Re: [BUG] BUG: unable to handle page fault for address: ffffffffa6df0480

[Yonghong Song <yonghong.song@linux.dev>]

On 11/8/24 6:26 AM, Yeqi Fu wrote:
> Hi there,
> A kernel page fault occurred at address ffffffffa6df0480 due to a supervisor read access in kernel mode. The error indicates a "not-present page" issue, leading to an Oops in the system. The fault address appears to be an invalid memory access, possibly due to incorrect handling of pointers or memory allocation within the BPF JIT compilation path.
> A proof-of-concept is available, and I have manually reproduced this bug.

I compiled your C file and run it with latest bpf-next for a few minutes
and there is no crash. Please give more details e.g. kernel config, which may help to reproduce.

>
> Report:
> ```
> BUG: unable to handle page fault for address: ffffffffa6df0480
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 75a87067 P4D 75a87067 PUD 75a88063 PMD 43c4063 PTE 800fffff8920f062
> Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
> CPU: 0 UID: 0 PID: 11294 Comm: syz.0.3563 Not tainted 6.12.0-rc3-gb22db8b8befe #2
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:__arch_prepare_bpf_trampoline+0x53d/0x3810 arch/x86/net/bpf_jit_comp.c:2974
> Code: 8b 44 24 18 48 8b 5c 24 30 e9 a4 00 00 00 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 8a 04 08 84 c0 0f 85 77 28 00 00 <41> 8b 1e bf 66 0f 1f 00 89 de e8 24 d6 3d 00 81 fb 66 0f 1f 00 75
> RSP: 0018:ffff888029b072e0 EFLAGS: 00010246
> RAX: 1ffffffff4dbe000 RBX: 0000000000000006 RCX: dffffc0000000000
> RDX: ffff88800b053780 RSI: 0000000000000004 RDI: 0000000000000000
> RBP: ffff888029b074c0 R08: ffffffffa099ba3a R09: 0000000000000006
> R10: fffffbfff8095000 R11: ffffed100020a30d R12: ffff888029b07440
> R13: 0000000000000030 R14: ffffffffa6df0480 R15: 0000000000000008
> FS: 00007fba28dc1640(0000) GS:ffff888065800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffffffa6df0480 CR3: 00000000281b4006 CR4: 0000000000370ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> arch_bpf_trampoline_size+0xd3/0x150 arch/x86/net/bpf_jit_comp.c:3212
> bpf_trampoline_update+0x78b/0x1020 kernel/bpf/trampoline.c:435
> __bpf_trampoline_link_prog+0x50a/0x6c0 kernel/bpf/trampoline.c:565
> bpf_trampoline_link_prog+0x2d/0x40 kernel/bpf/trampoline.c:578
> bpf_tracing_prog_attach+0x9e4/0xe50 kernel/bpf/syscall.c:3432
> bpf_raw_tp_link_attach+0x3ec/0x630 kernel/bpf/syscall.c:3798
> bpf_raw_tracepoint_open+0x172/0x1e0 kernel/bpf/syscall.c:3861
> __sys_bpf+0x3ae/0x850 kernel/bpf/syscall.c:5676
> __do_sys_bpf kernel/bpf/syscall.c:5741 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5739 [inline]
> __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5739
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xd8/0x1c0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x67/0x6f
> RIP: 0033:0x7fba2a76d72d
> Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fba28dc0f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
> RAX: ffffffffffffffda RBX: 00007fba2a945f80 RCX: 00007fba2a76d72d
> RDX: 0000000000000010 RSI: 0000000020000a80 RDI: 0000000000000011
> RBP: 00007fba2a7f7584 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 0000000000000000 R14: 00007fba2a945f80 R15: 00007fba28da1000
> </TASK>
> Modules linked in:
> CR2: ffffffffa6df0480
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:__arch_prepare_bpf_trampoline+0x53d/0x3810 arch/x86/net/bpf_jit_comp.c:2974
> Code: 8b 44 24 18 48 8b 5c 24 30 e9 a4 00 00 00 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 8a 04 08 84 c0 0f 85 77 28 00 00 <41> 8b 1e bf 66 0f 1f 00 89 de e8 24 d6 3d 00 81 fb 66 0f 1f 00 75
> RSP: 0018:ffff888029b072e0 EFLAGS: 00010246
> RAX: 1ffffffff4dbe000 RBX: 0000000000000006 RCX: dffffc0000000000
> RDX: ffff88800b053780 RSI: 0000000000000004 RDI: 0000000000000000
> RBP: ffff888029b074c0 R08: ffffffffa099ba3a R09: 0000000000000006
> R10: fffffbfff8095000 R11: ffffed100020a30d R12: ffff888029b07440
> R13: 0000000000000030 R14: ffffffffa6df0480 R15: 0000000000000008
> FS: 00007fba28dc1640(0000) GS:ffff888065800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffffffa6df0480 CR3: 00000000281b4006 CR4: 0000000000370ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> note: syz.0.3563[11294] exited with irqs disabled
> ----------------
> Code disassembly (best guess):
> 0: 8b 44 24 18 mov 0x18(%rsp),%eax
> 4: 48 8b 5c 24 30 mov 0x30(%rsp),%rbx
> 9: e9 a4 00 00 00 jmp 0xb2
> e: 4c 89 f0 mov %r14,%rax
> 11: 48 c1 e8 03 shr $0x3,%rax
> 15: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
> 1c: fc ff df
> 1f: 8a 04 08 mov (%rax,%rcx,1),%al
> 22: 84 c0 test %al,%al
> 24: 0f 85 77 28 00 00 jne 0x28a1
> * 2a: 41 8b 1e mov (%r14),%ebx <-- trapping instruction
> 2d: bf 66 0f 1f 00 mov $0x1f0f66,%edi
> 32: 89 de mov %ebx,%esi
> 34: e8 24 d6 3d 00 call 0x3dd65d
> 39: 81 fb 66 0f 1f 00 cmp $0x1f0f66,%ebx
> 3f: 75 .byte 0x75
> ```
[...]