* BUG: unable to handle page fault for address: ADDR
@ 2019-05-09 12:40 syzbot
2019-05-09 12:52 ` Dmitry Vyukov
0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2019-05-09 12:40 UTC (permalink / raw)
To: davem, kuznet, linux-kernel, netdev, syzkaller-bugs, yoshfuji
Hello,
syzbot found the following crash on:
HEAD commit: 80f23212 Merge git://git.kernel.org/pub/scm/linux/kernel/g..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=112de0d8a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=40a58b399941db7e
dashboard link: https://syzkaller.appspot.com/bug?extid=208b9694ae6aee1c7197
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+208b9694ae6aee1c7197@syzkaller.appspotmail.com
New replicast peer: 172.20.20.187
BUG: unable to handle page fault for address: ffffde202758ca0b
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 17591 Comm: syz-executor.3 Not tainted 5.1.0+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline]
RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94
Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6e 88 48 b8
00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00
RSP: 0018:ffff8880a0fb7008 EFLAGS: 00010a02
RAX: dffffc0000000000 RBX: ffff11013ac65040 RCX: 1ffffffff10dce0c
RDX: 1fffe2202758ca0b RSI: ffffffff83344b4c RDI: ffff11013ac65058
RBP: ffff8880a0fb7068 R08: ffff888059df8140 R09: ffffed1015d06be0
R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc
R13: ffff88806bbfec40 R14: ffff88806a6a3714 R15: ffff8880a097a8c0
FS: 00007fcf84ffc700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffde202758ca0b CR3: 00000000970bb000 CR4: 00000000001406f0
Call Trace:
udp_tunnel_xmit_skb+0x236/0x310 net/ipv4/udp_tunnel.c:191
tipc_udp_xmit.isra.0+0x805/0xcc0 net/tipc/udp_media.c:181
tipc_udp_send_msg+0x295/0x4a0 net/tipc/udp_media.c:247
tipc_bearer_xmit_skb+0x172/0x360 net/tipc/bearer.c:503
tipc_enable_bearer+0xac4/0xd20 net/tipc/bearer.c:328
__tipc_nl_bearer_enable+0x2de/0x3a0 net/tipc/bearer.c:899
tipc_nl_bearer_enable+0x23/0x40 net/tipc/bearer.c:907
genl_family_rcv_msg+0x753/0xf90 net/netlink/genetlink.c:629
genl_rcv_msg+0xca/0x16c net/netlink/genetlink.c:654
netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2486
genl_rcv+0x29/0x40 net/netlink/genetlink.c:665
netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1337
netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1926
sock_sendmsg_nosec net/socket.c:660 [inline]
sock_sendmsg+0x12e/0x170 net/socket.c:671
___sys_sendmsg+0x81d/0x960 net/socket.c:2292
__sys_sendmsg+0x105/0x1d0 net/socket.c:2330
__do_sys_sendmsg net/socket.c:2339 [inline]
__se_sys_sendmsg net/socket.c:2337 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337
do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458da9
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fcf84ffbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458da9
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf84ffc6d4
R13: 00000000004c6449 R14: 00000000004dad18 R15: 00000000ffffffff
Modules linked in:
CR2: ffffde202758ca0b
---[ end trace 7b8973c639719d58 ]---
RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline]
RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94
Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6e 88 48 b8
00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00
RSP: 0018:ffff8880a0fb7008 EFLAGS: 00010a02
RAX: dffffc0000000000 RBX: ffff11013ac65040 RCX: 1ffffffff10dce0c
RDX: 1fffe2202758ca0b RSI: ffffffff83344b4c RDI: ffff11013ac65058
RBP: ffff8880a0fb7068 R08: ffff888059df8140 R09: ffffed1015d06be0
R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc
R13: ffff88806bbfec40 R14: ffff88806a6a3714 R15: ffff8880a097a8c0
FS: 00007fcf84ffc700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffde202758ca0b CR3: 00000000970bb000 CR4: 00000000001406f0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle page fault for address: ADDR
2019-05-09 12:40 BUG: unable to handle page fault for address: ADDR syzbot
@ 2019-05-09 12:52 ` Dmitry Vyukov
0 siblings, 0 replies; 6+ messages in thread
From: Dmitry Vyukov @ 2019-05-09 12:52 UTC (permalink / raw)
To: syzbot
Cc: David Miller, Alexey Kuznetsov, LKML, netdev, syzkaller-bugs,
Hideaki YOSHIFUJI
From: syzbot <syzbot+208b9694ae6aee1c7197@syzkaller.appspotmail.com>
Date: Thu, May 9, 2019 at 2:40 PM
To: <davem@davemloft.net>, <kuznet@ms2.inr.ac.ru>,
<linux-kernel@vger.kernel.org>, <netdev@vger.kernel.org>,
<syzkaller-bugs@googlegroups.com>, <yoshfuji@linux-ipv6.org>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 80f23212 Merge git://git.kernel.org/pub/scm/linux/kernel/g..
