From: syzbot <syzbot+d3cb3281a93037d5a02e@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, bigeasy@linutronix.de,
bpf@vger.kernel.org, brauner@kernel.org, david@redhat.com,
ebiederm@xmission.com, linux-kernel@vger.kernel.org,
linux-usb@vger.kernel.org, luto@kernel.org,
syzkaller-bugs@googlegroups.com, tglx@linutronix.de
Subject: [syzbot] usb-testing boot error: general protection fault in copy_process
Date: Wed, 07 Sep 2022 07:56:34 -0700 [thread overview]
Message-ID: <000000000000e33bb005e817847a@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 4e55e22d3d9a USB: hcd-pci: Drop the unused id parameter fr..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=15ba5d7d080000
kernel config: https://syzkaller.appspot.com/x/.config?x=3cb39b084894e9a5
dashboard link: https://syzkaller.appspot.com/bug?extid=d3cb3281a93037d5a02e
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/26cea6f2cda1/disk-4e55e22d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/00aba451c439/vmlinux-4e55e22d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d3cb3281a93037d5a02e@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xffff000000000300: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0xfff8200000001800-0xfff8200000001807]
CPU: 0 PID: 36 Comm: kworker/u4:2 Not tainted 6.0.0-rc1-syzkaller-00049-g4e55e22d3d9a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
Workqueue: events_unbound call_usermodehelper_exec_work
RIP: 0010:freelist_dereference mm/slub.c:347 [inline]
RIP: 0010:get_freepointer mm/slub.c:354 [inline]
RIP: 0010:get_freepointer_safe mm/slub.c:368 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:3211 [inline]
RIP: 0010:slab_alloc mm/slub.c:3251 [inline]
RIP: 0010:__kmem_cache_alloc_lru mm/slub.c:3258 [inline]
RIP: 0010:kmem_cache_alloc+0x15d/0x4a0 mm/slub.c:3268
Code: 51 08 48 8b 01 48 83 79 10 00 48 89 04 24 0f 84 7c 02 00 00 48 85 c0 0f 84 73 02 00 00 49 8b 3c 24 41 8b 4c 24 28 40 f6 c7 0f <48> 8b 1c 08 0f 85 7b 02 00 00 48 8d 4a 08 65 48 0f c7 0f 0f 94 c0
RSP: 0000:ffffc900004778f0 EFLAGS: 00010246
RAX: ffff000000000000 RBX: 0000000000000000 RCX: 0000000000000300
RDX: 0000000000000580 RSI: 0000000000000dc0 RDI: 000000000003e300
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff88de9657
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88810016d500
R13: 0000000000000dc0 R14: ffffffff811486fe R15: 0000000000000dc0
FS: 0000000000000000(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823ffff000 CR3: 0000000007825000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kmem_cache_zalloc include/linux/slab.h:723 [inline]
copy_signal kernel/fork.c:1689 [inline]
copy_process+0x256e/0x6de0 kernel/fork.c:2253
kernel_clone+0xe7/0xab0 kernel/fork.c:2673
user_mode_thread+0xad/0xe0 kernel/fork.c:2742
call_usermodehelper_exec_work kernel/umh.c:174 [inline]
call_usermodehelper_exec_work+0xcc/0x180 kernel/umh.c:160
process_one_work+0x991/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2ea/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
Modules linked in:
----------------
Code disassembly (best guess):
0: 51 push %rcx
1: 08 48 8b or %cl,-0x75(%rax)
4: 01 48 83 add %ecx,-0x7d(%rax)
7: 79 10 jns 0x19
9: 00 48 89 add %cl,-0x77(%rax)
c: 04 24 add $0x24,%al
e: 0f 84 7c 02 00 00 je 0x290
14: 48 85 c0 test %rax,%rax
17: 0f 84 73 02 00 00 je 0x290
1d: 49 8b 3c 24 mov (%r12),%rdi
21: 41 8b 4c 24 28 mov 0x28(%r12),%ecx
26: 40 f6 c7 0f test $0xf,%dil
* 2a: 48 8b 1c 08 mov (%rax,%rcx,1),%rbx <-- trapping instruction
2e: 0f 85 7b 02 00 00 jne 0x2af
34: 48 8d 4a 08 lea 0x8(%rdx),%rcx
38: 65 48 0f c7 0f cmpxchg16b %gs:(%rdi)
3d: 0f 94 c0 sete %al
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
reply other threads:[~2022-09-07 14:57 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000e33bb005e817847a@google.com \
--to=syzbot+d3cb3281a93037d5a02e@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=bigeasy@linutronix.de \
--cc=bpf@vger.kernel.org \
--cc=brauner@kernel.org \
--cc=david@redhat.com \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=luto@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.