syzbot

 sign-in | mailing list | source | docs
🐞 Open [979] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12499] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: sleeping function called from invalid context in do_page_fault

Status: closed as dup on 2020/08/16 04:02
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+7f59c1e54e5ce4d95cf7@syzkaller.appspotmail.com
First crash: 1515d, last: 1444d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
general protection fault in syscall_return_slowpath kernel syz inconclusive done 1 1422d 1508d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
BUG: sleeping function called from invalid context in do_page_fault 0 (3) 2020/03/10 07:49
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: sleeping function called from invalid context in do_page_fault (2) kernel 1 1100d 1090d 0/26 auto-closed as invalid on 2021/08/18 11:26
upstream BUG: sleeping function called from invalid context in do_page_fault (3) gfs2 C 16 461d 730d 0/26 auto-obsoleted due to no activity on 2024/02/04 00:56
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2020/06/10 14:52 0m (2) bisect fix upstream error job log (0)
2020/05/01 17:07 29m bisect fix upstream job log (0) log

Sample crash report:
BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1400
in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 9434, name: syz-executor278
1 lock held by syz-executor278/9434:
 #0: ffff88808d27c2d8 (&mm->mmap_sem#2){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1383 [inline]
 #0: ffff88808d27c2d8 (&mm->mmap_sem#2){++++}, at: do_page_fault+0x34c/0x12da arch/x86/mm/fault.c:1517
irq event stamp: 17432
hardirqs last  enabled at (17431): [<ffffffff83926883>] __free_object+0x8b3/0xee0 lib/debugobjects.c:360
hardirqs last disabled at (17432): [<ffffffff8100b376>] syscall_return_slowpath arch/x86/entry/common.c:277 [inline]
hardirqs last disabled at (17432): [<ffffffff8100b376>] do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
hardirqs last disabled at (17432): [<ffffffff8100b376>] do_fast_syscall_32+0x386/0xe8f arch/x86/entry/common.c:408
softirqs last  enabled at (14944): [<ffffffff8129cd63>] memcpy include/linux/string.h:381 [inline]
softirqs last  enabled at (14944): [<ffffffff8129cd63>] fpu__copy+0x173/0x8b0 arch/x86/kernel/fpu/core.c:195
softirqs last disabled at (14942): [<ffffffff8129cc91>] fpu__copy+0xa1/0x8b0 arch/x86/kernel/fpu/core.c:183
CPU: 1 PID: 9434 Comm: syz-executor278 Not tainted 5.6.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 ___might_sleep.cold+0x1f4/0x23d kernel/sched/core.c:6798
 do_user_addr_fault arch/x86/mm/fault.c:1400 [inline]
 do_page_fault+0x379/0x12da arch/x86/mm/fault.c:1517
 page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
RIP: 0010:do_fast_syscall_32+0x4d1/0xe8f arch/x86/entry/common.c:408
Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 4c 8b 3b 31 ff 45 89 fd 41 81 e5 0e 38 00 00 44 89 ee e8 22 60 71 00 45 85 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900020d7f18 EFLAGS: 00010006
RAX: 0000000000000000 RBX: ffff88808e8fc380 RCX: ffffffff8100b4be
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: ffffc900020d7f58 R08: ffff88808e8fc380 R09: ffffed1011d1f871
R10: ffffed1011d1f870 R11: ffff88808e8fc387 R12: 00000000f7f3ce39
R13: 0000000000000000 R14: ffffc900020d7fd8 R15: 0000000020024000
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 97284067 P4D 97284067 PUD 91391067 PMD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9434 Comm: syz-executor278 Tainted: G        W         5.6.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
RIP: 0010:do_fast_syscall_32+0x4d1/0xe8f arch/x86/entry/common.c:408
Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 4c 8b 3b 31 ff 45 89 fd 41 81 e5 0e 38 00 00 44 89 ee e8 22 60 71 00 45 85 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900020d7f18 EFLAGS: 00010006
RAX: 0000000000000000 RBX: ffff88808e8fc380 RCX: ffffffff8100b4be
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: ffffc900020d7f58 R08: ffff88808e8fc380 R09: ffffed1011d1f871
R10: ffffed1011d1f870 R11: ffff88808e8fc387 R12: 00000000f7f3ce39
R13: 0000000000000000 R14: ffffc900020d7fd8 R15: 0000000020024000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0063) knlGS:00000000092e5840
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000096341000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
Modules linked in:
CR2: 0000000000000000
---[ end trace 8c5506cbd0e3ecc5 ]---
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
RIP: 0010:do_fast_syscall_32+0x4d1/0xe8f arch/x86/entry/common.c:408
Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 4c 8b 3b 31 ff 45 89 fd 41 81 e5 0e 38 00 00 44 89 ee e8 22 60 71 00 45 85 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900020d7f18 EFLAGS: 00010006
RAX: 0000000000000000 RBX: ffff88808e8fc380 RCX: ffffffff8100b4be
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: ffffc900020d7f58 R08: ffff88808e8fc380 R09: ffffed1011d1f871
R10: ffffed1011d1f870 R11: ffff88808e8fc387 R12: 00000000f7f3ce39
R13: 0000000000000000 R14: ffffc900020d7fd8 R15: 0000000020024000
FS:  0000000000000000(0000) GS:ffff8880ae700000(0063) knlGS:00000000092e5840
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000096341000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/10 07:48 upstream 30bb5572ce7a 35f53e45 .config console log report syz C ci-upstream-kasan-gce-386
2020/03/26 18:39 upstream 1b649e0bcae7 6d25c5a0 .config console log report syz ci-upstream-kasan-gce-root
2020/03/06 08:47 upstream 63623fd44972 c88c7b75 .config console log report syz ci-upstream-kasan-gce-root
2020/05/02 12:52 upstream 690e2aba7beb 58da4c35 .config console log report ci-upstream-kasan-gce
2020/03/01 02:04 upstream f8788d86ab28 59b57593 .config console log report ci-upstream-kasan-gce
2020/05/11 10:21 upstream 2ef96a5bb12b f8f57555 .config console log report ci-upstream-kasan-gce-386
2020/04/01 17:07 upstream 1a323ea5356e a34e2c33 .config console log report ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.