syzbot


BUG: unable to handle kernel paging request in __traceiter_sched_switch

Status: auto-closed as invalid on 2021/02/06 22:11
Subsystems: tomoyo
[Documentation on labels]
Reported-by: syzbot+de82c3b6b7737ee524de@syzkaller.appspotmail.com
First crash: 1226d, last: 1226d

Sample crash report:
BUG: unable to handle page fault for address: ffffffffa0050d4c
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD b88f067 P4D b88f067 PUD b890063 PMD 11377067 PTE 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4885 Comm: systemd-udevd Not tainted 5.10.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0xffffffffa0050d4c
Code: Unable to access opcode bytes at RIP 0xffffffffa0050d22.
RSP: 0018:ffffc900013ff868 EFLAGS: 00010046
RAX: 1ffff920001d3006 RBX: ffffc90000e98038 RCX: ffff8880193ccec0
RDX: 0000000000000000 RSI: ffffc90000e98038 RDI: ffffc900013ff870
RBP: ffffc900013ff8d0 R08: ffffffff817df106 R09: fffffbfff1d92a61
R10: fffffbfff1d92a61 R11: 0000000000000000 R12: ffff8880193ccec0
R13: dffffc0000000000 R14: ffff88801e104ec0 R15: ffffc90000e98030
FS:  00007f75546d08c0(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa0050d22 CR3: 0000000012e2a000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __traceiter_sched_switch+0x77/0xa0 include/trace/events/sched.h:138
 trace_sched_switch+0x12a/0x150 include/trace/events/sched.h:138
 __schedule+0x683/0xcb0 kernel/sched/core.c:4520
 preempt_schedule_common kernel/sched/core.c:4682 [inline]
 preempt_schedule+0xde/0x120 kernel/sched/core.c:4707
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:40
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
 _raw_spin_unlock_irqrestore+0x58/0x60 kernel/locking/spinlock.c:191
 __debug_check_no_obj_freed lib/debugobjects.c:997 [inline]
 debug_check_no_obj_freed+0x5a2/0x650 lib/debugobjects.c:1018
 slab_free_hook mm/slub.c:1536 [inline]
 slab_free_freelist_hook+0xc6/0x1a0 mm/slub.c:1577
 slab_free mm/slub.c:3142 [inline]
 kfree+0xd1/0x280 mm/slub.c:4124
 tomoyo_realpath_from_path+0x5d1/0x620 security/tomoyo/realpath.c:291
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x191/0x570 security/tomoyo/file.c:822
 security_inode_getattr+0xc0/0x140 security/security.c:1279
 vfs_getattr fs/stat.c:121 [inline]
 vfs_statx+0xe8/0x320 fs/stat.c:189
 vfs_fstatat fs/stat.c:207 [inline]
 vfs_lstat include/linux/fs.h:3109 [inline]
 __do_sys_newlstat fs/stat.c:362 [inline]
 __se_sys_newlstat fs/stat.c:356 [inline]
 __x64_sys_newlstat+0x81/0xd0 fs/stat.c:356
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f7553543335
Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89
RSP: 002b:00007ffc1eaffc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 000055acdb4a5960 RCX: 00007f7553543335
RDX: 00007ffc1eaffcb0 RSI: 00007ffc1eaffcb0 RDI: 000055acdb4a4960
RBP: 00007ffc1eaffd70 R08: 00007f75538021e8 R09: 0000000000001010
R10: 00007f7553801b58 R11: 0000000000000246 R12: 000055acdb4a4960
R13: 000055acdb4a4985 R14: 000055acdb49c384 R15: 000055acdb49c385
Modules linked in:
CR2: ffffffffa0050d4c
---[ end trace 94a3107ffe082bfa ]---
RIP: 0010:0xffffffffa0050d4c
Code: Unable to access opcode bytes at RIP 0xffffffffa0050d22.
RSP: 0018:ffffc900013ff868 EFLAGS: 00010046
RAX: 1ffff920001d3006 RBX: ffffc90000e98038 RCX: ffff8880193ccec0
RDX: 0000000000000000 RSI: ffffc90000e98038 RDI: ffffc900013ff870
RBP: ffffc900013ff8d0 R08: ffffffff817df106 R09: fffffbfff1d92a61
R10: fffffbfff1d92a61 R11: 0000000000000000 R12: ffff8880193ccec0
R13: dffffc0000000000 R14: ffff88801e104ec0 R15: ffffc90000e98030
FS:  00007f75546d08c0(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa0050d22 CR3: 0000000012e2a000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/11/08 22:10 upstream 9dbc1c03eeb5 64069d48 .config console log report info ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.