From: syzbot <syzbot+2d1f5a94167d430a3bd7@syzkaller.appspotmail.com> To: catalin.marinas@arm.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, will@kernel.org Subject: [syzbot] [arm?] BUG: unable to handle kernel paging request in trans_pgd_create_copy Date: Sat, 13 Apr 2024 01:53:25 -0700 [thread overview] Message-ID: <000000000000759c060615f685b3@google.com> (raw) Hello, syzbot found the following issue on: HEAD commit: 2c71fdf02a95 Merge tag 'drm-fixes-2024-04-09' of https://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=13400033180000 kernel config: https://syzkaller.appspot.com/x/.config?x=3b59c588989b5f9a dashboard link: https://syzkaller.appspot.com/bug?extid=2d1f5a94167d430a3bd7 compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17a303d3180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=128de44d180000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-2c71fdf0.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/627c4a5b3fcb/vmlinux-2c71fdf0.xz kernel image: https://storage.googleapis.com/syzbot-assets/39628cd13511/Image-2c71fdf0.gz.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+2d1f5a94167d430a3bd7@syzkaller.appspotmail.com Unable to handle kernel paging request at virtual address ffffffffc0000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000425f4000 [ffffffffc0000000] pgd=1000000042ac9003, p4d=00000000429e0003, pud=00000000429e1003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 3174 Comm: syz-executor195 Not tainted 6.9.0-rc3-syzkaller-00023-g2c71fdf02a95 #0 Hardware name: linux,dummy-virt (DT) pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : copy_pud arch/arm64/mm/trans_pgd.c:127 [inline] pc : copy_p4d arch/arm64/mm/trans_pgd.c:169 [inline] pc : copy_page_tables arch/arm64/mm/trans_pgd.c:188 [inline] pc : trans_pgd_create_copy+0x164/0x864 arch/arm64/mm/trans_pgd.c:215 lr : trans_alloc arch/arm64/mm/trans_pgd.c:31 [inline] lr : trans_pgd_create_copy+0x2c/0x864 arch/arm64/mm/trans_pgd.c:208 sp : ffff8000893b3c30 x29: ffff8000893b3c30 x28: f9f00000058e9200 x27: fff0000000000000 x26: fff1000000000000 x25: fff0008000000000 x24: fff0000000000000 x23: ffff800000000000 x22: ffffffffc0000000 x21: fff000007fdff000 x20: ffff8000893b3d68 x19: ffffffffc0000000 x18: 0000000000000001 x17: ffff800080171268 x16: ffff800080170f48 x15: ffff80008016f800 x14: 0000000000000002 x13: 0000000000000000 x12: 0000000000072170 x11: 000000000003cd0d x10: 0000000000000001 x9 : 0000000000000000 x8 : f1f0000007ef9000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000000 x3 : 1000000000000000 x2 : 00000000bfdff000 x1 : fff0ffffffffffff x0 : 18000000bfdfe003 Call trace: copy_p4d arch/arm64/mm/trans_pgd.c:167 [inline] copy_page_tables arch/arm64/mm/trans_pgd.c:188 [inline] trans_pgd_create_copy+0x164/0x864 arch/arm64/mm/trans_pgd.c:215 machine_kexec_post_load+0xa4/0x2c0 arch/arm64/kernel/machine_kexec.c:135 do_kexec_load+0x28c/0x2e4 kernel/kexec.c:162 __do_sys_kexec_load kernel/kexec.c:261 [inline] __se_sys_kexec_load kernel/kexec.c:242 [inline] __arm64_sys_kexec_load+0x9c/0xe8 kernel/kexec.c:242 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: eb01001f f94002a0 54fff9a2 b4002380 (f94002c0) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: eb01001f cmp x0, x1 4: f94002a0 ldr x0, [x21] 8: 54fff9a2 b.cs 0xffffffffffffff3c // b.hs, b.nlast c: b4002380 cbz x0, 0x47c * 10: f94002c0 ldr x0, [x22] <-- trapping instruction --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
WARNING: multiple messages have this Message-ID (diff)