> git tree: net
> console output: https://syzkaller.appspot.com/x/log.txt?x=112de0d8a00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=40a58b399941db7e
> dashboard link: https://syzkaller.appspot.com/bug?extid=208b9694ae6aee1c7197
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+208b9694ae6aee1c7197@syzkaller.appspotmail.com
Kernel has changed format of crash messages, but otherwise this is
#syz dup: BUG: unable to handle kernel paging request in iptunnel_xmit
https://syzkaller.appspot.com/bug?extid=61816a2458fec4918227
https://groups.google.com/forum/#!msg/syzkaller-bugs/dOzIJi3RjfY/buHkKqxgEgAJ
Reported in December, still happens.
> New replicast peer: 172.20.20.187
> BUG: unable to handle page fault for address: ffffde202758ca0b
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 0 P4D 0
> Oops: 0000 [#1] PREEMPT SMP KASAN
> CPU: 0 PID: 17591 Comm: syz-executor.3 Not tainted 5.1.0+ #3
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline]
> RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94
> Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6e 88 48 b8
> 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00
> RSP: 0018:ffff8880a0fb7008 EFLAGS: 00010a02
> RAX: dffffc0000000000 RBX: ffff11013ac65040 RCX: 1ffffffff10dce0c
> RDX: 1fffe2202758ca0b RSI: ffffffff83344b4c RDI: ffff11013ac65058
> RBP: ffff8880a0fb7068 R08: ffff888059df8140 R09: ffffed1015d06be0
> R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc
> R13: ffff88806bbfec40 R14: ffff88806a6a3714 R15: ffff8880a097a8c0
> FS: 00007fcf84ffc700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffde202758ca0b CR3: 00000000970bb000 CR4: 00000000001406f0
> Call Trace:
> udp_tunnel_xmit_skb+0x236/0x310 net/ipv4/udp_tunnel.c:191
> tipc_udp_xmit.isra.0+0x805/0xcc0 net/tipc/udp_media.c:181
> tipc_udp_send_msg+0x295/0x4a0 net/tipc/udp_media.c:247
> tipc_bearer_xmit_skb+0x172/0x360 net/tipc/bearer.c:503
> tipc_enable_bearer+0xac4/0xd20 net/tipc/bearer.c:328
> __tipc_nl_bearer_enable+0x2de/0x3a0 net/tipc/bearer.c:899
> tipc_nl_bearer_enable+0x23/0x40 net/tipc/bearer.c:907
> genl_family_rcv_msg+0x753/0xf90 net/netlink/genetlink.c:629
> genl_rcv_msg+0xca/0x16c net/netlink/genetlink.c:654
> netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2486
> genl_rcv+0x29/0x40 net/netlink/genetlink.c:665
> netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
> netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1337
> netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1926
> sock_sendmsg_nosec net/socket.c:660 [inline]
> sock_sendmsg+0x12e/0x170 net/socket.c:671
> ___sys_sendmsg+0x81d/0x960 net/socket.c:2292
> __sys_sendmsg+0x105/0x1d0 net/socket.c:2330
> __do_sys_sendmsg net/socket.c:2339 [inline]
> __se_sys_sendmsg net/socket.c:2337 [inline]
> __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337
> do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x458da9
> Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
> ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007fcf84ffbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458da9
> RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
> RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf84ffc6d4
> R13: 00000000004c6449 R14: 00000000004dad18 R15: 00000000ffffffff
> Modules linked in:
> CR2: ffffde202758ca0b
> ---[ end trace 7b8973c639719d58 ]---
> RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline]
> RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94
> Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6e 88 48 b8
> 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00
> RSP: 0018:ffff8880a0fb7008 EFLAGS: 00010a02
> RAX: dffffc0000000000 RBX: ffff11013ac65040 RCX: 1ffffffff10dce0c
> RDX: 1fffe2202758ca0b RSI: ffffffff83344b4c RDI: ffff11013ac65058
> RBP: ffff8880a0fb7068 R08: ffff888059df8140 R09: ffffed1015d06be0
> R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc
> R13: ffff88806bbfec40 R14: ffff88806a6a3714 R15: ffff8880a097a8c0
> FS: 00007fcf84ffc700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffde202758ca0b CR3: 00000000970bb000 CR4: 00000000001406f0
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000f10885058873bf83%40google.com.
