syzbot


BUG: unable to handle kernel paging request in bpf_dispatcher_xdp

Status: upstream: reported C repro on 2023/07/18 23:26
Bug presence: origin:lts
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+6eba52e4fa9c661eb6e9@syzkaller.appspotmail.com
First crash: 543d, last: 164d
Cause bisection: introduced by (bisect log) :
commit dbe69b29988465b011f198f2797b1c2b6980b50e
Author: Jiri Olsa <jolsa@kernel.org>
Date: Tue Oct 18 07:59:34 2022 +0000

  bpf: Fix dispatcher patchable function entry to 5 bytes nop

Crash: invalid opcode in bpf_dispatcher_xdp (log)
Repro: syz .config
  
Fix bisection: failed (error log, bisect log)
  
Bug presence (4)
Date Name Commit Repro Result
2024/02/02 android14-6.1 (ToT) 016b64023588 C [report] invalid opcode in bpf_dispatcher_xdp
2023/11/04 lts (merge base) 52a953d0934b C [report] invalid opcode in bpf_dispatcher_xdp
2024/02/02 lts (merge base) ba6f5fb46511 C Didn't crash
2023/11/04 upstream (ToT) 90b0c2b2edd1 C Didn't crash
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 BUG: unable to handle kernel paging request in bpf_dispatcher_xdp origin:lts-only C done 16 294d 599d 3/3 fixed on 2024/08/03 08:10
Last patch testing requests (10)
Created Duration User Patch Repo Result
2024/10/28 17:26 12m retest repro android14-6.1 OK log
2024/10/19 12:27 14m retest repro android14-6.1 report log
2024/09/29 17:56 13m retest repro android14-6.1 report log
2024/09/14 13:21 18m retest repro android14-6.1 OK log
2024/08/19 11:25 34m retest repro android14-6.1 report log
2024/08/08 20:38 14m retest repro android14-6.1 report log
2024/07/21 16:05 8m retest repro android14-6.1 report log
2024/07/06 12:40 14m retest repro android14-6.1 report log
2024/06/10 10:17 11m retest repro android14-6.1 report log
2024/05/12 16:10 14m retest repro android14-6.1 OK log
Fix bisection attempts (2)
Created Duration User Patch Repo Result
2024/05/30 16:57 7m bisect fix android14-6.1 error job log
2024/02/18 11:54 1h52m bisect fix android14-6.1 OK (0) job log log

