Hello,
syzbot found the following issue on:
HEAD commit: 7cf4bea77ab6 Merge tag 'for-6.6-rc6-tag' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15b76415680000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4436b383d761e86
dashboard link: https://syzkaller.appspot.com/bug?extid=84f695756ed0c4bb3aba
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1780cabd680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=157c04fe680000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-7cf4bea7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8097f65801fe/vmlinux-7cf4bea7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1824f0c42bd6/Image-7cf4bea7.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000097c38006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
Access size = 8 byte(s)
SSE = 0, SRT = 3
SF = 1, AR = 0
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046851000
[0000000000000000] pgd=0800000047e00003, p4d=0800000047e00003, pud=080000004684b003, pmd=0000000000000000
Internal error: Oops: 0000000097c38006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3098 Comm: syz-executor448 Not tainted 6.6.0-rc6-syzkaller-00045-g7cf4bea77ab6 #0
Hardware name: linux,dummy-virt (DT)
pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : page_kasan_tag include/linux/mm.h:1801 [inline]
pc : lowmem_page_address include/linux/mm.h:2172 [inline]
pc : kmap_local_page include/linux/highmem-internal.h:185 [inline]
pc : copy_page_to_iter+0xb0/0x150 lib/iov_iter.c:479
lr : sk_msg_recvmsg+0xf8/0x37c net/core/skmsg.c:437
sp : ffff800082b43940
x29: ffff800082b43940 x28: 0000000000000000 x27: fdff00000526c000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
x23: 0000000000000000 x22: 0000040000000000 x21: ffff000000000000
x20: 0000000000001000 x19: ffff800082b43d50 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffdf150998
x14: 000000000000012a x13: 000000000000012a x12: 0000000000000002
x11: 0000000000000001 x10: b5bbc95fda8a2138 x9 : 9908e50d67e0cf7a
x8 : f6ff000004f48f88 x7 : 0000000000000000 x6 : f9ff000004e6ed40
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff800082b43d50
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
arch_static_branch_jump arch/arm64/include/asm/jump_label.h:38 [inline]
kasan_enabled include/linux/kasan-enabled.h:13 [inline]
page_kasan_tag include/linux/mm.h:1800 [inline]
lowmem_page_address include/linux/mm.h:2172 [inline]
kmap_local_page include/linux/highmem-internal.h:185 [inline]
copy_page_to_iter+0xb0/0x150 lib/iov_iter.c:479
sk_msg_recvmsg+0xf8/0x37c net/core/skmsg.c:437
unix_bpf_recvmsg net/unix/unix_bpf.c:73 [inline]
unix_bpf_recvmsg+0x13c/0x4f0 net/unix/unix_bpf.c:50
unix_dgram_recvmsg+0x30/0x4c net/unix/af_unix.c:2457
sock_recvmsg_nosec net/socket.c:1044 [inline]
sock_recvmsg net/socket.c:1066 [inline]
sock_recvmsg net/socket.c:1062 [inline]
____sys_recvmsg+0x1d0/0x268 net/socket.c:2777
___sys_recvmsg+0x90/0xe8 net/socket.c:2819
do_recvmmsg+0xc8/0x2f4 net/socket.c:2913
__sys_recvmmsg net/socket.c:2992 [inline]
__do_sys_recvmmsg net/socket.c:3015 [inline]
__se_sys_recvmmsg net/socket.c:3008 [inline]
__arm64_sys_recvmmsg+0xd0/0xec net/socket.c:3008
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:51
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:136
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:155
el0_svc+0x40/0x114 arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:595
Code: 8b160320 d346fc00 8b0032a0 d503201f (f9400323)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 8b160320 add x0, x25, x22
4: d346fc00 lsr x0, x0, #6
8: 8b0032a0 add x0, x21, x0, lsl #12
c: d503201f nop
* 10: f9400323 ldr x3, [x25] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
For archival purposes, forwarding an incoming command email to
[email protected], [email protected].
