syzbot


INFO: task hung in sock_ioctl

Status: auto-closed as invalid on 2019/07/13 13:17
Subsystems: bridge
[Documentation on labels]
Reported-by: syzbot+eb5ed3be0eb6470d2f99@syzkaller.appspotmail.com
First crash: 2295d, last: 1928d
Discussions (1)
Title Replies (including bot) Last reply
INFO: task hung in sock_ioctl 0 (1) 2018/01/22 08:33
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in sock_ioctl (2) net 1 946d 946d 0/26 auto-closed as invalid on 2021/12/21 20:14
upstream INFO: task hung in rtnetlink_rcv_msg net C inconclusive inconclusive 913 44d 1889d 0/26 upstream: reported C repro on 2019/02/22 17:00
linux-4.14 INFO: task hung in sock_ioctl 1 1474d 1474d 0/1 auto-closed as invalid on 2020/08/10 12:43
linux-4.14 INFO: task hung in sock_ioctl (2) 1 1175d 1175d 0/1 auto-closed as invalid on 2021/06/05 18:05

Sample crash report:
binder: undelivered transaction 27, process died.
binder: send failed reply for transaction 33, target dead
binder: send failed reply for transaction 34, target dead
binder: undelivered TRANSACTION_COMPLETE
syz-executor4 (18543) used greatest stack depth: 15080 bytes left
INFO: task syz-executor1:18554 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc2 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor1   D24040 18554    851 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x897/0x1e60 kernel/sched/core.c:3472
 schedule+0xfe/0x350 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xa3b/0x1670 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457ec9
Code: Bad RIP value.
RSP: 002b:00007f9637627c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
RDX: 00000000200000c0 RSI: 00000000000089a1 RDI: 0000000000000004
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f96376286d4
R13: 00000000004c339d R14: 00000000004d5d58 R15: 00000000ffffffff
INFO: task syz-executor1:18562 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc2 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor1   D27576 18562    851 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x897/0x1e60 kernel/sched/core.c:3472
 schedule+0xfe/0x350 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xa3b/0x1670 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457ec9
Code: Bad RIP value.
RSP: 002b:00007f96375e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
RDX: 0000000020000100 RSI: 00000000000089a0 RDI: 0000000000000004
RBP: 000000000073c0e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f96375e66d4
R13: 00000000004c334a R14: 00000000004d5d10 R15: 00000000ffffffff
INFO: task syz-executor4:18557 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc2 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor4   D27576 18557   8179 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x897/0x1e60 kernel/sched/core.c:3472
 schedule+0xfe/0x350 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xa3b/0x1670 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457ec9
Code: Bad RIP value.
RSP: 002b:00007f01096bdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
RDX: 0000000020000100 RSI: 00000000000089a0 RDI: 0000000000000004
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f01096be6d4
R13: 00000000004c334a R14: 00000000004d5d10 R15: 00000000ffffffff
INFO: task syz-executor3:18556 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc2 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3   D27576 18556  29480 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x897/0x1e60 kernel/sched/core.c:3472
 schedule+0xfe/0x350 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xa3b/0x1670 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457ec9
Code: Bad RIP value.
RSP: 002b:00007f9de2373c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
RDX: 0000000020000100 RSI: 00000000000089a0 RDI: 0000000000000005
RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9de23746d4
R13: 00000000004c334a R14: 00000000004d5d10 R15: 00000000ffffffff
INFO: task syz-executor3:18559 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc2 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3   D23160 18559  29480 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x897/0x1e60 kernel/sched/core.c:3472
 schedule+0xfe/0x350 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xa3b/0x1670 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457ec9
Code: Bad RIP value.
RSP: 002b:00007f9de2352c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
RDX: 0000000020000080 RSI: 00000000000089a1 RDI: 0000000000000011
RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9de23536d4
R13: 00000000004c339d R14: 00000000004d5d58 R15: 00000000ffffffff
INFO: task syz-executor3:18563 blocked for more than 140 seconds.
      Not tainted 5.0.0-rc2 #25
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor3   D25720 18563  29480 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x897/0x1e60 kernel/sched/core.c:3472
 schedule+0xfe/0x350 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xa3b/0x1670 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457ec9
Code: Bad RIP value.
RSP: 002b:00007f9de2331c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
RDX: 0000000020000100 RSI: 00000000000089a0 RDI: 0000000000000011
RBP: 000000000073c0e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9de23326d4
R13: 00000000004c334a R14: 00000000004d5d10 R15: 00000000ffffffff

