syzbot

 sign-in | mailing list | source | docs
🐞 Open [980] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12496] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel paging request in pcpu_alloc

Status: fixed on 2020/02/14 01:19
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+82e323920b78d54aaed5@syzkaller.appspotmail.com
Fix commit: 253a496d8e57 kasan: don't assume percpu shadow allocations will succeed
First crash: 1603d, last: 1584d
Cause bisection: introduced by (bisect log) :
commit 0609ae011deb41c9629b7f5fd626dfa1ac9d16b0
Author: Daniel Axtens <dja@axtens.net>
Date: Sun Dec 1 01:55:00 2019 +0000

  x86/kasan: support KASAN_VMALLOC

Crash: BUG: unable to handle kernel paging request in pcpu_alloc (log)
Repro: C syz .config
  
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[patch 4/6] kasan: don't assume percpu shadow allocations will succeed 1 (1) 2019/12/18 04:51
[PATCH 1/3] mm: add apply_to_existing_pages helper 11 (11) 2019/12/11 01:31
[PATCH 1/2] kasan: fix crashes on access to memory mapped by vm_map_ram() 9 (9) 2019/12/06 17:32
BUG: unable to handle kernel paging request in pcpu_alloc 5 (7) 2019/12/05 13:19
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2019/12/08 23:10 18m dja@axtens.net linux-next OK
2019/12/05 06:53 0m dja@axtens.net patch linux-next error OK

