From: syzbot <syzbot+600fef7c414ee7e2d71b@syzkaller.appspotmail.com>
To: davem@davemloft.net, kgraul@linux.ibm.com, kuba@kernel.org,
linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org,
netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: BUG: unable to handle kernel paging request in smc_nl_handle_smcr_dev
Date: Thu, 17 Dec 2020 00:58:09 -0800 [thread overview]
Message-ID: <000000000000de052a05b6a5301c@google.com> (raw)
In-Reply-To: <000000000000705ff605b5f2b656@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 5e60366d Merge tag 'fallthrough-fixes-clang-5.11-rc1' of g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17842c13500000
kernel config: https://syzkaller.appspot.com/x/.config?x=503d0089cd701d6d
dashboard link: https://syzkaller.appspot.com/bug?extid=600fef7c414ee7e2d71b
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17d8e41f500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17962287500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+600fef7c414ee7e2d71b@syzkaller.appspotmail.com
infiniband syz1: set active
infiniband syz1: added macvtap0
RDS/IB: syz1: added
smc: adding ib device syz1 with port count 1
smc: ib device syz1 port 1 has pnetid
BUG: unable to handle page fault for address: ffffffffffffff74
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD b48f067 P4D b48f067 PUD b491067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8688 Comm: syz-executor225 Not tainted 5.10.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:smc_set_pci_values net/smc/smc_core.h:396 [inline]
RIP: 0010:smc_nl_handle_smcr_dev.isra.0+0x4e1/0x1280 net/smc/smc_ib.c:422
Code: fc ff df 48 8d bb 74 ff ff ff 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 29 0d 00 00 <0f> b7 83 74 ff ff ff 48 8d bb 76 ff ff ff 48 89 fa 48 c1 ea 03 66
RSP: 0018:ffffc90001f87220 EFLAGS: 00010246
RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff74
RBP: ffffffff8d5ac140 R08: 0000000000000001 R09: ffffc90001f87308
R10: fffff520003f0e64 R11: 1ffffffff1e2db6c R12: 000000001b556831
R13: ffff888013e29540 R14: dffffc0000000000 R15: ffff88802a360014
FS: 00000000015bf880(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffff74 CR3: 000000002687b000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
smc_nl_prep_smcr_dev net/smc/smc_ib.c:469 [inline]
smcr_nl_get_device+0xdf/0x1f0 net/smc/smc_ib.c:481
genl_lock_dumpit+0x60/0x90 net/netlink/genetlink.c:623
netlink_dump+0x4d9/0xb90 net/netlink/af_netlink.c:2268
__netlink_dump_start+0x665/0x920 net/netlink/af_netlink.c:2373
genl_family_rcv_msg_dumpit+0x2af/0x310 net/netlink/genetlink.c:686
genl_family_rcv_msg net/netlink/genetlink.c:780 [inline]
genl_rcv_msg+0x43c/0x590 net/netlink/genetlink.c:800
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:672
____sys_sendmsg+0x6e8/0x810 net/socket.c:2336
___sys_sendmsg+0xf3/0x170 net/socket.c:2390
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2423
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x443fd9
Code: e8 6c 05 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffe909694e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443fd9
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004
RBP: 00007ffe909694f0 R08: 0000000001bbbbbb R09: 0000000001bbbbbb
R10: 0000000001bbbbbb R11: 0000000000000246 R12: 00007ffe90969500
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffffffffffff74
---[ end trace 45a80c2d5f347bdc ]---
RIP: 0010:smc_set_pci_values net/smc/smc_core.h:396 [inline]
RIP: 0010:smc_nl_handle_smcr_dev.isra.0+0x4e1/0x1280 net/smc/smc_ib.c:422
Code: fc ff df 48 8d bb 74 ff ff ff 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 29 0d 00 00 <0f> b7 83 74 ff ff ff 48 8d bb 76 ff ff ff 48 89 fa 48 c1 ea 03 66
RSP: 0018:ffffc90001f87220 EFLAGS: 00010246
RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff74
RBP: ffffffff8d5ac140 R08: 0000000000000001 R09: ffffc90001f87308
R10: fffff520003f0e64 R11: 1ffffffff1e2db6c R12: 000000001b556831
R13: ffff888013e29540 R14: dffffc0000000000 R15: ffff88802a360014
FS: 00000000015bf880(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffff74 CR3: 000000002687b000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
prev parent reply other threads:[~2020-12-17 8:58 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-08 12:02 BUG: unable to handle kernel paging request in smc_nl_handle_smcr_dev syzbot
2020-12-17 8:58 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000de052a05b6a5301c@google.com \
--to=syzbot+600fef7c414ee7e2d71b@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=kgraul@linux.ibm.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.