From: syzbot <syzbot+d36d5ae81e1b0a53ef58@syzkaller.appspotmail.com>
To: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, eddyz87@gmail.com, haoluo@google.com,
john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org,
linux-kernel@vger.kernel.org, martin.lau@linux.dev,
sdf@fomichev.me, song@kernel.org,
syzkaller-bugs@googlegroups.com, yonghong.song@linux.dev
Subject: [syzbot] [bpf?] general protection fault in print_reg_state
Date: Tue, 23 Sep 2025 02:02:31 -0700 [thread overview]
Message-ID: <68d26227.a70a0220.1b52b.02a4.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: cec1e6e5d1ab Merge tag 'sched_ext-for-6.17-rc7-fixes' of g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=175418e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8f01d8629880e620
dashboard link: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=113bf8e2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1608c27c580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-cec1e6e5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2833a04dba30/vmlinux-cec1e6e5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/632491f232df/bzImage-cec1e6e5.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d36d5ae81e1b0a53ef58@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 1 UID: 0 PID: 6117 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:print_reg_state+0x2dc/0x1010 kernel/bpf/log.c:719
Code: c1 ea 03 80 3c 02 00 0f 85 5c 0c 00 00 48 ba 00 00 00 00 00 fc ff df 4c 8b 7b 08 49 8d 47 60 48 89 c1 48 89 04 24 48 c1 e9 03 <0f> b6 14 11 84 d2 74 06 0f 8e 45 0b 00 00 41 0f b6 57 60 48 8b 44
RSP: 0018:ffffc90004e67398 EFLAGS: 00010206
RAX: 0000000000000060 RBX: ffff8880275a5000 RCX: 000000000000000c
RDX: dffffc0000000000 RSI: ffffffff81daeb8b RDI: 0000000000000005
RBP: ffffc90004e674b0 R08: 0000000000000005 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888037df0000
R13: 0000000000000003 R14: 1ffff920009cce79 R15: 0000000000000000
FS: 0000555587b13500(0000) GS:ffff8880d67b2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000100 CR3: 0000000033bb5000 CR4: 0000000000352ef0
Call Trace:
<TASK>
print_verifier_state+0x234/0x1170 kernel/bpf/log.c:775
do_check kernel/bpf/verifier.c:20071 [inline]
do_check_common+0x283e/0xb410 kernel/bpf/verifier.c:23264
do_check_main kernel/bpf/verifier.c:23347 [inline]
bpf_check+0x869f/0xc670 kernel/bpf/verifier.c:24707
bpf_prog_load+0xe41/0x2490 kernel/bpf/syscall.c:2979
__sys_bpf+0x4a3f/0x4de0 kernel/bpf/syscall.c:6029
__do_sys_bpf kernel/bpf/syscall.c:6139 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6137 [inline]
__x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:6137
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1041d8eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd44cefdd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f1041fe5fa0 RCX: 00007f1041d8eec9
RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005
RBP: 00007f1041e11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1041fe5fa0 R14: 00007f1041fe5fa0 R15: 0000000000000003
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:print_reg_state+0x2dc/0x1010 kernel/bpf/log.c:719
Code: c1 ea 03 80 3c 02 00 0f 85 5c 0c 00 00 48 ba 00 00 00 00 00 fc ff df 4c 8b 7b 08 49 8d 47 60 48 89 c1 48 89 04 24 48 c1 e9 03 <0f> b6 14 11 84 d2 74 06 0f 8e 45 0b 00 00 41 0f b6 57 60 48 8b 44
RSP: 0018:ffffc90004e67398 EFLAGS: 00010206
RAX: 0000000000000060 RBX: ffff8880275a5000 RCX: 000000000000000c
RDX: dffffc0000000000 RSI: ffffffff81daeb8b RDI: 0000000000000005