Sample crash report:
RDX: 000000000000003c RSI: 0000000020000080 RDI: 0c00000000000000
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000018
R13: 0000000000000004 R14: 0000000000000005 R15: 0000000000000000
BUG: unable to handle page fault for address: fffff91ffff00000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 21ffe6067 P4D 21ffe6067 PUD aa56c067 PMD aa56d067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8999 Comm: syz-executor865 Not tainted 5.4.0-next-20191203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:121 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:135 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:166 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:182 [inline]
RIP: 0010:check_memory_region+0x9c/0x1a0 mm/kasan/generic.c:192
Code: c9 4d 0f 49 c1 49 c1 f8 03 45 85 c0 0f 84 10 01 00 00 41 83 e8 01 4e 8d 44 c0 08 eb 0d 48 83 c0 08 4c 39 c0 0f 84 a7 00 00 00 <48> 83 38 00 74 ed 4c 8d 40 08 eb 09 48 83 c0 01 49 39 c0 74 53 80
RSP: 0018:ffffc90001f67a80 EFLAGS: 00010216
RAX: fffff91ffff00000 RBX: fffff91ffff01000 RCX: ffffffff819e1589
RDX: 0000000000000001 RSI: 0000000000008000 RDI: ffffe8ffff800000
RBP: ffffc90001f67a98 R08: fffff91ffff01000 R09: 0000000000001000
R10: fffff91ffff00fff R11: ffffe8ffff807fff R12: fffff91ffff00000
R13: 0000000000008000 R14: 0000000000000000 R15: ffff88821fffd100
FS:  00000000011a7880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffff91ffff00000 CR3: 00000000a94ad000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 memset+0x24/0x40 mm/kasan/common.c:107
 memset include/linux/string.h:410 [inline]
 pcpu_alloc+0x589/0x1380 mm/percpu.c:1734
 __alloc_percpu_gfp+0x28/0x30 mm/percpu.c:1783
 bpf_array_alloc_percpu kernel/bpf/arraymap.c:35 [inline]
 array_map_alloc+0x698/0x7d0 kernel/bpf/arraymap.c:159
 find_and_alloc_map kernel/bpf/syscall.c:123 [inline]
 map_create kernel/bpf/syscall.c:654 [inline]
 __do_sys_bpf+0x478/0x3810 kernel/bpf/syscall.c:3012
 __se_sys_bpf kernel/bpf/syscall.c:2989 [inline]
 __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:2989
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x442f99
Code: e8 ec 09 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc8aa156d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442f99
RDX: 000000000000003c RSI: 0000000020000080 RDI: 0c00000000000000
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000018
R13: 0000000000000004 R14: 0000000000000005 R15: 0000000000000000
Modules linked in:
CR2: fffff91ffff00000
---[ end trace 449f8b43dad6ffb8 ]---
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:121 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:135 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:166 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:182 [inline]
RIP: 0010:check_memory_region+0x9c/0x1a0 mm/kasan/generic.c:192
Code: c9 4d 0f 49 c1 49 c1 f8 03 45 85 c0 0f 84 10 01 00 00 41 83 e8 01 4e 8d 44 c0 08 eb 0d 48 83 c0 08 4c 39 c0 0f 84 a7 00 00 00 <48> 83 38 00 74 ed 4c 8d 40 08 eb 09 48 83 c0 01 49 39 c0 74 53 80
RSP: 0018:ffffc90001f67a80 EFLAGS: 00010216
RAX: fffff91ffff00000 RBX: fffff91ffff01000 RCX: ffffffff819e1589
RDX: 0000000000000001 RSI: 0000000000008000 RDI: ffffe8ffff800000
RBP: ffffc90001f67a98 R08: fffff91ffff01000 R09: 0000000000001000
R10: fffff91ffff00fff R11: ffffe8ffff807fff R12: fffff91ffff00000
R13: 0000000000008000 R14: 0000000000000000 R15: ffff88821fffd100
FS:  00000000011a7880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffff91ffff00000 CR3: 00000000a94ad000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/04 06:07 linux-next 1ab75b2e415a ae13a849 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/04 13:22 upstream 63de37476ebd 0ecb9746 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/22 22:41 net-old 4bfeadfc0712 8b967267 .config console log report ci-upstream-net-this-kasan-gce
2019/12/19 22:46 bpf ca8d0fa7cfb8 36650b4b .config console log report ci-upstream-bpf-kasan-gce
2019/12/19 02:24 net-old ddd9b5e3e765 79b211f7 .config console log report ci-upstream-net-this-kasan-gce
2019/12/17 04:52 bpf a2ea07465c8d d13d7958 .config console log report ci-upstream-bpf-kasan-gce
2019/12/15 10:48 bpf 5133498f4ad1 eef6e580 .config console log report ci-upstream-bpf-kasan-gce
2019/12/14 06:41 bpf 0af67e49b018 5b2ca5da .config console log report ci-upstream-bpf-kasan-gce
2019/12/14 03:06 bpf 0af67e49b018 5b2ca5da .config console log report ci-upstream-bpf-kasan-gce
2019/12/14 00:33 net-old 0af67e49b018 5b2ca5da .config console log report ci-upstream-net-this-kasan-gce
2019/12/13 10:45 bpf fe3300897cbf 08003f64 .config console log report ci-upstream-bpf-kasan-gce
2019/12/06 20:30 bpf ae72555b4104 85f26751 .config console log report ci-upstream-bpf-kasan-gce
2019/12/06 19:39 bpf ae72555b4104 85f26751 .config console log report ci-upstream-bpf-kasan-gce
2019/12/06 06:31 bpf 8f9081c92523 98b4ef2d .config console log report ci-upstream-bpf-kasan-gce
2019/12/22 14:20 bpf-next f9e6bfdbaf0c 8b967267 .config console log report ci-upstream-bpf-next-kasan-gce
2019/12/20 06:19 bpf-next 5bf2fc1f9c88 e30cbdae .config console log report ci-upstream-bpf-next-kasan-gce
2019/12/19 18:05 bpf-next a352a82496d1 36650b4b .config console log report ci-upstream-bpf-next-kasan-gce
2019/12/18 16:42 bpf-next fb9a98e160f1 f2fe0772 .config console log report ci-upstream-bpf-next-kasan-gce
2019/12/18 11:51 bpf-next fb9a98e160f1 f2fe0772 .config console log report ci-upstream-bpf-next-kasan-gce
2019/12/15 01:47 bpf-next a06bf42f5a95 eef6e580 .config console log report ci-upstream-bpf-next-kasan-gce
2019/12/12 08:39 bpf-next c21939998802 d973f528 .config console log report ci-upstream-bpf-next-kasan-gce
2019/12/10 00:44 bpf-next e7096c131e51 b31eda3d .config console log report ci-upstream-bpf-next-kasan-gce
2019/12/07 04:03 linux-next 838333c80c4f 85f26751 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/12/04 05:34 linux-next 1ab75b2e415a ae13a849 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.