From: syzbot <syzbot+b18872ea9631b5dcef3b@syzkaller.appspotmail.com>
To: andrew.kanner@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [mm?] BUG: unable to handle kernel NULL pointer dereference in __kmap_local_page_prot
Date: Mon, 15 Apr 2024 17:44:02 -0700 [thread overview]
Message-ID: <000000000000c9efeb06162c0898@google.com> (raw)
In-Reply-To: <661dc810.050a0220.c9289.5241@mx.google.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in __kmap_local_page_prot
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read
[00000000] *pgd=84743003, *pmd=fe6cd003
Internal error: Oops: 207 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 3935 Comm: syz-executor.0 Not tainted 6.9.0-rc4-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at page_zonenum include/linux/mmzone.h:1100 [inline]
PC is at __kmap_local_page_prot+0xc/0x74 mm/highmem.c:573
LR is at kmap_local_page include/linux/highmem-internal.h:73 [inline]
LR is at copy_page_to_iter+0xf8/0x184 lib/iov_iter.c:360
pc : [<80479ea8>] lr : [<807e997c>] psr: 60000013
sp : df9f5ca0 ip : df9f5cb0 fp : df9f5cac
r10: 00000018 r9 : 8285a4e8 r8 : 00000000
r7 : 00000000 r6 : 00000000 r5 : 00000000 r4 : 8489a400
r3 : 00c00000 r2 : 0000071f r1 : 00000000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 30c5387d Table: 848db4c0 DAC: fffffffd
Register r0 information: NULL pointer
Register r1 information: NULL pointer
Register r2 information: non-paged memory
Register r3 information: non-paged memory
Register r4 information: slab kmalloc-1k start 8489a400 pointer offset 0 size 1024
Register r5 information: NULL pointer
Register r6 information: NULL pointer
Register r7 information: NULL pointer
Register r8 information: NULL pointer
Register r9 information: non-slab/vmalloc memory
Register r10 information: non-paged memory
Register r11 information: 2-page vmalloc region starting at 0xdf9f4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Register r12 information: 2-page vmalloc region starting at 0xdf9f4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Process syz-executor.0 (pid: 3935, stack limit = 0xdf9f4000)
Stack: (0xdf9f5ca0 to 0xdf9f6000)
5ca0: df9f5ce4 df9f5cb0 807e997c 80479ea8 df9f5cd4 df9f5f48 8024c880 8489a400
5cc0: 8489a400 00000000 00000000 00000000 000000d4 00000018 df9f5d34 df9f5ce8
5ce0: 814333f4 807e9890 00000000 6ddd6be4 83fffc00 83fffcd0 83dea700 83fffcd8
5d00: df9f5f48 00000000 df9f5d8c 83dea700 000000d4 83fffc00 8410b000 00000000
5d20: 00000000 00000000 df9f5da4 df9f5d38 816560a8 81433310 00000000 00000000
5d40: 00000000 00000000 00000000 00000000 83dea788 83fffcec 83dea934 df9f5f38
5d60: 00000000 6ddd6be4 818c33d0 821a9848 00000000 6ddd6be4 df9f5f38 81655f58
5d80: df9f5f38 83372780 00000000 00000000 00000000 df9f5df4 df9f5dc4 df9f5da8
5da0: 81655124 81655f64 00000000 00000000 00000000 816550ec df9f5de4 df9f5dc8
5dc0: 813a29d4 816550f8 df9f5f38 83372780 200001c0 00000000 df9f5ea4 df9f5de8
5de0: 813a2bd4 813a2990 00000000 00000000 00000001 00000000 00000000 00000000
5e00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5e20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5e60: 00000000 00000000 00000000 00000000 00000000 6ddd6be4 00000000 00000000
5e80: df9f5f38 200001c0 00000000 83372780 8410b000 00000129 df9f5f24 df9f5ea8
5ea0: 813a5b18 813a2b50 00000000 00000000 00000008 00000000 00000000 20000280
5ec0: 000000d4 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 6ddd6be4
5f00: df9f5f24 83372780 00000000 200001c0 00000000 80200288 df9f5fa4 df9f5f28
5f20: 813a6294 813a5a9c 00000000 df9f5f38 00000001 fffffff7 df9f5df4 00000000
5f40: 00000000 00000000 00000000 00000000 20000280 000000d4 00000001 00000000
