Good day, dear maintainers,
We found a bug using a modified kernel configuration file used by syzbot.
We enhanced the coverage of the configuration file using our tool, klocalizer.
Kernel Branch: 6.2.0-rc4-next-20230116
Kernel config: https://drive.google.com/file/d/1aDw7_IXEzr5avqtp-fb6mG199n7gkvy-/view?usp=sharing
Reproducer: https://drive.google.com/file/d/1JTPF8M111AkePf_Hce8dmkAdhjoSRMc-/view?usp=sharing
Thank you!
Best regards,
Sanan Hasanov
current_req=0000000000000000
command_status=-1
floppy0: floppy timeout called
no cont in shutdown!
floppy0: floppy_shutdown: timeout handler died.
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 3 PID: 90 Comm: kworker/u16:5 Not tainted 6.2.0-rc4-next-20230116 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: floppy floppy_work_workfn
RIP: 0010:floppy_ready+0xbc2/0x1400
Code: 8e e8 12 5a f6 fc f0 80 8b 20 9e 45 8e 10 48 8b 1d 63 51 6f 09 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9e 07 00 00 31 ff ff 53 18 48 8b 1d 38 51 6f 09
RSP: 0018:ffffc90000767ca0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff84d62ace
RDX: 0000000000000003 RSI: 0000000000000008 RDI: 0000000000000018
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff8e459e27
R10: fffffbfff1c8b3c4 R11: 0000000000000001 R12: ffffffff8e459e20
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88811a180000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc919f1940 CR3: 00000001148af000 CR4: 0000000000350ee0
Call Trace:
<TASK>
seek_interrupt+0x28a/0x2e0
process_one_work+0x9ba/0x1760
worker_thread+0x669/0x1090
kthread+0x2e8/0x3a0
ret_from_fork+0x1f/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:floppy_ready+0xbc2/0x1400
Code: 8e e8 12 5a f6 fc f0 80 8b 20 9e 45 8e 10 48 8b 1d 63 51 6f 09 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9e 07 00 00 31 ff ff 53 18 48 8b 1d 38 51 6f 09
RSP: 0018:ffffc90000767ca0 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff84d62ace
RDX: 0000000000000003 RSI: 0000000000000008 RDI: 0000000000000018
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff8e459e27
R10: fffffbfff1c8b3c4 R11: 0000000000000001 R12: ffffffff8e459e20
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88811a180000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc919f1940 CR3: 00000001148af000 CR4: 0000000000350ee0
----------------
Code disassembly (best guess):
0: 8e e8 mov %eax,%gs
2: 12 5a f6 adc -0xa(%rdx),%bl
5: fc cld
6: f0 80 8b 20 9e 45 8e lock orb $0x10,-0x71ba61e0(%rbx)
d: 10
e: 48 8b 1d 63 51 6f 09 mov 0x96f5163(%rip),%rbx # 0x96f5178
15: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1c: fc ff df
1f: 48 8d 7b 18 lea 0x18(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 9e 07 00 00 jne 0x7d2
34: 31 ff xor %edi,%edi
36: ff 53 18 call *0x18(%rbx)
39: 48 8b 1d 38 51 6f 09 mov 0x96f5138(%rip),%rbx # 0x96f5178