/07/26 12:40 10m retest repro android14-6.1 report log
2025/05/31 12:35 7m retest repro android14-6.1 report log

Sample crash report:
CFI failure at __traceiter_percpu_alloc_percpu+0xb3/0x110 include/trace/events/percpu.h:11 (target: 0xffffc90000a56580; expected type: 0x42e72b63)
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 374 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__traceiter_percpu_alloc_percpu+0xb3/0x110 include/trace/events/percpu.h:11
Code: d4 44 89 e9 4c 8b 45 c0 4c 8b 4d b8 8b 45 30 50 ff 75 28 ff 75 20 8b 45 18 50 ff 75 10 41 ba 9d d4 18 bd 45 03 54 24 fc 74 02 <0f> 0b 41 ff d4 48 83 c4 28 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80
RSP: 0018:ffffc90000a56580 EFLAGS: 00010a17
RAX: 0000000000010870 RBX: ffff88811657d2a8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81a4aaa5 RDI: ffffc90000cd9000
RBP: ffffc90000a565f0 R08: 0000000000000008 R09: 0000000000000008
R10: 0000000062593ba9 R11: 1ffff9200014ac7d R12: ffffffff81713fc0
R13: 0000000000000000 R14: ffff88811657d2a8 R15: dffffc0000000000
FS:  000055556e739500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000013362e000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 trace_percpu_alloc_percpu include/trace/events/percpu.h:11 [inline]
 pcpu_alloc+0x1548/0x1690 mm/percpu.c:1887
 __alloc_percpu_gfp+0x25/0x30 mm/percpu.c:1937
 fib_nh_common_init net/ipv4/fib_semantics.c:591 [inline]
 fib_nh_init+0x9b/0x400 net/ipv4/fib_semantics.c:630
 fib_create_info+0xdd7/0x2030 net/ipv4/fib_semantics.c:1497
 fib_table_insert+0xb6/0x1d00 net/ipv4/fib_trie.c:1217
 fib_magic net/ipv4/fib_frontend.c:1118 [inline]
 fib_add_ifaddr+0x320/0xd20 net/ipv4/fib_frontend.c:1140
 fib_netdev_event+0x231/0x5b0 net/ipv4/fib_frontend.c:1500
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xa1/0x110 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2009 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2047 [inline]
 call_netdevice_notifiers net/core/dev.c:2061 [inline]
 __dev_notify_flags+0x28f/0x500 net/core/dev.c:-1
 dev_change_flags+0xe8/0x1a0 net/core/dev.c:8730
 do_setlink+0xc3d/0x3d50 net/core/rtnetlink.c:2833
 __rtnl_newlink net/core/rtnetlink.c:3608 [inline]
 rtnl_newlink+0x17d9/0x2030 net/core/rtnetlink.c:3655
 rtnetlink_rcv_msg+0x9f4/0xcf0 net/core/rtnetlink.c:6153
 netlink_rcv_skb+0x1f2/0x440 net/netlink/af_netlink.c:2521
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6171
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x8ab/0xa30 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x8aa/0xbc0 net/netlink/af_netlink.c:1873
 sock_sendmsg_nosec net/socket.c:716 [inline]
 __sock_sendmsg net/socket.c:728 [inline]
 __sys_sendto+0x464/0x5e0 net/socket.c:2143
 __do_sys_sendto net/socket.c:2155 [inline]
 __se_sys_sendto net/socket.c:2151 [inline]
 __x64_sys_sendto+0xe5/0x100 net/socket.c:2151
 x64_sys_call+0x83/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7b21591583
Code: 64 89 02 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 90 80 3d e1 9f 22 00 00 41 89 ca 74 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 55 48 83 ec 30 44 89 4c 24
RSP: 002b:00007ffefbfdfa78 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f7b22314620 RCX: 00007f7b21591583
RDX: 0000000000000020 RSI: 00007f7b22314670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffefbfdfa94 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f7b22314670 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__traceiter_percpu_alloc_percpu+0xb3/0x110 include/trace/events/percpu.h:11
Code: d4 44 89 e9 4c 8b 45 c0 4c 8b 4d b8 8b 45 30 50 ff 75 28 ff 75 20 8b 45 18 50 ff 75 10 41 ba 9d d4 18 bd 45 03 54 24 fc 74 02 <0f> 0b 41 ff d4 48 83 c4 28 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80
RSP: 0018:ffffc90000a56580 EFLAGS: 00010a17

RAX: 0000000000010870 RBX: ffff88811657d2a8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81a4aaa5 RDI: ffffc90000cd9000
RBP: ffffc90000a565f0 R08: 0000000000000008 R09: 0000000000000008
R10: 0000000062593ba9 R11: 1ffff9200014ac7d R12: ffffffff81713fc0
R13: 0000000000000000 R14: ffff88811657d2a8 R15: dffffc0000000000
FS:  000055556e739500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000013362e000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/23 11:59 android14-6.1 eba111621724 4fb8ef37 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1 invalid opcode in __traceiter_percpu_alloc_percpu
2025/05/16 05:57 android14-6.1 218e2bd24587 cfde8269 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_percpu_alloc_percpu
2025/05/16 05:16 android14-6.1 218e2bd24587 cfde8269 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_percpu_alloc_percpu
2025/05/16 04:33 android14-6.1 218e2bd24587 cfde8269 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_percpu_alloc_percpu
2025/05/16 03:52 android14-6.1 218e2bd24587 cfde8269 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_percpu_alloc_percpu
2025/11/23 11:17 android14-6.1 eba111621724 4fb8ef37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1 invalid opcode in __traceiter_percpu_alloc_percpu
2025/07/09 16:59 android14-6.1 e2deb0b42a3a f4e5e155 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_percpu_alloc_percpu
2025/05/16 02:45 android14-6.1 218e2bd24587 cfde8269 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_percpu_alloc_percpu
2025/05/16 02:45 android14-6.1 218e2bd24587 cfde8269 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_percpu_alloc_percpu
* Struck through repros no longer work on HEAD.