syzbot


BUG: unable to handle kernel paging request (2)

Status: closed as invalid on 2017/12/19 12:44
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+99261fe290b0cc751b6cd4b8a238dff463706fdc@syzkaller.appspotmail.com
First crash: 2780d, last: 2771d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request (3) tipc 8 1 2740d 2736d 0/29 closed as invalid on 2018/02/12 15:43

Sample crash report:
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffff8801ac4cf218
IP: 0xffff8801ac4cf218
PGD 7d8a067 P4D 7d8a067 PUD 1c8d8e063 PMD 80000001ac4001e3 
Oops: 0011 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 17030 Comm: syz-executor0 Not tainted 4.15.0-rc2+ #120
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0xffff8801ac4cf218
RSP: 0018:ffff8801db407988 EFLAGS: 00010246
RAX: ffffffff815dba4c RBX: ffff8801a7ba5e10 RCX: 0000000000000000
RDX: 1ffff10034f74bc3 RSI: 0000000074bac128 RDI: ffff8801a7ba5e10
RBP: ffff8801db407c80 R08: 0000000000000001 R09: 0000000000000002
R10: 0000000000000000 R11: ffffffff87489d60 R12: ffff8801ac4cf218
R13: ffff8801a7ba5e18 R14: dffffc0000000000 R15: ffff8801db407c58
FS:  0000000000000000(0000) GS:ffff8801db400000(0063) knlGS:00000000f7742b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff8801ac4cf218 CR3: 00000001c4e30000 CR4: 00000000001406f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 __do_softirq+0x29d/0xbb2 kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x1d3/0x210 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:540 [inline]
 smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:795
 </IRQ>
RIP: 0010:clear_page_erms+0x7/0x10 arch/x86/lib/clear_page_64.S:49
RSP: 0018:ffff8801c45df370 EFLAGS: 00010246 ORIG_RAX: ffffffffffffff11
RAX: 0000000000000000 RBX: 0000000000000044 RCX: 0000000000000340
RDX: ffff8801c49e8000 RSI: 0000160000000000 RDI: ffff8801a0044cc0
RBP: ffff8801c45df3c0 R08: 00000000000290d0 R09: 0000000000000000
R10: ffffffffffffffe8 R11: 0000000000000000 R12: ffffea0006800000
R13: 00000000000001ad R14: dffffc0000000000 R15: ffffffff85316560
 __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline]
 do_huge_pmd_anonymous_page+0x59c/0x1b00 mm/huge_memory.c:728
 create_huge_pmd mm/memory.c:3828 [inline]
 __handle_mm_fault+0x1b9f/0x3e20 mm/memory.c:4031
 handle_mm_fault+0x334/0x8d0 mm/memory.c:4097
 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1429
 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1504
 page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1094
RIP: 0010:__put_user_4+0x1c/0x30 arch/x86/lib/putuser.S:68
RSP: 0018:ffff8801c45dfcc0 EFLAGS: 00010297
RAX: 0000000000000015 RBX: 00007fffffffeffd RCX: 00000000202f9000
RDX: 0000000000000767 RSI: ffffc90001939000 RDI: 0000000000000286
RBP: ffff8801c45dfdb0 R08: 1ffffffff0d2eb4f R09: 1ffff100388bbf6d
R10: ffff8801c49e8000 R11: 0000000000000000 R12: 0000000000000015
R13: 1ffff100388bbf9d R14: ffff8801c99f4c80 R15: 0000000000000016
 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]
 do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389
 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125
RIP: 0023:0xf7f46c79
RSP: 002b:00000000f774208c EFLAGS: 00000296 ORIG_RAX: 0000000000000168
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000000003
RDX: 0000000000000000 RSI: 00000000202f9000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: 88 ff ff e8 f1 4c ac 01 88 ff ff f8 f1 4c ac 01 88 ff ff f8 f1 4c ac 01 88 ff ff 08 f2 4c ac 01 88 ff ff 08 f2 4c ac 01 88 ff ff <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
RIP: 0xffff8801ac4cf218 RSP: ffff8801db407988
CR2: ffff8801ac4cf218
---[ end trace aa4cb9ec6182d45d ]---

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/06 19:34 upstream e56d565d67ae 5d643f8e .config console log report ci-upstream-kasan-gce-386
2017/12/15 20:59 linux-next 6084b576dca2 ac20b98c .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.