ci2 starts bisection 2024-06-07 16:05:24.284325556 +0000 UTC m=+139275.880041684
bisecting fixing commit since 3802b45594e1e000cdf46d1ae48b07783a276418
building syzkaller on e66542d78f1cf0c783877440cd239a11fb73fb15
ensuring issue is reproducible on original commit 3802b45594e1e000cdf46d1ae48b07783a276418
testing commit 3802b45594e1e000cdf46d1ae48b07783a276418 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: dad19eb7f1bf060804fa74a4be2df462c3a8d182ea4a262ac73db53790cd3c7a
all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str, types: [UNKNOWN]
check whether we can drop unnecessary instrumentation
disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit 3802b45594e1e000cdf46d1ae48b07783a276418 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9edac74be958adeff09f970bfdd6cd8144b8d6718b939b0a56925314432ec1e6
all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str, types: [UNKNOWN]
the bug reproduces without the instrumentation
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN LOCKDEP], they are not needed
kconfig minimization: base=4920 full=6159 leaves diff=241
split chunks (needed=false): <241>
split chunk #0 of len 241 into 5 parts
testing without sub-chunk 1/5
disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
testing commit 3802b45594e1e000cdf46d1ae48b07783a276418 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: eb6e4ac6c97b20fe862e5d53aae198b8be06584f9d2365134e7e5df687c8350c
all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str, types: [UNKNOWN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN], they are not needed
testing commit 3802b45594e1e000cdf46d1ae48b07783a276418 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e065c28fce8644fe307c864735386dd6b0d9ebc7b5586305b6203a2e6c90a55a
all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str, types: [UNKNOWN]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit 3802b45594e1e000cdf46d1ae48b07783a276418 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 1c9fa9bffa9928d5b2703582dfe170e24a0df09ff2e6d9be9900ebc889f1d13d
all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str, types: [UNKNOWN]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 3802b45594e1e000cdf46d1ae48b07783a276418 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: f165dedf34578661fc0f2a1a8cab754d527cec9fc462ddb0b0205e34346fbb3f
all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str, types: [UNKNOWN]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN], they are not needed
testing commit 3802b45594e1e000cdf46d1ae48b07783a276418 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
failed building 3802b45594e1e000cdf46d1ae48b07783a276418: net/socket.c:1191: undefined reference to `wext_handle_ioctl'
net/socket.c:3385: undefined reference to `compat_wext_handle_ioctl'
net/core/net-procfs.c:343: undefined reference to `wext_proc_exit'
net/core/net-procfs.c:327: undefined reference to `wext_proc_init'
minimized to 45 configs; suspects: [HID_ZEROPLUS USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF]
disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing current HEAD 79bd336c7a94039e3d325195b978a04f3b89d2f3
testing commit 79bd336c7a94039e3d325195b978a04f3b89d2f3 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 6a9f16611293d3e955dc7b9bbc70e44f32cd996ad297fd5309cea854e4646927
all runs: crashed: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
representative crash: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str, types: [UNKNOWN]
crash still not fixed/happens on the oldest tested release
revisions tested: 7, total time: 41m8.138966274s (build: 18m19.385350265s, test: 21m14.957018825s)
crash still not fixed or there were kernel test errors
commit msg: Merge a585faf05915 ("fs/ntfs3: Fix oob in ntfs_listxattr") into android-mainline
crash: BUG: unable to handle kernel paging request in bpf_probe_read_kernel_str
BUG: unable to handle page fault for address: ffffffffff600000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0001) - permissions violation
PGD 2e0e067 P4D 2e0e067 PUD 2e10067 PMD 2e12067 PTE 8000000002e05165
Oops: 0001 [#1] PREEMPT SMP
CPU: 0 PID: 6 Comm: kworker/0:0 Not tainted 5.15.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: mld mld_ifc_work
RIP: 0010:strncpy_from_kernel_nofault+0x5a/0xb0 mm/maccess.c:92
Code: ae 01 00 83 80 48 0b 00 00 01 31 f6 4c 89 e2 eb 17 48 83 c2 01 48 83 c3 01 48 89 d0 4c 29 e0 84 c9 74 30 4c 39 e8 7d 2b 89 f0 <8a> 0a 85 c0 88 0b 74 df 65 48 8b 04 25 00 ae 01 00 83 a8 48 0b 00