5f60: 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000
5f80: 8020ca6c 6ddd6be4 00000000 00000000 0014c2c8 00000129 00000000 df9f5fa8
5fa0: 80200060 813a622c 00000000 00000000 00000003 200001c0 00000000 00000000
5fc0: 00000000 00000000 0014c2c8 00000129 7ee5432e 7ee5432f 003d0f00 76b1d0fc
5fe0: 76b1cf08 76b1cef8 000168a0 00050c70 60000010 00000003 00000000 00000000
Call trace:
[<80479e9c>] (__kmap_local_page_prot) from [<807e997c>] (kmap_local_page include/linux/highmem-internal.h:73 [inline])
[<80479e9c>] (__kmap_local_page_prot) from [<807e997c>] (copy_page_to_iter+0xf8/0x184 lib/iov_iter.c:360)
[<807e9884>] (copy_page_to_iter) from [<814333f4>] (sk_msg_recvmsg+0xf0/0x3cc net/core/skmsg.c:437)
r10:00000018 r9:000000d4 r8:00000000 r7:00000000 r6:00000000 r5:8489a400
r4:8489a400
[<81433304>] (sk_msg_recvmsg) from [<816560a8>] (unix_bpf_recvmsg net/unix/unix_bpf.c:73 [inline])
[<81433304>] (sk_msg_recvmsg) from [<816560a8>] (unix_bpf_recvmsg+0x150/0x444 net/unix/unix_bpf.c:50)
r10:00000000 r9:00000000 r8:00000000 r7:8410b000 r6:83fffc00 r5:000000d4
r4:83dea700
[<81655f58>] (unix_bpf_recvmsg) from [<81655124>] (unix_dgram_recvmsg+0x38/0x4c net/unix/af_unix.c:2529)
r10:df9f5df4 r9:00000000 r8:00000000 r7:00000000 r6:83372780 r5:df9f5f38
r4:81655f58
[<816550ec>] (unix_dgram_recvmsg) from [<813a29d4>] (sock_recvmsg_nosec net/socket.c:1046 [inline])
[<816550ec>] (unix_dgram_recvmsg) from [<813a29d4>] (sock_recvmsg+0x50/0x78 net/socket.c:1068)
r4:816550ec
[<813a2984>] (sock_recvmsg) from [<813a2bd4>] (____sys_recvmsg+0x90/0x158 net/socket.c:2803)
r7:00000000 r6:200001c0 r5:83372780 r4:df9f5f38
[<813a2b44>] (____sys_recvmsg) from [<813a5b18>] (___sys_recvmsg+0x88/0xbc net/socket.c:2845)
r10:00000129 r9:8410b000 r8:83372780 r7:00000000 r6:200001c0 r5:df9f5f38
r4:00000000
[<813a5a90>] (___sys_recvmsg) from [<813a6294>] (__sys_recvmsg net/socket.c:2875 [inline])
[<813a5a90>] (___sys_recvmsg) from [<813a6294>] (__do_sys_recvmsg net/socket.c:2885 [inline])
[<813a5a90>] (___sys_recvmsg) from [<813a6294>] (sys_recvmsg+0x74/0xb8 net/socket.c:2882)
r8:80200288 r7:00000000 r6:200001c0 r5:00000000 r4:83372780
[<813a6220>] (sys_recvmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66)
Exception stack(0xdf9f5fa8 to 0xdf9f5ff0)
5fa0: 00000000 00000000 00000003 200001c0 00000000 00000000
5fc0: 00000000 00000000 0014c2c8 00000129 7ee5432e 7ee5432f 003d0f00 76b1d0fc
5fe0: 76b1cf08 76b1cef8 000168a0 00050c70
r7:00000129 r6:0014c2c8 r5:00000000 r4:00000000
Code: eaffffe8 e1a0c00d e92dd800 e24cb004 (e5901000)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: eaffffe8 b 0xffffffa8
4: e1a0c00d mov ip, sp
8: e92dd800 push {fp, ip, lr, pc}
c: e24cb004 sub fp, ip, #4
* 10: e5901000 ldr r1, [r0] <-- trapping instruction
Tested on:
commit: 96fca68c Merge tag 'nfsd-6.9-3' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1250f567180000
kernel config: https://syzkaller.appspot.com/x/.config?x=121101cdbf9c4dc2
dashboard link: https://syzkaller.appspot.com/bug?extid=b18872ea9631b5dcef3b
compiler: arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm
Note: no patches were applied.
next parent reply other threads:[~2024-04-16 0:44 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <661dc810.050a0220.c9289.5241@mx.google.com>
2024-04-16 0:44 ` syzbot [this message]
2023-10-04 17:50 [syzbot] [mm?] BUG: unable to handle kernel NULL pointer dereference in __kmap_local_page_prot syzbot
2024-01-02 11:09 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000c9efeb06162c0898@google.com \
--to=syzbot+b18872ea9631b5dcef3b@syzkaller.appspotmail.com \
--cc=andrew.kanner@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.