Extracting prog: 2m25.437197729s
Minimizing prog: 3m6.677022014s
Simplifying prog options: 0s
Extracting C: 1m4.378282462s
Simplifying C: 9m28.281446672s
1 programs, timeouts [30s 1m40s 6m0s]
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-syz_mount_image$hfs
detailed listing:
executing program 0:
perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x7, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_bp={0x0}, 0x8300}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xa)
syz_mount_image$hfs(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x208400, &(0x7f0000000500)=ANY=[@ANYBLOB="696f636861727365743d6d616363726f617469616e2c636f6465706167653d69736f383835392d392c747970653d8806e6d92c007c3da50838b213e45c60dfa80dde3ce87abe5e338e4e6a59adcbbcd8c1298ca6754466db1a8a1278dabca7f2fe40cf27dc1fb941304798bf42ba7569909de3630242504efec00c875fa448eb7bdaa7ba31d37ec3e7d64cd77624a0da2b05469cfb6ff12378569cc8b28d1168e0b17c24be8bc7e84cc44764d86c47497b7f98bc4582fe16504124539d5e1c09b9294efa2dd7"], 0x1, 0x2db, &(0x7f0000000600)="$eJzs3T9v004cx/HPOUmb/lF//rVFSCygQiVYKgoMiCUIZWVnQkCTShVREW2RgIWCGBEPgJ2nwINgAfEEYGLiAXQzusvZdRrbaUsT98/7JTWyz3fn7+ns+L6WIAJwZt1r/vx887f9M1JFFUl3pEBSXapKOqfz9RfrW2tbnXarqKOKa2H/jLotTV+dlfV2VlPbzrXwQrtX1XS6LM3094xDiqLo7q+yg0Dp3N2fIZDG/X3ojtdHHNewbEsXy45h1NITbHa0o5eaKTEcAMAx4J//gX9MTLsioyCQFv1j/1Q9/3fKDuBo3er0FUWFDVLPf7e6i4yd3//cod18zyVa9ngQZ4n7Caa2Z39M3SurZ4FpBmWVLpZgYnWtqqWVt2oFeqeGl6o27z5b3Us3NiDahYzctEB+bzXdn+yOxq0o94pDWl3rtMftRir+OIK5g53x35mv5rt5aEJ9UitZ/1UjY6fJzVS4Z6aCmo3/en6PU66VrSU/sEajEfRU+d+d5II/gzdglPXsjCTdZ/yCYDuJoChOd+5Z9b5W6I5ueUCruaxWYbKX02q+p1XFXwlLK886ha9ShiMeovloHpgF/dEXNVPr/8DGt6jUnVn0VW9cTX9ldMczll2z6mqGfU+O3dvlUhKBN37gsUHKe1uW44Oe6LZmNl+9flrpdNobduNxxsbz6Q3jS2rvpcw6w9+oqKCOtndLIutNFO2352iYwV870g7t90dSYm+frMr2LktKglFP01nZaH5T0QV5cjaiSMo5NLTvKRwjmyaedLdb1UTZEWHE7LrLdPM/t5L3qzqXoNiPsGCdXpxkqqfH5SSD610KzrrPyQNlcFP5GVzqjDdyckaXc12+Kl1JFRoVnjH0cZ4SpqkfesT7fwAAAAAAAAAAAAAAAAAAgJNmFP/SoOwxAgAAAAAAAAAAAAAAAAAAAABw0h3q93+z/o949/u/4Uh+/xfA0fgbAAD//wA5eM4=")
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-syz_mount_image$hfs
detailed listing:
executing program 0:
perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x7, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_bp={0x0}, 0x8300}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xa)
syz_mount_image$hfs(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x208400, &(0x7f0000000500)=ANY=[@ANYBLOB="696f636861727365743d6d616363726f617469616e2c636f6465706167653d69736f383835392d392c747970653d8806e6d92c007c3da50838b213e45c60dfa80dde3ce87abe5e338e4e6a59adcbbcd8c1298ca6754466db1a8a1278dabca7f2fe40cf27dc1fb941304798bf42ba7569909de3630242504efec00c875fa448eb7bdaa7ba31d37ec3e7d64cd77624a0da2b05469cfb6ff12378569cc8b28d1168e0b17c24be8bc7e84cc44764d86c47497b7f98bc4582fe16504124539d5e1c09b9294efa2dd7"], 0x1, 