syzbot
BUG: unable to handle kernel NULL pointer dereference in mmiocpy
Status:
moderation: reported on 2026/09/06 02:40
Subsystems:
rdma
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+57d3dfec4763bea25ad0@syzkaller.appspotmail.com
First crash: 4d04h, last: 4d04h
▶
▼
Last patch testing requests (1)
Sample crash report:
rtrs_client L2021: <s+>: CM error (CM event: address error, err: -ENODEV)
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read
[00000000] *pgd=80000080004003, *pmd=00000000
Internal error: Oops: 205 [#1] SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 8503 Comm: kworker/u8:4 Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: ARM-Versatile Express
Workqueue: ib_addr process_one_req
PC is at mmiocpy+0x48/0x330 arch/arm/lib/copy_template.S:105
LR is at do_trace_event_raw_event_rtrs_clt_conn_class drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:36 [inline]
LR is at trace_event_raw_event_rtrs_clt_conn_class+0xb0/0x11c drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:36
pc : [<81b3cc28>] lr : [<813ce4f0>] psr: 20000113
sp : dfc29c4c ip : 00000000 fp : dfc29ca4
r10: 861cd010 r9 : 861cd224 r8 : 861cd1fc
r7 : 861cd000 r6 : 8303ba10 r5 : 875e3d40 r4 : 87150c00
r3 : ffffffff r2 : 0000007f r1 : 00000000 r0 : 87024680
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 30c5387d Table: 861dee80 DAC: fffffffd
Register r0 information: non-slab/vmalloc memory
Register r1 information: NULL pointer
Register r2 information: non-paged memory
Register r3 information: non-paged memory
Register r4 information: slab kmalloc-1k start 87150c00 pointer offset 0 size 1024
Register r5 information: slab task_struct start 875e3d40 pointer offset 0 size 3136
Register r6 information: slab trace_event_file start 8303ba10 pointer offset 0 size 56
Register r7 information: slab kmalloc-1k start 861cd000 pointer offset 0 size 1024
Register r8 information: slab kmalloc-1k start 861cd000 pointer offset 508 size 1024
Register r9 information: slab kmalloc-1k start 861cd000 pointer offset 548 size 1024
Register r10 information: slab kmalloc-1k start 861cd000 pointer offset 16 size 1024
Register r11 information: 2-page vmalloc region starting at 0xdfc28000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766
Register r12 information: NULL pointer
Process kworker/u8:4 (pid: 8503, stack limit = 0xdfc28000)
Stack: (0xdfc29c4c to 0xdfc2a000)
9c40: 875e3d40 8303ba10 861cd1fc 861cd224 87024680
9c60: 87150c00 813ce4f0 860c8680 8301ea80 8702465c 8303ba10 87024664 00000000
9c80: 00000000 232c0941 802eb208 8617b148 87150c00 dfc29cc0 dfc29cbc dfc29ca8
9ca0: 813ce2d0 813ce44c 828cb740 87150c00 dfc29cdc dfc29cc0 813cae30 813ce2a8
9cc0: ffffff8f 860c8680 87150c00 861cd000 dfc29d74 dfc29ce0 813cc280 813cad78
9ce0: dfc29d14 dfc29cf0 803b7178 861cd000 875e3d40 8303b5e8 dfc29db8 861cd1fc
9d00: 861cd224 861cd010 dfc29d54 dfc29d18 81372b9c 803a910c 8022cc00 8301ea80
9d20: 83022e84 8303b5e8 83022e88 00000000 00000000 232c0941 8617b788 861cd000
9d40: dfc29db8 232c0941 dfc29d74 861cd000 dfc29db8 828cb740 dfc29d78 861cd1fc
9d60: 861cd224 861cd010 dfc29d9c dfc29d78 81369674 813cc208 861cd000 87312008
9d80: 00000001 00000010 861cd1fc 861cd224 dfc29ec4 dfc29da0 8136ea60 81369658
9da0: dfc29dcc dfc29db0 80293fc8 802a93e8 dfc29dcc ffffffed 00000001 ffffffed
9dc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9de0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9e00: 00000000 00000000 00000000 00000000 803a032c a5860002 00000000 00000000
