From: syzbot <syzbot+4089e577072948ac5531@syzkaller.appspotmail.com>
To: gianf.trad@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [erofs?] BUG: unable to handle kernel NULL pointer dereference in read_cache_folio
Date: Fri, 25 Oct 2024 07:37:02 -0700 [thread overview]
Message-ID: <671bad0e.050a0220.2e773.0006.GAE@google.com> (raw)
In-Reply-To: <8f093f2e-04ff-497d-b857-c328e4e6746a@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in read_cache_folio
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000086000006
EC = 0x21: IABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 52-bit VAs, pgdp=0000000045e33a80
[0000000000000000] pgd=080000004bfb6003, p4d=080000004bd49003, pud=080000004bde6003, pmd=0000000000000000
Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 UID: 0 PID: 3935 Comm: syz.0.15 Tainted: G B 6.12.0-rc4-syzkaller-gae90f6a6170d #0
Tainted: [B]=BAD_PAGE
Hardware name: linux,dummy-virt (DT)
pstate: 61400809 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c)
pc : 0x0
lr : filemap_read_folio+0x44/0xf4 mm/filemap.c:2367
sp : ffff8000897b3ac0
x29: ffff8000897b3ac0 x28: fdf0000003bf9180 x27: 0000000020ffd000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000002100cca
x23: f6f0000003c63780 x22: 0000000000000000 x21: f6f0000003c63780
x20: 0000000000000000 x19: ffffc1ffc0354cc0 x18: ffff8000897b3c20
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000000 x13: 0000000000000003 x12: 000000000006b8f7
x11: 0000000000000001 x10: ffff800081f1ae18 x9 : 0000000000000000
x8 : fff07ffffd1ef000 x7 : fff000007f8e9d58 x6 : 0000000000000001
x5 : ffffc1ffc0354cc0 x4 : 0000000000000000 x3 : fbf0000004756d80
x2 : 0000000000000000 x1 : ffffc1ffc0354cc0 x0 : f6f0000003c63780
Call trace:
0x0
do_read_cache_folio+0x18c/0x29c mm/filemap.c:3825
read_cache_folio+0x14/0x20 mm/filemap.c:3857
freader_get_folio+0x1bc/0x214 lib/buildid.c:77
freader_fetch+0x44/0x164 lib/buildid.c:120
__build_id_parse.isra.0+0x98/0x2a8 lib/buildid.c:305
build_id_parse+0x18/0x24 lib/buildid.c:359
do_procmap_query+0x670/0x7a0 fs/proc/task_mmu.c:534
procfs_procmap_ioctl+0x2c/0x44 fs/proc/task_mmu.c:613
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0xac/0xf0 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: ???????? ???????? ???????? ???????? (????????)
---[ end trace 0000000000000000 ]---
Tested on:
commit: ae90f6a6 Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16d3de40580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ed4ea7a5e1330003
dashboard link: https://syzkaller.appspot.com/bug?extid=4089e577072948ac5531
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Note: no patches were applied.
parent reply other threads:[~2024-10-25 14:37 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <8f093f2e-04ff-497d-b857-c328e4e6746a@gmail.com>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=671bad0e.050a0220.2e773.0006.GAE@google.com \
--to=syzbot+4089e577072948ac5531@syzkaller.appspotmail.com \
--cc=gianf.trad@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.