[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMt6jhxg-_Pd__TfpSqX+=d2_-MFqCoF84qYYDcuu1Ps9M9hfQ@mail.gmail.com>
Date: Thu, 10 Nov 2022 13:47:26 -0500
From: Sanan Hasanov <hasanou59@...il.com>
To: peterz@...radead.org, mingo@...hat.com, acme@...nel.org,
mark.rutland@....com, alexander.shishkin@...ux.intel.com,
jolsa@...nel.org, namhyung@...nel.org, tglx@...utronix.de,
bp@...en8.de, dave.hansen@...ux.intel.com, x86@...nel.org,
hpa@...or.com, linux-perf-users@...r.kernel.org,
linux-kernel@...r.kernel.org
Cc: paul@...zz.com, syzkaller <syzkaller@...glegroups.com>
Subject: Syzkaller found a bug: general protection fault in x86_pmu_enable_event
Good day, dear maintainers,
We found a bug using a modified kernel configuration file used by syzbot.
We enhanced the coverage of the configuration file using our tool, krepair.
config and reproducer files are attached.
Branch: https://github.com/torvalds/linux (HEAD detached at 33c9805860e58)
Reproducer can be executed as follows:
./syz-execprog -repeat=0 -procs=8 program
More info: https://github.com/google/syzkaller/blob/master/docs/executing_syzkaller_programs.md
Thank you!
general protection fault, probably for non-canonical address
0xdffffc0000000033: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000198-0x000000000000019f]
CPU: 0 PID: 7030 Comm: systemd-udevd Not tainted
6.1.0-rc1-00010-gbb1a1146467a #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:x86_pmu_enable_event+0x61/0x2b0
Code: 00 e8 93 95 3a 00 48 c7 c7 40 59 60 85 e8 47 17 a4 02 48 8d bb
98 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6
04 02 65 48 8b 2d 0b 46 a1 7d 84 c0 74 08 3c 03 0f 8e f3 01
RSP: 0000:ffff88811ae09ce8 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8260e90d
RDX: 0000000000000033 RSI: ffffffff85605940 RDI: 0000000000000198
RBP: ffff88811ae21e20 R08: 0000000000000001 R09: ffffed10235c43c5
R10: ffff88811ae21e27 R11: ffffed10235c43c4 R12: 0000000000000007
R13: ffff88811ae21c20 R14: fffffbfff0cf1d0f R15: 0000000000000004
FS: 00007f2607dbb8c0(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005606fbe35108 CR3: 000000010c384000 CR4: 0000000000350ef0
DR0: 0000000003be2348 DR1: 0000000003be2348 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
amd_pmu_enable_all+0x101/0x160
x86_pmu_enable+0x367/0xcb0
perf_pmu_enable+0xb6/0xf0
perf_mux_hrtimer_handler+0x4c0/0x880
__hrtimer_run_queues+0x2cf/0x6c0
hrtimer_interrupt+0x2f3/0x700
__sysvec_apic_timer_interrupt+0x114/0x370
sysvec_apic_timer_interrupt+0x89/0xc0
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x70
Code: 00 00 00 e9 f5 b6 a4 02 48 89 f7 e9 cd fc ff ff 66 66 2e 0f 1f
84 00 00 00 00 00 66 90 65 8b 05 19 ee 66 7d 89 c6 48 8b 0c 24 <81> e6
00 01 00 00 65 48 8b 14 25 00 6d 02 00 a9 00 01 ff 00 74 0e
RSP: 0000:ffff888111adfd18 EFLAGS: 00000246
RAX: 0000000080000000 RBX: ffff88800a90ba00 RCX: ffffffff84f039aa
RDX: ffff88811137e480 RSI: 0000000080000000 RDI: ffff88800a90baf0
RBP: ffff88800a90ba08 R08: 0000000000000001 R09: ffffed10011c59a0
R10: ffff888008e2ccff R11: ffffed10011c599f R12: ffff88800a90ba1c
R13: 0000000000000003 R14: 00005606fbe35108 R15: dffffc0000000000
mt_find+0x23a/0x9a0
find_vma+0x77/0xa0
do_user_addr_fault+0x268/0xe80
exc_page_fault+0x78/0x120
asm_exc_page_fault+0x22/0x30
RIP: 0033:0x7f2606bcae74
Code: fa ff ff 48 3b 5a 28 0f 85 28 04 00 00 48 8b 4b 28 48 3b 59 20
0f 85 1a 04 00 00 48 83 78 20 00 0f 84 3a 04 00 00 48 8b 43 28 <48> 89
42 28 48 8b 43 28 48 89 50 20 e9 5a fa ff ff 0f 1f 00 49 8b
RSP: 002b:00007ffdefeb6a10 EFLAGS: 00010206
RAX: 00005606fbe350e0 RBX: 00005606fbe350e0 RCX: 00005606fbe350e0
RDX: 00005606fbe350e0 RSI: 0000000000000000 RDI: 00007f2606eecb00
RBP: 00007f2606eecb00 R08: 00000000ffffffff R09: 000000000000001e
R10: 00007f2607dbb8c0 R11: 00005606fa0729a0 R12: 0000000000000000
R13: 0000000000005140 R14: 00005606fbe3a220 R15: 0000000000001010
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:x86_pmu_enable_event+0x61/0x2b0
Code: 00 e8 93 95 3a 00 48 c7 c7 40 59 60 85 e8 47 17 a4 02 48 8d bb
98 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6
04 02 65 48 8b 2d 0b 46 a1 7d 84 c0 74 08 3c 03 0f 8e f3 01
RSP: 0000:ffff88811ae09ce8 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8260e90d
RDX: 0000000000000033 RSI: ffffffff85605940 RDI: 0000000000000198
RBP: ffff88811ae21e20 R08: 0000000000000001 R09: ffffed10235c43c5
R10: ffff88811ae21e27 R11: ffffed10235c43c4 R12: 0000000000000007
R13: ffff88811ae21c20 R14: fffffbfff0cf1d0f R15: 0000000000000004
FS: 00007f2607dbb8c0(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005606fbe35108 CR3: 000000010c384000 CR4: 0000000000350ef0
DR0: 0000000003be2348 DR1: 0000000003be2348 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
0: 00 e8 add %ch,%al
2: 93 xchg %eax,%ebx
3: 95 xchg %eax,%ebp
4: 3a 00 cmp (%rax),%al
6: 48 c7 c7 40 59 60 85 mov $0xffffffff85605940,%rdi
d: e8 47 17 a4 02 callq 0x2a41759
12: 48 8d bb 98 01 00 00 lea 0x198(%rbx),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 65 48 8b 2d 0b 46 a1 mov %gs:0x7da1460b(%rip),%rbp # 0x7da14641
35: 7d
36: 84 c0 test %al,%al
38: 74 08 je 0x42
3a: 3c 03 cmp $0x3,%al
3c: 0f .byte 0xf
3d: 8e f3 mov %ebx,%?
3f: 01 .byte 0x1
Download attachment "core.c.config" of type "application/octet-stream" (505102 bytes)
Download attachment "repro.prog" of type "application/octet-stream" (787 bytes)
Powered by blists - more mailing lists