From: "Dae R. Jeong" <threeearcat@gmail.com>
To: gregkh@linuxfoundation.org, stern@rowland.harvard.edu,
water.zhangjiantao@huawei.com, rafael@kernel.org,
colin.i.king@gmail.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: BUG: unable to handle kernel paging request in __kernfs_new_node
Date: Wed, 5 Apr 2023 19:36:32 +0900 [thread overview]
Message-ID: <ZC1PMAWMO3dkp4KR@dragonet> (raw)
Hi,
We observed an issue "BUG: unable to handle kernel paging request in
__kernfs_new_node" during fuzzing.
Althogh the issue was detected in a kernfs API, we report this issue
to the usb gadget subsystem as we suspect that it is the most related
subsystem.
Unfortunately, we have not found a reproducer for the crash yet. We
will inform you if we have any update on this crash.
Detailed crash information is attached below.
Best regards,
Dae R. Jeong
-----
- Kernel version:
6.2-rc7
- Crash report:
BUG: unable to handle page fault for address: ffff8800302e746d
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 438 Comm: syz-executor.0 Not tainted 6.2.0-rc7-32171-g7f09e8f6ebfb #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:freelist_dereference mm/slub.c:388 [inline]
RIP: 0010:get_freepointer mm/slub.c:395 [inline]
RIP: 0010:get_freepointer_safe mm/slub.c:422 [inline]
RIP: 0010:__slab_alloc_node mm/slub.c:3347 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:3442 [inline]
RIP: 0010:__kmem_cache_alloc_node+0x1b6/0x430 mm/slub.c:3491
Code: 48 89 df e8 6c 25 e7 ff 49 c1 ed 3a 44 3b 6d c0 0f 85 08 01 00 00 41 8b 5e 28 4c 8b 6d b8 4c 89 ef e8 0e 25 e7 ff 49 8d 3c 1c <49> 8b 1c 1c e8 41 25 e7 ff 49 8d 47 08 48 89 45 a0 49 8b 06 48 89
RSP: 0018:ffff888010c238f8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000008 RCX: ffffc900078ee000
RDX: 0000000000000004 RSI: ffff888008441328 RDI: ffff8800302e746d
RBP: ffff888010c23968 R08: ffffffff8a667a61 R09: 00000000000009d6
R10: 0000000000000010 R11: ffff888011942180 R12: ffff8800302e7465
R13: ffff888008441328 R14: ffff888008441300 R15: 00000000000bd3f1
FS: 00007f288fea9700(0000) GS:ffff88813dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8800302e746d CR3: 0000000040920000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__do_kmalloc_node mm/slab_common.c:967 [inline]
__kmalloc_node_track_caller+0xa6/0x2a0 mm/slab_common.c:988
kstrdup mm/util.c:61 [inline]
kstrdup_const+0x5a/0xa0 mm/util.c:84
__kernfs_new_node+0x4d/0x3f0 fs/kernfs/dir.c:610
kernfs_new_node fs/kernfs/dir.c:676 [inline]
kernfs_create_dir_ns+0x70/0x180 fs/kernfs/dir.c:1032
sysfs_create_dir_ns+0x96/0x1a0 fs/sysfs/dir.c:59
create_dir lib/kobject.c:63 [inline]
kobject_add_internal+0x2be/0x640 lib/kobject.c:223
kobject_add_varg lib/kobject.c:358 [inline]
kobject_init_and_add+0xa3/0xe0 lib/kobject.c:441
bus_add_driver+0x145/0x3f0 drivers/base/bus.c:611
driver_register+0x1de/0x2a0 drivers/base/driver.c:246
usb_gadget_register_driver_owner+0x92/0x1b0 drivers/usb/gadget/udc/core.c:1560
raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:546 [inline]
raw_ioctl+0xbb9/0x1cf0 drivers/usb/gadget/legacy/raw_gadget.c:1253
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xe4/0x160 fs/ioctl.c:856
__x64_sys_ioctl+0x4b/0x60 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x478ab7
Code: 8f 38 02 00 85 c0 78 df 48 83 c4 08 48 89 d8 5b 5d c3 90 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb b4 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f288fea6b18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000000004d RCX: 0000000000478ab7
RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 000000000000000b
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000020000940 R14: 00000000004022a0 R15: 0000000020000540
</TASK>
Modules linked in:
CR2: ffff8800302e746d
---[ end trace 0000000000000000 ]---
RIP: 0010:freelist_dereference mm/slub.c:388 [inline]
RIP: 0010:get_freepointer mm/slub.c:395 [inline]
RIP: 0010:get_freepointer_safe mm/slub.c:422 [inline]
RIP: 0010:__slab_alloc_node mm/slub.c:3347 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:3442 [inline]
RIP: 0010:__kmem_cache_alloc_node+0x1b6/0x430 mm/slub.c:3491
Code: 48 89 df e8 6c 25 e7 ff 49 c1 ed 3a 44 3b 6d c0 0f 85 08 01 00 00 41 8b 5e 28 4c 8b 6d b8 4c 89 ef e8 0e 25 e7 ff 49 8d 3c 1c <49> 8b 1c 1c e8 41 25 e7 ff 49 8d 47 08 48 89 45 a0 49 8b 06 48 89
RSP: 0018:ffff888010c238f8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000008 RCX: ffffc900078ee000
RDX: 0000000000000004 RSI: ffff888008441328 RDI: ffff8800302e746d
RBP: ffff888010c23968 R08: ffffffff8a667a61 R09: 00000000000009d6
R10: 0000000000000010 R11: ffff888011942180 R12: ffff8800302e7465
R13: ffff888008441328 R14: ffff888008441300 R15: 00000000000bd3f1
FS: 00007f288fea9700(0000) GS:ffff88813dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8800302e746d CR3: 0000000040920000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 89 df mov %rbx,%rdi
3: e8 6c 25 e7 ff callq 0xffe72574
8: 49 c1 ed 3a shr $0x3a,%r13
c: 44 3b 6d c0 cmp -0x40(%rbp),%r13d
10: 0f 85 08 01 00 00 jne 0x11e
16: 41 8b 5e 28 mov 0x28(%r14),%ebx
1a: 4c 8b 6d b8 mov -0x48(%rbp),%r13
1e: 4c 89 ef mov %r13,%rdi
21: e8 0e 25 e7 ff callq 0xffe72534
26: 49 8d 3c 1c lea (%r12,%rbx,1),%rdi
* 2a: 49 8b 1c 1c mov (%r12,%rbx,1),%rbx <-- trapping instruction
2e: e8 41 25 e7 ff callq 0xffe72574
33: 49 8d 47 08 lea 0x8(%r15),%rax
37: 48 89 45 a0 mov %rax,-0x60(%rbp)
3b: 49 8b 06 mov (%r14),%rax
3e: 48 rex.W
3f: 89 .byte 0x89
reply other threads:[~2023-04-05 10:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZC1PMAWMO3dkp4KR@dragonet \
--to=threeearcat@gmail.com \
--cc=colin.i.king@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=water.zhangjiantao@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.