general protection fault in pvclock_gtod_notify (2)

Status: closed as dup on 2020/09/25 12:16
Subsystems: kvm-x86
[Documentation on labels]
Reported-by: syzbot+1dccfcb049726389379c@syzkaller.appspotmail.com
First crash: 2138d, last: 2128d
▶ ▼ Duplicate of
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported
general protection fault in perf_misc_flags perf 2 7 2128d 2136d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
general protection fault in perf_misc_flags 40 (41) 2020/10/01 11:05
BUG: unable to handle kernel NULL pointer dereference in map_vdso 2 (3) 2020/09/25 12:16
general protection fault in pvclock_gtod_notify (2) 2 (3) 2020/09/25 12:16
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in pvclock_gtod_notify kvm-x86 2 C 69 2139d 2220d 0/29 closed as dup on 2020/06/30 06:12

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 388 Comm: kworker/u4:5 Not tainted 5.9.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: krdsd rds_connect_worker
RIP: 0010:update_pvclock_gtod arch/x86/kvm/x86.c:1742 [inline]
RIP: 0010:pvclock_gtod_notify+0xce/0x490 arch/x86/kvm/x86.c:7466
Code: 41 b8 01 00 00 00 45 31 c9 41 56 e8 2c 85 4c 00 48 83 c4 08 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 42 6a a7 00 <49> 8b 00 00 00 00 4c 48 89 d8 48 c1 e8 03 42 8a 04 20 84 c0 0f 85
RSP: 0018:ffffc90000da8c50 EFLAGS: 00010046
RAX: 1ffffffff175237d RBX: 0000000000010001 RCX: ffffffff815acbf4
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 0000000000000082
RBP: ffffffff896bd1a8 R08: dffffc0000000000 R09: fffffbfff16c80a0
R10: fffffbfff16c80a0 R11: 0000000000000000 R12: dffffc0000000000
R13: 00000000ffffffff R14: ffffffff814f60f7 R15: ffffffff8ba91be8
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559c89e4c118 CR3: 0000000050313000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 notifier_call_chain kernel/notifier.c:83 [inline]
 __raw_notifier_call_chain kernel/notifier.c:361 [inline]
 raw_notifier_call_chain+0xe7/0x170 kernel/notifier.c:368
 update_pvclock_gtod kernel/time/timekeeping.c:581 [inline]
 timekeeping_update+0x281/0x3f0 kernel/time/timekeeping.c:675
 timekeeping_advance+0x830/0xa00 kernel/time/timekeeping.c:2122
 tick_sched_do_timer kernel/time/tick-sched.c:147 [inline]
 tick_sched_timer+0xba/0x410 kernel/time/tick-sched.c:1321
 __run_hrtimer kernel/time/hrtimer.c:1524 [inline]
 __hrtimer_run_queues+0x42d/0x930 kernel/time/hrtimer.c:1588
 hrtimer_interrupt+0x373/0xd60 kernel/time/hrtimer.c:1650
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1080 [inline]
 __sysvec_apic_timer_interrupt+0xf0/0x260 arch/x86/kernel/apic/apic.c:1097
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 sysvec_apic_timer_interrupt+0x94/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:102 [inline]
RIP: 0010:__local_bh_enable_ip+0x155/0x1c0 kernel/softirq.c:202
Code: 6d 89 48 c1 e8 03 42 80 3c 38 00 74 0c 48 c7 c7 c8 17 6d 89 e8 cc e1 6c 00 48 83 3d 4c 2d 25 08 00 74 6a fb 66 0f 1f 44 00 00 <65> 8b 05 80 13 ba 7e 85 c0 75 05 e8 f2 84 b8 ff 5b 41 5e 41 5f 5d
RSP: 0018:ffffc900021d75a0 EFLAGS: 00000286
RAX: 1ffffffff12da2f9 RBX: 0000000000000282 RCX: ffff8880a8b861c0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000000001ff R08: dffffc0000000000 R09: fffffbfff16c80a9
R10: fffffbfff16c80a9 R11: 0000000000000000 R12: 0000000000000010
R13: ffff88804761a6a8 R14: ffffffff870ca0a5 R15: dffffc0000000000
 rcu_read_unlock_bh include/linux/rcupdate.h:723 [inline]
 ip_finish_output2+0x1492/0x18e0 net/ipv4/ip_output.c:230
 dst_output include/net/dst.h:443 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0x1087/0x1aa0 net/ipv4/ip_output.c:531
 __tcp_transmit_skb+0x1bfd/0x3040 net/ipv4/tcp_output.c:1246
 tcp_transmit_skb net/ipv4/tcp_output.c:1264 [inline]
 tcp_connect+0x98b/0x2480 net/ipv4/tcp_output.c:3686
 tcp_v4_connect+0x10a1/0x1b70 net/ipv4/tcp_ipv4.c:312
 __inet_stream_connect+0x93d/0xc20 net/ipv4/af_inet.c:661
 inet_stream_connect+0x61/0xa0 net/ipv4/af_inet.c:725
 rds_tcp_conn_path_connect+0x62b/0x9a0 net/rds/tcp_connect.c:172
 rds_connect_worker+0x1c3/0x270 net/rds/threads.c:176
 process_one_work+0x789/0xfc0 kernel/workqueue.c:2269
 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415
 kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Modules linked in:
---[ end trace bd5339edc05e44e1 ]---
RIP: 0010:update_pvclock_gtod arch/x86/kvm/x86.c:1742 [inline]
RIP: 0010:pvclock_gtod_notify+0xce/0x490 arch/x86/kvm/x86.c:7466
Code: 41 b8 01 00 00 00 45 31 c9 41 56 e8 2c 85 4c 00 48 83 c4 08 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 42 6a a7 00 <49> 8b 00 00 00 00 4c 48 89 d8 48 c1 e8 03 42 8a 04 20 84 c0 0f 85
RSP: 0018:ffffc90000da8c50 EFLAGS: 00010046
RAX: 1ffffffff175237d RBX: 0000000000010001 RCX: ffffffff815acbf4
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 0000000000000082
RBP: ffffffff896bd1a8 R08: dffffc0000000000 R09: fffffbfff16c80a0
R10: fffffbfff16c80a0 R11: 0000000000000000 R12: dffffc0000000000
R13: 00000000ffffffff R14: ffffffff814f60f7 R15: ffffffff8ba91be8
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559c89e4c118 CR3: 0000000050313000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/09/27 07:26 upstream eeddbe6841cd 5dd8aee8 .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/21 12:11 upstream ba4f184e126b 9e1fa68e .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/19 21:10 upstream eb5f95f1593f 53ce8104 .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/18 04:11 upstream 10b82d517648 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/18 00:29 upstream 5925fa68fe82 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/17 23:06 upstream 5925fa68fe82 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/17 19:44 upstream 5925fa68fe82 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/17 17:31 upstream 5925fa68fe82 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/17 14:58 upstream 5925fa68fe82 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
2020/09/17 08:00 upstream 5925fa68fe82 8247808b .config console log report info ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.