From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82CC9CD1293 for ; Tue, 2 Apr 2024 05:19:29 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 02F966B009B; Tue, 2 Apr 2024 01:19:29 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id F22446B009D; Tue, 2 Apr 2024 01:19:28 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DE9DB6B009E; Tue, 2 Apr 2024 01:19:28 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id BCB336B009B for ; Tue, 2 Apr 2024 01:19:28 -0400 (EDT) Received: from smtpin20.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 7E5E4C098D for ; Tue, 2 Apr 2024 05:19:28 +0000 (UTC) X-FDA: 81963438816.20.B5FD578 Received: from mail-io1-f72.google.com (mail-io1-f72.google.com [209.85.166.72]) by imf23.hostedemail.com (Postfix) with ESMTP id CF0F014000C for ; Tue, 2 Apr 2024 05:19:26 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=none; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none); spf=pass (imf23.hostedemail.com: domain of 3XpULZgkbAO0hnoZPaaTgPeeXS.VddVaTjhTgRdciTci.Rdb@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.72 as permitted sender) smtp.mailfrom=3XpULZgkbAO0hnoZPaaTgPeeXS.VddVaTjhTgRdciTci.Rdb@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712035166; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references; bh=kYVVXxXxwvwLBoFTWIsBcqq+uv4/UNSrobzSgSgvS04=; b=d+2IEhRtlOypGI32tgTNFyg19nndAIPZUXaAnHvCTEl6E2R53aGHIvQL7WPNoeebuysDOF B9/E1LVrukmF5iBiL69419Q4t73RsLDgmuyrphBL37Zdb+vdwtXCs91zqRpZkiCMVgkfTq DDpqmzjXuMglqwkVrzZMbJqWOeJq02Y= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=none; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=appspotmail.com (policy=none); spf=pass (imf23.hostedemail.com: domain of 3XpULZgkbAO0hnoZPaaTgPeeXS.VddVaTjhTgRdciTci.Rdb@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com designates 209.85.166.72 as permitted sender) smtp.mailfrom=3XpULZgkbAO0hnoZPaaTgPeeXS.VddVaTjhTgRdciTci.Rdb@M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712035166; a=rsa-sha256; cv=none; b=BogeMupCyGs/6HP2mikGu6bVP+/nLnoo5rXxQiDCmbVp6iDBHA8Wdd5HzLfLlTbataCNRj Fpe49JzPaejWHaLGYLxS5qx5Be+SWgXoYw4MzvDMuGJvQ06pdhK49NsHDNjvuohlXIy2Yw C3Cn9v5dlLQE+Od1mVXdy3TrqS3UC5I= Received: by mail-io1-f72.google.com with SMTP id ca18e2360f4ac-7cbf1aea97fso521678039f.2 for ; Mon, 01 Apr 2024 22:19:26 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712035166; x=1712639966; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=kYVVXxXxwvwLBoFTWIsBcqq+uv4/UNSrobzSgSgvS04=; b=eDe/CjGaqTJETqS+cTJ9mY1rpqWdwcyTBMBRT81ZCmXQHMntMv+FIbrzv7Y8Yv0D4e hcRdB7ToU/QX31LrbHQPTgN4szdWMP19kgGKnInI5Xn6WnFPFjYbdMbueE2o9mr5Nd8J fP7uqyMaTtUvMF+HjxoCf9jcuKW+LN6KfOn1EiTWJsYg5ROoFA5+D/IqmFTFsWgpTm+A PpJeJRkTWRa6wpeNv53EahjcjptiwA9dNQcP4TmCTF7GR/cDzvGTPtYkAn2oBasGVFwq TmOD1z7h6+KYl52pzKdhuVpZ1NHGfxbpprFLh5JoBDkR6gB9+/uus4QUIf2ZnIi9EyQz i5Cw== X-Forwarded-Encrypted: i=1; AJvYcCV+38CvnmLP76BDTfBeuZJIm2SIkirY+5z8DVgCAtZlyKQxME431knnP6ry1xqPldBQYErRuw7JVh+wKUoP7Q5QH+I= X-Gm-Message-State: AOJu0YwvHv1VFSbIbpMhqWefFJJ+42YuU6Y1dTdoyjlZJ5UUGWpwuZUF PqcuSrPlCD0nglKXDf5prev9i97x17wjSMmMSuDVPEtrDzNbvsOZDjVkUDEeBRabl5gfIr9R/7O r1vfRK7/6+99UEL57a54TeJHsMPYv30kC2ZHHaV35R+asmg+V7HdwsX8= X-Google-Smtp-Source: AGHT+IHLQYkgWrBAbHKxWaZCU4/H+RHRbGyYps2YbpiYUvStM7h5dddUvZdb0bL0WVbotDYYteytcoeK7GMxNzJrIMJtjQYJ2WSX MIME-Version: 1.0 