syzbot


invalid opcode in asm_sysvec_reschedule_ipi

Status: upstream: reported on 2025/05/11 05:41
Reported-by: syzbot+e9a8989c16d516993c38@syzkaller.appspotmail.com
First crash: 20d, last: 20d

Sample crash report:
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 6419 Comm: syz.0.492 Not tainted 5.15.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:asm_sysvec_reschedule_ipi+0x15/0x20 arch/x86/include/asm/idtentry.h:681
Code: 48 89 c4 48 89 e7 e8 1a ff e0 ff e9 85 04 00 00 90 90 90 90 90 0f 01 ca fc 6a ff e8 85 03 00 00 48 89 c4 48 89 e7 e8 da 16 e1 <ff> e9 65 04 00 00 90 90 90 90 90 0f 01 ca fc 6a ff e8 65 03 00 00
RSP: 0000:ffffc9000306e7e8 EFLAGS: 00010082
RAX: 0df95e0bf5ea4500 RBX: 0000000000000000 RCX: 0df95e0bf5ea4500
RDX: dffffc0000000000 RSI: ffffffff8a0b0fc0 RDI: ffffffff8a59a2c0
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff1ff3445
R10: fffffbfff1ff3445 R11: 1ffffffff1ff3444 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f6de752a6c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000007e00d000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x32/0x60 kernel/kcov.c:206
Code: a4 b1 8a 7e 65 8b 15 a5 b1 8a 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 34 16 00 00 00 74 2c 8b 91 10 16 00 00 <83> fa 02 75 21 48 8b 91 18 16 00 00 48 8b 32 48 8d 7e 01 8b 89 14
RSP: 0000:ffffc9000306e890 EFLAGS: 00000246
RAX: ffffffff81a114a0 RBX: ffffc9000306ecd0 RCX: ffff88802b2a9dc0
RDX: 0000000000000002 RSI: 0000000000009b66 RDI: ffffc9000306ecd0
RBP: ffffc9000306e9f0 R08: dffffc0000000000 R09: fffff9400038a547
R10: fffff9400038a547 R11: 1ffffd400038a546 R12: 1ffff9200060dd9b
R13: dffffc0000000000 R14: ffffc9000306ecd0 R15: ffffffff8a3c23a8
 readahead_page+0x20/0x3d0 include/linux/pagemap.h:869
 read_pages+0x16d/0x920 mm/readahead.c:132
 page_cache_ra_unbounded+0x830/0x930 mm/readahead.c:239
 page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
 filemap_get_pages mm/filemap.c:2551 [inline]
 filemap_read+0x589/0x2480 mm/filemap.c:2634
 __kernel_read+0x4eb/0x910 fs/read_write.c:443
 integrity_kernel_read+0x86/0xd0 security/integrity/iint.c:228
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
 ima_calc_file_hash+0x1546/0x18e0 security/integrity/ima/ima_crypto.c:573
 ima_collect_measurement+0x2ef/0x760 security/integrity/ima/ima_api.c:255
 process_measurement+0xfb9/0x1a10 security/integrity/ima/ima_main.c:351
 ima_file_check+0xc1/0x100 security/integrity/ima/ima_main.c:533
 do_open fs/namei.c:3610 [inline]
 path_openat+0x2735/0x2f30 fs/namei.c:3742
 do_filp_open+0x1b3/0x3e0 fs/namei.c:3769
 do_sys_openat2+0x142/0x4a0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_open fs/open.c:1277 [inline]
 __se_sys_open fs/open.c:1273 [inline]
 __x64_sys_open+0x11b/0x140 fs/open.c:1273
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f6de9704969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6de752a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f6de992c160 RCX: 00007f6de9704969
RDX: 1df2a23c5997fa5f RSI: 0000000000080242 RDI: 0000200000000580
RBP: 00007f6de9786ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f6de992c160 R15: 00007ffe0958c8c8
 </TASK>
Modules linked in:
---[ end trace fe9c3196f7b88c22 ]---
RIP: 0010:asm_sysvec_reschedule_ipi+0x15/0x20 arch/x86/include/asm/idtentry.h:681
Code: 48 89 c4 48 89 e7 e8 1a ff e0 ff e9 85 04 00 00 90 90 90 90 90 0f 01 ca fc 6a ff e8 85 03 00 00 48 89 c4 48 89 e7 e8 da 16 e1 <ff> e9 65 04 00 00 90 90 90 90 90 0f 01 ca fc 6a ff e8 65 03 00 00
RSP: 0000:ffffc9000306e7e8 EFLAGS: 00010082
RAX: 0df95e0bf5ea4500 RBX: 0000000000000000 RCX: 0df95e0bf5ea4500
RDX: dffffc0000000000 RSI: ffffffff8a0b0fc0 RDI: ffffffff8a59a2c0
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff1ff3445
R10: fffffbfff1ff3445 R11: 1ffffffff1ff3444 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f6de752a6c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000007e00d000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	a4                   	movsb  %ds:(%rsi),%es:(%rdi)
   1:	b1 8a                	mov    $0x8a,%cl
   3:	7e 65                	jle    0x6a
   5:	8b 15 a5 b1 8a 7e    	mov    0x7e8ab1a5(%rip),%edx        # 0x7e8ab1b0
   b:	81 e2 00 01 ff 00    	and    $0xff0100,%edx
  11:	74 11                	je     0x24
  13:	81 fa 00 01 00 00    	cmp    $0x100,%edx
  19:	75 35                	jne    0x50
  1b:	83 b9 34 16 00 00 00 	cmpl   $0x0,0x1634(%rcx)
  22:	74 2c                	je     0x50
  24:	8b 91 10 16 00 00    	mov    0x1610(%rcx),%edx
* 2a:	83 fa 02             	cmp    $0x2,%edx <-- trapping instruction
  2d:	75 21                	jne    0x50
  2f:	48 8b 91 18 16 00 00 	mov    0x1618(%rcx),%rdx
  36:	48 8b 32             	mov    (%rdx),%rsi
  39:	48 8d 7e 01          	lea    0x1(%rsi),%rdi
  3d:	8b                   	.byte 0x8b
  3e:	89                   	.byte 0x89
  3f:	14                   	.byte 0x14

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/11 05:40 linux-5.15.y 3b8db0e4f263 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan invalid opcode in asm_sysvec_reschedule_ipi
* Struck through repros no longer work on HEAD.