0x2db, &(0x7f0000000600)="$eJzs3T9v004cx/HPOUmb/lF//rVFSCygQiVYKgoMiCUIZWVnQkCTShVREW2RgIWCGBEPgJ2nwINgAfEEYGLiAXQzusvZdRrbaUsT98/7JTWyz3fn7+ns+L6WIAJwZt1r/vx887f9M1JFFUl3pEBSXapKOqfz9RfrW2tbnXarqKOKa2H/jLotTV+dlfV2VlPbzrXwQrtX1XS6LM3094xDiqLo7q+yg0Dp3N2fIZDG/X3ojtdHHNewbEsXy45h1NITbHa0o5eaKTEcAMAx4J//gX9MTLsioyCQFv1j/1Q9/3fKDuBo3er0FUWFDVLPf7e6i4yd3//cod18zyVa9ngQZ4n7Caa2Z39M3SurZ4FpBmWVLpZgYnWtqqWVt2oFeqeGl6o27z5b3Us3NiDahYzctEB+bzXdn+yOxq0o94pDWl3rtMftRir+OIK5g53x35mv5rt5aEJ9UitZ/1UjY6fJzVS4Z6aCmo3/en6PU66VrSU/sEajEfRU+d+d5II/gzdglPXsjCTdZ/yCYDuJoChOd+5Z9b5W6I5ueUCruaxWYbKX02q+p1XFXwlLK886ha9ShiMeovloHpgF/dEXNVPr/8DGt6jUnVn0VW9cTX9ldMczll2z6mqGfU+O3dvlUhKBN37gsUHKe1uW44Oe6LZmNl+9flrpdNobduNxxsbz6Q3jS2rvpcw6w9+oqKCOtndLIutNFO2352iYwV870g7t90dSYm+frMr2LktKglFP01nZaH5T0QV5cjaiSMo5NLTvKRwjmyaedLdb1UTZEWHE7LrLdPM/t5L3qzqXoNiPsGCdXpxkqqfH5SSD610KzrrPyQNlcFP5GVzqjDdyckaXc12+Kl1JFRoVnjH0cZ4SpqkfesT7fwAAAAAAAAAAAAAAAAAAgJNmFP/SoOwxAgAAAAAAAAAAAAAAAAAAAABw0h3q93+z/o949/u/4Uh+/xfA0fgbAAD//wA5eM4=")
program crashed: kernel BUG in trace_dma_unmap_sg
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
detailed listing:
executing program 0:
perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x7, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_bp={0x0}, 0x8300}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xa)
program crashed: kernel BUG in trace_dma_unmap_sg
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
detailed listing:
executing program 0:
perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xa)
program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
program crashed: kernel BUG in trace_dma_unmap_sg
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
program did not crash
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
program crashed: kernel BUG in trace_dma_unmap_sg
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
program crashed: kernel BUG in trace_dma_unmap_sg
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
program crashed: kernel BUG in trace_dma_unmap_sg
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
program crashed: kernel BUG in trace_dma_unmap_sg
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
program crashed: kernel BUG in trace_dma_unmap_sg
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open
program did not crash
reproducing took 16m4.773971722s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:171!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 4594 Comm: udevd Not tainted 6.11.0-syzkaller-08068-g1ec6d097897a #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:sg_page include/linux/scatterlist.h:171 [inline]
RIP: 0010:sg_phys include/linux/scatterlist.h:389 [inline]
RIP: 0010:perf_trace_dma_unmap_sg+0x784/0x790 include/trace/events/dma.h:224
Code: 00 48 8b 54 24 08 e9 6b fe ff ff e8 06 7d 17 00 48 c7 c7 60 79 94 8e 4c 89 f6 e8 27 33 74 03 e9 5b fa ff ff e8 ed 7c 17 00 90 <0f> 0b e8 f5 ea 43 0a 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000007aa0 EFLAGS: 00010006
RAX: ffffffff817d37f3 RBX: ffff888000630288 RCX: ffff888000a98000
RDX: 0000000000010000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000007bd0 R08: ffffffff817d34eb R09: 322e66313a30303a
R10: dffffc0000000000 R11: fffff91ffff86f4c R12: 0000000000000008
R13: ffff88801cfa9f81 R14: ffff8880006302a8 R15: dffffc0000000000
FS: 00007f54266ba280(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fa022e3302 CR3: 0000000011df4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_dma_unmap_sg+0x1c2/0x230 include/trace/events/dma.h:224
dma_unmap_sg_attrs+0x49/0xe0 kernel/dma/mapping.c:308
ata_sg_clean drivers/ata/libata-core.c:4627 [inline]
__ata_qc_complete+0x1ae/0x5b0 drivers/ata/libata-core.c:4720
ata_qc_complete_multiple+0x1a3/0x280 drivers/ata/libata-sata.c:789