Showing all locks held in the system:
1 lock held by khungtaskd/1040:
 #0: 0000000096ff112a (rcu_read_lock){....}, at: debug_show_all_locks+0xc6/0x41d kernel/locking/lockdep.c:4389
1 lock held by udevd/3868:
1 lock held by rsyslogd/8024:
 #0: 00000000cd950797 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1b3/0x1f0 fs/file.c:795
2 locks held by getty/8135:
 #0: 000000007bfcfa0c (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000997704c2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8136:
 #0: 00000000878060c2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000007e7cc5ef (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8137:
 #0: 00000000597da94b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 000000003d72e414 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8138:
 #0: 000000003cf9fb3a (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000dfbc11f2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8139:
 #0: 0000000012ed3538 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000006449022 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8140:
 #0: 000000002464c8a0 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000046ecf787 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
2 locks held by getty/8141:
 #0: 00000000b314ebc8 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000ddbdd4d1 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 drivers/tty/n_tty.c:2154
1 lock held by syz-executor1/18554:
 #0: 000000003456eef3 (br_ioctl_mutex){+.+.}, at: sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
1 lock held by syz-executor1/18562:
 #0: 000000003456eef3 (br_ioctl_mutex){+.+.}, at: sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
7 locks held by syz-executor4/18548:
1 lock held by syz-executor4/18557:
 #0: 000000003456eef3 (br_ioctl_mutex){+.+.}, at: sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
1 lock held by syz-executor3/18556:
 #0: 000000003456eef3 (br_ioctl_mutex){+.+.}, at: sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
1 lock held by syz-executor3/18559:
 #0: 000000003456eef3 (br_ioctl_mutex){+.+.}, at: sock_ioctl+0x2c7/0x6c0 net/socket.c:1039
1 lock held by syz-executor3/18563:
 #0: 000000003456eef3 (br_ioctl_mutex){+.+.}, at: sock_ioctl+0x2c7/0x6c0 net/socket.c:1039

