syzbot


BUG: unable to handle kernel paging request in bpf_trace_run7

Status: upstream: reported C repro on 2021/01/13 12:33
Reported-by: syzbot+2b62226b968c71163b99@syzkaller.appspotmail.com
First crash: 749d, last: 713d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in bpf_trace_run7 2 742d 739d 0/24 auto-closed as invalid on 2021/05/20 22:44
upstream KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7 C done error 8 720d 757d 0/24 auto-obsoleted due to no activity on 2022/09/03 18:37

Sample crash report:
BUG: unable to handle page fault for address: ffffc9000005f030
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1f5ca2067 P4D 1f5ca2067 PUD 1f5ca3067 PMD 1f5cb0067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 351 Comm: syz-executor682 Not tainted 5.4.98-syzkaller-00281-g2c9f69951f7c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bpf_call_func include/linux/filter.h:608 [inline]
RIP: 0010:__bpf_trace_run kernel/trace/bpf_trace.c:1338 [inline]
RIP: 0010:bpf_trace_run7+0x1be/0x360 kernel/trace/bpf_trace.c:1381
Code: 44 00 00 e8 34 d4 f8 ff 48 8b 1c 24 48 8d 7b 30 48 89 f8 48 c1 e8 03 42 80 3c 30 00 74 05 e8 89 8f 27 00 48 8d 73 38 4c 89 ef <ff> 53 30 bf 01 00 00 00 e8 75 44 da ff 65 8b 1d aa c6 95 7e 31 ff
RSP: 0018:ffff8881e891f780 EFLAGS: 00010246
RAX: 1ffff9200000be06 RBX: ffffc9000005f000 RCX: ffff8881e89d1f80
RDX: 0000000000000000 RSI: ffffc9000005f038 RDI: ffff8881e891f7c0
RBP: ffff8881e891f878 R08: 0000000000000008 R09: ffffe8ffffc00000
R10: fffffbfff0c8dfb5 R11: 0000000000000000 R12: 1ffff1103d123ef4
R13: ffff8881e891f7c0 R14: dffffc0000000000 R15: 0000607e08e101c0
FS:  0000000001652300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000005f030 CR3: 00000001e9da1000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __bpf_trace_percpu_alloc_percpu+0x3d/0x50 include/trace/events/percpu.h:10
 trace_percpu_alloc_percpu include/trace/events/percpu.h:10 [inline]
 pcpu_alloc+0xf08/0x1180 mm/percpu.c:1739
 bpf_prog_alloc+0x47/0x140 kernel/bpf/core.c:114
 bpf_prog_load kernel/bpf/syscall.c:1677 [inline]
 __do_sys_bpf+0x5c69/0xbe70 kernel/bpf/syscall.c:2888
 do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x440309
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffda7ebf988 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 0000000000440309
RDX: 0000000000000078 RSI: 0000000020000200 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000565d
R13: 00007ffda7ebf99c R14: 00007ffda7ebf9c0 R15: 00007ffda7ebf9b0
Modules linked in:
CR2: ffffc9000005f030
---[ end trace dc8661240b0c20cd ]---
RIP: 0010:bpf_call_func include/linux/filter.h:608 [inline]
RIP: 0010:__bpf_trace_run kernel/trace/bpf_trace.c:1338 [inline]
RIP: 0010:bpf_trace_run7+0x1be/0x360 kernel/trace/bpf_trace.c:1381
Code: 44 00 00 e8 34 d4 f8 ff 48 8b 1c 24 48 8d 7b 30 48 89 f8 48 c1 e8 03 42 80 3c 30 00 74 05 e8 89 8f 27 00 48 8d 73 38 4c 89 ef <ff> 53 30 bf 01 00 00 00 e8 75 44 da ff 65 8b 1d aa c6 95 7e 31 ff
RSP: 0018:ffff8881e891f780 EFLAGS: 00010246
RAX: 1ffff9200000be06 RBX: ffffc9000005f000 RCX: ffff8881e89d1f80
RDX: 0000000000000000 RSI: ffffc9000005f038 RDI: ffff8881e891f7c0
RBP: ffff8881e891f878 R08: 0000000000000008 R09: ffffe8ffffc00000
R10: fffffbfff0c8dfb5 R11: 0000000000000000 R12: 1ffff1103d123ef4
R13: ffff8881e891f7c0 R14: dffffc0000000000 R15: 0000607e08e101c0
FS:  0000000001652300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000005f030 CR3: 00000001e9da1000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-android-5-4-kasan 2021/02/18 07:56 android12-5.4 2c9f69951f7c 14052202 .config console log report syz C BUG: unable to handle kernel paging request in bpf_trace_run7
ci2-android-5-4-kasan 2021/02/18 07:40 android12-5.4 2c9f69951f7c 14052202 .config console log report info BUG: unable to handle kernel paging request in bpf_trace_run7
ci2-android-5-4-kasan 2021/01/13 12:32 android12-5.4 e1d2125552ac a945f0a3 .config console log report info
* Struck through repros no longer work on HEAD.