syzbot


BUG: unable to handle kernel paging request in bpf_trace_run4

Status: upstream: reported C repro on 2020/09/22 09:52
Reported-by: syzbot+8eff18beca8f96a2ffac@syzkaller.appspotmail.com
First crash: 863d, last: 863d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in bpf_trace_run4 2 813d 813d 0/24 auto-closed as invalid on 2021/03/11 20:35

Sample crash report:
BUG: unable to handle page fault for address: ffffc90000069030
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1da89e067 P4D 1da89e067 PUD 1da89f067 PMD 1da8a4067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 194 Comm: rs:main Q:Reg Tainted: G        W         5.4.65-syzkaller-00175-g63d1c2f0b547 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bpf_call_func include/linux/filter.h:608 [inline]
RIP: 0010:__bpf_trace_run kernel/trace/bpf_trace.c:1334 [inline]
RIP: 0010:bpf_trace_run4+0x14b/0x280 kernel/trace/bpf_trace.c:1374
Code: 7e 01 0f 1f 44 00 00 e8 83 0e f9 ff 49 8d 7e 30 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 7c c2 26 00 49 8d 76 38 4c 89 e7 <41> ff 56 30 e9 b3 00 00 00 e8 57 0e f9 ff e8 32 22 bf ff 49 89 c7
RSP: 0018:ffff8881d90e75e0 EFLAGS: 00010246
RAX: 1ffff9200000d206 RBX: dffffc0000000000 RCX: ffff8881da31cd80
RDX: 0000000000000000 RSI: ffffc90000069038 RDI: ffff8881d90e7620
RBP: ffff8881d90e76a8 R08: ffffffff81a09f7d R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881d90e7620
R13: dffffc0000000000 R14: ffffc90000069000 R15: ffff8881d6585000
FS:  00007ff6979e3700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000069030 CR3: 00000001c8a4f002 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 trace_ext4_journal_start include/trace/events/ext4.h:1747 [inline]
 __ext4_journal_start_sb+0x12a/0x420 fs/ext4/ext4_jbd2.c:73
 __ext4_journal_start fs/ext4/ext4_jbd2.h:311 [inline]
 ext4_da_write_begin+0xb0d/0xfb0 fs/ext4/inode.c:3107
 generic_perform_write+0x271/0x530 mm/filemap.c:3284
 __generic_file_write_iter+0x232/0x460 mm/filemap.c:3413
 ext4_file_write_iter+0x515/0x1250 fs/ext4/file.c:270
 call_write_iter include/linux/fs.h:1958 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0x579/0x700 fs/read_write.c:496
 vfs_write+0x217/0x4f0 fs/read_write.c:558
 ksys_write+0x168/0x2a0 fs/read_write.c:611
 do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7ff69a4271cd
Code: c2 20 00 00 75 10 b8 01 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ae fc ff ff 48 89 04 24 b8 01 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 f7 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ff6979e2590 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff68c003a50 RCX: 00007ff69a4271cd
RDX: 0000000000000d61 RSI: 00007ff68c003a50 RDI: 0000000000000006
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007ff68c0037b0
R13: 00007ff6979e25b0 R14: 00005653d4f88360 R15: 0000000000000d61
Modules linked in:
CR2: ffffc90000069030
---[ end trace ae8d229e5a7b1e8b ]---
RIP: 0010:bpf_call_func include/linux/filter.h:608 [inline]
RIP: 0010:__bpf_trace_run kernel/trace/bpf_trace.c:1334 [inline]
RIP: 0010:bpf_trace_run4+0x14b/0x280 kernel/trace/bpf_trace.c:1374
Code: 7e 01 0f 1f 44 00 00 e8 83 0e f9 ff 49 8d 7e 30 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 7c c2 26 00 49 8d 76 38 4c 89 e7 <41> ff 56 30 e9 b3 00 00 00 e8 57 0e f9 ff e8 32 22 bf ff 49 89 c7
RSP: 0018:ffff8881d90e75e0 EFLAGS: 00010246
RAX: 1ffff9200000d206 RBX: dffffc0000000000 RCX: ffff8881da31cd80
RDX: 0000000000000000 RSI: ffffc90000069038 RDI: ffff8881d90e7620
RBP: ffff8881d90e76a8 R08: ffffffff81a09f7d R09: fffffbfff09b257d
R10: fffffbfff09b257d R11: 0000000000000000 R12: ffff8881d90e7620
R13: dffffc0000000000 R14: ffffc90000069000 R15: ffff8881d6585000
FS:  00007ff6979e3700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000069030 CR3: 00000001c8a4f002 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-android-5-4-kasan 2020/09/22 10:03 https://android.googlesource.com/kernel/common android-5.4 63d1c2f0b547 3e8f6c27 .config console log report syz C
ci2-android-5-4-kasan 2020/09/22 09:52 https://android.googlesource.com/kernel/common android-5.4 63d1c2f0b547 3e8f6c27 .config console log report info
* Struck through repros no longer work on HEAD.