From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65828CD1292 for ; Thu, 4 Apr 2024 22:57:20 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id F1D396B0098; Thu, 4 Apr 2024 18:57:19 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id ECCD56B0099; Thu, 4 Apr 2024 18:57:19 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D6DF16B009C; Thu, 4 Apr 2024 18:57:19 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id B6DA86B0098 for ; Thu, 4 Apr 2024 18:57:19 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 493BF1C1332 for ; Thu, 4 Apr 2024 22:57:19 +0000 (UTC) X-FDA: 81973362198.11.D93399B Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) by imf12.hostedemail.com (Postfix) with ESMTP id 5692940013 for ; Thu, 4 Apr 2024 22:57:17 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=jatFDqAO; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf12.hostedemail.com: domain of alexei.starovoitov@gmail.com designates 209.85.221.44 as permitted sender) smtp.mailfrom=alexei.starovoitov@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712271437; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Q8Y/0FBc6X/EtKXau0Qf+nlfqNdcdxQlAMfTvPoQeI0=; b=2BsJQLSNXDwRxVLB2mgXFYzoHA3CucTxr1qvAQgmxipyGrpJvWUm84wXS4v1KH6Ha2ToFx gPzn6u/rRWBE/Uq4AmJ6gef2PKP58opPm40uSyuNvpYOs9iqqVTQzPwJiK664flWVMN8Ia scSYySIRj1uLkZLu0LTLznniaTNUdg8= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=jatFDqAO; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf12.hostedemail.com: domain of alexei.starovoitov@gmail.com designates 209.85.221.44 as permitted sender) smtp.mailfrom=alexei.starovoitov@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712271437; a=rsa-sha256; cv=none; b=S81ylmhBwssDaTBrztKKuWjuQwUBwYlyEXO8BLATj71S+72FtBAwtVyqWrGTvVj25qri5/ hoNdnedPKG0Xfy/7WPcCKh/YRRWh1O+CH4fPz/77rJYvGLhQXowRmaN7a10K36v/YIYFMP EXRs/4IDjqB0LO8Jwz/ZWpgbdguFLhE= Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-33ddd1624beso866376f8f.1 for ; Thu, 04 Apr 2024 15:57:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1712271436; x=1712876236; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=Q8Y/0FBc6X/EtKXau0Qf+nlfqNdcdxQlAMfTvPoQeI0=; b=jatFDqAO2bXEQ4BPk8OFkYH6TfqWI65JHCfzobGrlqYNEYJPo0xapYefKD2reN9bvV dNonV3XiXnzPuBsl4BFm0Q6Mh58GnuBAVOCtfFzKPLhMP3ukeCUqrX3E7UVk0lBbUU8V qUcUG+dRJ3LviBpZM7zN/enFuN3K7L3dq7x73aAaaTNIBMKP+Np1IzmkajSrudCn3wle yHCMHOoYHaH56RGxrnie3NNKPA8g8t8fOF0Fxhakxm4K7oKKvDOoqvdzP5aqB9pK7ckq VOtGt/4rauKenczNsegtWsT3HmWMrofITAReXaCqfPcfzrBLRukCoI91O6P4Y70S1VmM FjyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712271436; x=1712876236; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Q8Y/0FBc6X/EtKXau0Qf+nlfqNdcdxQlAMfTvPoQeI0=; b=xSyqs55GqrJfirgVmk2bBsFs8oukiAjKBZxjd3QCOGaQCCS6BudK8JP3S3g6KiJG9r wWNIJWqOsB25Uxa7i2tXXSBDKJnIRY/u+U70nPhJCQHS+5FC5drysFhdNh/vU2DNOkLI 0Z4wQcFEbGqDBxXQyjtOQ0hxGjslymi+7BDjhpgP6Cb/lADPs3AC2nOa2snTubidgl2t +qd9wuaIuEDz+Xd7comwOkNhDCD/oFbYd7VD/wdYVqbxyPeYivN87VGHV0bmwR+w8pSK bcZoE+UvdTYZeAGMq98YrEhCFCdoVzBWpDZtQPlf550gQ/tlHgpOoiexFi3DWz+YYR8Y nB1g== X-Forwarded-Encrypted: i=1; AJvYcCW0GdyUQ0P1cQnYlGGUqno/UTjtIGfaaPDHmSsBZAEaT1skJFm4EvpOCvDi2xpcjF3DEGP6b+SDg6CLKNeAeIJSO3I= X-Gm-Message-State: AOJu0Ywh214ptD/YBjeCJA6WLIasYQFpj7nDkFv8XBZhSogdIXajPMZd