Dear Linux Developer, Recently when using our tool to fuzz kernel, the following crash was triggered: HEAD commit: 64570fbc14f8 Linux 5.15-rc5 git tree: upstream compiler: clang 12.0.0 console output: https://drive.google.com/file/d/1uCdjFTp2Xv6bJKVrjgr7-TyTZaM3Veb5/view?usp=sharing kernel config: https://drive.google.com/file/d/1lNwvovjLNrcuyFGrg05IoSmgO5jaKBBJ/view?usp=sharing Unfortunately, I don't have any reproducer for this crash yet. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 10cc9b067 P4D 10cc9b067 PUD 10cc9c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 6765 Comm: kworker/u4:2 Not tainted 5.15.0-rc5 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 Workqueue: floppy fd_timer_workfn RIP: 0010:start_motor+0x4d/0x200 drivers/block/floppy.c:1905 Code: 0f b6 1d 76 8b 3d 06 4b 8d 04 a4 44 0f b6 3c c5 2d 8e 98 88 89 d9 48 8b 05 d8 9d 3d 06 83 e1 03 41 d3 e6 44 0f b6 e9 45 21 f7 <f6> 00 04 0f 85 fb 00 00 00 e8 35 14 db fe 49 83 fc 01 0f 87 24 01 RSP: 0018:ffffc90002253dd0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88810b2e0000 RSI: ffffffff825b026c RDI: ffffffff825b6710 RBP: ffffffff825b6710 R08: 0000000000000000 R09: 0000000000000001 R10: ffffc90002253e70 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000010 FS: 0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010cc9a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: floppy_ready+0x4c/0xc60 drivers/block/floppy.c:1932 process_one_work+0x34e/0x810 kernel/workqueue.c:2297 worker_thread+0x42/0x4c0 kernel/workqueue.c:2444 kthread+0x178/0x1b0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) CR2: 0000000000000000 ---[ end trace 5df88fd80b74c734 ]--- RIP: 0010:start_motor+0x4d/0x200 drivers/block/floppy.c:1905 Code: 0f b6 1d 76 8b 3d 06 4b 8d 04 a4 44 0f b6 3c c5 2d 8e 98 88 89 d9 48 8b 05 d8 9d 3d 06 83 e1 03 41 d3 e6 44 0f b6 e9 45 21 f7 <f6> 00 04 0f 85 fb 00 00 00 e8 35 14 db fe 49 83 fc 01 0f 87 24 01 RSP: 0018:ffffc90002253dd0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88810b2e0000 RSI: ffffffff825b026c RDI: ffffffff825b6710 RBP: ffffffff825b6710 R08: 0000000000000000 R09: 0000000000000001 R10: ffffc90002253e70 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000010 FS: 0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010cc9a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 0f b6 1d 76 8b 3d 06 movzbl 0x63d8b76(%rip),%ebx # 0x63d8b7d 7: 4b 8d 04 a4 lea (%r12,%r12,4),%rax b: 44 0f b6 3c c5 2d 8e movzbl -0x776771d3(,%rax,8),%r15d 12: 98 88 14: 89 d9 mov %ebx,%ecx 16: 48 8b 05 d8 9d 3d 06 mov 0x63d9dd8(%rip),%rax # 0x63d9df5 1d: 83 e1 03 and $0x3,%ecx 20: 41 d3 e6 shl %cl,%r14d 23: 44 0f b6 e9 movzbl %cl,%r13d 27: 45 21 f7 and %r14d,%r15d * 2a: f6 00 04 testb $0x4,(%rax) <-- trapping instruction 2d: 0f 85 fb 00 00 00 jne 0x12e 33: e8 35 14 db fe callq 0xfedb146d 38: 49 83 fc 01 cmp $0x1,%r12 3c: 0f .byte 0xf 3d: 87 24 01 xchg %esp,(%rcx,%rax,1) Best, Wei
