syzbot


WARNING in sco_sock_sendmsg

Status: fixed on 2022/10/13 06:09
Subsystems: mm
[Documentation on labels]
Fix commit: 0771cbb3b97d Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
First crash: 968d, last: 968d
Cause bisection: the cause commit could be any of (bisect log):
  3beed9bf1e3d Merge branch 'for-4.17/upstream-fixes' into for-next
  d13f5d84ca27 Merge branch 'for-4.16/signal-sysfs-force-v2' into for-next
  d7ab8e67aa52 Merge branch 'for-4.18/upstream' into for-next
  

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6540 at mm/page_alloc.c:5348 current_gfp_context include/linux/sched/mm.h:187 [inline]
WARNING: CPU: 1 PID: 6540 at mm/page_alloc.c:5348 __alloc_pages+0x45d/0x500 mm/page_alloc.c:5360
Modules linked in:
CPU: 1 PID: 6540 Comm: syz-executor576 Not tainted 5.14.0-next-20210901-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__alloc_pages+0x45d/0x500 mm/page_alloc.c:5348
Code: be c9 00 00 00 48 c7 c7 60 1a 97 89 c6 05 5c de a6 0b 01 e8 47 6e 3d 07 e9 6a ff ff ff 0f 0b e9 a0 fd ff ff 40 80 e5 3f eb 88 <0f> 0b e9 18 ff ff ff 4c 89 ef 44 89 e6 45 31 ed e8 ae 74 ff ff e9
RSP: 0018:ffffc90002ccf790 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff92000599ef3 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000013 RDI: 0000000000040cc0
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff81b8f8a6 R11: 0000000000000001 R12: ffffffff902661a0
R13: 0000000000000013 R14: 0000000000000000 R15: 00000000ffffffa1
FS:  00000000008bf300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001d00 CR3: 00000000724a0000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2188
 kmalloc_order+0x34/0xf0 mm/slab_common.c:957
 kmalloc_order_trace+0x14/0x120 mm/slab_common.c:973
 kmalloc include/linux/slab.h:599 [inline]
 sco_sock_sendmsg+0x18c/0x6a0 net/bluetooth/sco.c:737
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 ____sys_sendmsg+0x331/0x810 net/socket.c:2409
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463
 __sys_sendmmsg+0x195/0x470 net/socket.c:2549
 __do_sys_sendmmsg net/socket.c:2578 [inline]
 __se_sys_sendmmsg net/socket.c:2575 [inline]
 __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2575
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43ef69
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff6748af08 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043ef69
RDX: 0000000000000001 RSI: 0000000020001d00 RDI: 0000000000000003
RBP: 0000000000402f50 R08: 0000000000000000 R09: 0000000000400488
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402fe0
R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/09/01 22:22 linux-next c1b13fe76e95 7eb7e152 .config console log report syz C ci-upstream-linux-next-kasan-gce-root WARNING in sco_sock_sendmsg
2021/09/01 22:04 linux-next c1b13fe76e95 7eb7e152 .config console log report info ci-upstream-linux-next-kasan-gce-root WARNING in sco_sock_sendmsg
* Struck through repros no longer work on HEAD.