From: syzbot <syzbot+ea8b28e8dca42fc3bcbe@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] BUG: unable to handle kernel paging request in p9_client_disconnect
Date: Fri, 06 Jan 2023 23:01:14 -0800 [thread overview]
Message-ID: <0000000000008fd3b705f1a719c8@google.com> (raw)
In-Reply-To: <20230107063010.4809-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel paging request in percpu_ref_get_many
Unable to handle kernel paging request at virtual address 0000ffff64000000
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010e408000
[0000ffff64000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3885 Comm: dhcpcd-run-hook Not tainted 6.1.0-rc2-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __ref_is_percpu include/linux/percpu-refcount.h:174 [inline]
pc : percpu_ref_get_many+0x64/0x140 include/linux/percpu-refcount.h:204
lr : rcu_read_lock include/linux/rcupdate.h:739 [inline]
lr : percpu_ref_get_many+0x2c/0x140 include/linux/percpu-refcount.h:202
sp : ffff800012ddba00
x29: ffff800012ddba00 x28: 0000000000000005 x27: 00000000fffffff8
x26: ffff80000d2de560 x25: ffff80000d37d050 x24: 0000000000000000
x23: ffff0001fefcc560 x22: 0000000000000001 x21: ffff0000d04e0080
x20: 0000ffff64000000 x19: 0000000000000001 x18: fffffffffffffff5
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000002 x12: 0000000000000701
x11: ff808000095d1078 x10: 0000000000000000 x9 : ffff80000d2dd658
x8 : 0000000100000000 x7 : 0000000000000000 x6 : ffff800008579b18
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000000 x1 : ffff80000ce888e3 x0 : 0000000000000001
Call trace:
rcu_read_lock include/linux/rcupdate.h:739 [inline]
percpu_ref_get_many+0x64/0x140 include/linux/percpu-refcount.h:202
percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
obj_cgroup_get include/linux/memcontrol.h:779 [inline]
refill_obj_stock+0x8c/0x254 mm/memcontrol.c:3327
obj_cgroup_uncharge+0x14/0x20 mm/memcontrol.c:3394
memcg_slab_free_hook+0x118/0x188 mm/slab.h:569
slab_free mm/slub.c:3656 [inline]
kmem_cache_free+0xd8/0x3a4 mm/slub.c:3683
vm_area_free+0x38/0xe8 kernel/fork.c:485
remove_vma mm/mmap.c:144 [inline]
exit_mmap+0x1f0/0x390 mm/mmap.c:3108
__mmput+0x90/0x204 kernel/fork.c:1185
mmput+0x64/0xa0 kernel/fork.c:1207
exit_mm+0x16c/0x1c0 kernel/exit.c:516
do_exit+0x264/0xcac kernel/exit.c:807
__arm64_sys_exit_group+0x0/0x18 kernel/exit.c:950
__do_sys_exit_group kernel/exit.c:961 [inline]
__se_sys_exit_group kernel/exit.c:959 [inline]
__wake_up_parent+0x0/0x40 kernel/exit.c:959
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: 913af042 52805c81 39285909 97f0ad5f (f9400289)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 913af042 add x2, x2, #0xebc
4: 52805c81 mov w1, #0x2e4 // #740
8: 39285909 strb w9, [x8, #2582]
c: 97f0ad5f bl 0xffffffffffc2b588
* 10: f9400289 ldr x9, [x20] <-- trapping instruction
Tested on:
commit: 247f34f7 Linux 6.1-rc2
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1695d26e480000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa9bed8d6a8992a0
dashboard link: https://syzkaller.appspot.com/bug?extid=ea8b28e8dca42fc3bcbe
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=1606acd2480000
next parent reply other threads:[~2023-01-07 7:13 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20230107063010.4809-1-hdanton@sina.com>
2023-01-07 7:01 ` syzbot [this message]
[not found] <20230107234052.5103-1-hdanton@sina.com>
2023-01-07 23:58 ` [syzbot] BUG: unable to handle kernel paging request in p9_client_disconnect syzbot
[not found] <20230107121634.4974-1-hdanton@sina.com>
2023-01-07 21:35 ` syzbot
[not found] <20230107020600.4739-1-hdanton@sina.com>
2023-01-07 4:08 ` syzbot
2022-11-22 15:35 syzbot
2023-01-06 5:38 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000008fd3b705f1a719c8@google.com \
--to=syzbot+ea8b28e8dca42fc3bcbe@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.