RSP: 0018:ffffc90000003c50 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffc90000003ca0 RCX: 0000000000000010
RDX: ffffffffff600000 RSI: 0000000000000000 RDI: ffffffffff600000
RBP: ffffc90000003c68 R08: ffffffffff600000 R09: 0000000000000008
R10: 0000000000000000 R11: 0000000000000003 R12: ffffffffff600000
R13: 0000000000000005 R14: ffff888111c1f600 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000010faad000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_probe_read_kernel_str_common kernel/trace/bpf_trace.c:255 [inline]
____bpf_probe_read_kernel_str kernel/trace/bpf_trace.c:264 [inline]
bpf_probe_read_kernel_str+0x1d/0x50 kernel/trace/bpf_trace.c:261
bpf_prog_ef3a4661c9d1378e+0x42/0xa30
bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
bpf_trace_run2+0x37/0x90 kernel/trace/bpf_trace.c:1917
__bpf_trace_kfree+0x9/0x10 include/trace/events/kmem.h:118
trace_kfree include/trace/events/kmem.h:118 [inline]
kfree+0x1ff/0x2a0 mm/slub.c:4569
skb_free_head+0x64/0x80 net/core/skbuff.c:656
skb_release_data+0x12a/0x140 net/core/skbuff.c:678
skb_release_all net/core/skbuff.c:743 [inline]
__kfree_skb net/core/skbuff.c:757 [inline]
kfree_skb_reason.part.0+0x31/0xe0 net/core/skbuff.c:778
kfree_skb_reason+0x19/0x50 include/linux/refcount.h:279
kfree_skb+0xb/0x10 net/core/skbuff.c:792
ip6_mc_input+0xd6/0xe0 net/ipv6/ip6_input.c:572
dst_input include/net/dst.h:454 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:69 [inline]
NF_HOOK include/linux/netfilter.h:305 [inline]
NF_HOOK include/linux/netfilter.h:299 [inline]
ipv6_rcv+0xd2/0xe0 net/ipv6/ip6_input.c:300
__netif_receive_skb_one_core+0x51/0x70 net/core/dev.c:5492
__netif_receive_skb+0x10/0x50 net/core/dev.c:5606
process_backlog+0xa6/0x150 net/core/dev.c:6483
__napi_poll+0x24/0x160 net/core/dev.c:7042
napi_poll net/core/dev.c:7109 [inline]
net_rx_action+0xdb/0x220 net/core/dev.c:7196
__do_softirq+0xff/0x2fc kernel/softirq.c:565
do_softirq kernel/softirq.c:452 [inline]
do_softirq+0x6f/0x90 kernel/softirq.c:439
__local_bh_enable_ip+0x5a/0x60 kernel/softirq.c:379
local_bh_enable include/linux/bottom_half.h:32 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:775 [inline]
ip6_finish_output2+0x1d3/0x5d0 net/ipv6/ip6_output.c:127
__ip6_finish_output.part.0+0x9a/0x1f0 net/ipv6/ip6_output.c:197
__ip6_finish_output net/ipv6/ip6_output.c:212 [inline]
ip6_finish_output+0xa7/0x100 net/ipv6/ip6_output.c:207
NF_HOOK_COND include/linux/netfilter.h:294 [inline]
ip6_output+0x6b/0x130 net/ipv6/ip6_output.c:230
dst_output include/net/dst.h:444 [inline]
NF_HOOK include/linux/netfilter.h:305 [inline]
NF_HOOK include/linux/netfilter.h:299 [inline]
mld_sendpack+0x21e/0x2d0 net/ipv6/mcast.c:1820
mld_send_cr net/ipv6/mcast.c:2121 [inline]
mld_ifc_work+0x18f/0x470 net/ipv6/mcast.c:2653
process_one_work+0x199/0x340 kernel/workqueue.c:2325
worker_thread+0x4e/0x340 kernel/workqueue.c:2472
kthread+0x13a/0x160 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
CR2: ffffffffff600000
---[ end trace 0225f435606c8519 ]---
RIP: 0010:strncpy_from_kernel_nofault+0x5a/0xb0 mm/maccess.c:92
Code: ae 01 00 83 80 48 0b 00 00 01 31 f6 4c 89 e2 eb 17 48 83 c2 01 48 83 c3 01 48 89 d0 4c 29 e0 84 c9 74 30 4c 39 e8 7d 2b 89 f0 <8a> 0a 85 c0 88 0b 74 df 65 48 8b 04 25 00 ae 01 00 83 a8 48 0b 00
RSP: 0018:ffffc90000003c50 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffc90000003ca0 RCX: 0000000000000010
RDX: ffffffffff600000 RSI: 0000000000000000 RDI: ffffffffff600000
RBP: ffffc90000003c68 R08: ffffffffff600000 R09: 0000000000000008
R10: 0000000000000000 R11: 0000000000000003 R12: ffffffffff600000
R13: 0000000000000005 R14: ffff888111c1f600 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000010faad000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: ae scas %es:(%rdi),%al
1: 01 00 add %eax,(%rax)
3: 83 80 48 0b 00 00 01 addl $0x1,0xb48(%rax)
a: 31 f6 xor %esi,%esi
c: 4c 89 e2 mov %r12,%rdx
f: eb 17 jmp 0x28
11: 48 83 c2 01 add $0x1,%rdx
15: 48 83 c3 01 add $0x1,%rbx
19: 48 89 d0 mov %rdx,%rax
1c: 4c 29 e0 sub %r12,%rax
1f: 84 c9 test %cl,%cl
21: 74 30 je 0x53
23: 4c 39 e8 cmp %r13,%rax
26: 7d 2b jge 0x53
28: 89 f0 mov %esi,%eax
* 2a: 8a 0a mov (%rdx),%cl <-- trapping instruction
2c: 85 c0 test %eax,%eax
2e: 88 0b mov %cl,(%rbx)
30: 74 df je 0x11
32: 65 48 8b 04 25 00 ae mov %gs:0x1ae00,%rax
39: 01 00
3b: 83 .byte 0x83
3c: a8 48 test $0x48,%al
3e: 0b 00 or (%rax),%eax