RBP: ffffc90004e674b0 R08: 0000000000000005 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888037df0000
R13: 0000000000000003 R14: 1ffff920009cce79 R15: 0000000000000000
FS: 0000555587b13500(0000) GS:ffff8880d67b2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000100 CR3: 0000000033bb5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: c1 ea 03 shr $0x3,%edx
3: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
7: 0f 85 5c 0c 00 00 jne 0xc69
d: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
14: fc ff df
17: 4c 8b 7b 08 mov 0x8(%rbx),%r15
1b: 49 8d 47 60 lea 0x60(%r15),%rax
1f: 48 89 c1 mov %rax,%rcx
22: 48 89 04 24 mov %rax,(%rsp)
26: 48 c1 e9 03 shr $0x3,%rcx
* 2a: 0f b6 14 11 movzbl (%rcx,%rdx,1),%edx <-- trapping instruction
2e: 84 d2 test %dl,%dl
30: 74 06 je 0x38
32: 0f 8e 45 0b 00 00 jle 0xb7d
38: 41 0f b6 57 60 movzbl 0x60(%r15),%edx
3d: 48 rex.W
3e: 8b .byte 0x8b
3f: 44 rex.R
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2025-09-23 9:02 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-23 9:02 syzbot [this message]
2025-09-23 16:41 ` [PATCH 1/1] bpf: fix NULL pointer dereference in print_reg_state() Brahmajit Das
2025-10-01 19:17 ` [PATCH v4 0/2] bpf: Fix verifier crash on BPF_NEG with pointer register Brahmajit Das
2025-10-01 19:17 ` [PATCH v4 1/2] bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer Brahmajit Das
2025-10-01 19:32 ` Eduard Zingerman
2025-10-01 19:17 ` [PATCH v4 2/2] selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP Brahmajit Das
2025-10-01 19:33 ` Eduard Zingerman
2025-10-01 21:10 ` [PATCH v4 0/2] bpf: Fix verifier crash on BPF_NEG with pointer register patchwork-bot+netdevbpf
2025-09-23 16:43 ` [PATCH 1/1] bpf: fix NULL pointer dereference in print_reg_state() Brahmajit Das
2025-09-23 18:52 ` Alexei Starovoitov
2025-09-23 17:10 ` Forwarded: [PATCH] " syzbot
2025-09-23 17:47 ` [PATCH v2] " Brahmajit Das
2025-09-24 7:32 ` Alexei Starovoitov
2025-09-24 9:09 ` Brahmajit Das
2025-09-24 15:40 ` Brahmajit Das
2025-09-24 17:28 ` Alexei Starovoitov
2025-09-24 17:38 ` KaFai Wan
2025-09-24 18:28 ` Brahmajit Das
2025-09-25 15:31 ` KaFai Wan
2025-09-26 1:04 ` Brahmajit Das
2025-09-26 1:56 ` Brahmajit Das
2025-09-26 10:36 ` KaFai Wan
2025-09-30 18:21 ` Brahmajit Das
2025-10-01 5:08 ` KaFai Wan
2025-09-29 18:23 ` [syzbot] [bpf?] general protection fault in print_reg_state syzbot
2025-10-01 9:56 ` [PATCH v3 0/2] bpf: Fix verifier crash on BPF_NEG with pointer register Brahmajit Das
2025-10-01 9:56 ` [PATCH v3 1/2] bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer Brahmajit Das
2025-10-01 16:55 ` Alexei Starovoitov
2025-10-01 18:29 ` Eduard Zingerman
2025-10-01 18:49 ` Brahmajit Das
2025-10-01 18:54 ` Eduard Zingerman
2025-10-01 9:56 ` [PATCH v3 2/2] selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP Brahmajit Das
2025-10-01 18:37 ` Eduard Zingerman
2025-10-01 18:40 ` [PATCH v3 0/2] bpf: Fix verifier crash on BPF_NEG with pointer register Eduard Zingerman
2025-10-01 19:28 ` [PATCH v4 " Brahmajit Das
2025-10-01 19:28 ` [PATCH v4 1/2] bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer Brahmajit Das
2025-10-01 21:10 ` patchwork-bot+netdevbpf
2025-10-01 19:28 ` [PATCH v4 2/2] selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP Brahmajit Das
[not found] <20250923171012.1627266-1-listout@listout.xyz>
2025-09-23 17:30 ` [syzbot] [bpf?] general protection fault in print_reg_state syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68d26227.a70a0220.1b52b.02a4.GAE@google.com \
--to=syzbot+d36d5ae81e1b0a53ef58@syzkaller.appspotmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.