syzbot


kernel BUG at arch/x86/mm/physaddr.c:LINE!

Status: upstream: reported C repro on 2019/12/26 02:01
Reported-by: syzbot+f3c6a35e3859372ab734@syzkaller.appspotmail.com
First crash: 913d, last: 457d

Fix bisection: the fix commit could be any of (bisect log):
  98db2bf27b9e Linux 4.14.171
  56dfe6252c68 Linux 4.14.188
similar bugs (9):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG at arch/x86/mm/physaddr.c:LINE! (6) 90 200d 697d 0/22 auto-closed as invalid on 2022/04/07 07:37
linux-4.19 kernel BUG at arch/x86/mm/physaddr.c:LINE! (3) 75 38d 712d 0/1 upstream: reported on 2020/07/14 16:42
upstream kernel BUG at arch/x86/mm/physaddr.c:LINE! (2) C done 522 1108d 1318d 13/22 fixed on 2019/06/14 18:22
linux-4.19 kernel BUG at arch/x86/mm/physaddr.c:LINE! (2) C done 82 766d 906d 1/1 fixed on 2020/06/20 23:56
linux-4.19 kernel BUG at arch/x86/mm/physaddr.c:LINE! syz done 1 1093d 1093d 1/1 fixed on 2019/12/16 09:09
upstream kernel BUG at arch/x86/mm/physaddr.c:LINE! (5) C done 241 713d 786d 17/22 fixed on 2020/07/17 17:58
upstream kernel BUG at arch/x86/mm/physaddr.c:LINE! (3) 4 1099d 1099d 0/22 auto-closed as invalid on 2019/10/25 08:46
upstream kernel BUG at arch/x86/mm/physaddr.c:LINE! C 10 1323d 1355d 12/22 fixed on 2018/11/12 21:25
upstream kernel BUG at arch/x86/mm/physaddr.c:LINE! (4) C 18 821d 855d 17/22 fixed on 2020/04/15 17:19

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
audit: type=1400 audit(1582522046.771:36): avc:  denied  { map } for  pid=7234 comm="syz-executor700" path="/root/syz-executor700685718" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
------------[ cut here ]------------
kernel BUG at arch/x86/mm/physaddr.c:27!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 7234 Comm: syz-executor700 Not tainted 4.14.171-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880976260c0 task.stack: ffff888096948000
RIP: 0010:__phys_addr+0x87/0xe0 arch/x86/mm/physaddr.c:27
RSP: 0018:ffff88809694f620 EFLAGS: 00010097
RAX: ffff8880976260c0 RBX: 0000000002777259 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000002777259
RBP: ffff88809694f638 R08: ffff8880976260c0 R09: ffff888097626960
R10: 0000000000000000 R11: 0000000000000000 R12: 0000778002777259
R13: 0000000082777259 R14: ffff88809ee3cdc0 R15: 0000000000000007
FS:  00000000014de880(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200004c0 CR3: 000000009757b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 virt_to_head_page include/linux/mm.h:600 [inline]
 virt_to_cache mm/slab.c:399 [inline]
 kfree+0x7b/0x270 mm/slab.c:3811
 audit_free_lsm_field kernel/auditfilter.c:87 [inline]
 audit_free_rule kernel/auditfilter.c:102 [inline]
 audit_data_to_entry+0xa71/0x2170 kernel/auditfilter.c:583
 audit_rule_change+0x56d/0xdd0 kernel/auditfilter.c:1106
 audit_receive_msg+0xdaa/0x21d0 kernel/audit.c:1330
 audit_receive+0xe1/0x1c0 kernel/audit.c:1473
 netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
 netlink_unicast+0x44d/0x650 net/netlink/af_netlink.c:1312
 netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xce/0x110 net/socket.c:656
 ___sys_sendmsg+0x70a/0x840 net/socket.c:2062
 __sys_sendmsg+0xb9/0x140 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2103
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4401a9
RSP: 002b:00007ffe173236b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004401a9
RDX: 0000000000000000 RSI: 00000000200004c0 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a30
R13: 0000000000401ac0 R14: 0000000000000000 R15: 0000000000000000
Code: 04 84 d2 75 28 0f b6 0d a1 12 87 07 4c 89 e0 48 d3 e8 48 85 c0 75 0f e8 e8 dd 31 00 4c 89 e0 5b 41 5c 41 5d 5d c3 e8 d9 dd 31 00 <0f> 0b 48 c7 c7 09 fd b1 88 e8 2b 6d 5c 00 eb ca e8 c4 dd 31 00 
RIP: __phys_addr+0x87/0xe0 arch/x86/mm/physaddr.c:27 RSP: ffff88809694f620
---[ end trace 25672fef3f7000ab ]---

