Message-ID: <xftkeek5ydwgnfc3x3nhwzhawbe5blucnuatw5hcnm3gp75scs@nhwpxyh6phjo>
Date: Thu, 15 May 2025 10:17:15 +0200
From: Joel Granados <joel.granados@...nel.org>
To: syzbot <syzbot+0b62957894976d747660@...kaller.appspotmail.com>
Cc: kees@...nel.org, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [fs?] BUG: unable to handle kernel paging request in
 drop_sysctl_table

On Wed, May 14, 2025 at 03:36:33PM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    1a33418a69cc Merge tag '6.15-rc5-smb3-client-fixes' of git..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15c0ccf4580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=925afd2bdd38a581
> dashboard link: https://syzkaller.appspot.com/bug?extid=0b62957894976d747660
> compiler:       arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=160eecf4580000
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/98a89b9f34e4/non_bootable_disk-1a33418a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1b719c768f61/vmlinux-1a33418a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/37b85c3e7f3b/zImage-1a33418a.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+0b62957894976d747660@...kaller.appspotmail.com
> 
> veth1_macvtap: left promiscuous mode
> veth0_macvtap: left promiscuous mode
> veth1_vlan: left promiscuous mode
> veth0_vlan: left promiscuous mode
> 8<--- cut here ---
> Unable to handle kernel paging request at virtual address 74756f78 when read
> [74756f78] *pgd=80000080005003, *pmd=00000000
> Internal error: Oops: 206 [#1] SMP ARM
> Modules linked in:
> CPU: 1 UID: 0 PID: 3143 Comm: kworker/u8:2 Not tainted 6.15.0-rc5-syzkaller #0 PREEMPT 
> Hardware name: ARM-Versatile Express
> Workqueue: netns cleanup_net
> PC is at __rb_change_child include/linux/rbtree_augmented.h:199 [inline]
> PC is at __rb_erase_augmented include/linux/rbtree_augmented.h:242 [inline]
> PC is at rb_erase+0x270/0x394 lib/rbtree.c:443
> LR is at 0x0
> pc : [<81a3fb58>]    lr : [<00000000>]    psr: 200f0013
> sp : df9e5d80  ip : 74756f70  fp : df9e5d94
> r10: 82c1f980  r9 : 829d1ec4  r8 : 00000004
> r7 : 838d8b00  r6 : 00000001  r5 : 8517c348  r4 : 8517c300
> r3 : 74756f72  r2 : 00000000  r1 : 838d8b34  r0 : 8517c368
> Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
> Control: 30c5387d  Table: 850515c0  DAC: 00000000
> Register r0 information: slab kmalloc-128 start 8517c300 pointer offset 104 size 128
> Register r1 information: slab kmalloc-128 start 838d8b00 pointer offset 52 size 128
> Register r2 information: NULL pointer
> Register r3 information: non-paged memory
> Register r4 information: slab kmalloc-128 start 8517c300 pointer offset 0 size 128
> Register r5 information: slab kmalloc-128 start 8517c300 pointer offset 72 size 128
> Register r6 information: non-paged memory
> Register r7 information: slab kmalloc-128 start 838d8b00 pointer offset 0 size 128
> Register r8 information: non-paged memory
> Register r9 information: non-slab/vmalloc memory
> Register r10 information: non-slab/vmalloc memory
> Register r11 information: 2-page vmalloc region starting at 0xdf9e4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2844
> Register r12 information: non-paged memory
> Process kworker/u8:2 (pid: 3143, stack limit = 0xdf9e4000)
> Stack: (0xdf9e5d80 to 0xdf9e6000)
> 5d80: 8517c300 8517c348 df9e5dd4 df9e5d98 80610d54 81a3f8f4 0000000c 600f0013
> 5da0: ddde099c 600f0013 00000000 03710a8b 8517cb00 84813a00 8517cb00 00000001
> 5dc0: 8517c300 00000004 df9e5e14 df9e5dd8 80610d88 80610c90 816f4260 829d1ec4
> 5de0: 829d1ec4 82aca2a8 df9e5e90 03710a8b df9e5e14 84813a00 df9e5e90 829e0224
> 5e00: df9e5e90 829d1ec4 df9e5e2c df9e5e18 80610e58 80610c90 8517cb00 df9e5e90
> 5e20: df9e5e3c df9e5e30 81980b1c 80610e3c df9e5e54 df9e5e40 816f45b0 81980b18
> 5e40: 84951b00 df9e5e90 df9e5e74 df9e5e58 81539cdc 816f45a4 829e0224 82c1f940
> 5e60: 829d1e80 df9e5e90 df9e5ed4 df9e5e78 8153c160 81539ca8 81a5bd14 8029ce24
> 5e80: 82c1f940 829d1e80 808c99b0 81539d04 84951b20 84951b20 00000100 00000122
