syzbot


invalid opcode in __traceiter_hrtimer_init

Status: upstream: reported C repro on 2025/12/13 14:28
Reported-by: syzbot+7c7abdd820477a819799@syzkaller.appspotmail.com
First crash: 3d07h, last: 2d13h
Bug presence (3)
Date Name Commit Repro Result
2025/12/14 android14-6.1 (ToT) 6f1c2f8fd8c8 C Failed due to an error; will retry later
2025/12/14 lts (merge base) cc276771a052 C Failed due to an error; will retry later
2025/12/14 upstream (ToT) 8f0b4cce4481 C Didn't crash

Sample crash report:
CFI failure at __traceiter_hrtimer_init+0x82/0xd0 include/trace/events/timer.h:173 (target: tp_stub_func+0x0/0x10; expected type: 0x98398cdb)
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 373 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__traceiter_hrtimer_init+0x82/0xd0 include/trace/events/timer.h:173
Code: 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 27 65 53 00 49 8b 7d 08 4c 89 fe 8b 55 d4 8b 4d d0 41 ba 25 73 c6 67 45 03 56 fc 74 02 <0f> 0b 41 ff d6 49 83 c4 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08
RSP: 0018:ffffc90007e6fcc0 EFLAGS: 00010213

RAX: 1ffff110243cd6c3 RBX: dffffc0000000000 RCX: 0000000000000006
RDX: 0000000000000001 RSI: ffff888120131bb8 RDI: ffffc900007d5000
RBP: ffffc90007e6fcf0 R08: dffffc0000000000 R09: fffffbfff0ee4f16
R10: 000000000d06da31 R11: 1ffffffff0ee4f15 R12: ffff888121e6b610
R13: ffff888121e6b610 R14: ffffffff81714610 R15: ffff888120131bb8
FS:  00005555918f2500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe22c2ab68 CR3: 000000012ff62000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 trace_hrtimer_init include/trace/events/timer.h:173 [inline]
 debug_init kernel/time/hrtimer.c:460 [inline]
 hrtimer_init+0x2d9/0x330 kernel/time/hrtimer.c:1592
 tcp_init_xmit_timers+0x4c/0xb0 net/ipv4/tcp_timer.c:823
 tcp_init_sock+0x71/0x830 net/ipv4/tcp.c:419
 tcp_v4_init_sock+0x15/0x50 net/ipv4/tcp_ipv4.c:2249
 inet_create+0xb63/0xf70 net/ipv4/af_inet.c:380
 __sock_create+0x39e/0x7c0 net/socket.c:1540
 sock_create net/socket.c:1596 [inline]
 __sys_socket_create net/socket.c:1633 [inline]
 __sys_socket+0xcd/0x1a0 net/socket.c:1661
 __do_sys_socket net/socket.c:1674 [inline]
 __se_sys_socket net/socket.c:1672 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1672
 x64_sys_call+0x449/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:42
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9891d91667
Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe22c2bd28 EFLAGS: 00000206
 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 00007f9891fb4300 RCX: 00007f9891d91667
RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 00007ffe22c2c44c R08: 000000000000000a R09: 00007ffe22c2c157
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000003
R13: 00000000000927c0 R14: 0000000000000000 R15: 00007ffe22c2c4a0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__traceiter_hrtimer_init+0x82/0xd0 include/trace/events/timer.h:173
Code: 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 27 65 53 00 49 8b 7d 08 4c 89 fe 8b 55 d4 8b 4d d0 41 ba 25 73 c6 67 45 03 56 fc 74 02 <0f> 0b 41 ff d6 49 83 c4 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08
RSP: 0018:ffffc90007e6fcc0 EFLAGS: 00010213

RAX: 1ffff110243cd6c3 RBX: dffffc0000000000 RCX: 0000000000000006
RDX: 0000000000000001 RSI: ffff888120131bb8 RDI: ffffc900007d5000
RBP: ffffc90007e6fcf0 R08: dffffc0000000000 R09: fffffbfff0ee4f16
R10: 000000000d06da31 R11: 1ffffffff0ee4f15 R12: ffff888121e6b610
R13: ffff888121e6b610 R14: ffffffff81714610 R15: ffff888120131bb8
FS:  00005555918f2500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe22c2ab68 CR3: 000000012ff62000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/13 18:58 android14-6.1 6f1c2f8fd8c8 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_hrtimer_init
2025/12/13 17:50 android14-6.1 6f1c2f8fd8c8 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_hrtimer_init
2025/12/13 16:41 android14-6.1 6f1c2f8fd8c8 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_hrtimer_init
2025/12/13 15:32 android14-6.1 6f1c2f8fd8c8 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_hrtimer_init
2025/12/13 14:21 android14-6.1 6f1c2f8fd8c8 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_hrtimer_init
2025/12/14 06:52 android14-6.1 6f1c2f8fd8c8 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1 invalid opcode in __traceiter_hrtimer_init
2025/12/13 13:10 android14-6.1 6f1c2f8fd8c8 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf invalid opcode in __traceiter_hrtimer_init
* Struck through repros no longer work on HEAD.