Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <00000000000079eebe05fa2ea9ad@google.com> <20230426044928.GD1496740@google.com>
In-Reply-To: <20230426044928.GD1496740@google.com>
From:   Dmitry Vyukov <dvyukov@google.com>
Date:   Wed, 26 Apr 2023 08:40:23 +0200
Message-ID: <CACT4Y+bJQOYV4_VumkrwobDio8CH-oqT2Wuo4Gzz2+BkX6tqzA@mail.gmail.com>
Subject: Re: [syzbot] upstream boot error: BUG: unable to handle kernel NULL
 pointer dereference in __dabt_svc
To:     Sergey Senozhatsky <senozhatsky@chromium.org>
Cc:     syzbot <syzbot+d692037148a8169fc9dd@syzkaller.appspotmail.com>,
        alex.gaynor@gmail.com, andriy.shevchenko@linux.intel.com,
        bjorn3_gh@protonmail.com, boqun.feng@gmail.com,
        bpf@vger.kernel.org, gary@garyguo.net,
        linux-kernel@vger.kernel.org, linux@rasmusvillemoes.dk,
        ojeda@kernel.org, pmladek@suse.com, rostedt@goodmis.org,
        rust-for-linux@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        wedsonaf@gmail.com,
        Linux ARM <linux-arm-kernel@lists.infradead.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Wed, 26 Apr 2023 at 06:49, Sergey Senozhatsky
<senozhatsky@chromium.org> wrote:
>
> On (23/04/25 13:06), syzbot wrote:
> > 8<--- cut here ---
> > Unable to handle kernel NULL pointer dereference at virtual address 000005fc when read
> > [000005fc] *pgd=80000080004003, *pmd=00000000
> > Internal error: Oops: 206 [#1] PREEMPT SMP ARM
> > Modules linked in:
> > CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.3.0-syzkaller #0
> > Hardware name: ARM-Versatile Express
>
> > Insufficient stack space to handle exception!
>
> So much stuff is going on there.
>
> > Task stack:     [0xdf85c000..0xdf85e000]
> > IRQ stack:      [0xdf804000..0xdf806000]
> > Overflow stack: [0x828ae000..0x828af000]
> > Internal error: kernel stack overflow: 0 [#2] PREEMPT SMP ARM
> > Modules linked in:
> > CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.3.0-syzkaller #0
> > Hardware name: ARM-Versatile Express
> > PC is at __dabt_svc+0x14/0x60 arch/arm/kernel/entry-armv.S:210
> > LR is at vsnprintf+0x378/0x408 lib/vsprintf.c:2862
> > pc : [<80200a74>]    lr : [<817ad5d8>]    psr: 00000193
> > sp : df804028  ip : df805868  fp : df805864
> > r10: 00000060  r9 : ffffffff  r8 : 00000010
> > r7 : 00000020  r6 : 00000004  r5 : ffffffff  r4 : df805960
> > r3 : ffffffff  r2 : 00000040  r1 : ffffffff  r0 : 8264d250
> > Flags: nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
> > Control: 30c5387d  Table: 80003000  DAC: 00000000
> > Register r0 information:
> > 8<--- cut here ---
> > Unable to handle kernel NULL pointer dereference at virtual address 000001ff when read
> > [000001ff] *pgd=80000080004003, *pmd=00000000
> > Internal error: Oops: 206 [#3] PREEMPT SMP ARM
> > Modules linked in:
> > CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.3.0-syzkaller #0
> > Hardware name: ARM-Versatile Express
> > PC is at __find_vmap_area mm/vmalloc.c:841 [inline]
> > PC is at find_vmap_area mm/vmalloc.c:1862 [inline]
> > PC is at find_vm_area mm/vmalloc.c:2571 [inline]
> > PC is at vmalloc_dump_obj+0x38/0xb4 mm/vmalloc.c:4108
> > LR is at __raw_spin_lock include/linux/spinlock_api_smp.h:132 [inline]
> > LR is at _raw_spin_lock+0x18/0x58 kernel/locking/spinlock.c:154
>
> Not sure if I can make sense out of this.

+linux-arm-kernel@

I suspect this is some recent arch/arm related corruption.
There are also these similar boot crashes that started happening at
roughly the same time:
https://syzkaller.appspot.com/bug?id=4d697346183db2f86ba2f76acb7d66e7731f88df
https://syzkaller.appspot.com/bug?id=dcd98d67539fe4d0d28d2e655e510569eda6f4de