> For more options, visit https://groups.google.com/d/optout.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle page fault for address = ADDR
2019-04-26 11:36 ` Ben Hutchings
@ 2019-04-27 1:27 ` Linus Torvalds
0 siblings, 0 replies; 6+ messages in thread
From: Linus Torvalds @ 2019-04-27 1:27 UTC (permalink / raw)
To: Ben Hutchings
Cc: syzbot, David Miller, Dmitry Vyukov, Alan Cox,
Greg Kroah-Hartman, Jiri Slaby, Linux List Kernel Mailing,
Michal Hocko, Netdev, Tetsuo Handa, peter, syzkaller-bugs,
vegard.nossum
On Fri, Apr 26, 2019 at 4:36 AM Ben Hutchings <ben@decadent.org.uk> wrote:
>
> This looks sensible to me.
I've just applied it directly to my tree. It looks like slip is
largely a thing of the past, there have been no slip-specific patches
for the last year (all changes in the last year have been due to
treewide changes that weren't slip-specific).
Linus
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle page fault for address = ADDR
2019-04-25 23:13 ` Linus Torvalds
@ 2019-04-26 11:36 ` Ben Hutchings
2019-04-27 1:27 ` Linus Torvalds
0 siblings, 1 reply; 6+ messages in thread
From: Ben Hutchings @ 2019-04-26 11:36 UTC (permalink / raw)
To: Linus Torvalds, syzbot
Cc: David Miller, Dmitry Vyukov, Alan Cox, Greg Kroah-Hartman,
Jiri Slaby, Linux List Kernel Mailing, Michal Hocko, Netdev,
Tetsuo Handa, peter, syzkaller-bugs, vegard.nossum
[-- Attachment #1: Type: text/plain, Size: 1037 bytes --]
On Thu, 2019-04-25 at 16:13 -0700, Linus Torvalds wrote:
[...]
> so we do "slhc_free()" on an error pointer, which results in
>
> BUG: unable to handle page fault for address = fffffffffffffff4
>
> and the fix might be something like the appended whitespace-damaged
> trivial one-liner: just make slhc_free() silently ignore an error
> pointer, to match the slhc_init() return behavior.
>
> Ben? David?
This looks sensible to me.
Ben.
> Linus
>
> diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
> index f4e93f5fc204..ea90db3c7705 100644
> --- a/drivers/net/slip/slhc.c
> +++ b/drivers/net/slip/slhc.c
> @@ -153,7 +153,7 @@ slhc_init(int rslots, int tslots)
> void
> slhc_free(struct slcompress *comp)
> {
> - if ( comp == NULLSLCOMPR )
> + if ( IS_ERR_OR_NULL(comp) )
> return;
>
> if ( comp->tstate != NULLSLSTATE )
--
Ben Hutchings
It is impossible to make anything foolproof
because fools are so ingenious.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle page fault for address = ADDR
2019-04-25 22:16 BUG: unable to handle page fault for address = ADDR syzbot
@ 2019-04-25 23:13 ` Linus Torvalds
2019-04-26 11:36 ` Ben Hutchings
0 siblings, 1 reply; 6+ messages in thread
From: Linus Torvalds @ 2019-04-25 23:13 UTC (permalink / raw)
To: syzbot, Ben Hutchings
Cc: David Miller, Dmitry Vyukov, Alan Cox, Greg Kroah-Hartman,
Jiri Slaby, Linux List Kernel Mailing, Michal Hocko, Netdev,
Tetsuo Handa, peter, syzkaller-bugs, vegard.nossum
On Thu, Apr 25, 2019 at 3:16 PM syzbot
<syzbot+45474c076a4927533d2e@syzkaller.appspotmail.com> wrote:
>
> The bug was bisected to:
>
> commit bcdd0ca8cb8730573afebcaae4138f8f4c8eaa20
> Author: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Date: Wed Apr 25 11:12:31 2018 +0000
>
> tty: Use __GFP_NOFAIL for tty_ldisc_get()
I think this just makes slhc_init() fail more easily, but the bug was
pre-existing.
The *real* source of the bug seems to be
4ab42d78e37a ("ppp, slip: Validate VJ compression slot parameters
completely")
from back in 2015.
We have (in drivers/net/slip/slip.c: sl_alloc_bufs())
slcomp = slhc_init(16, 16);
if (IS_ERR(slcomp))
goto err_exit;
....
err_exit:
#ifdef SL_INCLUDE_CSLIP
kfree(cbuff);
slhc_free(slcomp);
#endif
so we do "slhc_free()" on an error pointer, which results in
BUG: unable to handle page fault for address = fffffffffffffff4
and the fix might be something like the appended whitespace-damaged
trivial one-liner: just make slhc_free() silently ignore an error
pointer, to match the slhc_init() return behavior.
Ben? David?
