Messages in this thread | | | Date | Wed, 11 Apr 2018 14:02:02 -0700 | Subject | BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:LINE (2) | From | syzbot <> |
| |
Hello,
syzbot hit the following crash on upstream commit c18bb396d3d261ebbb4efbc05129c5d354c541e4 (Tue Apr 10 00:04:10 2018 +0000) Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=4af447792df4648be93b
syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=4934545564499968 Raw console output: https://syzkaller.appspot.com/x/log.txt?id=6277896712749056 Kernel config: https://syzkaller.appspot.com/x/.config?id=-1223000601505858474 compiler: gcc (GCC) 8.0.1 20180301 (experimental)
IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+4af447792df4648be93b@syzkaller.appspotmail.com It will help syzbot understand when the bug is fixed. See footer for details. If you forward the report, please keep this part and the footer.
IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1342 in_atomic(): 0, irqs_disabled(): 1, pid: 4512, name: blkid 1 lock held by blkid/4512: #0: 00000000d5b4e650 (&mm->mmap_sem){++++}, at: __do_page_fault+0x381/0xe40 arch/x86/mm/fault.c:1328 irq event stamp: 1812 hardirqs last enabled at (1811): [<ffffffff87600096>] entry_SYSCALL_64_after_hwframe+0x52/0xb7 hardirqs last disabled at (1812): [<ffffffff87601402>] error_entry+0x72/0xd0 arch/x86/entry/entry_64.S:1261 softirqs last enabled at (1804): [<ffffffff87800778>] __do_softirq+0x778/0xaf5 kernel/softirq.c:311 softirqs last disabled at (1797): [<ffffffff8146dd91>] invoke_softirq kernel/softirq.c:365 [inline] softirqs last disabled at (1797): [<ffffffff8146dd91>] irq_exit+0x1d1/0x200 kernel/softirq.c:405 CPU: 1 PID: 4512 Comm: blkid Not tainted 4.16.0+ #16 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: BUG: unable to handle kernel paging request at 0000000041b5e1f3 PGD 1b4390067 P4D 1b4390067 PUD 0 Oops: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 4512 Comm: blkid Tainted: G W 4.16.0+ #16 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:msr_write_intercepted arch/x86/kvm/vmx.c:2126 [inline] RIP: 0010:vmx_vcpu_run+0xa3d/0x25f0 arch/x86/kvm/vmx.c:9884 RSP: 0018:ffff8801b5d27380 EFLAGS: 00010046 ================================================================== BUG: KASAN: stack-out-of-bounds in __show_regs.cold.7+0x4e/0x54a arch/x86/kernel/process_64.c:79 Read of size 8 at addr ffff8801b5d27300 by task blkid/4512
CPU: 1 PID: 4512 Comm: blkid Tainted: G W 4.16.0+ #16 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace:
The buggy address belongs to the page: page:ffffea0006d749c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x2fffc0000000000() raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff raw: 0000000000000000 ffffea0006d70101 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff8801b5d27200: f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 ffff8801b5d27280: f3 f3 f3 f3 f2 f2 f8 f2 f2 f2 f2 f2 f2 f2 00 00 > ffff8801b5d27300: f2 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 ^ ffff8801b5d27380: f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 ffff8801b5d27400: f2 f2 f2 f2 00 f2 f2 f2 f3 f3 f3 f3 00 00 00 00 ==================================================================
--- This bug is generated by a dumb bot. It may contain errors. See https://goo.gl/tpsmEJ for details. Direct all questions to syzkaller@googlegroups.com.
syzbot will keep track of this bug report. If you forgot to add the Reported-by tag, once the fix for this bug is merged into any tree, please reply to this email with: #syz fix: exact-commit-title If you want to test a patch for this bug, please reply with: #syz test: git://repo/address.git branch and provide the patch inline or as an attachment. To mark this as a duplicate of another syzbot report, please reply with: #syz dup: exact-subject-of-another-report If it's a one-off invalid bug report, please reply with: #syz invalid Note: if the crash happens again, it will cause creation of a new bug report. Note: all commands must start from beginning of the line in the email body.
| |