From: syzbot <syzbot+8b093786303cd0c2041d@syzkaller.appspotmail.com> To: catalin.marinas@arm.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, will@kernel.org Subject: [syzbot] [arm?] BUG: unable to handle kernel paging request in huge_pte_alloc Date: Sat, 13 Apr 2024 19:59:27 -0700 [thread overview] Message-ID: <00000000000071dfbd061605b1bd@google.com> (raw) Hello, syzbot found the following issue on: HEAD commit: 2c71fdf02a95 Merge tag 'drm-fixes-2024-04-09' of https://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16b397ad180000 kernel config: https://syzkaller.appspot.com/x/.config?x=3b59c588989b5f9a dashboard link: https://syzkaller.appspot.com/bug?extid=8b093786303cd0c2041d compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16f55d29180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a32e75180000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-2c71fdf0.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/627c4a5b3fcb/vmlinux-2c71fdf0.xz kernel image: https://storage.googleapis.com/syzbot-assets/39628cd13511/Image-2c71fdf0.gz.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+8b093786303cd0c2041d@syzkaller.appspotmail.com Unable to handle kernel paging request at virtual address ffffffffc0000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000425f4000 [ffffffffc0000000] pgd=1000000042ac9003, p4d=00000000429e0003, pud=00000000429e1003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 3176 Comm: syz-executor300 Not tainted 6.9.0-rc3-syzkaller-00023-g2c71fdf02a95 #0 Hardware name: linux,dummy-virt (DT) pstate: 01400009 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : pud_alloc include/linux/mm.h:2819 [inline] pc : huge_pte_alloc+0xd4/0x358 arch/arm64/mm/hugetlbpage.c:280 lr : copy_hugetlb_page_range+0x108/0x924 mm/hugetlb.c:5423 sp : ffff8000890e3810 x29: ffff8000890e3810 x28: ffff80008283c358 x27: fcf0000005e14980 x26: 0000000000000000 x25: fbf0000005e15300 x24: f8f0000006360780 x23: f8f0000006360780 x22: fcf0000005e14980 x21: 0000000021000000 x20: 0000000020400000 x19: ffffffffc0000000 x18: ffff8000890e3ba8 x17: 0000000000000000 x16: 1ede000000c4c181 x15: 0000000000000001 x14: ffffffffffffffff x13: 0000000000000000 x12: ffff8000890e3ac8 x11: 0000000020400000 x10: ffff8000890e3ba8 x9 : 0000000020400000 x8 : 0000000000000000 x7 : 0000000000000102 x6 : 0000000040000000 x5 : 0000000000000000 x4 : ffffffffc0000000 x3 : 0000000000200000 x2 : f3f0000005f34f80 x1 : 0000000000000000 x0 : 0000000040000000 Call trace: p4d_offset_lockless arch/arm64/include/asm/pgtable.h:965 [inline] p4d_offset arch/arm64/include/asm/pgtable.h:971 [inline] huge_pte_alloc+0xd4/0x358 arch/arm64/mm/hugetlbpage.c:279 copy_hugetlb_page_range+0x108/0x924 mm/hugetlb.c:5423 copy_page_range+0x1a0c/0x1a58 mm/memory.c:1355 dup_mmap kernel/fork.c:747 [inline] dup_mm kernel/fork.c:1687 [inline] copy_mm+0x62c/0x7ac kernel/fork.c:1736 copy_process+0xc30/0x1484 kernel/fork.c:2389 kernel_clone+0x64/0x360 kernel/fork.c:2796 __do_sys_clone+0x70/0xa8 kernel/fork.c:2939 __se_sys_clone kernel/fork.c:2907 [inline] __arm64_sys_clone+0x20/0x2c kernel/fork.c:2907 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: aa010084 cb000084 b24c2c84 8b130c93 (f9400260) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: aa010084 orr x4, x4, x1 4: cb000084 sub x4, x4, x0 8: b24c2c84 orr x4, x4, #0xfff0000000000000 c: 8b130c93 add x19, x4, x19, lsl #3 * 10: f9400260 ldr x0, [x19] <-- trapping instruction --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
WARNING: multiple messages have this Message-ID (diff)
