From: syzbot <syzbot+1f4e278e8e1a9b01f95f@syzkaller.appspotmail.com>
To: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, rafael@kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [kernel?] general protection fault in device_move
Date: Sat, 21 Dec 2024 11:34:23 -0800 [thread overview]
Message-ID: <6767183f.050a0220.226966.0014.GAE@google.com> (raw)
In-Reply-To: <673e3029.050a0220.363a1b.0024.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 499551201b5f Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14c81fe8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4f1586bab1323870
dashboard link: https://syzkaller.appspot.com/bug?extid=1f4e278e8e1a9b01f95f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12c81fe8580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-49955120.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/43341c129049/vmlinux-49955120.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7a854e2daaae/bzImage-49955120.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1f4e278e8e1a9b01f95f@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 0 UID: 0 PID: 6777 Comm: syz.7.38 Not tainted 6.13.0-rc3-syzkaller-00209-g499551201b5f #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:klist_put+0x4d/0x1b0 lib/klist.c:212
Code: c1 ea 03 80 3c 02 00 0f 85 5f 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 83 e4 fe 49 8d 7c 24 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 2e 01 00 00 4c 89 e7 4d 8b 74 24 58 e8 7c ce 0c
RSP: 0018:ffffc9000448f6d0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880302eb060 RCX: 0000000000000000
RDX: 000000000000000b RSI: ffffffff8b1f62c5 RDI: 0000000000000058
RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff2085610
R10: ffffffff9042b083 R11: 0000000000000003 R12: 0000000000000000
R13: 0000000000000001 R14: 1ffff92000891ee2 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88806a600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557dd40787d8 CR3: 000000003095e000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
klist_del lib/klist.c:230 [inline]
klist_remove+0x140/0x2b0 lib/klist.c:249
device_move+0x12d/0x10b0 drivers/base/core.c:4636
hci_conn_del_sysfs+0x81/0x170 net/bluetooth/hci_sysfs.c:75
hci_conn_cleanup net/bluetooth/hci_conn.c:174 [inline]
hci_conn_del+0x54e/0xdb0 net/bluetooth/hci_conn.c:1164
hci_conn_hash_flush+0x4bf/0x790 net/bluetooth/hci_conn.c:2699
hci_dev_close_sync+0x603/0x11a0 net/bluetooth/hci_sync.c:5212
hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:482
hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2697
vhci_release+0x79/0xf0 drivers/bluetooth/hci_vhci.c:664
__fput+0x3f8/0xb60 fs/file_table.c:450
task_work_run+0x14e/0x250 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xad8/0x2d70 kernel/exit.c:938
do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
get_signal+0x24ed/0x26c0 kernel/signal.c:3017
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe5b7bb85e5
Code: Unable to access opcode bytes at 0x7fe5b7bb85bb.
RSP: 002b:00007fe5b8974f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6
RAX: fffffffffffffdfc RBX: 00007fe5b7d75fa0 RCX: 00007fe5b7bb85e5
RDX: 00007fe5b8974fc0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fe5b7c01aa8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe5b7d75fa0 R15: 00007ffda9a5cfa8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:klist_put+0x4d/0x1b0 lib/klist.c:212
Code: c1 ea 03 80 3c 02 00 0f 85 5f 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 83 e4 fe 49 8d 7c 24 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 2e 01 00 00 4c 89 e7 4d 8b 74 24 58 e8 7c ce 0c
RSP: 0018:ffffc9000448f6d0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880302eb060 RCX: 0000000000000000
RDX: 000000000000000b RSI: ffffffff8b1f62c5 RDI: 0000000000000058
RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff2085610
R10: ffffffff9042b083 R11: 0000000000000003 R12: 0000000000000000
R13: 0000000000000001 R14: 1ffff92000891ee2 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88806a600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557dd40787d8 CR3: 0000000029cf2000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: c1 ea 03 shr $0x3,%edx
3: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
7: 0f 85 5f 01 00 00 jne 0x16c
d: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
14: fc ff df
17: 4c 8b 23 mov (%rbx),%r12
1a: 49 83 e4 fe and $0xfffffffffffffffe,%r12
1e: 49 8d 7c 24 58 lea 0x58(%r12),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 2e 01 00 00 jne 0x162
34: 4c 89 e7 mov %r12,%rdi
37: 4d 8b 74 24 58 mov 0x58(%r12),%r14
3c: e8 .byte 0xe8
3d: 7c ce jl 0xd
3f: 0c .byte 0xc
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-12-21 19:34 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-11-20 18:53 [syzbot] [kernel?] general protection fault in device_move syzbot
2024-12-21 19:34 ` syzbot [this message]
2025-09-24 6:46 ` Forwarded: upstream test syzbot
[not found] <CAL4kbRPJhQq7r8Ts_iuqW0c=__eWgdYvVmBLCx+DCj8RkEEf=Q@mail.gmail.com>
2025-09-24 7:23 ` [syzbot] [kernel?] general protection fault in device_move syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6767183f.050a0220.226966.0014.GAE@google.com \
--to=syzbot+1f4e278e8e1a9b01f95f@syzkaller.appspotmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.