> 5ea0: 00000000 03710a8b 81c01f84 83b83d80 829d1e98 8301bc00 8300e600 84186000
> 5ec0: 8301bc15 8300f070 df9e5f2c df9e5ed8 802873bc 8153bebc 81c01a44 84186000
> 5ee0: df9e5f14 df9e5ef0 829d1e9c 829d1e98 829d1e9c 829d1e98 df9e5f2c 00000000
> 5f00: 80282cf8 83b83d80 8300e620 8300e600 82804d40 83b83dac 84186000 61c88647
> 5f20: df9e5f6c df9e5f30 80288004 80287214 81a5bd14 8029ce24 df9e5f6c df9e5f48
> 5f40: 8028eb98 00000001 84186000 83b83e00 e4935e60 80287e08 83b83d80 00000000
> 5f60: df9e5fac df9e5f70 8028f07c 80287e14 80274ea8 81a5bc9c 84186000 03710a8b
> 5f80: df9e5fac 84986300 8028ef50 00000000 00000000 00000000 00000000 00000000
> 5fa0: 00000000 df9e5fb0 80200114 8028ef5c 00000000 00000000 00000000 00000000
> 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
> Call trace: 
> [<81a3f8e8>] (rb_erase) from [<80610d54>] (erase_entry fs/proc/proc_sysctl.c:189 [inline])
> [<81a3f8e8>] (rb_erase) from [<80610d54>] (erase_header fs/proc/proc_sysctl.c:225 [inline])
> [<81a3f8e8>] (rb_erase) from [<80610d54>] (start_unregistering fs/proc/proc_sysctl.c:322 [inline])
> [<81a3f8e8>] (rb_erase) from [<80610d54>] (drop_sysctl_table+0xd0/0x1ac fs/proc/proc_sysctl.c:1514)
>  r5:8517c348 r4:8517c300
> [<80610c84>] (drop_sysctl_table) from [<80610d88>] (drop_sysctl_table+0x104/0x1ac fs/proc/proc_sysctl.c:1521)
>  r8:00000004 r7:8517c300 r6:00000001 r5:8517cb00 r4:84813a00
> [<80610c84>] (drop_sysctl_table) from [<80610e58>] (unregister_sysctl_table fs/proc/proc_sysctl.c:1539 [inline])
> [<80610c84>] (drop_sysctl_table) from [<80610e58>] (unregister_sysctl_table+0x28/0x38 fs/proc/proc_sysctl.c:1531)
>  r8:829d1ec4 r7:df9e5e90 r6:829e0224 r5:df9e5e90 r4:84813a00
> [<80610e30>] (unregister_sysctl_table) from [<81980b1c>] (unregister_net_sysctl_table+0x10/0x14 net/sysctl_net.c:177)
>  r5:df9e5e90 r4:8517cb00
> [<81980b0c>] (unregister_net_sysctl_table) from [<816f45b0>] (sysctl_route_net_exit+0x18/0x38 net/ipv4/route.c:3632)
> [<816f4598>] (sysctl_route_net_exit) from [<81539cdc>] (ops_exit_list+0x40/0x68 net/core/net_namespace.c:172)
>  r5:df9e5e90 r4:84951b00
> [<81539c9c>] (ops_exit_list) from [<8153c160>] (cleanup_net+0x2b0/0x49c net/core/net_namespace.c:654)
>  r7:df9e5e90 r6:829d1e80 r5:82c1f940 r4:829e0224
> [<8153beb0>] (cleanup_net) from [<802873bc>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3238)
>  r10:8300f070 r9:8301bc15 r8:84186000 r7:8300e600 r6:8301bc00 r5:829d1e98
>  r4:83b83d80
> [<80287208>] (process_one_work) from [<80288004>] (process_scheduled_works kernel/workqueue.c:3319 [inline])
> [<80287208>] (process_one_work) from [<80288004>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3400)
>  r10:61c88647 r9:84186000 r8:83b83dac r7:82804d40 r6:8300e600 r5:8300e620
>  r4:83b83d80
> [<80287e08>] (worker_thread) from [<8028f07c>] (kthread+0x12c/0x280 kernel/kthread.c:464)
>  r10:00000000 r9:83b83d80 r8:80287e08 r7:e4935e60 r6:83b83e00 r5:84186000
>  r4:00000001
> [<8028ef50>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137)

I'm looking at https://syzkaller.appspot.com/text?tag=ReproLog&x=11a1b4d4580000
and I see that a test failed in neigh_parms_release before all this happened
(output here [1]). Questions:

1. Could the previous test have caused this to show in sysctl
   erase_entry? How do I find out?

2. I don't have clear what commit introduced this. I see a head commit,
   but I cant find the subcommit related to this failure.

Help appreciated.

[1]
  program crashed: BUG: corrupted list in neigh_parms_release
  a never seen crash title: BUG: corrupted list in neigh_parms_release, ignore
  testing program (duration=22m39.514192312s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-syz_clone
  detailed listing:
  executing program 0:
  openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
  syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)


Best
-- 

Joel Granados

Download attachment "signature.asc" of type "application/pgp-signature" (660 bytes)

Powered by blists - more mailing lists