8<--- cut here --- Unable to handle kernel paging request at virtual address ffffffdc when read [ffffffdc] *pgd=80000080007003, *pmd=deffd003, *pte=00000000 Internal error: Oops: 207 [#1] SMP ARM Modules linked in: CPU: 1 UID: 0 PID: 4037 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at strlen+0xc/0x38 lib/string.c:402 LR is at __fortify_strlen include/linux/fortify-string.h:218 [inline] LR is at audit_log_untrustedstring+0x1c/0x30 kernel/audit.c:2203 pc : [<81b62034>] lr : [<8038359c>] psr: 40070013 sp : e8405c58 ip : e8405c68 fp : e8405c64 r10: 82389560 r9 : 8238957c r8 : ffffffdc r7 : 00000000 r6 : 85db1c80 r5 : 853e9038 r4 : ffffffdc r3 : 84860c40 r2 : 00000000 r1 : ffffffdc r0 : ffffffdc Flags: nZcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 86040140 DAC: 00000000 Register r0 information: non-paged memory Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: slab task_struct start 84860c40 pointer offset 0 size 3136 Register r4 information: non-paged memory Register r5 information: slab trace_event_file start 853e9038 pointer offset 0 size 56 Register r6 information: slab inode_cache start 85db1c80 pointer offset 0 size 376 Register r7 information: NULL pointer Register r8 information: non-paged memory Register r9 information: non-slab/vmalloc memory Register r10 information: non-slab/vmalloc memory Register r11 information: 2-page vmalloc region starting at 0xe8404000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r12 information: 2-page vmalloc region starting at 0xe8404000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Process syz.2.17 (pid: 4037, stack limit = 0xe8404000) Stack: (0xe8405c58 to 0xe8406000) 5c40: e8405c7c e8405c68 5c60: 8038359c 81b62034 84861428 853e9038 e8405cd4 e8405c80 80844740 8038358c 5c80: ffffffff ffffffff 00000fc5 00000000 805489fc 2e7a7973 37312e32 00000000 5ca0: 00000000 bc21f554 e8405cd4 84ef5000 85d32660 82389560 00000002 00000000 5cc0: 00000000 8084f424 e8405cf4 e8405cd8 80844814 808445d8 82389560 fffffff3 5ce0: 00000000 00000000 e8405d2c e8405cf8 8084f5e4 808447ec 82389560 fffffff3 5d00: 00000000 e8405e54 85d32660 e8405e54 85d32660 8612c6c0 82b21e14 00000002 5d20: e8405d64 e8405d30 807f0c40 8084f430 00000002 00000000 805dddb8 85d32660 5d40: 82b21e14 e8405e54 8612c6c0 85db1c80 00000000 e8405db8 e8405d94 e8405d68 5d60: 805de930 807f0a84 00000002 00000000 e8405d94 e8405e40 85db1d00 85d32660 5d80: 8612c6c0 00000002 e8405dec e8405d98 805dea98 805de8d8 00000002 00000000 5da0: e8405db8 8022cb78 8612c6c0 e8405e54 82b21e14 8612c6c0 00000000 bc21f554 5dc0: 804d60c4 e8405e40 e8405e54 00000002 8612c6c0 82b21e14 85d32660 00000000 5de0: e8405e1c e8405df0 805dec0c 805dea04 00000002 00000000 00000000 83efe100 5e00: e8405e40 83efe100 00000004 20001080 e8405e3c e8405e20 805dee48 805deb84 5e20: 0000000c 8612c6c0 83efe100 83efe100 e8405f84 e8405e40 805df0a8 805dedfc 5e40: 20001080 8612c6c0 00000002 e8405e54 00000000 75636573 79746972 616d692e 5e60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5e80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5f40: 00000000 00000000 00000000 00000000 00000000 bc21f554 ffffffff 00000000 