ci2 starts bisection 2024-01-14 17:34:56.043949591 +0000 UTC m=+177927.945857811 bisecting fixing commit since 61cfd264993d07540f60a5c53d77a14c818e54a9 building syzkaller on cb976f63e0177b96eb9ce1c631cc5e2c4b4b0759 ensuring issue is reproducible on original commit 61cfd264993d07540f60a5c53d77a14c818e54a9 testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: cb8ec7461171e950967542b82a10141f95f006a4c71fdbf559169c0a42f8f8b3 all runs: crashed: BUG: unable to handle kernel paging request in copy_from_kernel_nofault representative crash: BUG: unable to handle kernel paging request in copy_from_kernel_nofault, types: [UNKNOWN] check whether we can drop unnecessary instrumentation disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2ffe7c50ed1b0bbaa93fbc514dd6aafeee42670f3ffe1aa45e79554bd4a850cf all runs: crashed: BUG: unable to handle kernel paging request in copy_from_kernel_nofault representative crash: BUG: unable to handle kernel paging request in copy_from_kernel_nofault, types: [UNKNOWN] the bug reproduces without the instrumentation disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN LOCKDEP], they are not needed kconfig minimization: base=4920 full=6161 leaves diff=241 split chunks (needed=false): <241> split chunk #0 of len 241 into 5 parts testing without sub-chunk 1/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 5b59ebae3167a969a74fc6382d2c72be885aa69d4d2fadc0b0574eb907b7b7e6 all runs: crashed: BUG: unable to handle kernel paging request in copy_from_kernel_nofault representative crash: BUG: unable to handle kernel paging request in copy_from_kernel_nofault, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1f75cbddc2787a445c1afbbfb28e7c078ba3b808ad5eee7a1b96b8690a87a439 all runs: crashed: BUG: unable to handle kernel paging request in copy_from_kernel_nofault representative crash: BUG: unable to handle kernel paging request in copy_from_kernel_nofault, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 5c7479b1dcb6752d3b531c56e12e8f67dbdb2941ddd341811534f772ab86dcd8 all runs: crashed: BUG: unable to handle kernel paging request in copy_from_kernel_nofault representative crash: BUG: unable to handle kernel paging request in copy_from_kernel_nofault, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2b48f5d5a63d09d3ecdc35b81046e39eec8cfc674edd5db13d836a09759cb023 all runs: crashed: BUG: unable to handle kernel paging request in copy_from_kernel_nofault representative crash: BUG: unable to handle kernel paging request in copy_from_kernel_nofault, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 61cfd264993d07540f60a5c53d77a14c818e54a9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 failed building 61cfd264993d07540f60a5c53d77a14c818e54a9: net/socket.c:1189: undefined reference to `wext_handle_ioctl' net/socket.c:3383: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343: undefined reference to `wext_proc_exit' net/core/net-procfs.c:327: undefined reference to `wext_proc_init' minimized to 45 configs; suspects: [HID_ZEROPLUS USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF] disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing current HEAD ea2937bdd12f6ebc51e6698c5696a1b16507999b testing commit ea2937bdd12f6ebc51e6698c5696a1b16507999b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 24ec63235bb73c43163b906c9fd8b0534d065a80e985d286f3a305b3fc2c66e4 all runs: crashed: BUG: unable to handle kernel paging request in copy_from_kernel_nofault representative crash: BUG: unable to handle kernel paging request in copy_from_kernel_nofault, types: [UNKNOWN] crash still not fixed/happens on the oldest tested release revisions tested: 7, total time: 46m58.769675426s (build: 13m44.086347123s, test: 31m20.025897532s) crash still not fixed or there were kernel test errors commit msg: Merge 5.15.145 