From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: syzbot <syzbot+838346b979830606c854@syzkaller.appspotmail.com>,
"Björn Töpel" <bjorn@kernel.org>,
"Stanislav Fomichev" <sdf@google.com>
Cc: Andrii Nakryiko <andrii@kernel.org>,
Alexei Starovoitov <ast@kernel.org>, bpf <bpf@vger.kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Eddy Z <eddyz87@gmail.com>, Hao Luo <haoluo@google.com>,
John Fastabend <john.fastabend@gmail.com>,
Jiri Olsa <jolsa@kernel.org>, KP Singh <kpsingh@kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Yonghong Song <yonghong.song@linux.dev>
Subject: Re: [syzbot] [bpf?] BUG: unable to handle kernel paging request in bpf_prog_ADDR (2)
Date: Fri, 19 Apr 2024 12:44:04 -0700 [thread overview]
Message-ID: <CAADnVQKoPfHC_o7jSa0W-gC=fqodmNDeoRO8eaTPN_NxBuXD6w@mail.gmail.com> (raw)
In-Reply-To: <0000000000004792a90615a1dde0@google.com>
On Mon, Apr 8, 2024 at 8:53 PM syzbot
<syzbot+838346b979830606c854@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12596223180000
> kernel config: https://syzkaller.appspot.com/x/.config?x=4d90a36f0cab495a
> dashboard link: https://syzkaller.appspot.com/bug?extid=838346b979830606c854
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=134ecbb5180000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=141a8b3d180000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/f6c04726a2ae/disk-fe46a7dd.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/09c26ce901ea/vmlinux-fe46a7dd.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/134acf7f5322/bzImage-fe46a7dd.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+838346b979830606c854@syzkaller.appspotmail.com
>
> BUG: unable to handle page fault for address: 0000001000000112
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 800000002e7b1067 P4D 800000002e7b1067 PUD 0
> Oops: 0000 [#1] PREEMPT SMP KASAN PTI
> CPU: 0 PID: 5060 Comm: syz-executor351 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> RIP: 0010:bpf_prog_a8e24a805b35c61b+0x19/0x1e
> Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 31 c0 48 8b 7f 18 <8b> 7f 00 c9 c3 cc cc cc cc cc cc 40 03 00 00 cc cc cc cc cc cc cc
> RSP: 0018:ffffc90003b07b30 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffffc90000ace048 RCX: ffff88802aa89e00
> RDX: 0000000000000000 RSI: ffffc90000ace048 RDI: 0000001000000112
> RBP: ffffc90003b07b30 R08: ffffffff81bf633c R09: 1ffffffff2595ca0
> R10: dffffc0000000000 R11: ffffffffa000095c R12: ffffc90000ace030
> R13: ffff88802ac3ae28 R14: dffffc0000000000 R15: ffff88802ac3ae28
> FS: 000055558f759380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000001000000112 CR3: 0000000077cfa000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
> __bpf_prog_run include/linux/filter.h:657 [inline]
> bpf_prog_run include/linux/filter.h:664 [inline]
> bpf_prog_run_array_cg kernel/bpf/cgroup.c:51 [inline]
> __cgroup_bpf_run_filter_setsockopt+0x6fa/0x1040 kernel/bpf/cgroup.c:1830
> do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293
> __sys_setsockopt+0x1ae/0x250 net/socket.c:2334
> __do_sys_setsockopt net/socket.c:2343 [inline]
> __se_sys_setsockopt net/socket.c:2340 [inline]
> __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340
> do_syscall_64+0xfb/0x240
> entry_SYSCALL_64_after_hwframe+0x6d/0x75
This one looks interesting.
But I cannot reproduce it.
Bjorn or Stan,
Could you take a look?
Probably a race in xdp dispatcher setup or the way cgroup-lsm
logic is doing it.
next prev parent reply other threads:[~2024-04-19 19:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-09 3:53 [syzbot] [bpf?] BUG: unable to handle kernel paging request in bpf_prog_ADDR (2) syzbot
2024-04-19 19:44 ` Alexei Starovoitov [this message]
2024-04-19 22:42 ` Stanislav Fomichev
2024-04-22 10:36 ` Björn Töpel
2024-04-22 16:03 ` Stanislav Fomichev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAADnVQKoPfHC_o7jSa0W-gC=fqodmNDeoRO8eaTPN_NxBuXD6w@mail.gmail.com' \
--to=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bjorn@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=syzbot+838346b979830606c854@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.