From: syzbot <syzbot+a9ed3d9132939852d0df@syzkaller.appspotmail.com>
To: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, eddyz87@gmail.com, haoluo@google.com,
john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org,
linux-kernel@vger.kernel.org, martin.lau@linux.dev,
sdf@fomichev.me, song@kernel.org,
syzkaller-bugs@googlegroups.com, yonghong.song@linux.dev
Subject: [syzbot] [bpf?] WARNING in do_misc_fixups
Date: Sun, 03 Aug 2025 22:08:32 -0700 [thread overview]
Message-ID: <68904050.050a0220.7f033.0001.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: a6923c06a3b2 Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1561dcf0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f89bb9497754f485
dashboard link: https://syzkaller.appspot.com/bug?extid=a9ed3d9132939852d0df
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165d0aa2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117bd834580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/fa3fbcfdac58/non_bootable_disk-a6923c06.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9862ca8219e0/vmlinux-a6923c06.xz
kernel image: https://storage.googleapis.com/syzbot-assets/042ebe320cfd/Image-a6923c06.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a9ed3d9132939852d0df@syzkaller.appspotmail.com
------------[ cut here ]------------
verifier bug: not inlined functions bpf_probe_read_kernel_str#115 is missing func(1)
WARNING: CPU: 1 PID: 3594 at kernel/bpf/verifier.c:22838 do_misc_fixups+0x1784/0x1ab4 kernel/bpf/verifier.c:22838
Modules linked in:
CPU: 1 UID: 0 PID: 3594 Comm: syz.2.17 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT
Hardware name: linux,dummy-virt (DT)
pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : do_misc_fixups+0x1784/0x1ab4 kernel/bpf/verifier.c:22838
lr : do_misc_fixups+0x1784/0x1ab4 kernel/bpf/verifier.c:22838
sp : ffff80008936b9a0
x29: ffff80008936b9a0 x28: f5ff8000832f5000 x27: 000000000000000a
x26: f8f0000007ba8000 x25: 0000000000000000 x24: f8f0000007bae200
x23: 000000000000f0ff x22: 000000000000000a x21: f8f0000007bae128
x20: f8f0000007ba8aa8 x19: ffff80008243e828 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffff800081b73b80
x14: 0000000000000342 x13: 0000000000000000 x12: 0000000000000002
x11: 00000000000000c0 x10: 646e0773d90f24cc x9 : 73727a981a23afd7
x8 : fcf0000007bb36f8 x7 : 0000000000000190 x6 : 0000003978391654
x5 : 0000000000000001 x4 : fbffff3fffffffff x3 : 000000000000ffff
x2 : 0000000000000000 x1 : 0000000000000000 x0 : fcf0000007bb2500
Call trace:
do_misc_fixups+0x1784/0x1ab4 kernel/bpf/verifier.c:22838 (P)
bpf_check+0x1308/0x2a8c kernel/bpf/verifier.c:24739
bpf_prog_load+0x634/0xb74 kernel/bpf/syscall.c:2979
__sys_bpf+0x2e0/0x1a3c kernel/bpf/syscall.c:6029
__do_sys_bpf kernel/bpf/syscall.c:6139 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6137 [inline]
__arm64_sys_bpf+0x24/0x34 kernel/bpf/syscall.c:6137
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
el0_svc+0x34/0x10c arch/arm64/kernel/entry-common.c:879
el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:898
el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2025-08-04 5:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-04 5:08 syzbot [this message]
2025-08-04 16:05 ` [syzbot] [bpf?] WARNING in do_misc_fixups Alexei Starovoitov
2025-08-05 13:53 ` Jiri Olsa
2025-08-05 14:23 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68904050.050a0220.7f033.0001.GAE@google.com \
--to=syzbot+a9ed3d9132939852d0df@syzkaller.appspotmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.