wfGXl6E8Ah0cge/pEMJ7s21xiQeA5g21GvSjo+m7w4jXUiHXHbcT8Ix86eYTSXrUDsBRY9ALixQ 7r6NlHX6SFuMAn8eYRQtXwVkAFAI= X-Google-Smtp-Source: AGHT+IF3Nh4FYYKX55U6jOpOab6/MctiH1JFvCuQfG6hhtIN2gwBYUeuBqo9lbWfS+doAekfX0VqbiOdUpqMUH+sGIY= X-Received: by 2002:adf:e742:0:b0:341:b5ca:9e9c with SMTP id c2-20020adfe742000000b00341b5ca9e9cmr535343wrn.25.1712271435557; Thu, 04 Apr 2024 15:57:15 -0700 (PDT) MIME-Version: 1.0 References: <000000000000e9a8d80615163f2a@google.com> <20240403184149.0847a9d614f11b249529fd02@linux-foundation.org> In-Reply-To: <20240403184149.0847a9d614f11b249529fd02@linux-foundation.org> From: Alexei Starovoitov Date: Thu, 4 Apr 2024 15:57:04 -0700 Message-ID: Subject: Re: [syzbot] [mm?] BUG: unable to handle kernel paging request in copy_from_kernel_nofault (2) To: Andrew Morton , linux-arm-kernel Cc: syzbot , LKML , linux-mm , syzkaller-bugs , bpf Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 5692940013 X-Stat-Signature: s3we8tummeksr79pbabm4fnzris76ty1 X-HE-Tag: 1712271437-112279 X-HE-Meta: U2FsdGVkX189dpmIK76E9Evhf37Ylog0S6IpC3N+tVFkm98J/cjZrv1iAEVeVhk7+HvjXVhig+LPjVlR5OYmy2gwPrduMgFqMj9NPYFhYeFpwDelsVgdPKBXXAxVll8qf32BcbKjKPPmplxd1yJFXCH7QwG0fPzzcZ1Y4vYWThh5F++aQglpM9yLkbA8w8mQIeoelMmtmcfCEInSbVLPWN1/zB346cF2vT0kpgbl4ylttXf7YhiOfr7V2yo9oXOQA+ay4DrzcxBf7qPq5cxdwz6+BwzdOaL72rfzh7SdOwt1ubiESTw7Q4Fj9kfvFJF6Qx26GAo3vEh4Mgg4MWUE7cvvgDHONTmUYVdWXpj13AWECu9AOlmEmqD8iOrfWd3hIQt4wMmQtnefjbZuJYYEZqfNYnnEwOYdAsAXdoM1fEFg7oRhrWxPFkyoZFViLq76Z0r4gJwiB6pNMCSaUg20WUDYNcY5RaSuHTHIHvUwTB1fYczEpQsztUkxd1gBDKPcqCDeIQKpxQx/IhrXcyBv1BHxfBZLE6VY2kIEvuRtC5vcQNepiEl1o/IoD4cjbSqR/1ZXXJR2vQtFXjky35zydmvK7kCoopw12/HntNuOYrz8JGKxdHNa9o8H7elRnSmJKNHeMIJZY4GmVFawSuYOKTNFN3Xd68Er2xH7L1oDm5o+rbOfO8dB13PXS16zVrXnBmY6eKWnUdcISRPuzAfh0scYa2V5fSKsfh8jQR0eKcYZGwF8gZoBWGUK8pGOvK8X3HarfSUo3tYLHS7FWlhXN82XZFlfgee6wFCz2HJlxW+kQEhFdnJMD8KEMRfmDtQye7VFZSxy8p7cYt+X2snKP9nM8i/taSTiuFd+8U6pLyW4pE1bvNYKfcUNpZOWBlI3eu1SKSk3LZF9Mty2j1NGhsUKtkVlL4YNAK/RQO29DBxz7+AmrtQFr07RgAdKgJ0dMgCPVYZ8Eimsi+G/00T PjiOyB6z SNq6fS/g3jbp681Sl4FpQO9WuDZUni0LqWNwTjmBh+1Pbi1/tDaI9cxsgAv/hYTLK/VE53VuE/VHQ5Mv5CHh7nDi18V7lC3dw4swVd5OOhli/K9mAVVA7+7lT1qn/lq8XyzH8gzoPErEWcG3Pfx3P1wN11GXUXQwppTnLFexKCrwQBoHhftP1d3NyhZcUvB4UGHeyY1CO2OzV31OOJUhre9lE7sllRxSZUFeSNBCVL2hcnzc/SUzICjXUzJyzoXABUuwUeqzqM53TXZSMIJeqnb/aRZKS1LAa/8/5e3hP1SqiY+v6EKrpfNCpcgDi3WXsawuBc7X6zOPzdaa+f6r0w5XlHV+ixVRCt7lZiPiFoMmC2PTtuC3WWw7cgYI/qclWtAjeaiE5mhqrLpDHeK2RMSHkG3gGW/Xh0i/Fay870/mq/SNhnvsfN2SkmtAcw90STY4k7LbeC0xJCWVC15qFNXvFsfF0WoqrT4sRqftjE+7Odyuvr2nS34csSp3TY1p2pkNBipZXiWAttWS+/MWEeFYCDRoFCYC073G3R1NivFFSkdSeGWXKS0Q1rprEQ99n1ZZG3JyA/1xEwrXunnGfKEVLjDncl+gttYB9qjAt6DNiwmx3BOyRVB3KpkFaew1Vlcxba8/H9nFNURiCiLLsEs2nFdSRd5DciBgSTwcMoS80cPaBXGuIqXb70lavMDrsfEB3cLGQOmzeAKd3X3sDsuYsQwyvH07c+p27QffcRatSu//zZeZlzpGBfkMNBlvx6UkoDOU/Njj/qJI2uWO1llc+8wwHHuDeEJp3jmuOxLxncUIkJMj9Q5bDaSqQkOl0WVaHPZRpK3PawqUm+X0ePWSnCRWY5o1R4uVg1jBeG17vcOl9OD1cishKAJXWZpIsL5UefRl+aahVQTjqMJ6X2g61XFJjNzLQCXAry15MVwBocpNu131RGYnodPklfVlpyU88Sx1hwgM9HiA8DmBDlLxRyzIx M+LD8I32 oY0uJykq1jWyNvVkP4OTuP8D9jX4MTPRH1v2MNffjinOruEnbkBKSz/5bFaCXh/uXEIr1Yls7PS1VrymQrexux/98LwHPctOC8bv6xg12ZitouMVbYl8BuwzNbwtckEHddi5HAtsAcxiVmCS7vPz4I0z7FhACYqh8Tn/ed1GmczuO/1V+4yNs0c4ViSFdHAiwCKt+uy/LTpSSZedPR0L2fWaimUte+guZRUfs4VCDifIzeAQnEGKGU8BAvbPh/CQ8hHwG0+2sxNFI8K8rR58SA5IW+ZdqOLddCNzTx/jkUY= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, Apr 