ci2 starts bisection 2024-04-08 17:52:52.633590999 +0000 UTC m=+19394.664630769 bisecting fixing commit since 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b building syzkaller on 1e153dc8b31e685ca8495576db4f8c077585e39c ensuring issue is reproducible on original commit 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b testing commit 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4fba9295b2a16444cbcf582cb299e05952198242afb4e7cdf2ffd212879a4e15 all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str, types: [UNKNOWN] check whether we can drop unnecessary instrumentation disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b85dd131d31765f0d02109fe291a8c2597916e93b55b83d804580ecec5151c64 all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str, types: [UNKNOWN] the bug reproduces without the instrumentation disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed kconfig minimization: base=4920 full=6161 leaves diff=241 split chunks (needed=false): <241> split chunk #0 of len 241 into 5 parts testing without sub-chunk 1/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4060180128b3da90be0ceef50279f8ccdb21e54c3e508c523805222feea0c125 all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ebed83e8e5f10e16a15f7776384c4e1386263204e2e9b01d074d76abbb40a363 all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 34930f70fe1b392f4d3e2bfe41dbc529630aed7b02e09172b43552d570941eb4 all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0547bff88fa85e893cfca5e3a3b60aaa5d945e13b1f98f4ec555444685bb9952 all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 failed building 1c3a1f32bcbdc0591d0eab67b745f1f4d3ecef6b: net/socket.c:1191: undefined reference to `wext_handle_ioctl' net/socket.c:3385: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343: undefined reference to `wext_proc_exit' net/core/net-procfs.c:327: undefined reference to `wext_proc_init' minimized to 45 configs; suspects: [HID_ZEROPLUS USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF] disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing current HEAD 993bed180178156a70afdafe8aaf23a117107352 testing commit 993bed180178156a70afdafe8aaf23a117107352 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7a683329efcf8467d79f63f674bea7b7eb0e3c84c14dff8174e153128e60c1a4 all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str, types: [UNKNOWN] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 1h15m58.753994016s (build: 30m0.753729722s, test: 43m54.988598418s) crash still not fixed or there were kernel test errors commit msg: Merge "Merge branch 'android13-5.15' into branch 'android13-5.15-lts'" into android13-5.15-lts crash: BUG: unable to handle kernel paging request in bpf_probe_read_compat_str BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: error_code(0x0001) - permissions violation PGD 2e0e067 P4D 2e0e067 PUD 2e10067 PMD 2e12067 PTE 8000000002e05165 Oops: 0001 [#1] PREEMPT SMP CPU: 1 PID: 356 Comm: syz-executor.0 Not tainted 5.15.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:strncpy_from_kernel_nofault+0x5a/0xb0 mm/maccess.c:92 Code: ae 01 00 83 80 48 0b 00 00 01 31 f6 4c 89 e2 eb 17 48 83 c2 01 48 83 c3 01 48 89 d0 4c 29 e0 84 c9 74 30 4c 39 e8 7d 2b 89 f0 <8a> 0a 85 c0 88 0b 74 df 65 48 8b 04 25 00 ae 01 00 83 a8 48 0b 00 RSP: 0018:ffffc9000041baf8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffffc9000041bb48 RCX: 0000000000000010 RDX: ffffffffff600000 RSI: 0000000000000000 RDI: ffffffffff600000 RBP: ffffc9000041bb10 R08: ffffffffff600000 