syzbot


BUG: unable to handle kernel NULL pointer dereference in rcu_core (2)

Status: moderation: reported on 2022/11/25 19:51
Reported-by: syzbot+01a568f75d7787cf7bfb@syzkaller.appspotmail.com
First crash: 69d, last: 49d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in rcu_core 1 1065d 1061d 0/24 auto-closed as invalid on 2020/04/29 14:31

Sample crash report:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000086000004
  EC = 0x21: IABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000109e43000
[0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 2603 Comm: udevd Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : rcu_do_batch+0x1a4/0x584 kernel/rcu/tree.c:2250
sp : ffff800008003e60
x29: ffff800008003e90 x28: 0000000000000004 x27: 000000000000000a
x26: 0000000000000000 x25: ffff000132ccddf0 x24: ffff80000d37c000
x23: ffff80000d4a4690 x22: ffff80000c0cec40 x21: ffff0000c7903480
x20: ffff0001fefd0cc0 x19: ffff80000d2d0cc0 x18: 000000000000ba7e
x17: ffff8001f1cee000 x16: ffff80000dbe6158 x15: ffff0000c7903480
x14: 0000000000000018 x13: 0000000000000001 x12: ffff0000c7903480
x11: ff808000095d5398 x10: 0000000000000000 x9 : 1fd3e11f8cfd8b00
x8 : 0000000000000000 x7 : ffff8000081f6978 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : ffff80000cbaae40 x0 : ffff000132ccddf0
Call trace:
 0x0
 rcu_core+0x2bc/0x5b4 kernel/rcu/tree.c:2510
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2527
 _stext+0x168/0x37c
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq+0x70/0xbc kernel/softirq.c:452
 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650
 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:580
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
 lock_acquire+0x130/0x1f8 kernel/locking/lockdep.c:5671
 fs_reclaim_acquire+0x90/0xe0 mm/page_alloc.c:4699
 might_alloc include/linux/sched/mm.h:271 [inline]
 slab_pre_alloc_hook mm/slab.h:710 [inline]
 slab_alloc_node mm/slub.c:3318 [inline]
 __kmem_cache_alloc_node+0x58/0x350 mm/slub.c:3437
 kmalloc_trace+0x44/0x7c mm/slab_common.c:1045
 kmalloc include/linux/slab.h:553 [inline]
 kzalloc include/linux/slab.h:689 [inline]
 uevent_show+0xb0/0x194 drivers/base/core.c:2487
 dev_attr_show+0x3c/0x94 drivers/base/core.c:2195
 sysfs_kf_seq_show+0x138/0x214 fs/sysfs/file.c:59
 kernfs_seq_show+0x5c/0xd0 fs/kernfs/file.c:201
 seq_read_iter+0x220/0x5e0 fs/seq_file.c:230
 kernfs_fop_read_iter+0x98/0x300 fs/kernfs/file.c:275
 call_read_iter include/linux/fs.h:2193 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x2d4/0x448 fs/read_write.c:470
 ksys_read+0xb4/0x160 fs/read_write.c:613
 __do_sys_read fs/read_write.c:623 [inline]
 __se_sys_read fs/read_write.c:621 [inline]
 __arm64_sys_read+0x24/0x34 fs/read_write.c:621
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
Code: bad PC value
---[ end trace 0000000000000000 ]---

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-gce-arm64 2022/12/11 02:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 67be1ae7 .config console log report info [disk image] [vmlinux] [kernel image] BUG: unable to handle kernel NULL pointer dereference in rcu_core
ci-upstream-gce-arm64 2022/11/25 21:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6d464646530f 74a66371 .config console log report info [disk image] [vmlinux] [kernel image] BUG: unable to handle kernel NULL pointer dereference in rcu_core
ci-upstream-gce-arm64 2022/11/21 19:45 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 1c576c23 .config console log report info [disk image] [vmlinux] [kernel image] BUG: unable to handle kernel NULL pointer dereference in rcu_core
* Struck through repros no longer work on HEAD.