syzbot


kernel BUG at mm/memory.c:LINE!
Status: upstream: reported C repro on 2020/05/21 22:29
Reported-by: syzbot+f7b83f3f64369aef5473@syzkaller.appspotmail.com
First crash: 734d, last: 71d

Fix bisection: failed (bisect log)
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in __handle_mm_fault 2 391d 390d 0/22 auto-closed as invalid on 2021/06/29 08:42
upstream kernel BUG in vmf_insert_pfn_prot C done 1415 4d01h 251d 0/22 upstream: reported C repro on 2021/09/17 09:22
linux-4.14 kernel BUG at mm/memory.c:LINE! syz inconclusive 2 650d 734d 0/1 upstream: reported syz repro on 2020/05/21 23:25
upstream kernel BUG at mm/memory.c:LINE! 1 1418d 1417d 9/22 fixed on 2018/08/08 18:10

Sample crash report:
next ffff88809adb0da8 prev ffff88809adb0eb0 mm ffff888089e34a00
prot 25 anon_vma 0000000000000000 vm_ops ffffffff87720c20
pgoff 0 file ffff888096293d00 private_data 0000000000000000
flags: 0xfe(write|exec|shared|mayread|maywrite|mayexec|mayshare)
------------[ cut here ]------------
kernel BUG at mm/memory.c:3947!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6449 Comm: syz-executor666 Not tainted 4.19.124-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RSP: 0000:ffff88808a77fce8 EFLAGS: 00010283
RAX: 0000000000000137 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81534081 RDI: ffffed10114eff78
RBP: 00000000802000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff88809adb0568
R13: 1ffff110114effa3 R14: 0000000000000001 R15: ffff888089e34a00
FS:  00007f12b4789700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2ab3094000 CR3: 000000009de53000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 handle_mm_fault+0x436/0xafd mm/memory.c:4202
 __do_page_fault+0x6d5/0xde0 arch/x86/mm/fault.c:1412
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205
RIP: 0033:0x4014b4
Code: 00 0f 1f 44 00 00 f0 83 2d 68 a7 2d 00 01 4c 89 e7 e8 20 fc ff ff eb af 48 b8 63 67 72 6f 75 70 2e 63 b9 72 73 00 00 45 31 c0 <48> 89 04 25 c0 01 00 20 48 b8 6f 6e 74 72 6f 6c 6c 65 66 89 0c 25
RSP: 002b:00007f12b4788d20 EFLAGS: 00010246
RAX: 632e70756f726763 RBX: 00000000006dbc48 RCX: 0000000000007372
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00000000006dbc4c
RBP: 00000000006dbc40 R08: 0000000000000000 R09: 65732f636f72702f
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc4c
R13: 00007f12b4788d20 R14: 00007f12b4788d20 R15: 00000000006dbc4c
Modules linked in:
---[ end trace 71d9a04397c25329 ]---
RIP: 0010:wp_huge_pmd mm/memory.c:3947 [inline]
RIP: 0010:__handle_mm_fault+0x29b0/0x43b0 mm/memory.c:4155
Code: d6 d5 ff 84 db 0f 84 81 e7 ff ff e8 ea d4 d5 ff 48 89 ef e8 d2 a0 f4 ff e9 6f e7 ff ff e8 d8 d4 d5 ff 4c 89 e7 e8 b9 33 fd ff <0f> 0b e8 c9 d4 d5 ff 4c 8d 4c 24 60 4c 89 cf e8 5c da 0d 00 41 89
RSP: 0000:ffff88808a77fce8 EFLAGS: 00010283
RAX: 0000000000000137 RBX: 0000000000000008 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81534081 RDI: ffffed10114eff78
RBP: 00000000802000e5 R08: 0000000000000137 R09: ffffed1015ce5081
R10: ffffed1015ce5080 R11: ffff8880ae728407 R12: ffff88809adb0568
R13: 1ffff110114effa3 R14: 0000000000000001 R15: ffff888089e34a00
FS:  00007f12b4789700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002100003f CR3: 000000009de53000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (6):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2020/05/21 22:59 linux-4.19.y 1bab61d3e8cd 4afdfa20 .config log report syz C
ci2-linux-4-19 2022/03/16 08:12 linux-4.19.y 3f8a27f9e27b 9e8eaa75 .config log report info kernel BUG in __handle_mm_fault
ci2-linux-4-19 2021/12/06 12:30 linux-4.19.y 3f8a27f9e27b 579a8754 .config log report info kernel BUG in __handle_mm_fault
ci2-linux-4-19 2021/11/14 15:07 linux-4.19.y 3f8a27f9e27b 75b04091 .config log report info kernel BUG in __handle_mm_fault
ci2-linux-4-19 2020/10/29 03:27 linux-4.19.y ad326970d25c f24824d3 .config log report info
ci2-linux-4-19 2020/05/21 22:28 linux-4.19.y 1bab61d3e8cd 4afdfa20 .config log report