R09: 0000000000000004 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffff600000 R13: 0000000000000008 R14: ffffc9000041bbc0 R15: ffff8881025e1280 FS: 00007fb605d9b6c0(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600000 CR3: 0000000110cd0000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bpf_probe_read_kernel_str_common kernel/trace/bpf_trace.c:255 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:303 [inline] bpf_probe_read_compat_str+0x58/0x90 kernel/trace/bpf_trace.c:296 bpf_prog_f17ebaf3f5f7baf8+0x3a/0x908 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline] __bpf_prog_run include/linux/filter.h:625 [inline] bpf_prog_run include/linux/filter.h:632 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline] bpf_trace_run3+0x3b/0xa0 kernel/trace/bpf_trace.c:1921 __bpf_trace_sched_switch+0xd/0x10 include/trace/events/sched.h:220 trace_sched_switch include/trace/events/sched.h:220 [inline] __schedule+0x50a/0x730 kernel/sched/core.c:6509 preempt_schedule_common+0x32/0x80 kernel/sched/core.c:6688 preempt_schedule+0x1f/0x30 kernel/sched/core.c:6713 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34 try_to_wake_up+0x3aa/0x620 kernel/sched/core.c:4259 wake_up_process kernel/sched/core.c:4322 [inline] wake_up_q+0x57/0xa0 kernel/sched/core.c:972 futex_wake+0x194/0x300 kernel/futex/core.c:1706 do_futex+0x188/0xb60 kernel/futex/core.c:4000 __do_sys_futex kernel/futex/core.c:4072 [inline] __se_sys_futex kernel/futex/core.c:4053 [inline] __x64_sys_futex+0x6b/0x190 kernel/futex/core.c:4053 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fb606218da9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb605d9b178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 00007fb606347f88 RCX: 00007fb606218da9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb606347f8c RBP: 00007fb606347f80 R08: 00007ffcf4b2a080 R09: 00007fb605d9b6c0 R10: 0000000000000004 R11: 0000000000000246 R12: 00007fb606347f8c R13: 000000000000000b R14: 00007ffcf4a9bb20 R15: 00007ffcf4a9bc08 Modules linked in: CR2: ffffffffff600000 ---[ end trace da46f004eb29b264 ]--- RIP: 0010:strncpy_from_kernel_nofault+0x5a/0xb0 mm/maccess.c:92 Code: ae 01 00 83 80 48 0b 00 00 01 31 f6 4c 89 e2 eb 17 48 83 c2 01 48 83 c3 01 48 89 d0 4c 29 e0 84 c9 74 30 4c 39 e8 7d 2b 89 f0 <8a> 0a 85 c0 88 0b 74 df 65 48 8b 04 25 00 ae 01 00 83 a8 48 0b 00 RSP: 0018:ffffc9000041baf8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffffc9000041bb48 RCX: 0000000000000010 RDX: ffffffffff600000 RSI: 0000000000000000 RDI: ffffffffff600000 RBP: ffffc9000041bb10 R08: ffffffffff600000 R09: 0000000000000004 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffff600000 R13: 0000000000000008 R14: ffffc9000041bbc0 R15: ffff8881025e1280 FS: 00007fb605d9b6c0(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600000 CR3: 0000000110cd0000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: ae scas %es:(%rdi),%al 1: 01 00 add %eax,(%rax) 3: 83 80 48 0b 00 00 01 addl $0x1,0xb48(%rax) a: 31 f6 xor %esi,%esi c: 4c 89 e2 mov %r12,%rdx f: eb 17 jmp 0x28 11: 48 83 c2 01 add $0x1,%rdx 15: 48 83 c3 01 add $0x1,%rbx 19: 48 89 d0 mov %rdx,%rax 1c: 4c 29 e0 sub %r12,%rax 1f: 84 c9 test %cl,%cl 21: 74 30 je 0x53 23: 4c 39 e8 cmp %r13,%rax 26: 7d 2b jge 0x53 28: 89 f0 mov %esi,%eax * 2a: 8a 0a mov (%rdx),%cl <-- trapping instruction 2c: 85 c0 test %eax,%eax 2e: 88 0b mov %cl,(%rbx) 30: 74 df je 0x11 32: 65 48 8b 04 25 00 ae mov %gs:0x1ae00,%rax 39: 01 00 3b: 83 .byte 0x83 3c: a8 48 test $0x48,%al 3e: 0b 00 or (%rax),%eax