***
Subject: Test
Author: [email protected]
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in sk_msg_recvmsg
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000097c38006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
Access size = 8 byte(s)
SSE = 0, SRT = 3
SF = 1, AR = 0
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000045ff3000
[0000000000000000] pgd=080000004d468003, p4d=080000004d468003, pud=0800000045fd2003, pmd=0000000000000000
Internal error: Oops: 0000000097c38006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3469 Comm: syz-executor.0 Not tainted 6.6.0-syzkaller-gd2f51b3516da #0
Hardware name: linux,dummy-virt (DT)
pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : page_kasan_tag include/linux/mm.h:1810 [inline]
pc : lowmem_page_address include/linux/mm.h:2181 [inline]
pc : kmap_local_page include/linux/highmem-internal.h:185 [inline]
pc : copy_page_to_iter+0xb0/0x150 lib/iov_iter.c:379
lr : sk_msg_recvmsg+0xf8/0x37c net/core/skmsg.c:437
sp : ffff800082c1b940
x29: ffff800082c1b940 x28: 0000000000000000 x27: f9ff000006afdc00
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
x23: 0000000000000000 x22: 0000040000000000 x21: ffff000000000000
x20: 0000000000001000 x19: ffff800082c1bd50 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000fffffdc6d2a8
x14: 0000000000000194 x13: 0000000000000000 x12: ffff80008244fe70
x11: 0000000000000001 x10: 7210c3fc147100c6 x9 : d0bd2b0aa9cf051c
x8 : faff00000b25de48 x7 : 0000000000000000 x6 : fdff000006afd540
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff800082c1bd50
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
arch_static_branch_jump arch/arm64/include/asm/jump_label.h:38 [inline]
kasan_enabled include/linux/kasan-enabled.h:13 [inline]
page_kasan_tag include/linux/mm.h:1809 [inline]
lowmem_page_address include/linux/mm.h:2181 [inline]
kmap_local_page include/linux/highmem-internal.h:185 [inline]
copy_page_to_iter+0xb0/0x150 lib/iov_iter.c:379
sk_msg_recvmsg+0xf8/0x37c net/core/skmsg.c:437
unix_bpf_recvmsg net/unix/unix_bpf.c:73 [inline]
unix_bpf_recvmsg+0x13c/0x4f0 net/unix/unix_bpf.c:50
unix_dgram_recvmsg+0x30/0x4c net/unix/af_unix.c:2485
sock_recvmsg_nosec net/socket.c:1044 [inline]
sock_recvmsg net/socket.c:1066 [inline]
sock_recvmsg net/socket.c:1062 [inline]
____sys_recvmsg+0x1d0/0x268 net/socket.c:2807
___sys_recvmsg+0x90/0xe8 net/socket.c:2849
do_recvmmsg+0xc8/0x2f8 net/socket.c:2943
__sys_recvmmsg net/socket.c:3022 [inline]
__do_sys_recvmmsg net/socket.c:3045 [inline]
__se_sys_recvmmsg net/socket.c:3038 [inline]
__arm64_sys_recvmmsg+0xd0/0xec net/socket.c:3038
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:51
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:136
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:155
el0_svc+0x34/0xd8 arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:595
Code: 8b160320 d346fc00 8b0032a0 d503201f (f9400323)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 8b160320 add x0, x25, x22
4: d346fc00 lsr x0, x0, #6
8: 8b0032a0 add x0, x21, x0, lsl #12
c: d503201f nop
* 10: f9400323 ldr x3, [x25] <-- trapping instruction
Tested on:
commit: d2f51b35 Merge tag 'rtc-6.7' of git://git.kernel.org/p..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=10d706eb680000
kernel config: https://syzkaller.appspot.com/x/.config?x=fe6eaf758d1d4518
dashboard link: https://syzkaller.appspot.com/bug?extid=84f695756ed0c4bb3aba
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Note: no patches were applied.
For archival purposes, forwarding an incoming command email to
[email protected].
***
Subject: test arm64, please
Author: [email protected]
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
--
Andrew Kanner
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in sk_msg_recvmsg
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043940000
[0000000000000000] pgd=08000000468bd003, p4d=08000000468bd003, pud=0800000046ab8003, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3479 Comm: syz-executor.0 Not tainted 6.9.0-rc4-syzkaller-g96fca68c4fbf #0
Hardware name: linux,dummy-virt (DT)
pstate: 61401009 (nZCv daif +PAN -UAO -TCO +DIT +SSBS BTYPE=--)
pc : page_kasan_tag include/linux/mm.h:1834 [inline]
pc : lowmem_page_address include/linux/mm.h:2234 [inline]
pc : kmap_local_page include/linux/highmem-internal.h:185 [inline]
pc : copy_page_to_iter+0xb4/0x154 lib/iov_iter.c:360
lr : sk_msg_recvmsg+0xf8/0x37c net/core/skmsg.c:437
sp : ffff80008964b940
x29: ffff80008964b940 x28: 0000000000000000 x27: f1ff000005cd9800
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
x23: 0000000000000000 x22: 0000020040000000 x21: ffff000000000000
x20: 0000000000001000 x19: ffff80008964bd50 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000382 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000001 x10: 382d7d5bed6f0326 x9 : a9c46d8380c16462
x8 : fdff0000056d6bc8 x7 : 0000000000000000 x6 : fdff000005cd6d40
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80008964bd50
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff801000000000
Call trace:
arch_static_branch_jump arch/arm64/include/asm/jump_label.h:38 [inline]
kasan_enabled include/linux/kasan-enabled.h:13 [inline]
page_kasan_tag include/linux/mm.h:1833 [inline]
lowmem_page_address include/linux/mm.h:2234 [inline]
kmap_local_page include/linux/highmem-internal.h:185 [inline]
copy_page_to_iter+0xb4/0x154 lib/iov_iter.c:360
sk_msg_recvmsg+0xf8/0x37c net/core/skmsg.c:437
unix_bpf_recvmsg net/unix/unix_bpf.c:73 [inline]
unix_bpf_recvmsg+0x13c/0x4f0 net/unix/unix_bpf.c:50
unix_dgram_recvmsg+0x30/0x4c net/unix/af_unix.c:2529
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg net/socket.c:1068 [inline]
sock_recvmsg net/socket.c:1064 [inline]
____sys_recvmsg+0x1d0/0x268 net/socket.c:2803
___sys_recvmsg+0x90/0xe8 net/socket.c:2845
do_recvmmsg+0xc8/0x2f8 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__arm64_sys_recvmmsg+0xd0/0xec net/socket.c:3034
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152
el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: 8b160320 d346fc00 8b0032a0 d503201f (f9400323)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 8b160320 add x0, x25, x22
4: d346fc00 lsr x0, x0, #6
8: 8b0032a0 add x0, x21, x0, lsl #12
c: d503201f nop
* 10: f9400323 ldr x3, [x25] <-- trapping instruction
Tested on:
commit: 96fca68c Merge tag 'nfsd-6.9-3' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16572cc3180000
kernel config: https://syzkaller.appspot.com/x/.config?x=4ba795506e24be71
dashboard link: https://syzkaller.appspot.com/bug?extid=84f695756ed0c4bb3aba
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Note: no patches were applied.