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1040 Comm: khungtaskd Not tainted 5.0.0-rc2 #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0xbbb/0x1170 kernel/hung_task.c:287
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.004 msecs
NMI backtrace for cpu 1
CPU: 1 PID: 18548 Comm: syz-executor4 Not tainted 5.0.0-rc2 #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:23 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:200 [inline]
RIP: 0010:native_write_msr+0x6/0x30 arch/x86/include/asm/msr.h:164
Code: d5 47 88 e9 dc 2f e9 06 0f 21 f8 c3 0f 21 c0 c3 0f 21 c8 c3 0f 21 d0 c3 0f 21 d8 c3 0f 21 f0 c3 0f 0b 66 90 89 f9 89 f0 0f 30 <0f> 1f 44 00 00 c3 55 48 c1 e2 20 89 f6 48 89 e5 48 09 d6 31 d2 e8
RSP: 0018:ffff8880ae707da0 EFLAGS: 00000046
RAX: 000000000000003e RBX: 0000000000000838 RCX: 0000000000000838
RDX: 0000000000000000 RSI: 000000000000003e RDI: 0000000000000838
RBP: ffff8880ae707db8 R08: ffff88808ea82000 R09: ffffffff8a9a905d
R10: ffffffff8a9a9050 R11: 0000000000000001 R12: ffff8880ae71f140
R13: 000000000000003e R14: 0000000000000000 R15: 0000000000000001
FS:  00007f01096df700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 00000000384d1000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 apic_write arch/x86/include/asm/apic.h:397 [inline]
 lapic_next_event+0x57/0x90 arch/x86/kernel/apic/apic.c:467
 clockevents_program_event+0x266/0x380 kernel/time/clockevents.c:334
 tick_program_event+0xb4/0x130 kernel/time/tick-oneshot.c:44
 hrtimer_interrupt+0x369/0x770 kernel/time/hrtimer.c:1522
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
 smp_apic_timer_interrupt+0x18d/0x760 arch/x86/kernel/apic/apic.c:1060
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
 </IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x54/0x90 kernel/locking/spinlock.c:192
Code: c0 c0 80 92 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 33 48 83 3d 95 64 9e 01 00 74 20 fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 02 02 64 f9 65 8b 05 8b d1 0d 78 85 c0 74 06 41
RSP: 0018:ffff88808ef46700 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff1325018 RBX: ffff88808ef46950 RCX: 1ffff11011d50519
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff88808ea8287c
RBP: ffff88808ef46708 R08: 0000000000000007 R09: ffff88808ea828c8
R10: ffff88808ea82000 R11: 0000000000000000 R12: ffff88808c045b60
R13: ffff88808c045b58 R14: ffff88808ef467c0 R15: 0000000000000000
 spin_unlock_irq include/linux/spinlock.h:379 [inline]
 __add_to_page_cache_locked+0xa14/0x1730 mm/filemap.c:842
 add_to_page_cache_lru+0x314/0xd20 mm/filemap.c:886
 mpage_readpages+0x4cb/0x920 fs/mpage.c:399
 blkdev_readpages+0x2d/0x40 fs/block_dev.c:601
 read_pages+0x119/0x650 mm/readahead.c:123
 __do_page_cache_readahead+0x499/0x800 mm/readahead.c:187
 ra_submit mm/internal.h:66 [inline]
 do_sync_mmap_readahead mm/filemap.c:2432 [inline]
 filemap_fault+0xd9e/0x2640 mm/filemap.c:2508
 __do_fault+0x176/0x7b0 mm/memory.c:3019
 do_read_fault mm/memory.c:3430 [inline]
 do_fault mm/memory.c:3556 [inline]
 handle_pte_fault mm/memory.c:3787 [inline]
 __handle_mm_fault+0x370a/0x55a0 mm/memory.c:3911
 handle_mm_fault+0x4ec/0xc80 mm/memory.c:3948
 do_user_addr_fault arch/x86/mm/fault.c:1475 [inline]
 __do_page_fault+0x5da/0xd60 arch/x86/mm/fault.c:1541
 do_page_fault+0xe6/0x7d8 arch/x86/mm/fault.c:1572
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1143
RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 arch/x86/lib/copy_user_64.S:66
Code: 4c 8b 5e 38 4c 89 47 20 4c 89 4f 28 4c 89 57 30 4c 89 5f 38 48 8d 76 40 48 8d 7f 40 ff c9 75 b6 89 d1 83 e2 07 c1 e9 03 74 12 <4c> 8b 06 4c 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10
RSP: 0018:ffff88808ef479b0 EFLAGS: 00010202
RAX: ffffed1011de8f5f RBX: 0000000000000010 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: ffff88808ef47ae8
RBP: ffff88808ef479e8 R08: 1ffff11011de8f5d R09: ffffed1011de8f5f
R10: ffffed1011de8f5e R11: ffff88808ef47af7 R12: 00000000200000c0
R13: 00000000200000d0 R14: ffff88808ef47ae8 R15: 00007ffffffff000
 copy_from_user include/linux/uaccess.h:144 [inline]
 br_ioctl_deviceless_stub+0x305/0xb00 net/bridge/br_ioctl.c:373
 sock_ioctl+0x2f0/0x6c0 net/socket.c:1041
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457ec9
Code: Bad RIP value.
RSP: 002b:00007f01096dec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9
RDX: 00000000200000c0 RSI: 00000000000089a1 RDI: 0000000000000004
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f01096df6d4
R13: 00000000004c339d R14: 00000000004d5d58 R15: 00000000ffffffff

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/14 13:16 upstream 1c7fc5cbc339 95485883 .config console log report ci-upstream-kasan-gce-smack-root
2018/01/24 01:16 net-next-old e71494ae68d2 a5b7566c .config console log report ci-upstream-net-kasan-gce
2018/01/15 12:09 net-next-old 564737f981fb 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/14 21:57 net-next-old 1988c7957881 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/14 16:58 net-next-old 6bd39bc3da0f 66d492a6 .config console log report ci-upstream-net-kasan-gce
2018/01/14 01:19 net-next-old 6bd39bc3da0f c9e7aeae .config console log report ci-upstream-net-kasan-gce
2018/01/13 22:24 net-next-old 6bd39bc3da0f c9e7aeae .config console log report ci-upstream-net-kasan-gce
2018/01/13 02:30 net-next-old 19d28fbd306e 9dc808a6 .config console log report ci-upstream-net-kasan-gce
2018/08/06 07:21 linux-next 116b181bb646 1beb8136 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.