syzbot
BUG: unable to handle kernel paging request in e1000_get_variants_82571
Status:
upstream: reported C repro on 2026/08/06 15:36
Subsystems:
intel-wired-lan
[Documentation on labels]
Reported-by: syzbot+0ddf1022b4d5c391c09b@syzkaller.appspotmail.com
First crash: 2d13h, last: 2d01h
Sample crash report:
e1000e 0000:00:03.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
e1000e 0000:00:03.0 0000:00:03.0 (uninitialized): Failed to initialize MSI interrupts. Falling back to legacy interrupts.
BUG: unable to handle page fault for address: ffffc900035b4b58
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 13fe5c067 P4D 13fe5c067 PUD 1cae3067 PMD 22725067 PTE 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: sync_wq local_pci_probe_callback
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:__er32 drivers/net/ethernet/intel/e1000e/e1000.h:604 [inline]
RIP: 0010:e1000_init_mac_params_82571 drivers/net/ethernet/intel/e1000e/82571.c:278 [inline]
RIP: 0010:e1000_get_variants_82571+0xe08/0x1c30 drivers/net/ethernet/intel/e1000e/82571.c:320
Code: f6 ff ff e8 da 1f 0f fb 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f7 0b 00 00 49 8b 87 00 07 00 00 <8b> a8 58 5b 00 00 89 e8 31 ff 83 e0 02 89 c6 89 44 24 10 e8 10 1a
RSP: 0018:ffffc900000f7a00 EFLAGS: 00010246
RAX: ffffc900035af000 RBX: ffff88807ed91694 RCX: ffffffff86fb44f8
RDX: 1ffff1100fdb22b8 RSI: ffffffff86fb4506 RDI: ffff88801eaa2540
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff9200001ef45
R13: ffff88807ed915c0 R14: ffff88807ed915b8 R15: ffff88807ed90ec0
FS: 0000000000000000(0000) GS:ffff888123dd8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900035b4b58 CR3: 0000000073af9000 CR4: 00000000003526f0
Call Trace:
<TASK>
e1000_probe+0x1123/0x36b0 drivers/net/ethernet/intel/e1000e/netdev.c:7494
local_pci_probe+0xdd/0x1b0 drivers/pci/pci-driver.c:332
local_pci_probe_callback+0x35/0x80 drivers/pci/pci-driver.c:361
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
CR2: ffffc900035b4b58
---[ end trace 0000000000000000 ]---
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:__er32 drivers/net/ethernet/intel/e1000e/e1000.h:604 [inline]
RIP: 0010:e1000_init_mac_params_82571 drivers/net/ethernet/intel/e1000e/82571.c:278 [inline]
RIP: 0010:e1000_get_variants_82571+0xe08/0x1c30 drivers/net/ethernet/intel/e1000e/82571.c:320
Code: f6 ff ff e8 da 1f 0f fb 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f7 0b 00 00 49 8b 87 00 07 00 00 <8b> a8 58 5b 00 00 89 e8 31 ff 83 e0 02 89 c6 89 44 24 10 e8 10 1a
RSP: 0018:ffffc900000f7a00 EFLAGS: 00010246
RAX: ffffc900035af000 RBX: ffff88807ed91694 RCX: ffffffff86fb44f8
RDX: 1ffff1100fdb22b8 RSI: ffffffff86fb4506 RDI: ffff88801eaa2540
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff9200001ef45
R13: ffff88807ed915c0 R14: ffff88807ed915b8 R15: ffff88807ed90ec0
FS: 0000000000000000(0000) GS:ffff888123dd8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900035b4b58 CR3: 0000000073af9000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: f6 ff idiv %bh
2: ff ljmp (bad)
3: e8 da 1f 0f fb call 0xfb0f1fe2
8: 4c 89 ea mov %r13,%rdx
b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
12: fc ff df
15: 48 c1 ea 03 shr $0x3,%rdx
19: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
1d: 0f 85 f7 0b 00 00 jne 0xc1a
23: 49 8b 87 00 07 00 00 mov 0x700(%r15),%rax
* 2a: 8b a8 58 5b 00 00 mov 0x5b58(%rax),%ebp <-- trapping instruction
30: 89 e8 mov %ebp,%eax
32: 31 ff xor %edi,%edi
34: 83 e0 02 and $0x2,%eax
37: 89 c6 mov %eax,%esi
39: 89 44 24 10 mov %eax,0x10(%rsp)
3d: e8 .byte 0xe8
3e: 10 1a adc %bl,(%rdx)
* Struck through repros no longer work on HEAD.