3, 2024 at 6:56=E2=80=AFPM Andrew Morton wrote: > > On Mon, 01 Apr 2024 22:19:25 -0700 syzbot wrote: > > > Hello, > > Thanks. Cc: bpf@vger.kernel.org I suspect the issue is not on bpf side. Looks like the bug is somewhere in arm32 bits. copy_from_kernel_nofault() is called from lots of places. bpf is just one user that is easy for syzbot to fuzz. Interestingly arm defines copy_from_kernel_nofault_allowed() that should have filtered out user addresses. In this case ffffffe9 is probably a kernel address? But the kernel is doing a write? Which makes no sense, since copy_from_kernel_nofault is probe reading. arm folks, pls take a look. > > syzbot found the following issue on: > > > > HEAD commit: 317c7bc0ef03 Merge tag 'mmc-v6.9-rc1' of git://git.kern= el... > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=3D1060bd41180= 000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=3D43f1e0cbdb8= 52271 > > dashboard link: https://syzkaller.appspot.com/bug?extid=3D186522670e672= 2692d86 > > compiler: arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0, GNU ld= (GNU Binutils for Debian) 2.40 > > userspace arch: arm > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=3D157511291= 80000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=3D10136341180= 000 > > > > Downloadable assets: > > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets= /8ead8862021c/non_bootable_disk-317c7bc0.raw.xz > > vmlinux: https://storage.googleapis.com/syzbot-assets/49458dc4ddf2/vmli= nux-317c7bc0.xz > > kernel image: https://storage.googleapis.com/syzbot-assets/031f516e5544= /zImage-317c7bc0.xz > > > > IMPORTANT: if you fix the issue, please add the following tag to the co= mmit: > > Reported-by: syzbot+186522670e6722692d86@syzkaller.appspotmail.com > > > > 8<--- cut here --- > > Unable to handle kernel paging request at virtual address ffffffe9 when= write > > [ffffffe9] *pgd=3D80000080007003, *pmd=3Ddeffd003, *pte=3D00000000 > > Internal error: Oops: a07 [#1] PREEMPT SMP ARM > > Modules linked in: > > CPU: 1 PID: 3001 Comm: syz-executor291 Not tainted 6.9.0-rc1-syzkaller = #0 > > Hardware name: ARM-Versatile Express > > PC is at copy_from_kernel_nofault mm/maccess.c:38 [inline] > > PC is at copy_from_kernel_nofault+0xb8/0x12c mm/maccess.c:24 > > LR is at copy_from_kernel_nofault+0x24/0x12c mm/maccess.c:31 > > pc : [<804361f0>] lr : [<8043615c>] psr: a0000013 > > sp : df96dc90 ip : df96dc90 fp : df96dcac > > r10: 00000000 r9 : df96dd40 r8 : ffffffe9 > > r7 : 83d33c00 r6 : 00000005 r5 : ffffffe9 r4 : ffffffe9 > > r3 : fffffff2 r2 : 00000000 r1 : 00000005 r0 : 00000001 > > Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none > > Control: 30c5387d Table: 8434d080 DAC: 00000000 > > Register r0 information: non-paged memory > > Register r1 information: non-paged memory > > Register r2 information: NULL pointer > > Register r3 information: non-paged memory > > Register r4 information: non-paged memory > > Register r5 information: non-paged memory > > Register r6 information: non-paged memory > > Register r7 information: slab task_struct start 83d33c00 pointer offset= 0 size 