ahci_qc_complete drivers/ata/libahci.c:1881 [inline]
ahci_handle_port_interrupt+0x422/0x650 drivers/ata/libahci.c:1948
ahci_port_intr drivers/ata/libahci.c:1959 [inline]
ahci_handle_port_intr+0x18e/0x2c0 drivers/ata/libahci.c:1990
ahci_single_level_irq_intr+0xa1/0xf0 drivers/ata/libahci.c:2024
__handle_irq_event_percpu+0x29a/0xa80 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x89/0x1f0 kernel/irq/handle.c:210
handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0x136/0x230 arch/x86/kernel/irq.c:285
common_interrupt+0xb4/0xd0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5826
Code: 2b 00 74 08 4c 89 f7 e8 ba 5a 8d 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc900021271a0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff92000424e40 RCX: 89f1c2910a3e7200
RDX: dffffc0000000000 RSI: ffffffff8c0adbc0 RDI: ffffffff8c60d540
RBP: ffffc900021272e8 R08: ffffffff96af65d7 R09: 1ffffffff2d5ecba
R10: dffffc0000000000 R11: fffffbfff2d5ecbb R12: 1ffff92000424e3c
R13: dffffc0000000000 R14: ffffc90002127200 R15: 0000000000000246
down_read+0xb1/0xa40 kernel/locking/rwsem.c:1526
filemap_invalidate_lock_shared include/linux/fs.h:870 [inline]
filemap_fault+0x6e8/0x1950 mm/filemap.c:3327
__do_fault+0x135/0x460 mm/memory.c:4876
do_read_fault mm/memory.c:5282 [inline]
do_fault mm/memory.c:5416 [inline]
do_pte_missing mm/memory.c:3965 [inline]
handle_pte_fault+0x2d1c/0x6800 mm/memory.c:5751
__handle_mm_fault mm/memory.c:5894 [inline]
handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6062
do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x2b9/0x8c0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]
RIP: 0010:strncpy_from_user+0x110/0x2e0 lib/strncpy_from_user.c:139
Code: 00 00 00 4c 89 e6 e8 3f eb a3 fc 49 83 fc 07 0f 86 9a 00 00 00 48 89 6c 24 08 48 c7 44 24 10 f8 ff ff ff 45 31 ed 4c 89 3c 24 <4f> 8b 3c 2f 48 b8 ff fe fe fe fe fe fe fe 49 8d 1c 07 4c 89 fd 48
RSP: 0018:ffffc90002127c88 EFLAGS: 00050246
RAX: 0000000000000000 RBX: ffff888000c98000 RCX: ffff888000a98000
RDX: 0000000000000000 RSI: 0000000000000fe0 RDI: 0000000000000007
RBP: 0000000000000fe0 R08: ffffffff84f0ce81 R09: 1ffffffff2038f3d
R10: dffffc0000000000 R11: fffffbfff2038f3e R12: 0000000000000fe0
R13: 0000000000000000 R14: ffff888000c98020 R15: 000055fa022e3302
getname_flags+0xf1/0x540 fs/namei.c:150
vfs_fstatat+0x12c/0x190 fs/stat.c:340
__do_sys_newfstatat fs/stat.c:505 [inline]
__se_sys_newfstatat fs/stat.c:499 [inline]
__x64_sys_newfstatat+0x11d/0x1a0 fs/stat.c:499
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f54263165f4
Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8
RSP: 002b:00007ffdd2708538 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 000055fa11aa7030 RCX: 00007f54263165f4
RDX: 00007ffdd2708548 RSI: 000055fa022e3302 RDI: 00000000ffffff9c
RBP: 000055fa11a8f910 R08: 00000000ffffffff R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 000055fa022f75e8
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:sg_page include/linux/scatterlist.h:171 [inline]
RIP: 0010:sg_phys include/linux/scatterlist.h:389 [inline]
RIP: 0010:perf_trace_dma_unmap_sg+0x784/0x790 include/trace/events/dma.h:224
Code: 00 48 8b 54 24 08 e9 6b fe ff ff e8 06 7d 17 00 48 c7 c7 60 79 94 8e 4c 89 f6 e8 27 33 74 03 e9 5b fa ff ff e8 ed 7c 17 00 90 <0f> 0b e8 f5 ea 43 0a 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000007aa0 EFLAGS: 00010006
