syzbot


usb-testing boot error: BUG: unable to handle kernel paging request in dequeue_task_fair

Status: internal: reported on 2022/08/29 15:42
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 9993a4f989c7 virtio: Revert "virtio: find_vqs() add arg sizes"
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 161d, last: 161d

Sample crash report:
BUG: unable to handle page fault for address: ffffdc0000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 100026067 P4D 100026067 PUD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.0.0-rc1-syzkaller-00028-g4dce3b375179 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:165 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:286 [inline]
RIP: 0010:rb_erase+0x21a/0x1210 lib/rbtree.c:443
Code: ea 03 80 3c 02 00 0f 85 b8 0f 00 00 49 89 5e 08 48 85 c9 74 4f 48 89 ca 48 83 cd 01 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 0f 00 00 48 b8 00 00 00 00 00 fc ff df 48 89
RSP: 0000:ffffc90000178bb0 EFLAGS: 00010806
RAX: dffffc0000000000 RBX: ffff88810e690090 RCX: ffff000000000000
RDX: 1fffe00000000000 RSI: ffff88810e690090 RDI: 1ffff11021ccc732
RBP: ffff88810e693991 R08: 0000000000000000 R09: ffff8881f6837bf8
R10: ffff8881f6837cc0 R11: 0000000000000001 R12: 0000000000000001
R13: ffff88810e445610 R14: 0000000000000000 R15: ffff8881f6837bf0
FS:  0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffdc0000000000 CR3: 0000000007825000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 rb_erase_cached include/linux/rbtree.h:126 [inline]
 __dequeue_entity kernel/sched/fair.c:634 [inline]
 dequeue_entity kernel/sched/fair.c:4535 [inline]
 dequeue_task_fair+0x24e/0x16a0 kernel/sched/fair.c:5835
 detach_task kernel/sched/fair.c:7980 [inline]
 detach_tasks kernel/sched/fair.c:8118 [inline]
 load_balance+0xe4b/0x2be0 kernel/sched/fair.c:10164
 rebalance_domains+0x65a/0xc30 kernel/sched/fair.c:10561
 __do_softirq+0x1c0/0x9a9 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x113/0x170 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt+0x6f/0xb0 drivers/acpi/processor_idle.c:113
Code: fb 84 db 74 06 5b e9 50 61 50 fb e8 4b 61 50 fb e8 36 ce 56 fb 66 90 e8 3f 61 50 fb 0f 00 2d a8 72 76 00 e8 33 61 50 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 fe 5d 50 fb 48 85 db
RSP: 0000:ffffc9000010fd20 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8881002d5580 RSI: ffffffff85f5a7bd RDI: 0000000000000000
RBP: ffff888109ac1064 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000001 R14: ffff888109ac1000 R15: ffff88810c971004
 acpi_idle_do_entry drivers/acpi/processor_idle.c:555 [inline]
 acpi_idle_enter+0x524/0x6a0 drivers/acpi/processor_idle.c:692
 cpuidle_enter_state+0x1ab/0xd30 drivers/cpuidle/cpuidle.c:239
 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:356
 call_cpuidle kernel/sched/idle.c:155 [inline]
 cpuidle_idle_call kernel/sched/idle.c:236 [inline]
 do_idle+0x3e8/0x590 kernel/sched/idle.c:303
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
 start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:262
 secondary_startup_64_no_verify+0xce/0xdb
 </TASK>
Modules linked in:
CR2: ffffdc0000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:165 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:286 [inline]
RIP: 0010:rb_erase+0x21a/0x1210 lib/rbtree.c:443
Code: ea 03 80 3c 02 00 0f 85 b8 0f 00 00 49 89 5e 08 48 85 c9 74 4f 48 89 ca 48 83 cd 01 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 0f 00 00 48 b8 00 00 00 00 00 fc ff df 48 89
RSP: 0000:ffffc90000178bb0 EFLAGS: 00010806
RAX: dffffc0000000000 RBX: ffff88810e690090 RCX: ffff000000000000
RDX: 1fffe00000000000 RSI: ffff88810e690090 RDI: 1ffff11021ccc732
RBP: ffff88810e693991 R08: 0000000000000000 R09: ffff8881f6837bf8
R10: ffff8881f6837cc0 R11: 0000000000000001 R12: 0000000000000001
R13: ffff88810e445610 R14: 0000000000000000 R15: ffff8881f6837bf0
FS:  0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffdc0000000000 CR3: 0000000007825000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   6:	85 b8 0f 00 00 49    	test   %edi,0x4900000f(%rax)
   c:	89 5e 08             	mov    %ebx,0x8(%rsi)
   f:	48 85 c9             	test   %rcx,%rcx
  12:	74 4f                	je     0x63
  14:	48 89 ca             	mov    %rcx,%rdx
  17:	48 83 cd 01          	or     $0x1,%rbp
  1b:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  22:	fc ff df
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2d:	0f 85 a2 0f 00 00    	jne    0xfd5
  33:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  3a:	fc ff df
  3d:	48                   	rex.W
  3e:	89                   	.byte 0x89

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-upstream-usb 2022/08/29 15:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 4dce3b375179 d7593c58 .config console log report [disk image] [vmlinux] usb-testing boot error: BUG: unable to handle kernel paging request in dequeue_task_fair
* Struck through repros no longer work on HEAD.