X-Received: by 2002:a05:6638:3790:b0:47f:9ab:1fa6 with SMTP id w16-20020a056638379000b0047f09ab1fa6mr54666jal.3.1712035166000; Mon, 01 Apr 2024 22:19:26 -0700 (PDT) Date: Mon, 01 Apr 2024 22:19:25 -0700 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <000000000000e9a8d80615163f2a@google.com> Subject: [syzbot] [mm?] BUG: unable to handle kernel paging request in copy_from_kernel_nofault (2) From: syzbot To: akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" X-Rspam-User: X-Stat-Signature: iuunduph7km4eou6y65z6uncx93q4rrb X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: CF0F014000C X-HE-Tag: 1712035166-244633 X-HE-Meta: U2FsdGVkX1/0a3VeBYQCD0StH5yM71Y4Wl4yDIL3y7fBl/40EH8dKRAI9WREZCrY7vYW0zsiRpErW+wswS6V8MhZ8ntLGmAGZrVp/O4KPBdH522oB9T0f6W0sgGL2hlD6CjfqoiigkTs0EucXg8L4GdtEiXMiOznSnMJTWQxxOQin96533ombhEdisdkaNCn7cUiSdW+zHdXaYBFno8cDsgjDwBWa2CVHZbY98I6jx15wbnGSVNVsu8hsEZnwVnWpI6r1vfml77dYuhhCfIIkhYJQkzsscJY6+VMTD5LpRaPcMZgh2eZCOakbDxyaQ9JZMovGOghgsRE2zbr3mRnJXaHUIr9d7xcOl74tEa4hnjVnM+4cWcZQbN3lSzS2KPvBm2HhqVIUJScU8n6WNm3rQAwI1jX1c/1RLR25+sHERTW/8FCmws7UAaXO6JCekIo29F+9zxp15bSif5VH+B9N91cbgHDIO4BOAJD8yo3mqiVxlgmensEnHei2xtn4wWhkT+m8Acy/EAB0jUCjC3sBiEE9I2QOy3Jo+7fWV+gSW8yyXX/iJJfxXi8KJrHmTu9Qdkk9W16yrnPEYFep7BdnEeLEcza+/wA25ZO7Q0eHUgyo6CHxB/kN793iGWVOjvfrUeWYGOg5wwVkVVPEvVfzaXIkh1v0w6JrgR+qECIdxNvKVYgD/3jtOSP6p9x5ZXFoyRIC8xElFKzRWdhgqPZEiA8Q0TRMkC1hacWYV52/gANRXQktSzUNr52/m/WTNDIANVwZi2NsP/N+FA9DXCvoWG4ZlhktROpSOXqCUe2FC4n0Xi9df/9EJqRDmT4iTUlo9+wYOfuluFPLX3/JONvuN7EW6ZPB7AUpyUmRb6wqyRDWQjgS6de8QBBSYo4H9mfvk0HK3UULMpsOaEiufAA0PUJGGrzQSyaAtQ4DJ3zPTbptnEyO0GphOFPHzflbHu+1CU3XFKCclvRoewTDS3 D8U6fkA1 IvbHtEO4/nJQ78gtVgZP8tLfd8lVeEwvlLwJJwuD0EsB4wShhVQwz6nYQGP+oofObObxV+J/qe3QLCWVyo+dK/ayvn+q0z20oJ+mnMw/y6nunJEQsrzM79NrHvSAJ0y8MrsmG+okOChnVhJSGpTUJrfqls/1PYT6UW/zssZeZZXtDE19RbjSZZbATLt9OTvvSL0ePBBCpHRApV6eJ5AZ5kj4CQ/TExZyM18JwhQ/CU/EEv9Z5bnR+xtHdwc9XS1XmTEWWMnhkvNjS7qC2gkNwl89HlDPa3rurnnBLXWWi1Y+AGIkUESuCDME2DWyVkOF3e+9115EZ6F/Zt7rLXksC1EUsRZIki4UyYLy1xJu6qFCJjpvlbeL8iX23xhH50A12PkaD9tX8FrC56B735BPV9XjnudtHuyMyrrmDja3q2THqbd8ouzUueXZk/xc71TTnKEsWzyxRjr4bnxPDJxAvk7pnMTkhWqYIXrX3CQDlsNPD1PbtQFcv5EAayQXlhSydkY1rY2BNlT5AZUUy+T1bDunqhpLl2tKNG6WrEPtdV7uJB984pu/Zlcd47BCQDSynYE9R4i0Ms677WRW5gqYdGMaYoQlcYaXD9Q2l+B3Bufr742McyMhpXbaDQP3YIlAlo7DqxPTmdBaZU1/Cj6hgG+YYe2E6fnlvnpZfJPq1vEdf6D9Dk3GLjEuOc8rNEyfoEKl44HRRl7MsRhoHSalxzzKNe9Olkr+2xzJ3btdBZZviC9aAv58YQgUclMzL/182pdoAf/UTyNl63Zdjef56Chi4rgC1hHol2lCWB1GtCCtqvc54yNHn/FWN2ABnNQEbDqFkC01xph4q4nbMrSfoV4XGD5xM4UJWbsHDNz8xS/2J4FMg7zYjTIBNHOwEfZ8UATJjaF6gb7V3UViFyT3crjhYqhDwMb+3b7c+wAadFIKkX9E2n4G1gAVBTpZvzCIsmaMiGu9JP60vobkfqFq/w4S0jsZG qenk8UCU A3pv89ZUasG5vMAHrwLXMbckqrNaFzLzyvtmi6wKc2XY8d+oCPciq5IczuDM6JMi6X7B0kF8tt/QwQuWx4TZvXEuo5fYlM2SLkm98mF3i+q1CNLHH2CZdscz9WZJY1hqF3NGzX4hlgBxvyzCyGOTeIO7Py+C9W8qBl3HWmGqMj0+c77y2zFr0ih/uD/6P9qvKuZgHcmzzLuviI6sj9kI9uGNL2vMZuvzAGGcibma1q4OPT7N/KCzx20kgpah6GsqLGCRdSePfollt5Vn9qIC0oIkdu64B8m92nUaIxnjuu68bWEiTutzcuMtOMkngLLslXloyj/xF0eehDZQZSOKbR68wBdasGEC4VLKKjGEU30= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hello, syzbot found the following issue on: HEAD commit: 317c7bc0ef03 Merge tag 'mmc-v6.9-rc1' of git://git.kernel... git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1060bd41180000 kernel config: https://syzkaller.appspot.com/x/.config?x=43f1e0cbdb852271 dashboard link: https://syzkaller.appspot.com/bug?extid=186522670e6722692d86 compiler: arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 userspace arch: arm syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15751129180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10136341180000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/8ead8862021c/non_bootable_disk-317c7bc0.