RAX: ffffffff817d37f3 RBX: ffff888000630288 RCX: ffff888000a98000
RDX: 0000000000010000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000007bd0 R08: ffffffff817d34eb R09: 322e66313a30303a
R10: dffffc0000000000 R11: fffff91ffff86f4c R12: 0000000000000008
R13: ffff88801cfa9f81 R14: ffff8880006302a8 R15: dffffc0000000000
FS: 00007f54266ba280(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fa022e3302 CR3: 0000000011df4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 2b 00 sub (%rax),%eax
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 ba 5a 8d 00 call 0x8d5ac6
c: f6 44 24 61 02 testb $0x2,0x61(%rsp)
11: 0f 85 85 01 00 00 jne 0x19c
17: 41 f7 c7 00 02 00 00 test $0x200,%r15d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1)
3a: 00 00
3c: 43 rex.XB
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 25 .byte 0x25
final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:171!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 4594 Comm: udevd Not tainted 6.11.0-syzkaller-08068-g1ec6d097897a #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:sg_page include/linux/scatterlist.h:171 [inline]
RIP: 0010:sg_phys include/linux/scatterlist.h:389 [inline]
RIP: 0010:perf_trace_dma_unmap_sg+0x784/0x790 include/trace/events/dma.h:224
Code: 00 48 8b 54 24 08 e9 6b fe ff ff e8 06 7d 17 00 48 c7 c7 60 79 94 8e 4c 89 f6 e8 27 33 74 03 e9 5b fa ff ff e8 ed 7c 17 00 90 <0f> 0b e8 f5 ea 43 0a 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000007aa0 EFLAGS: 00010006
RAX: ffffffff817d37f3 RBX: ffff888000630288 RCX: ffff888000a98000
RDX: 0000000000010000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000007bd0 R08: ffffffff817d34eb R09: 322e66313a30303a
R10: dffffc0000000000 R11: fffff91ffff86f4c R12: 0000000000000008
R13: ffff88801cfa9f81 R14: ffff8880006302a8 R15: dffffc0000000000
FS: 00007f54266ba280(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fa022e3302 CR3: 0000000011df4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_dma_unmap_sg+0x1c2/0x230 include/trace/events/dma.h:224
dma_unmap_sg_attrs+0x49/0xe0 kernel/dma/mapping.c:308
ata_sg_clean drivers/ata/libata-core.c:4627 [inline]
__ata_qc_complete+0x1ae/0x5b0 drivers/ata/libata-core.c:4720
ata_qc_complete_multiple+0x1a3/0x280 drivers/ata/libata-sata.c:789
ahci_qc_complete drivers/ata/libahci.c:1881 [inline]
ahci_handle_port_interrupt+0x422/0x650 drivers/ata/libahci.c:1948
ahci_port_intr drivers/ata/libahci.c:1959 [inline]
ahci_handle_port_intr+0x18e/0x2c0 drivers/ata/libahci.c:1990
ahci_single_level_irq_intr+0xa1/0xf0 drivers/ata/libahci.c:2024
__handle_irq_event_percpu+0x29a/0xa80 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x89/0x1f0 kernel/irq/handle.c:210
handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0x136/0x230 arch/x86/kernel/irq.c:285
common_interrupt+0xb4/0xd0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5826
Code: 2b 00 74 08 4c 89 f7 e8 ba 5a 8d 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc900021271a0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff92000424e40 RCX: 89f1c2910a3e7200
RDX: dffffc0000000000 RSI: ffffffff8c0adbc0 RDI: ffffffff8c60d540
RBP: ffffc900021272e8 R08: ffffffff96af65d7 R09: 1ffffffff2d5ecba