5f60: 00000000 00356318 000000e4 8020029c 84860c40 000000e4 e8405fa4 e8405f88 5f80: 805df2fc 805def4c 20001080 00000002 00000000 84860c40 00000000 e8405fa8 5fa0: 80200060 805df2d8 00000000 00000000 00000004 20000080 20001080 00000002 5fc0: 00000000 00000000 00356318 000000e4 003562d8 00000000 003562d8 003562e4 5fe0: 7efaa798 7efaa788 00018fa0 001309d0 60000010 00000004 00000000 00000000 Call trace: [<81b62028>] (strlen) from [<8038359c>] (__fortify_strlen include/linux/fortify-string.h:218 [inline]) [<81b62028>] (strlen) from [<8038359c>] (audit_log_untrustedstring+0x1c/0x30 kernel/audit.c:2203) [<80383580>] (audit_log_untrustedstring) from [<80844740>] (integrity_audit_message+0x174/0x214 security/integrity/integrity_audit.c:60) r5:853e9038 r4:84861428 [<808445cc>] (integrity_audit_message) from [<80844814>] (integrity_audit_msg+0x34/0x3c security/integrity/integrity_audit.c:32) r10:8084f424 r9:00000000 r8:00000000 r7:00000002 r6:82389560 r5:85d32660 r4:84ef5000 [<808447e0>] (integrity_audit_msg) from [<8084f5e4>] (validate_hash_algo security/integrity/ima/ima_appraise.c:752 [inline]) [<808447e0>] (integrity_audit_msg) from [<8084f5e4>] (ima_inode_setxattr+0x1c0/0x1d0 security/integrity/ima/ima_appraise.c:775) [<8084f424>] (ima_inode_setxattr) from [<807f0c40>] (security_inode_setxattr+0x1c8/0x3e8 security/security.c:1940) r8:00000002 r7:82b21e14 r6:8612c6c0 r5:85d32660 r4:e8405e54 [<807f0a78>] (security_inode_setxattr) from [<805de930>] (__vfs_setxattr_locked+0x64/0x12c fs/xattr.c:309) r10:e8405db8 r9:00000000 r8:85db1c80 r7:8612c6c0 r6:e8405e54 r5:82b21e14 r4:85d32660 [<805de8cc>] (__vfs_setxattr_locked) from [<805dea98>] (vfs_setxattr+0xa0/0x180 fs/xattr.c:344) r8:00000002 r7:8612c6c0 r6:85d32660 r5:85db1d00 r4:e8405e40 [<805de9f8>] (vfs_setxattr) from [<805dec0c>] (do_setxattr+0x94/0x9c fs/xattr.c:662) r10:00000000 r9:85d32660 r8:82b21e14 r7:8612c6c0 r6:00000002 r5:e8405e54 r4:e8405e40 [<805deb78>] (do_setxattr) from [<805dee48>] (file_setxattr fs/xattr.c:672 [inline]) [<805deb78>] (do_setxattr) from [<805dee48>] (file_setxattr+0x58/0x78 fs/xattr.c:666) r9:20001080 r8:00000004 r7:83efe100 r6:e8405e40 r5:83efe100 r4:00000000 [<805dedf0>] (file_setxattr) from [<805df0a8>] (path_setxattrat+0x168/0x1bc fs/xattr.c:732) r7:83efe100 r6:83efe100 r5:8612c6c0 r4:0000000c [<805def40>] (path_setxattrat) from [<805df2fc>] (__do_sys_fsetxattr fs/xattr.c:782 [inline]) [<805def40>] (path_setxattrat) from [<805df2fc>] (sys_fsetxattr+0x30/0x38 fs/xattr.c:779) r10:000000e4 r9:84860c40 r8:8020029c r7:000000e4 r6:00356318 r5:00000000 r4:00000000 [<805df2cc>] (sys_fsetxattr) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xe8405fa8 to 0xe8405ff0) 5fa0: 00000000 00000000 00000004 20000080 20001080 00000002 5fc0: 00000000 00000000 00356318 000000e4 003562d8 00000000 003562d8 003562e4 5fe0: 7efaa798 7efaa788 00018fa0 001309d0 Code: e89da800 e1a0c00d e92dd800 e24cb004 (e5d03000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e89da800 ldm sp, {fp, sp, pc} 4: e1a0c00d mov ip, sp 8: e92dd800 push {fp, ip, lr, pc} c: e24cb004 sub fp, ip, #4 * 10: e5d03000 ldrb r3, [r0] <-- trapping instruction