Crashes (23):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-14 2020/02/24 05:29 linux-4.14.y 98db2bf27b9e d801cb02 .config log report syz C
ci2-linux-4-14 2021/03/26 15:06 linux-4.14.y 670d6552eda8 a8529b82 .config log report info kernel BUG in __phys_addr
ci2-linux-4-14 2021/03/22 13:35 linux-4.14.y cb83ddcd5332 bea32f74 .config log report info kernel BUG in __phys_addr
ci2-linux-4-14 2021/02/20 07:56 linux-4.14.y 29c52025152b f689d40a .config log report info kernel BUG in __phys_addr
ci2-linux-4-14 2020/12/20 12:17 linux-4.14.y 3f2ecb86cb90 04201c06 .config log report info
ci2-linux-4-14 2020/08/20 18:17 linux-4.14.y 14b58326976d 70160577 .config log report
ci2-linux-4-14 2020/07/29 20:36 linux-4.14.y e5a54aa2d312 233283a1 .config log report
ci2-linux-4-14 2020/06/12 01:40 linux-4.14.y b850307b279c 1beaee21 .config log report
ci2-linux-4-14 2020/05/25 11:55 linux-4.14.y a41ba30d9df2 11284182 .config log report
ci2-linux-4-14 2020/05/24 12:57 linux-4.14.y a41ba30d9df2 ce7ca010 .config log report
ci2-linux-4-14 2020/05/23 17:49 linux-4.14.y a41ba30d9df2 4afdfa20 .config log report
ci2-linux-4-14 2020/05/21 06:04 linux-4.14.y a41ba30d9df2 4afdfa20 .config log report
ci2-linux-4-14 2020/05/20 08:45 linux-4.14.y a41ba30d9df2 6d882fd2 .config log report
ci2-linux-4-14 2020/05/18 07:49 linux-4.14.y ab9dfda23248 37bccd4e .config log report
ci2-linux-4-14 2020/05/16 23:16 linux-4.14.y ab9dfda23248 37bccd4e .config log report
ci2-linux-4-14 2020/05/12 01:42 linux-4.14.y ab9dfda23248 9eb09c40 .config log report
ci2-linux-4-14 2020/05/10 10:01 linux-4.14.y ab9dfda23248 8742a2b9 .config log report
ci2-linux-4-14 2020/05/10 00:15 linux-4.14.y d71f695ce745 88cb3e92 .config log report
ci2-linux-4-14 2020/04/16 21:12 linux-4.14.y c10b57a567e4 c743fcb3 .config log report
ci2-linux-4-14 2020/04/11 12:58 linux-4.14.y 4520f06b03ae a8c6a3f8 .config log report
ci2-linux-4-14 2020/04/10 02:49 linux-4.14.y 4520f06b03ae a8c6a3f8 .config log report
ci2-linux-4-14 2020/03/16 06:26 linux-4.14.y 12cd844a39ed 749688d2 .config log report
ci2-linux-4-14 2019/12/26 02:01 linux-4.14.y e1f7d50ae3a3 be5c2c81 .config log report