syzbot


BUG: unable to handle kernel paging request in prepare_error_buf

Status: upstream: reported C repro on 2024/08/17 17:42
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+99bf584fb5f18d82cba5@syzkaller.appspotmail.com
First crash: 130d, last: 10h19m
Bug presence (3)
Date Name Commit Repro Result
2024/12/12 linux-6.1.y (ToT) e4d90d63d385 C [report] BUG: unable to handle kernel paging request in prepare_error_buf
2024/10/28 upstream (ToT) 819837584309 C [report] BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/12 upstream (ToT) eefa7a9c0699 C Didn't crash
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 BUG: unable to handle kernel paging request in prepare_error_buf origin:upstream missing-backport C 45 7d05h 161d 0/3 upstream: reported C repro on 2024/07/17 12:15

Sample crash report:
REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 1)
REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 1) not found (pos 1)
Unable to handle kernel paging request at virtual address 00000000ffffffff
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010febf000
[00000000ffffffff] pgd=0800000104c30003, p4d=0800000104c30003, pud=0000000000000000
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4297 Comm: syz-executor366 Not tainted 6.1.114-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : scnprintf_cpu_key fs/reiserfs/prints.c:95 [inline]
pc : prepare_error_buf+0x6dc/0x157c fs/reiserfs/prints.c:229
lr : prepare_error_buf+0x430/0x157c fs/reiserfs/prints.c:230
sp : ffff800021047180
x29: ffff800021047300 x28: ffff80001cd0597e x27: ffff80001cd04a7e
x26: ffff8000210473f8 x25: ffff8000210473e0 x24: ffff800021047260
x23: ffff80001cd04a60 x22: 00000000ffffffff x21: ffffffffffffffe2
x20: 00000000000003e2 x19: dfff800000000000 x18: 1ffff00004201205
x17: 0000000000000000 x16: ffff8000084f7858 x15: 0000000000000000
x14: 000000000000007a x13: ffff0000de593780 x12: 0000000000ff0100
x11: 0000000000ff0100 x10: 0000000000000000 x9 : 000000000000000a
x8 : 00000000000000ff x7 : 20726f6620686372 x6 : 7261657320666f20
x5 : ffff80001cd04a7e x4 : ffff80001cd0597e x3 : ffff80001224936c
x2 : 000000000000000f x1 : 00000000ffffffe0 x0 : 00000000ffffffff
Call trace:
 scnprintf_cpu_key fs/reiserfs/prints.c:95 [inline]
 prepare_error_buf+0x6dc/0x157c fs/reiserfs/prints.c:229
 __reiserfs_error+0xe8/0x2ac fs/reiserfs/prints.c:396
 reiserfs_do_truncate+0x2c0/0x11c8 fs/reiserfs/stree.c:1930
 reiserfs_truncate_file+0x510/0xb1c fs/reiserfs/inode.c:2310
 reiserfs_truncate_failed_write fs/reiserfs/inode.c:2743 [inline]
 reiserfs_write_begin+0x544/0x71c fs/reiserfs/inode.c:2808
 generic_perform_write+0x278/0x55c mm/filemap.c:3845
 __generic_file_write_iter+0x168/0x388 mm/filemap.c:3973
 generic_file_write_iter+0xb8/0x2b4 mm/filemap.c:4005
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x610/0x91c fs/read_write.c:584
 ksys_write+0x15c/0x26c fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: d343fec8 38f36908 35005548 aa1603e0 (b8404418) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d343fec8 	lsr	x8, x22, #3
   4:	38f36908 	ldrsb	w8, [x8, x19]
   8:	35005548 	cbnz	w8, 0xab0
   c:	aa1603e0 	mov	x0, x22
* 10:	b8404418 	ldr	w24, [x0], #4 <-- trapping instruction

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/28 13:44 linux-6.1.y 7ec6f9fa3d97 65e8686b .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/26 00:05 linux-6.1.y 29f02ec58a94 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/08 08:53 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/07 13:14 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/07 12:26 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/07 12:09 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/07 12:09 linux-6.1.y e4d90d63d385 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/03 19:27 linux-6.1.y e4d90d63d385 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/12/02 07:51 linux-6.1.y e4d90d63d385 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/11/27 00:26 linux-6.1.y e4d90d63d385 e9a9a9f2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/11/27 00:25 linux-6.1.y e4d90d63d385 e9a9a9f2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/11/11 04:05 linux-6.1.y d7039b844a1c 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/11/10 05:53 linux-6.1.y d7039b844a1c 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/11/10 05:51 linux-6.1.y d7039b844a1c 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/11/05 23:07 linux-6.1.y 7c15117f9468 da38b4c9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/11/05 23:03 linux-6.1.y 7c15117f9468 da38b4c9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/10/28 13:00 linux-6.1.y 7ec6f9fa3d97 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/10/20 06:26 linux-6.1.y 54d90d17e8ce cd6fc0a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/09/23 08:30 linux-6.1.y e526b12bf916 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/08/26 02:35 linux-6.1.y ee5e09825b81 d7d32352 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/08/17 17:41 linux-6.1.y 117ac406ba90 dbc93b08 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/08/17 17:41 linux-6.1.y 117ac406ba90 dbc93b08 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel paging request in prepare_error_buf
2024/08/26 02:32 linux-6.1.y ee5e09825b81 d7d32352 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: user-memory-access Read in prepare_error_buf
* Struck through repros no longer work on HEAD.