R10: dffffc0000000000 R11: fffffbfff2d5ecbb R12: 1ffff92000424e3c
R13: dffffc0000000000 R14: ffffc90002127200 R15: 0000000000000246
down_read+0xb1/0xa40 kernel/locking/rwsem.c:1526
filemap_invalidate_lock_shared include/linux/fs.h:870 [inline]
filemap_fault+0x6e8/0x1950 mm/filemap.c:3327
__do_fault+0x135/0x460 mm/memory.c:4876
do_read_fault mm/memory.c:5282 [inline]
do_fault mm/memory.c:5416 [inline]
do_pte_missing mm/memory.c:3965 [inline]
handle_pte_fault+0x2d1c/0x6800 mm/memory.c:5751
__handle_mm_fault mm/memory.c:5894 [inline]
handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6062
do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x2b9/0x8c0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]
RIP: 0010:strncpy_from_user+0x110/0x2e0 lib/strncpy_from_user.c:139
Code: 00 00 00 4c 89 e6 e8 3f eb a3 fc 49 83 fc 07 0f 86 9a 00 00 00 48 89 6c 24 08 48 c7 44 24 10 f8 ff ff ff 45 31 ed 4c 89 3c 24 <4f> 8b 3c 2f 48 b8 ff fe fe fe fe fe fe fe 49 8d 1c 07 4c 89 fd 48
RSP: 0018:ffffc90002127c88 EFLAGS: 00050246
RAX: 0000000000000000 RBX: ffff888000c98000 RCX: ffff888000a98000
RDX: 0000000000000000 RSI: 0000000000000fe0 RDI: 0000000000000007
RBP: 0000000000000fe0 R08: ffffffff84f0ce81 R09: 1ffffffff2038f3d
R10: dffffc0000000000 R11: fffffbfff2038f3e R12: 0000000000000fe0
R13: 0000000000000000 R14: ffff888000c98020 R15: 000055fa022e3302
getname_flags+0xf1/0x540 fs/namei.c:150
vfs_fstatat+0x12c/0x190 fs/stat.c:340
__do_sys_newfstatat fs/stat.c:505 [inline]
__se_sys_newfstatat fs/stat.c:499 [inline]
__x64_sys_newfstatat+0x11d/0x1a0 fs/stat.c:499
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f54263165f4
Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8
RSP: 002b:00007ffdd2708538 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 000055fa11aa7030 RCX: 00007f54263165f4
RDX: 00007ffdd2708548 RSI: 000055fa022e3302 RDI: 00000000ffffff9c
RBP: 000055fa11a8f910 R08: 00000000ffffffff R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 000055fa022f75e8
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:sg_page include/linux/scatterlist.h:171 [inline]
RIP: 0010:sg_phys include/linux/scatterlist.h:389 [inline]
RIP: 0010:perf_trace_dma_unmap_sg+0x784/0x790 include/trace/events/dma.h:224
Code: 00 48 8b 54 24 08 e9 6b fe ff ff e8 06 7d 17 00 48 c7 c7 60 79 94 8e 4c 89 f6 e8 27 33 74 03 e9 5b fa ff ff e8 ed 7c 17 00 90 <0f> 0b e8 f5 ea 43 0a 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000007aa0 EFLAGS: 00010006
RAX: ffffffff817d37f3 RBX: ffff888000630288 RCX: ffff888000a98000
RDX: 0000000000010000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000007bd0 R08: ffffffff817d34eb R09: 322e66313a30303a
R10: dffffc0000000000 R11: fffff91ffff86f4c R12: 0000000000000008
R13: ffff88801cfa9f81 R14: ffff8880006302a8 R15: dffffc0000000000
FS: 00007f54266ba280(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fa022e3302 CR3: 0000000011df4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 2b 00 sub (%rax),%eax
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 ba 5a 8d 00 call 0x8d5ac6
c: f6 44 24 61 02 testb $0x2,0x61(%rsp)
11: 0f 85 85 01 00 00 jne 0x19c
17: 41 f7 c7 00 02 00 00 test $0x200,%r15d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1)
3a: 00 00
3c: 43 rex.XB
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 25 .byte 0x25