9e20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9e60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9e80: 00000000 00000000 00000000 00000000 00000000 232c0941 83012a00 87312118
9ea0: 87312008 87312000 83012a00 828cb740 875e3d40 83f59805 dfc29ef4 dfc29ec8
9ec0: 81335ed0 8136e944 83022e74 00000000 00000000 232c0941 86644900 87312118
9ee0: 83f59800 83012a00 dfc29f4c dfc29ef8 802772b8 81335ea0 86644930 86644930
9f00: dfc29f34 dfc29f10 802739e0 80966f18 87312118 00000000 86644900 00000000
9f20: 875e3d40 86644900 83012a00 83012a20 82a03d80 875e3d40 86644930 83012a00
9f40: dfc29f84 dfc29f50 80277f64 802770fc 82a03d80 83012a5c 802803bc 877d3540
9f60: 875e3d40 80277df8 86644900 86644800 dfca5e88 00000000 dfc29fac dfc29f88
9f80: 802827b4 80277e04 877d3540 80282698 00000000 00000000 00000000 00000000
9fa0: 00000000 dfc29fb0 80200114 802826a4 00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
Call trace:
[<813ce440>] (trace_event_raw_event_rtrs_clt_conn_class) from [<813ce2d0>] (__traceiter_rtrs_rdma_error_recovery+0x34/0x48 drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:78)
r6:dfc29cc0 r5:87150c00 r4:8617b148
[<813ce29c>] (__traceiter_rtrs_rdma_error_recovery) from [<813cae30>] (__do_trace_rtrs_rdma_error_recovery drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:78 [inline])
[<813ce29c>] (__traceiter_rtrs_rdma_error_recovery) from [<813cae30>] (trace_rtrs_rdma_error_recovery drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h:78 [inline])
[<813ce29c>] (__traceiter_rtrs_rdma_error_recovery) from [<813cae30>] (rtrs_rdma_error_recovery+0xc4/0x170 drivers/infiniband/ulp/rtrs/rtrs-clt.c:311)
r5:87150c00 r4:828cb740
[<813cad6c>] (rtrs_rdma_error_recovery) from [<813cc280>] (rtrs_clt_rdma_cm_handler+0x84/0x944 drivers/infiniband/ulp/rtrs/rtrs-clt.c:2065)
r7:861cd000 r6:87150c00 r5:860c8680 r4:ffffff8f
[<813cc1fc>] (rtrs_clt_rdma_cm_handler) from [<81369674>] (cma_cm_event_handler+0x28/0x1e0 drivers/infiniband/core/cma.c:2181)
r10:861cd010 r9:861cd224 r8:861cd1fc r7:dfc29d78 r6:828cb740 r5:dfc29db8
r4:861cd000
[<8136964c>] (cma_cm_event_handler) from [<8136ea60>] (addr_handler+0x128/0x2b8 drivers/infiniband/core/cma.c:3550)
r9:861cd224 r8:861cd1fc r7:00000010 r6:00000001 r5:87312008 r4:861cd000
[<8136e938>] (addr_handler) from [<81335ed0>] (process_one_req+0x3c/0x154 drivers/infiniband/core/addr.c:624)
r10:83f59805 r9:875e3d40 r8:828cb740 r7:83012a00 r6:87312000 r5:87312008
r4:87312118
[<81335e94>] (process_one_req) from [<802772b8>] (process_one_work+0x1c8/0x580 kernel/workqueue.c:3322)
r7:83012a00 r6:83f59800 r5:87312118 r4:86644900
[<802770f0>] (process_one_work) from [<80277f64>] (process_scheduled_works kernel/workqueue.c:3405 [inline])
[<802770f0>] (process_one_work) from [<80277f64>] (worker_thread+0x16c/0x318 kernel/workqueue.c:3486)
r10:83012a00 r9:86644930 r8:875e3d40 r7:82a03d80 r6:83012a20 r5:83012a00
r4:86644900
[<80277df8>] (worker_thread) from [<802827b4>] (kthread+0x11c/0x154 kernel/kthread.c:436)
r10:00000000 r9:dfca5e88 r8:86644800 r7:86644900 r6:80277df8 r5:875e3d40
r4:877d3540
[<80282698>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137)
Exception stack(0xdfc29fb0 to 0xdfc29ff8)
9fa0: 00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80282698 r4:877d3540
Code: ba000002 f5d1f03c f5d1f05c f5d1f07c (e8b15378)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: ba000002 blt 0x10
4: f5d1f03c pld [r1, #60] @ 0x3c
8: f5d1f05c pld [r1, #92] @ 0x5c
c: f5d1f07c pld [r1, #124] @ 0x7c
* 10: e8b15378 ldm r1!, {r3, r4, r5, r6, r8, r9, ip, lr} <-- trapping instruction
Struck through repros no longer work on HEAD.