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/49458dc4ddf2/vmlinux-317c7bc0.xz kernel image: https://storage.googleapis.com/syzbot-assets/031f516e5544/zImage-317c7bc0.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+186522670e6722692d86@syzkaller.appspotmail.com 8<--- cut here --- Unable to handle kernel paging request at virtual address ffffffe9 when write [ffffffe9] *pgd=80000080007003, *pmd=deffd003, *pte=00000000 Internal error: Oops: a07 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 3001 Comm: syz-executor291 Not tainted 6.9.0-rc1-syzkaller #0 Hardware name: ARM-Versatile Express PC is at copy_from_kernel_nofault mm/maccess.c:38 [inline] PC is at copy_from_kernel_nofault+0xb8/0x12c mm/maccess.c:24 LR is at copy_from_kernel_nofault+0x24/0x12c mm/maccess.c:31 pc : [<804361f0>] lr : [<8043615c>] psr: a0000013 sp : df96dc90 ip : df96dc90 fp : df96dcac r10: 00000000 r9 : df96dd40 r8 : ffffffe9 r7 : 83d33c00 r6 : 00000005 r5 : ffffffe9 r4 : ffffffe9 r3 : fffffff2 r2 : 00000000 r1 : 00000005 r0 : 00000001 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 8434d080 DAC: 00000000 Register r0 information: non-paged memory Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: non-paged memory Register r6 information: non-paged memory Register r7 information: slab task_struct start 83d33c00 pointer offset 0 size 3072 Register r8 information: non-paged memory Register r9 information: 2-page vmalloc region starting at 0xdf96c000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdf96c000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r12 information: 2-page vmalloc region starting at 0xdf96c000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Process syz-executor291 (pid: 3001, stack limit = 0xdf96c000) Stack: (0xdf96dc90 to 0xdf96e000) dc80: df96ddb8 ffffffe9 00000005 ffffffff dca0: df96dccc df96dcb0 8037c428 80436144 df96ddb8 00000000 8037c40c ffffffff dcc0: df96dd64 df96dcd0 7f011aa0 8037c418 ffffffe9 df96dd40 802ff648 81182b54 dce0: df96dd64 df96dd30 35702575 00000000 828c0a94 40000013 00000000 00000000 dd00: df96dcf0 00000000 df96dd74 df96dd18 df96dd2c df96dd20 81182b64 81898a78 dd20: df96dd64 df96dd30 802ff648 81182b54 ffffffe9 df96dd40 00000005 00000000 dd40: df96ddb8 00000000 df969000 842879c0 df969030 df96de30 df96ddfc df96dd68 dd60: 8149c734 7f011a00 804d0184 8089c164 00000000 83d33c00 804b4cdc 804d0124 dd80: 8260ca3c df96de30 00000001 df96de2c 80468494 00000000 df96ddb8 00000000 dda0: 00000001 00000000 19df2b20 00000014 00000000 00000000 df969000 00000000 ddc0: 00000000 00000000 84497800 f655f23e df96ddfc 842879c0 00000000 df96dec0 dde0: 83f79c00 84497800 00000000 0000000e df96de64 df96de00 8149d6a0 8149c5d0 de00: df96de30 00000000 00000000 df96de98 20000080 00000000 df969000 00000000 de20: 828ffe80 82fe0000 8051cdd4 00000000 00000000 f655f23e 80395130 df969000 de40: 00000028 df96de98 0000000a 20000080 00000028 00000000 df96df8c df96de68 de60: 8039c858 