All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+d44d88f1d11e6ca8576b@syzkaller.appspotmail.com>
To: davem@davemloft.net, edumazet@google.com, jhs@mojatatu.com,
	jiri@resnulli.us, kuba@kernel.org, linux-kernel@vger.kernel.org,
	netdev@vger.kernel.org, pabeni@redhat.com,
	syzkaller-bugs@googlegroups.com, xiyou.wangcong@gmail.com
Subject: [syzbot] BUG: unable to handle kernel paging request in atm_tc_destroy
Date: Fri, 10 Feb 2023 07:23:43 -0800	[thread overview]
Message-ID: <00000000000033d42a05f45a155e@google.com> (raw)

Hello,

syzbot found the following issue on:

HEAD commit:    0b34d68049b0 net: enable usercopy for skb_small_head_cache
git tree:       net-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=14cb251f480000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd3e305b3a7ab2b0
dashboard link: https://syzkaller.appspot.com/bug?extid=d44d88f1d11e6ca8576b
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1259c7cb480000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1789967d480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e6e9cd443f49/disk-0b34d680.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d27805ca50d/vmlinux-0b34d680.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0a3e607b6ca7/bzImage-0b34d680.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d44d88f1d11e6ca8576b@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: ffffffffffffffa0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD c48f067 P4D c48f067 PUD c491067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5075 Comm: syz-executor134 Not tainted 6.2.0-rc6-syzkaller-01486-g0b34d68049b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
RIP: 0010:atm_tc_destroy+0x7d/0x250 net/sched/sch_atm.c:588
Code: 0f 84 52 01 00 00 48 bd 00 00 00 00 00 fc ff df e8 88 0e 8b f9 4c 8d 73 28 4c 89 f0 48 c1 e8 03 80 3c 28 00 0f 85 70 01 00 00 <48> 8b 7b 28 e8 ea f4 f2 ff 4c 89 f0 48 c1 e8 03 80 3c 28 00 0f 85
RSP: 0018:ffffc90003c0f3f0 EFLAGS: 00010246
RAX: 1ffffffffffffff4 RBX: ffffffffffffff78 RCX: 0000000000000000
RDX: ffff88802695d7c0 RSI: ffffffff87f5ed08 RDI: ffff888022026000
RBP: dffffc0000000000 R08: 0000000000000007 R09: fffffffffffff000
R10: ffffffffffffffea R11: 0000000000000000 R12: ffff888022026370
R13: ffff888022026000 R14: ffffffffffffffa0 R15: ffff888021d6c000
FS:  0000555555aee300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffa0 CR3: 000000001c561000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 qdisc_create+0xaca/0x1150 net/sched/sch_api.c:1329
 tc_modify_qdisc+0x948/0x19c0 net/sched/sch_api.c:1662
 rtnetlink_rcv_msg+0x43e/0xca0 net/core/rtnetlink.c:6174
 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2574
 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
 netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
 netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1942
 sock_sendmsg_nosec net/socket.c:722 [inline]
 sock_sendmsg+0xde/0x190 net/socket.c:745
 ____sys_sendmsg+0x71c/0x900 net/socket.c:2501
 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2555
 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2584
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f6162cddba9
Code: 28 c3 e8 1a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe242b7018 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f6162d4bed0 RCX: 00007f6162cddba9
RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003
RBP: 00007ffe242b7028 R08: 00007f6162d4be40 R09: 00007f6162d4be40
R10: 00007f6162d4be40 R11: 0000000000000246 R12: 00007ffe242b7030
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
CR2: ffffffffffffffa0
---[ end trace 0000000000000000 ]---
RIP: 0010:atm_tc_destroy+0x7d/0x250 net/sched/sch_atm.c:588
Code: 0f 84 52 01 00 00 48 bd 00 00 00 00 00 fc ff df e8 88 0e 8b f9 4c 8d 73 28 4c 89 f0 48 c1 e8 03 80 3c 28 00 0f 85 70 01 00 00 <48> 8b 7b 28 e8 ea f4 f2 ff 4c 89 f0 48 c1 e8 03 80 3c 28 00 0f 85
RSP: 0018:ffffc90003c0f3f0 EFLAGS: 00010246
RAX: 1ffffffffffffff4 RBX: ffffffffffffff78 RCX: 0000000000000000
RDX: ffff88802695d7c0 RSI: ffffffff87f5ed08 RDI: ffff888022026000
RBP: dffffc0000000000 R08: 0000000000000007 R09: fffffffffffff000
R10: ffffffffffffffea R11: 0000000000000000 R12: ffff888022026370
R13: ffff888022026000 R14: ffffffffffffffa0 R15: ffff888021d6c000
FS:  0000555555aee300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffa0 CR3: 000000001c561000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	0f 84 52 01 00 00    	je     0x158
   6:	48 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbp
   d:	fc ff df
  10:	e8 88 0e 8b f9       	callq  0xf98b0e9d
  15:	4c 8d 73 28          	lea    0x28(%rbx),%r14
  19:	4c 89 f0             	mov    %r14,%rax
  1c:	48 c1 e8 03          	shr    $0x3,%rax
  20:	80 3c 28 00          	cmpb   $0x0,(%rax,%rbp,1)
  24:	0f 85 70 01 00 00    	jne    0x19a
* 2a:	48 8b 7b 28          	mov    0x28(%rbx),%rdi <-- trapping instruction
  2e:	e8 ea f4 f2 ff       	callq  0xfff2f51d
  33:	4c 89 f0             	mov    %r14,%rax
  36:	48 c1 e8 03          	shr    $0x3,%rax
  3a:	80 3c 28 00          	cmpb   $0x0,(%rax,%rbp,1)
  3e:	0f                   	.byte 0xf
  3f:	85                   	.byte 0x85


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

             reply	other threads:[~2023-02-10 15:24 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-02-10 15:23 syzbot [this message]
2023-02-10 15:29 ` [syzbot] BUG: unable to handle kernel paging request in atm_tc_destroy Eric Dumazet

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=00000000000033d42a05f45a155e@google.com \
    --to=syzbot+d44d88f1d11e6ca8576b@syzkaller.appspotmail.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=jhs@mojatatu.com \
    --cc=jiri@resnulli.us \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=xiyou.wangcong@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.