From: syzbot <syzbot+8b093786303cd0c2041d@syzkaller.appspotmail.com> To: catalin.marinas@arm.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, will@kernel.org Subject: [syzbot] [arm?] BUG: unable to handle kernel paging request in huge_pte_alloc Date: Sat, 13 Apr 2024 19:59:27 -0700 [thread overview] Message-ID: <00000000000071dfbd061605b1bd@google.com> (raw) Hello, syzbot found the following issue on: HEAD commit: 2c71fdf02a95 Merge tag 'drm-fixes-2024-04-09' of https://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16b397ad180000 kernel config: https://syzkaller.appspot.com/x/.config?x=3b59c588989b5f9a dashboard link: https://syzkaller.appspot.com/bug?extid=8b093786303cd0c2041d compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16f55d29180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a32e75180000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-2c71fdf0.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/627c4a5b3fcb/vmlinux-2c71fdf0.xz kernel image: https://storage.googleapis.com/syzbot-assets/39628cd13511/Image-2c71fdf0.gz.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+8b093786303cd0c2041d@syzkaller.appspotmail.com Unable to handle kernel paging request at virtual address ffffffffc0000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000425f4000 [ffffffffc0000000] pgd=1000000042ac9003, p4d=00000000429e0003, pud=00000000429e1003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 3176 Comm: syz-executor300 Not tainted 6.9.0-rc3-syzkaller-00023-g2c71fdf02a95 #0 Hardware name: linux,dummy-virt (DT) pstate: 01400009 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : pud_alloc include/linux/mm.h:2819 [inline] pc : huge_pte_alloc+0xd4/0x358 arch/arm64/mm/hugetlbpage.c:280 lr : copy_hugetlb_page_range+0x108/0x924 mm/hugetlb.c:5423 sp : ffff8000890e3810 x29: ffff8000890e3810 x28: ffff80008283c358 x27: fcf0000005e14980 x26: 0000000000000000 x25: fbf0000005e15300 x24: f8f0000006360780 x23: f8f0000006360780 x22: fcf0000005e14980 x21: 0000000021000000 x20: 0000000020400000 x19: ffffffffc0000000 x18: ffff8000890e3ba8 x17: 0000000000000000 x16: 1ede000000c4c181 x15: 0000000000000001 x14: ffffffffffffffff x13: 0000000000000000 x12: ffff8000890e3ac8 x11: 0000000020400000 x10: ffff8000890e3ba8 x9 : 0000000020400000 x8 : 0000000000000000 x7 : 0000000000000102 x6 : 0000000040000000 x5 : 0000000000000000 x4 : ffffffffc0000000 x3 : 0000000000200000 x2 : f3f0000005f34f80 x1 : 0000000000000000 x0 : 0000000040000000 Call trace: p4d_offset_lockless arch/arm64/include/asm/pgtable.h:965 [inline] p4d_offset arch/arm64/include/asm/pgtable.h:971 [inline] huge_pte_alloc+0xd4/0x358 arch/arm64/mm/hugetlbpage.c:279 copy_hugetlb_page_range+0x108/0x924 mm/hugetlb.c:5423 copy_page_range+0x1a0c/0x1a58 mm/memory.c:1355 dup_mmap kernel/fork.c:747 [inline] dup_mm kernel/fork.c:1687 [inline] copy_mm+0x62c/0x7ac kernel/fork.c:1736 copy_process+0xc30/0x1484 kernel/fork.c:2389 kernel_clone+0x64/0x360 kernel/fork.c:2796 __do_sys_clone+0x70/0xa8 kernel/fork.c:2939 __se_sys_clone kernel/fork.c:2907 [inline] __arm64_sys_clone+0x20/0x2c kernel/fork.c:2907 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: aa010084 cb000084 b24c2c84 8b130c93 (f9400260) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: aa010084 orr x4, x4, x1 4: cb000084 sub x4, x4, x0 8: b24c2c84 orr x4, x4, #0xfff0000000000000 c: 8b130c93 add x19, x4, x19, lsl #3 * 10: f9400260 ldr x0, [x19] <-- trapping instruction --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2024-04-14 2:59 UTC|newest] Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-04-14 2:59 syzbot [this message] 2024-04-14 2:59 ` [syzbot] [arm?] BUG: unable to handle kernel paging request in huge_pte_alloc syzbot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=00000000000071dfbd061605b1bd@google.com \ --to=syzbot+8b093786303cd0c2041d@syzkaller.appspotmail.com \ --cc=catalin.marinas@arm.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=syzkaller-bugs@googlegroups.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.