Linus
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index f4e93f5fc204..ea90db3c7705 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -153,7 +153,7 @@ slhc_init(int rslots, int tslots)
void
slhc_free(struct slcompress *comp)
{
- if ( comp == NULLSLCOMPR )
+ if ( IS_ERR_OR_NULL(comp) )
return;
if ( comp->tstate != NULLSLSTATE )
^ permalink raw reply related [flat|nested] 6+ messages in thread
* BUG: unable to handle page fault for address = ADDR
@ 2019-04-25 22:16 syzbot
2019-04-25 23:13 ` Linus Torvalds
0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2019-04-25 22:16 UTC (permalink / raw)
To: davem, dvyukov, gnomes, gregkh, jslaby, linux-kernel, mhocko,
netdev, penguin-kernel, penguin-kernel, peter, syzkaller-bugs,
torvalds, vegard.nossum
Hello,
syzbot found the following crash on:
HEAD commit: c392798a Add linux-next specific files for 20190424
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14772c42a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=37a4076eb047eef5
dashboard link: https://syzkaller.appspot.com/bug?extid=45474c076a4927533d2e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1369c242a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12ee2e88a00000
The bug was bisected to:
commit bcdd0ca8cb8730573afebcaae4138f8f4c8eaa20
Author: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Wed Apr 25 11:12:31 2018 +0000
tty: Use __GFP_NOFAIL for tty_ldisc_get()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=157d9014a00000
final crash: https://syzkaller.appspot.com/x/report.txt?x=177d9014a00000
console output: https://syzkaller.appspot.com/x/log.txt?x=137d9014a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+45474c076a4927533d2e@syzkaller.appspotmail.com
Fixes: bcdd0ca8cb87 ("tty: Use __GFP_NOFAIL for tty_ldisc_get()")
do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441149
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffd8ae1c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441149
RDX: 0000000020000140 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007fffd8ae1c50 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
BUG: unable to handle page fault for address = fffffffffffffff4
#PF: supervisor-privileged read access from kernel code
#PF: error_code(0x0000) - not-present page
PGD 8870067 P4D 8870067 PUD 8872067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7949 Comm: syz-executor714 Not tainted 5.1.0-rc6-next-20190424
#30
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
Code: 54 49 89 fc e8 c0 b3 15 fd 4d 85 e4 74 77 e8 b6 b3 15 fd 4c 89 e2 48
b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24 4d
85 ed 74 0d e8 91 b3 15 fd 4c 89 ef e8 09 5b 4e fd
RSP: 0018:ffff8880a3e7f9f0 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 1ffff1101426e1c6
RDX: 1ffffffffffffffe RSI: ffffffff845b7bea RDI: fffffffffffffff4
RBP: ffff8880a3e7fa00 R08: ffff8880a1370540 R09: ffff8880a1370e30
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
R13: ffff88809f531040 R14: 00000000ffffff97 R15: ffff8880a3dff2c0
FS: 0000555556f4d880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 000000008b56d000 CR4: 00000000001406e0
Call Trace:
sl_alloc_bufs drivers/net/slip/slip.c:196 [inline]
slip_open+0xe16/0x1138 drivers/net/slip/slip.c:821
tty_ldisc_open.isra.0+0x8b/0xe0 drivers/tty/tty_ldisc.c:469
tty_set_ldisc+0x2d7/0x690 drivers/tty/tty_ldisc.c:596
tiocsetd drivers/tty/tty_io.c:2332 [inline]
tty_ioctl+0x5dc/0x15c0 drivers/tty/tty_io.c:2592
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441149
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffd8ae1c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441149
RDX: 0000000020000140 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007fffd8ae1c50 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: fffffffffffffff4
---[ end trace c314d2d667c67584 ]---
RIP: 0010:slhc_free+0x31/0xb0 drivers/net/slip/slhc.c:159
Code: 54 49 89 fc e8 c0 b3 15 fd 4d 85 e4 74 77 e8 b6 b3 15 fd 4c 89 e2 48
b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6d <4d> 8b 2c 24 4d
85 ed 74 0d e8 91 b3 15 fd 4c 89 ef e8 09 5b 4e fd
RSP: 0018:ffff8880a3e7f9f0 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 1ffff1101426e1c6
RDX: 1ffffffffffffffe RSI: ffffffff845b7bea RDI: fffffffffffffff4
RBP: ffff8880a3e7fa00 R08: ffff8880a1370540 R09: ffff8880a1370e30
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffff4
R13: ffff88809f531040 R14: 00000000ffffff97 R15: ffff8880a3dff2c0
FS: 0000555556f4d880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff4 CR3: 000000008b56d000 CR4: 00000000001406e0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-05-09 12:52 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-09 12:40 BUG: unable to handle page fault for address: ADDR syzbot
2019-05-09 12:52 ` Dmitry Vyukov
-- strict thread matches above, loose matches on Subject: below --
2019-04-25 22:16 BUG: unable to handle page fault for address = ADDR syzbot
2019-04-25 23:13 ` Linus Torvalds
2019-04-26 11:36 ` Ben Hutchings
2019-04-27 1:27 ` Linus Torvalds
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.