3072 > > Register r8 information: non-paged memory > > Register r9 information: 2-page vmalloc region starting at 0xdf96c000 a= llocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 > > Register r10 information: NULL pointer > > Register r11 information: 2-page vmalloc region starting at 0xdf96c000 = allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 > > Register r12 information: 2-page vmalloc region starting at 0xdf96c000 = allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 > > Process syz-executor291 (pid: 3001, stack limit =3D 0xdf96c000) > > Stack: (0xdf96dc90 to 0xdf96e000) > > dc80: df96ddb8 ffffffe9 00000005 ff= ffffff > > dca0: df96dccc df96dcb0 8037c428 80436144 df96ddb8 00000000 8037c40c ff= ffffff > > dcc0: df96dd64 df96dcd0 7f011aa0 8037c418 ffffffe9 df96dd40 802ff648 81= 182b54 > > dce0: df96dd64 df96dd30 35702575 00000000 828c0a94 40000013 00000000 00= 000000 > > dd00: df96dcf0 00000000 df96dd74 df96dd18 df96dd2c df96dd20 81182b64 81= 898a78 > > dd20: df96dd64 df96dd30 802ff648 81182b54 ffffffe9 df96dd40 00000005 00= 000000 > > dd40: df96ddb8 00000000 df969000 842879c0 df969030 df96de30 df96ddfc df= 96dd68 > > dd60: 8149c734 7f011a00 804d0184 8089c164 00000000 83d33c00 804b4cdc 80= 4d0124 > > dd80: 8260ca3c df96de30 00000001 df96de2c 80468494 00000000 df96ddb8 00= 000000 > > dda0: 00000001 00000000 19df2b20 00000014 00000000 00000000 df969000 00= 000000 > > ddc0: 00000000 00000000 84497800 f655f23e df96ddfc 842879c0 00000000 df= 96dec0 > > dde0: 83f79c00 84497800 00000000 0000000e df96de64 df96de00 8149d6a0 81= 49c5d0 > > de00: df96de30 00000000 00000000 df96de98 20000080 00000000 df969000 00= 000000 > > de20: 828ffe80 82fe0000 8051cdd4 00000000 00000000 f655f23e 80395130 df= 969000 > > de40: 00000028 df96de98 0000000a 20000080 00000028 00000000 df96df8c df= 96de68 > > de60: 8039c858 8149d388 81c66394 84342c0c fcd9275f 00a00000 20000000 83= d33c00 > > de80: df96dee0 df96dfb0 df96dea4 df96de98 8089c348 df96dee0 20000080 00= 000000 > > dea0: 83d33c00 df96ded0 00000008 00000000 00000008 80426e10 df96deec df= 96dec8 > > dec0: 00000003 02000000 0000000e 00000055 20000140 00000000 20000380 00= 000000 > > dee0: 00000000 04000000 00000000 00000000 00000000 00000000 00000000 00= 000000 > > df00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00= 000000 > > df20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00= 000000 > > df40: 00000000 00000000 00000000 00000000 00000000 00000000 20000000 f6= 55f23e > > df60: 80216078 ffffffff 00000000 0008e050 00000182 80200288 83d33c00 00= 000182 > > df80: df96dfa4 df96df90 8039dd98 8039b934 20000080 00000000 00000000 df= 96dfa8 > > dfa0: 80200060 8039dd78 ffffffff 00000000 0000000a 20000080 00000028 00= 000000 > > dfc0: ffffffff 00000000 0008e050 00000182 20000100 00000000 00000001 00= 003a97 > > dfe0: 7ec66c70 7ec66c60 00010748 0002e890 00000010 0000000a 00000000 00= 000000 > > Call trace: > > [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (bpf_probe_re= ad_kernel_common include/linux/bpf.h:2909 [inline]) > > [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (____bpf_prob= e_read_kernel kernel/trace/bpf_trace.c:240 [inline]) > > [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (bpf_probe_re= ad_kernel+0x1c/0x44 