From: syzbot <syzbot+27fb2fab2e8cd029d352@syzkaller.appspotmail.com>
To: brauner@kernel.org, ebiederm@xmission.com, keescook@chromium.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
oleg@redhat.com, syzkaller-bugs@googlegroups.com,
tglx@linutronix.de
Subject: [syzbot] usb-testing boot error: BUG: unable to handle kernel paging request in put_prev_entity
Date: Mon, 22 Aug 2022 13:31:32 -0700 [thread overview]
Message-ID: <0000000000004ef49705e6da5557@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: ad57410d231d usb: gadget: rndis: use %u instead of %d to p..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=15f8653d080000
kernel config: https://syzkaller.appspot.com/x/.config?x=3cb39b084894e9a5
dashboard link: https://syzkaller.appspot.com/bug?extid=27fb2fab2e8cd029d352
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+27fb2fab2e8cd029d352@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: ffffdc0000000001
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 100026067 P4D 100026067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 251 Comm: kworker/u4:2 Not tainted 6.0.0-rc1-syzkaller-00005-gad57410d231d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:__rb_insert lib/rbtree.c:115 [inline]
RIP: 0010:rb_insert_color+0x6d/0x7a0 lib/rbtree.c:436
Code: 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 48 05 00 00 48 8b 2b 40 f6 c5 01 0f 85 81 01 00 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 01 05 00 00 4c 8b 75 08 49 39 de 0f 84 6d 01
RSP: 0000:ffffc9000157fc10 EFLAGS: 00010802
RAX: 1fffe00000000001 RBX: ffff88810e6e0090 RCX: 1ffff11021cb53a4
RDX: 1ffff11021cb53a2 RSI: ffff8881f6937bf0 RDI: ffff000000000008
RBP: ffff000000000000 R08: ffff88810e5a9d10 R09: ffff8881f6937bc0
R10: ffffffff89ca5057 R11: 0000000000000001 R12: ffff88810e5a9d10
R13: dffffc0000000000 R14: dffffc0000000000 R15: 000000003aefdc00
FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffdc0000000001 CR3: 0000000007825000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rb_insert_color_cached include/linux/rbtree.h:114 [inline]
rb_add_cached include/linux/rbtree.h:183 [inline]
__enqueue_entity kernel/sched/fair.c:629 [inline]
put_prev_entity+0x1d4/0x4c0 kernel/sched/fair.c:4722
pick_next_task_fair+0xa42/0xf80 kernel/sched/fair.c:7443
__pick_next_task kernel/sched/core.c:5804 [inline]
pick_next_task kernel/sched/core.c:6313 [inline]
__schedule+0x3a3/0x26f0 kernel/sched/core.c:6458
preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6663
__cond_resched+0x13/0x20 kernel/sched/core.c:8299
might_resched include/linux/kernel.h:110 [inline]
percpu_down_read include/linux/percpu-rwsem.h:49 [inline]
cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:740 [inline]
exit_signals+0x26/0x8b0 kernel/signal.c:2949
do_exit+0x50d/0x2930 kernel/exit.c:751
call_usermodehelper_exec_async+0x418/0x580 kernel/umh.c:125
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
Modules linked in:
CR2: ffffdc0000000001
---[ end trace 0000000000000000 ]---
RIP: 0010:__rb_insert lib/rbtree.c:115 [inline]
RIP: 0010:rb_insert_color+0x6d/0x7a0 lib/rbtree.c:436
Code: 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 48 05 00 00 48 8b 2b 40 f6 c5 01 0f 85 81 01 00 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 01 05 00 00 4c 8b 75 08 49 39 de 0f 84 6d 01
RSP: 0000:ffffc9000157fc10 EFLAGS: 00010802
RAX: 1fffe00000000001 RBX: ffff88810e6e0090 RCX: 1ffff11021cb53a4
RDX: 1ffff11021cb53a2 RSI: ffff8881f6937bf0 RDI: ffff000000000008
RBP: ffff000000000000 R08: ffff88810e5a9d10 R09: ffff8881f6937bc0
R10: ffffffff89ca5057 R11: 0000000000000001 R12: ffff88810e5a9d10
R13: dffffc0000000000 R14: dffffc0000000000 R15: 000000003aefdc00
FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffdc0000000001 CR3: 0000000007825000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 89 d8 mov %rbx,%rax
3: 48 c1 e8 03 shr $0x3,%rax
7: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
c: 0f 85 48 05 00 00 jne 0x55a
12: 48 8b 2b mov (%rbx),%rbp
15: 40 f6 c5 01 test $0x1,%bpl
19: 0f 85 81 01 00 00 jne 0x1a0
1f: 48 8d 7d 08 lea 0x8(%rbp),%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 0f 85 01 05 00 00 jne 0x536
35: 4c 8b 75 08 mov 0x8(%rbp),%r14
39: 49 39 de cmp %rbx,%r14
3c: 0f .byte 0xf
3d: 84 6d 01 test %ch,0x1(%rbp)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
reply other threads:[~2022-08-22 20:31 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000004ef49705e6da5557@google.com \
--to=syzbot+27fb2fab2e8cd029d352@syzkaller.appspotmail.com \
--cc=brauner@kernel.org \
--cc=ebiederm@xmission.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.