syzbot


general protection fault in srcu_gp_start_if_needed (2)

Status: moderation: reported on 2025/04/05 10:10
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+cc9f5ca6b9758792a852@syzkaller.appspotmail.com
First crash: 7d11h, last: 7d11h
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in srcu_gp_start_if_needed kernel 1 110d 106d 0/28 auto-obsoleted due to no activity on 2025/02/16 21:52
upstream KASAN: global-out-of-bounds Read in srcu_gp_start_if_needed bcachefs 1 320d 316d 27/28 fixed on 2024/08/23 03:09

Sample crash report:
Oops: general protection fault, probably for non-canonical address 0xfc101bfff1100af1: 0000 [#1] SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0xe080ffff88805788-0xe080ffff8880578f]
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0-syzkaller-11144-g1e7857b28020 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: rcu_gp srcu_invoke_callbacks
RIP: 0010:check_init_srcu_struct kernel/rcu/srcutree.c:410 [inline]
RIP: 0010:srcu_gp_start_if_needed+0xb2/0x12a0 kernel/rcu/srcutree.c:1263
Code: 42 c7 44 21 0d f3 f3 48 89 8c 24 90 00 00 00 42 c6 44 21 0f f3 48 89 7c 24 40 4c 8d 7f 38 4c 89 f8 48 c1 e8 03 48 89 44 24 28 <42> 80 3c 20 00 74 08 4c 89 ff e8 bf bd 81 00 bb 88 01 00 00 49 03
RSP: 0018:ffffc900000e7880 EFLAGS: 00010a02
RAX: 1c101ffff1100af1 RBX: 1ffffd1ffffada7a RCX: 1ffff9200001cf24
RDX: 0000000000000001 RSI: ffffe8ffffd6d3c8 RDI: e080ffff88805750
RBP: ffffc900000e79f0 R08: ffffffff905e2977 R09: 1ffffffff20bc52e
R10: dffffc0000000000 R11: fffffbfff20bc52f R12: dffffc0000000000
R13: ffffe8ffffd6d3c8 R14: ffffe8ffffd6d3c8 R15: e080ffff88805788
FS:  0000000000000000(0000) GS:ffff888124fe4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f54471ff000 CR3: 000000000eb38000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 srcu_invoke_callbacks+0x23a/0x4a0 kernel/rcu/srcutree.c:1805
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319
 worker_thread+0x870/0xd50 kernel/workqueue.c:3400
 kthread+0x7b7/0x940 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:check_init_srcu_struct kernel/rcu/srcutree.c:410 [inline]
RIP: 0010:srcu_gp_start_if_needed+0xb2/0x12a0 kernel/rcu/srcutree.c:1263
Code: 42 c7 44 21 0d f3 f3 48 89 8c 24 90 00 00 00 42 c6 44 21 0f f3 48 89 7c 24 40 4c 8d 7f 38 4c 89 f8 48 c1 e8 03 48 89 44 24 28 <42> 80 3c 20 00 74 08 4c 89 ff e8 bf bd 81 00 bb 88 01 00 00 49 03
RSP: 0018:ffffc900000e7880 EFLAGS: 00010a02

RAX: 1c101ffff1100af1 RBX: 1ffffd1ffffada7a RCX: 1ffff9200001cf24
RDX: 0000000000000001 RSI: ffffe8ffffd6d3c8 RDI: e080ffff88805750
RBP: ffffc900000e79f0 R08: ffffffff905e2977 R09: 1ffffffff20bc52e
R10: dffffc0000000000 R11: fffffbfff20bc52f R12: dffffc0000000000
R13: ffffe8ffffd6d3c8 R14: ffffe8ffffd6d3c8 R15: e080ffff88805788
FS:  0000000000000000(0000) GS:ffff888124fe4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f54471ff000 CR3: 000000000eb38000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	42 c7 44 21 0d f3 f3 	movl   $0x8948f3f3,0xd(%rcx,%r12,1)
   7:	48 89
   9:	8c 24 90             	mov    %fs,(%rax,%rdx,4)
   c:	00 00                	add    %al,(%rax)
   e:	00 42 c6             	add    %al,-0x3a(%rdx)
  11:	44 21 0f             	and    %r9d,(%rdi)
  14:	f3 48 89 7c 24 40    	xrelease mov %rdi,0x40(%rsp)
  1a:	4c 8d 7f 38          	lea    0x38(%rdi),%r15
  1e:	4c 89 f8             	mov    %r15,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	48 89 44 24 28       	mov    %rax,0x28(%rsp)
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 ff             	mov    %r15,%rdi
  34:	e8 bf bd 81 00       	call   0x81bdf8
  39:	bb 88 01 00 00       	mov    $0x188,%ebx
  3e:	49                   	rex.WB
  3f:	03                   	.byte 0x3

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/01 10:03 upstream 1e7857b28020 36d76a97 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in srcu_gp_start_if_needed
* Struck through repros no longer work on HEAD.