syzbot


BUG: unable to handle kernel paging request in call_usermodehelper_exec_async

Status: auto-obsoleted due to no activity on 2023/02/07 17:39
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+10d19d528d9755d9af22@syzkaller.appspotmail.com
First crash: 538d, last: 538d
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] umh: fix UAF when the process is being killed 17 (17) 2023/01/24 17:39
[PATCH v2] umh: fix out of scope usage when the process is being killed 3 (3) 2022/12/15 05:11

Sample crash report:
Unable to handle kernel paging request at virtual address 000000009cb03193
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000158178000
[000000009cb03193] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 8602 Comm: modprobe Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __lock_acquire+0x60/0x30a4 kernel/locking/lockdep.c:4923
lr : lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666
sp : ffff8000211a3c40
x29: ffff8000211a3d20 x28: 0000000000000000 x27: 00000000000000c0
x26: 000000009cb03193 x25: ffff8000081873d0 x24: 0000000000000080
x23: 0000000000000000 x22: 000000009cb03193 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 000000006bcf960d
x17: 00000000398fa029 x16: ffff80000db49158 x15: ffff0001183eb500
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0001183eb500
x11: ff808000095d19c0 x10: 0000000000000000 x9 : 0000000000000001
x8 : 0000000000000001 x7 : ffff8000081873d0 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000009cb03193
Call trace:
 __lock_acquire+0x60/0x30a4 kernel/locking/lockdep.c:4923
 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
 complete+0x24/0x90 kernel/sched/completion.c:32
 umh_complete kernel/umh.c:58 [inline]
 call_usermodehelper_exec_async+0x15c/0x214 kernel/umh.c:122
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Code: 2a0303f4 2a0203f7 aa0003fa 34000148 (f9400348) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	2a0303f4 	mov	w20, w3
   4:	2a0203f7 	mov	w23, w2
   8:	aa0003fa 	mov	x26, x0
   c:	34000148 	cbz	w8, 0x34
* 10:	f9400348 	ldr	x8, [x26] <-- trapping instruction

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/11/04 16:13 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 6d752409 .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in call_usermodehelper_exec_async
* Struck through repros no longer work on HEAD.