into android13-5.15-lts crash: BUG: unable to handle kernel paging request in copy_from_kernel_nofault BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: error_code(0x0001) - permissions violation PGD 2e0e067 P4D 2e0e067 PUD 2e10067 PMD 2e12067 PTE 8000000002e05165 Oops: 0001 [#1] PREEMPT SMP CPU: 1 PID: 24 Comm: ksoftirqd/1 Not tainted 5.15.145-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 RIP: 0010:copy_from_kernel_nofault mm/maccess.c:37 [inline] RIP: 0010:copy_from_kernel_nofault+0x53/0xf0 mm/maccess.c:25 Code: 25 00 ae 01 00 83 80 48 0b 00 00 01 49 83 fd 07 76 41 31 c9 eb 12 49 83 ed 08 49 83 c4 08 48 83 c3 08 49 83 fd 07 76 2b 89 c8 <48> 8b 13 85 c0 49 89 14 24 74 e1 65 48 8b 04 25 00 ae 01 00 83 a8 RSP: 0018:ffffc900000cfc80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffff600000 RCX: 0000000000000000 RDX: 0000000000000030 RSI: 0000000000000008 RDI: ffffffffff600000 RBP: ffffc900000cfc98 R08: ffffffffff600000 R09: 0000000000000100 R10: ffff88810e10cc40 R11: 0000000000000100 R12: ffffc900000cfcd0 R13: 0000000000000008 R14: ffffc900000cfdc0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600000 CR3: 000000010f38b000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bpf_probe_read_kernel_common kernel/trace/bpf_trace.c:220 [inline] ____bpf_probe_read_kernel kernel/trace/bpf_trace.c:229 [inline] bpf_probe_read_kernel+0x1d/0x50 kernel/trace/bpf_trace.c:226 bpf_prog_bd8b22826c103b08+0x3a/0x5b8 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline] __bpf_prog_run include/linux/filter.h:625 [inline] bpf_prog_run include/linux/filter.h:632 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline] bpf_trace_run2+0x37/0x90 kernel/trace/bpf_trace.c:1920 __bpf_trace_kfree+0x9/0x10 include/trace/events/kmem.h:118 trace_kfree include/trace/events/kmem.h:118 [inline] kfree+0x1ff/0x2a0 mm/slub.c:4569 kvfree+0x25/0x30 mm/util.c:664 __nf_hook_entries_free+0xd/0x10 net/netfilter/core.c:72 rcu_do_batch+0x177/0x4a0 kernel/rcu/tree.c:2523 rcu_core+0x261/0x390 kernel/rcu/tree.c:2763 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2776 __do_softirq+0xff/0x2fc kernel/softirq.c:565 run_ksoftirqd kernel/softirq.c:937 [inline] run_ksoftirqd+0x26/0x30 kernel/softirq.c:929 smpboot_thread_fn+0x17c/0x220 kernel/smpboot.c:164 kthread+0x13a/0x160 kernel/kthread.c:337 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Modules linked in: CR2: ffffffffff600000 ---[ end trace 3381f5219be39496 ]--- RIP: 0010:copy_from_kernel_nofault mm/maccess.c:37 [inline] RIP: 0010:copy_from_kernel_nofault+0x53/0xf0 mm/maccess.c:25 Code: 25 00 ae 01 00 83 80 48 0b 00 00 01 49 83 fd 07 76 41 31 c9 eb 12 49 83 ed 08 49 83 c4 08 48 83 c3 08 49 83 fd 07 76 2b 89 c8 <48> 8b 13 85 c0 49 89 14 24 74 e1 65 48 8b 04 25 00 ae 01 00 83 a8 RSP: 0018:ffffc900000cfc80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffff600000 RCX: 0000000000000000 RDX: 0000000000000030 RSI: 0000000000000008 RDI: ffffffffff600000 RBP: ffffc900000cfc98 R08: ffffffffff600000 R09: 0000000000000100 R10: ffff88810e10cc40 R11: 0000000000000100 R12: ffffc900000cfcd0 R13: 0000000000000008 R14: ffffc900000cfdc0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600000 CR3: 000000010f38b000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 25 00 ae 01 00 and $0x1ae00,%eax 5: 83 80 48 0b 00 00 01 addl $0x1,0xb48(%rax) c: 49 83 fd 07 cmp $0x7,%r13 10: 76 41 jbe 0x53 12: 31 c9 xor %ecx,%ecx 14: eb 12 jmp 0x28 16: 49 83 ed 08 sub $0x8,%r13 1a: 49 83 c4 08 add $0x8,%r12 1e: 48 83 c3 08 add $0x8,%rbx 22: 49 83 fd 07 cmp $0x7,%r13 26: 76 2b jbe 0x53 28: 89 c8 mov %ecx,%eax * 2a: 48 8b 13 mov (%rbx),%rdx <-- trapping instruction 2d: 85 c0 test %eax,%eax 2f: 49 89 14 24 mov %rdx,(%r12) 33: 74 e1 je 0x16 35: 65 48 8b 04 25 00 ae mov %gs:0x1ae00,%rax 3c: 01 00 3e: 83 .byte 0x83 3f: a8 .byte 0xa8