kernel/trace/bpf_trace.c:237) > > r7:ffffffff r6:00000005 r5:ffffffe9 r4:df96ddb8 > > [<8037c40c>] (bpf_probe_read_kernel) from [<7f011aa0>] (bpf_prog_244768= d4818575ac+0xac/0xc0) > > r7:ffffffff r6:8037c40c r5:00000000 r4:df96ddb8 > > [<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_dispatc= her_nop_func include/linux/bpf.h:1234 [inline]) > > [<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (__bpf_prog_= run include/linux/filter.h:657 [inline]) > > [<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_prog_ru= n include/linux/filter.h:664 [inline]) > > [<7f0119f4>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_test_ru= n+0x170/0x388 net/bpf/test_run.c:425) > > r9:df96de30 r8:df969030 r7:842879c0 r6:df969000 r5:00000000 r4:df96ddb= 8 > > [<8149c5c4>] (bpf_test_run) from [<8149d6a0>] (bpf_prog_test_run_skb+0x= 324/0x6cc net/bpf/test_run.c:1058) > > r10:0000000e r9:00000000 r8:84497800 r7:83f79c00 r6:df96dec0 r5:000000= 00 > > r4:842879c0 > > [<8149d37c>] (bpf_prog_test_run_skb) from [<8039c858>] (bpf_prog_test_r= un kernel/bpf/syscall.c:4240 [inline]) > > [<8149d37c>] (bpf_prog_test_run_skb) from [<8039c858>] (__sys_bpf+0xf30= /0x1ef0 kernel/bpf/syscall.c:5649) > > r10:00000000 r9:00000028 r8:20000080 r7:0000000a r6:df96de98 r5:000000= 28 > > r4:df969000 > > [<8039b928>] (__sys_bpf) from [<8039dd98>] (__do_sys_bpf kernel/bpf/sys= call.c:5738 [inline]) > > [<8039b928>] (__sys_bpf) from [<8039dd98>] (sys_bpf+0x2c/0x48 kernel/bp= f/syscall.c:5736) > > r10:00000182 r9:83d33c00 r8:80200288 r7:00000182 r6:0008e050 r5:000000= 00 > > r4:ffffffff > > [<8039dd6c>] (sys_bpf) from [<80200060>] (ret_fast_syscall+0x0/0x1c arc= h/arm/mm/proc-v7.S:66) > > Exception stack(0xdf96dfa8 to 0xdf96dff0) > > dfa0: ffffffff 00000000 0000000a 20000080 00000028 00= 000000 > > dfc0: ffffffff 00000000 0008e050 00000182 20000100 00000000 00000001 00= 003a97 > > dfe0: 7ec66c70 7ec66c60 00010748 0002e890 > > Code: 9a000007 e3a03000 e4942000 e3530000 (e5852000) > > ---[ end trace 0000000000000000 ]--- > > ---------------- > > Code disassembly (best guess): > > 0: 9a000007 bls 0x24 > > 4: e3a03000 mov r3, #0 > > 8: e4942000 ldr r2, [r4], #0 > > c: e3530000 cmp r3, #0 > > * 10: e5852000 str r2, [r5] <-- trapping instruction > > > > > > --- > > This report is generated by a bot. It may contain errors. > > See https://goo.gl/tpsmEJ for more information about syzbot. > > syzbot engineers can be reached at syzkaller@googlegroups.com. > > > > syzbot will keep track of this issue. See: > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > > > If the report is already addressed, let syzbot know by replying with: > > #syz fix: exact-commit-title > > > > If you want syzbot to run the reproducer, reply with: > > #syz test: git://repo/address.git branch-or-commit-hash > > If you attach or paste a git patch, syzbot will apply it before testing= . > > > > If you want to overwrite report's subsystems, reply with: > > #syz set subsystems: new-subsystem > > (See the list of subsystem names on the web dashboard) > > > > If the report is a duplicate of another one, reply with: > > #syz dup: exact-subject-of-another-report > > > > If you want to undo deduplication, reply with: > > #syz undup >