Sample crash report:
BUG: unable to handle page fault for address: ffffffff240fe3a9
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 6c12067 P4D 6c12067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4179 Comm: syz-executor351 Not tainted 6.1.43-syzkaller-00262-g7bec8a818066 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
RIP: 0010:bpf_dispatcher_xdp+0x863/0x1000
Code: eb d7 ff ff ff e2 90 48 81 fa 8c 1c 00 a0 7f 17 48 81 fa 8c 1c 00 a0 0f 84 f6 d8 ff ff ff e2 0f 1f 84 00 00 00 00 00 48 81 fa <20> 1d 00 a0 0f 84 73 d9 ff ff ff e2 ff e2 0f 1f 84 00 00 00 00 00
RSP: 0018:ffffc90000d078b0 EFLAGS: 00010046
RAX: ffffffff84117f17 RBX: ffffc90000d07c00 RCX: ffff888120220000
RDX: ffffffffa0001c8c RSI: ffffc900007e1050 RDI: ffffc90000d07c00
RBP: ffffc90000d078d0 R08: ffffffff842f95ed R09: ffffed1024044001
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffc900007e1030 R14: ffffffffa0001c8c R15: ffffc900007e1050
FS:  00007f7e956616c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff240fe3a9 CR3: 0000000128ebc000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __bpf_prog_run include/linux/filter.h:600 [inline]
 bpf_prog_run_xdp include/linux/filter.h:775 [inline]
 bpf_test_run+0x470/0xa40 net/bpf/test_run.c:400
 bpf_prog_test_run_xdp+0x7a7/0x1130 net/bpf/test_run.c:1389
 bpf_prog_test_run+0x3b0/0x630 kernel/bpf/syscall.c:3635
 __sys_bpf+0x59f/0x7f0 kernel/bpf/syscall.c:4990
 __do_sys_bpf kernel/bpf/syscall.c:5076 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5074 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5074
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7e956a5869
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7e95661238 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f7e95730408 RCX: 00007f7e956a5869
RDX: 0000000000000048 RSI: 0000000020001480 RDI: 000000000000000a
RBP: 00007f7e95730400 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffb0
R13: 000000000000000b R14: 00007ffc02016ad0 R15: 00007ffc02016bb8
 </TASK>
Modules linked in:
CR2: ffffffff240fe3a9
---[ end trace 0000000000000000 ]---
RIP: 0010:bpf_dispatcher_xdp+0x863/0x1000
Code: eb d7 ff ff ff e2 90 48 81 fa 8c 1c 00 a0 7f 17 48 81 fa 8c 1c 00 a0 0f 84 f6 d8 ff ff ff e2 0f 1f 84 00 00 00 00 00 48 81 fa <20> 1d 00 a0 0f 84 73 d9 ff ff ff e2 ff e2 0f 1f 84 00 00 00 00 00
RSP: 0018:ffffc90000d078b0 EFLAGS: 00010046
RAX: ffffffff84117f17 RBX: ffffc90000d07c00 RCX: ffff888120220000
RDX: ffffffffa0001c8c RSI: ffffc900007e1050 RDI: ffffc90000d07c00
RBP: ffffc90000d078d0 R08: ffffffff842f95ed R09: ffffed1024044001
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffc900007e1030 R14: ffffffffa0001c8c R15: ffffc900007e1050
FS:  00007f7e956616c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff240fe3a9 CR3: 0000000128ebc000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (20):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/11/04 10:26 android14-6.1 7bec8a818066 500bfdc4 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci2-android-6-1 BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/07/18 23:21 android14-6.1 6c695fad68dc 022df2bb .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/10/31 15:58 android14-6.1 82fe654f5652 58499c95 .config console log report syz [disk image] [vmlinux] [kernel image] ci2-android-6-1 BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/11/03 03:15 android14-6.1 f8d3b450e9be c4ac074c .config console log report syz [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf general protection fault in bpf_dispatcher_xdp
2024/01/08 06:12 android14-6.1 ac90f0829243 d0304e9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2024/01/05 07:46 android14-6.1 e74417834ea0 28c42cff .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/12/06 02:46 android14-6.1 924116f1b811 858d62d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/11/22 17:17 android14-6.1 5c8e593916ad 03e12510 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/11/21 13:19 android14-6.1 8f46c3493178 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/10/14 07:23 android14-6.1 acb072863888 f757a323 .config console log report syz [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/10/12 08:38 android14-6.1 f4812c6864dc 1b231e3c .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/10/04 07:13 android14-6.1 5f8aa27248b3 65faba36 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2023/05/28 11:31 android14-6.1 500484f5be02 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: unable to handle kernel paging request in bpf_dispatcher_xdp
2024/04/12 22:08 android14-6.1 cfa154389a65 c8349e48 .config console log report syz [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf general protection fault in bpf_dispatcher_xdp
2023/12/24 11:40 android14-6.1 401a2769d990 fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf general protection fault in bpf_dispatcher_xdp
2023/11/30 17:38 android14-6.1 dc61d0ccd68a f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf general protection fault in bpf_dispatcher_xdp
2023/11/16 00:44 android14-6.1 fb91717581d1 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf general protection fault in bpf_dispatcher_xdp
2023/11/11 17:17 android14-6.1 48c6c901fe0e 6d6dbf8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf general protection fault in bpf_dispatcher_xdp
2023/11/09 03:36 android14-6.1 beea09533dd2 4862372a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf general protection fault in bpf_dispatcher_xdp
2023/09/12 13:21 android14-6.1 2eb5b31ac1e3 59da8366 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf general protection fault in bpf_dispatcher_xdp
* Struck through repros no longer work on HEAD.