From: syzbot <syzbot+2d1f5a94167d430a3bd7@syzkaller.appspotmail.com> To: catalin.marinas@arm.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, will@kernel.org Subject: [syzbot] [arm?] BUG: unable to handle kernel paging request in trans_pgd_create_copy Date: Sat, 13 Apr 2024 01:53:25 -0700 [thread overview] Message-ID: <000000000000759c060615f685b3@google.com> (raw) Hello, syzbot found the following issue on: HEAD commit: 2c71fdf02a95 Merge tag 'drm-fixes-2024-04-09' of https://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=13400033180000 kernel config: https://syzkaller.appspot.com/x/.config?x=3b59c588989b5f9a dashboard link: https://syzkaller.appspot.com/bug?extid=2d1f5a94167d430a3bd7 compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17a303d3180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=128de44d180000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-2c71fdf0.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/627c4a5b3fcb/vmlinux-2c71fdf0.xz kernel image: https://storage.googleapis.com/syzbot-assets/39628cd13511/Image-2c71fdf0.gz.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+2d1f5a94167d430a3bd7@syzkaller.appspotmail.com Unable to handle kernel paging request at virtual address ffffffffc0000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000425f4000 [ffffffffc0000000] pgd=1000000042ac9003, p4d=00000000429e0003, pud=00000000429e1003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 3174 Comm: syz-executor195 Not tainted 6.9.0-rc3-syzkaller-00023-g2c71fdf02a95 #0 Hardware name: linux,dummy-virt (DT) pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : copy_pud arch/arm64/mm/trans_pgd.c:127 [inline] pc : copy_p4d arch/arm64/mm/trans_pgd.c:169 [inline] pc : copy_page_tables arch/arm64/mm/trans_pgd.c:188 [inline] pc : trans_pgd_create_copy+0x164/0x864 arch/arm64/mm/trans_pgd.c:215 lr : trans_alloc arch/arm64/mm/trans_pgd.c:31 [inline] lr : trans_pgd_create_copy+0x2c/0x864 arch/arm64/mm/trans_pgd.c:208 sp : ffff8000893b3c30 x29: ffff8000893b3c30 x28: f9f00000058e9200 x27: fff0000000000000 x26: fff1000000000000 x25: fff0008000000000 x24: fff0000000000000 x23: ffff800000000000 x22: ffffffffc0000000 x21: fff000007fdff000 x20: ffff8000893b3d68 x19: ffffffffc0000000 x18: 0000000000000001 x17: ffff800080171268 x16: ffff800080170f48 x15: ffff80008016f800 x14: 0000000000000002 x13: 0000000000000000 x12: 0000000000072170 x11: 000000000003cd0d x10: 0000000000000001 x9 : 0000000000000000 x8 : f1f0000007ef9000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000000 x3 : 1000000000000000 x2 : 00000000bfdff000 x1 : fff0ffffffffffff x0 : 18000000bfdfe003 Call trace: copy_p4d arch/arm64/mm/trans_pgd.c:167 [inline] copy_page_tables arch/arm64/mm/trans_pgd.c:188 [inline] trans_pgd_create_copy+0x164/0x864 arch/arm64/mm/trans_pgd.c:215 machine_kexec_post_load+0xa4/0x2c0 arch/arm64/kernel/machine_kexec.c:135 do_kexec_load+0x28c/0x2e4 kernel/kexec.c:162 __do_sys_kexec_load kernel/kexec.c:261 [inline] __se_sys_kexec_load kernel/kexec.c:242 [inline] __arm64_sys_kexec_load+0x9c/0xe8 kernel/kexec.c:242 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: eb01001f f94002a0 54fff9a2 b4002380 (f94002c0) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: eb01001f cmp x0, x1 4: f94002a0 ldr x0, [x21] 8: 54fff9a2 b.cs 0xffffffffffffff3c // b.hs, b.nlast c: b4002380 cbz x0, 0x47c * 10: f94002c0 ldr x0, [x22] <-- trapping instruction --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2024-04-13 8:53 UTC|newest] Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-04-13 8:53 syzbot [this message] 2024-04-13 8:53 ` [syzbot] [arm?] BUG: unable to handle kernel paging request in trans_pgd_create_copy syzbot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=000000000000759c060615f685b3@google.com \ --to=syzbot+2d1f5a94167d430a3bd7@syzkaller.appspotmail.com \ --cc=catalin.marinas@arm.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=syzkaller-bugs@googlegroups.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.