8149d388 81c66394 84342c0c fcd9275f 00a00000 20000000 83d33c00 de80: df96dee0 df96dfb0 df96dea4 df96de98 8089c348 df96dee0 20000080 00000000 dea0: 83d33c00 df96ded0 00000008 00000000 00000008 80426e10 df96deec df96dec8 dec0: 00000003 02000000 0000000e 00000055 20000140 00000000 20000380 00000000 dee0: 00000000 04000000 00000000 00000000 00000000 00000000 00000000 00000000 df00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 df20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 df40: 00000000 00000000 00000000 00000000 00000000 00000000 20000000 f655f23e df60: 80216078 ffffffff 00000000 0008e050 00000182 80200288 83d33c00 00000182 df80: df96dfa4 df96df90 8039dd98 8039b934 20000080 00000000 00000000 df96dfa8 dfa0: 80200060 8039dd78 ffffffff 00000000 0000000a 20000080 00000028 00000000 dfc0: ffffffff 00000000 0008e050 00000182 20000100 00000000 00000001 00003a97 dfe0: 7ec66c70 7ec66c60 00010748 0002e890 00000010 0000000a 00000000 00000000 Call trace: [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (bpf_probe_read_kernel_common include/linux/bpf.h:2909 [inline]) [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (____bpf_probe_read_kernel kernel/trace/bpf_trace.c:240 [inline]) [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (bpf_probe_read_kernel+0x1c/0x44 kernel/trace/bpf_trace.c:237) r7:ffffffff r6:00000005 r5:ffffffe9 r4:df96ddb8 [<8037c40c>] (bpf_probe_read_kernel) from [<7f011aa0>] (bpf_prog_244768d4818575ac+0xac/0xc0) r7:ffffffff r6:8037c40c r5:00000000 r4:df96ddb8 [<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]) [<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (__bpf_prog_run include/linux/filter.h:657 [inline]) [<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_prog_run include/linux/filter.h:664 [inline]) [<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_test_run+0x170/0x388 net/bpf/test_run.c:425) r9:df96de30 r8:df969030 r7:842879c0 r6:df969000 r5:00000000 r4:df96ddb8 [<8149c5c4>] (bpf_test_run) from [<8149d6a0>] (bpf_prog_test_run_skb+0x324/0x6cc net/bpf/test_run.c:1058) r10:0000000e r9:00000000 r8:84497800 r7:83f79c00 r6:df96dec0 r5:00000000 r4:842879c0 [<8149d37c>] (bpf_prog_test_run_skb) from [<8039c858>] (bpf_prog_test_run kernel/bpf/syscall.c:4240 [inline]) [<8149d37c>] (bpf_prog_test_run_skb) from [<8039c858>] (__sys_bpf+0xf30/0x1ef0 kernel/bpf/syscall.c:5649) r10:00000000 r9:00000028 r8:20000080 r7:0000000a r6:df96de98 r5:00000028 r4:df969000 [<8039b928>] (__sys_bpf) from [<8039dd98>] (__do_sys_bpf kernel/bpf/syscall.c:5738 [inline]) [<8039b928>] (__sys_bpf) from [<8039dd98>] (sys_bpf+0x2c/0x48 kernel/bpf/syscall.c:5736) r10:00000182 r9:83d33c00 r8:80200288 r7:00000182 r6:0008e050 r5:00000000 r4:ffffffff [<8039dd6c>] (sys_bpf) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66) Exception stack(0xdf96dfa8 to 0xdf96dff0) dfa0: ffffffff 00000000 0000000a 20000080 00000028 00000000 dfc0: ffffffff 00000000 0008e050 00000182 20000100 00000000 00000001 00003a97 dfe0: 7ec66c70 7ec66c60 00010748 0002e890 Code: 9a000007 e3a03000 e4942000 e3530000 (e5852000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 9a000007 bls 0x24 4: e3a03000 mov r3, #0 8: e4942000 ldr r2, [r4], #0 c: e3530000 cmp r3, #0 * 10: e5852000 str r2, [r5] <-- trapping instruction --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup