syzbot
WARNING in pcpu_get_vm_areas
Status:
upstream: reported on 2026/09/07 20:14
Subsystems:
bpf
[Documentation on labels]
Reported-by: syzbot+442828bb356b10813a47@syzkaller.appspotmail.com
First crash: 4d03h, last: 4d03h
Sample crash report:
------------[ cut here ]------------
unlikely(ret)
WARNING: mm/vmalloc.c:5110 at pcpu_get_vm_areas+0x12b1/0x56c0 mm/vmalloc.c:5110, CPU#0: syz.3.1809/13474
Modules linked in:
CPU: 0 UID: 0 PID: 13474 Comm: syz.3.1809 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:pcpu_get_vm_areas+0x12b1/0x56c0 mm/vmalloc.c:5110
Code: 08 48 83 84 24 c8 00 00 00 08 41 39 ef 0f 84 76 1b 00 00 89 6c 24 70 e9 58 fb ff ff 4c 8b bc 24 f0 00 00 00 e8 70 78 a0 ff 90 <0f> 0b 90 e8 67 78 a0 ff 8b 5c 24 70 31 ff 89 de 8d 6b ff e8 c7 72
RSP: 0018:ffffc90002ee75a0 EFLAGS: 00010287
RAX: 000000000006dea5 RBX: dffffc0000000000 RCX: ffffc90007131000
RDX: 0000000000080000 RSI: ffffffff826ac3c0 RDI: ffffffff8e6b7920
RBP: 0000000000000000 R08: 00000000ffffffff R09: fffffbfff1dffc3a
R10: ffffffff8effe1d3 R11: 0000000000000000 R12: ffff888060404a90
R13: ffffe8ffff000000 R14: dffffc0000000000 R15: ffffe8ffffe00000
FS: 0000000000000000(0000) GS:ffff888096967000(0063) knlGS:00000000f544db40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f542cda4 CR3: 000000006f19b000 CR4: 0000000000352ef0
Call Trace:
<TASK>
pcpu_create_chunk+0x275/0x750 mm/percpu-vm.c:363
pcpu_alloc_noprof+0x1923/0x1e50 mm/percpu.c:1852
bpf_map_alloc_percpu+0x9a/0xf0 kernel/bpf/syscall.c:583
bpf_array_alloc_percpu kernel/bpf/arraymap.c:39 [inline]
array_map_alloc+0x553/0x750 kernel/bpf/arraymap.c:153
map_create_alloc kernel/bpf/syscall.c:1534 [inline]
map_create+0x874/0x30d0 kernel/bpf/syscall.c:1644
__sys_bpf+0x12a0/0x4a30 kernel/bpf/syscall.c:6344
__do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
__ia32_sys_bpf+0xcc/0x170 kernel/bpf/syscall.c:6483
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf705efec
Code: Unable to access opcode bytes at 0xf705efc2.
RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000
RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
* Struck through repros no longer work on HEAD.