Hello, syzbot found the following issue on: HEAD commit: 05dbaf8dd8bf Merge tag 'x86-urgent-2025-01-28' of git://gi.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=168d3918580000 kernel config: https://syzkaller.appspot.com/x/.config?x=ccb9b8c423893ece dashboard link: https://syzkaller.appspot.com/bug?extid=be35ef678b99e18dae51 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/05c0efec0249/disk-05dbaf8d.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/fcabe68eb297/vmlinux-05dbaf8d.xz kernel image: https://storage.googleapis.com/syzbot-assets/15bb26e810d5/bzImage-05dbaf8d.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+be35ef678b99e18dae51@xxxxxxxxxxxxxxxxxxxxxxxxx BUG: unable to handle page fault for address: 00006c656e72656b #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.13.0-syzkaller-09338-g05dbaf8dd8bf #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: events free_ipc RIP: 0010:strlen+0x38/0x90 lib/string.c:413 Code: 41 54 53 48 89 fb 49 c7 c6 ff ff ff ff e8 d0 68 5c f2 49 89 c7 41 b4 01 eb 0b 48 ff c3 49 ff c6 45 84 ed 74 31 45 84 e4 74 23 <44> 0f b6 2b 48 89 df e8 6c 5a 5c f2 0f b6 00 84 c0 74 dd f6 d0 44 RSP: 0018:ffff888100273858 EFLAGS: 00010202 RAX: ffff88810025ac08 RBX: 00006c656e72656b RCX: 0000000000000000 RDX: ffff88801d513538 RSI: ffff88813fffaaf0 RDI: 00006c656e72656b RBP: ffff888100273880 R08: ffffea000000000f R09: ffffffff82d145f0 R10: 0000000000000002 R11: ffff88810025a0c0 R12: 0000000000000001 R13: 0000000000000000 R14: ffffffffffffffff R15: ffff88810025ac08 FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00006c656e72656b CR3: 00000000134c8000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> put_links+0x226/0x9d0 fs/proc/proc_sysctl.c:1490 drop_sysctl_table+0x10d/0x4f0 fs/proc/proc_sysctl.c:1512 drop_sysctl_table+0x4b6/0x4f0 fs/proc/proc_sysctl.c:1520 unregister_sysctl_table+0x48/0x70 fs/proc/proc_sysctl.c:1538 retire_ipc_sysctls+0x67/0xc0 ipc/ipc_sysctl.c:310 free_ipc_ns ipc/namespace.c:160 [inline] free_ipc+0x1d6/0x4c0 ipc/namespace.c:181 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3317 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3398 kthread+0x6b9/0xef0 kernel/kthread.c:464 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: CR2: 00006c656e72656b ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x38/0x90 lib/string.c:413 Code: 41 54 53 48 89 fb 49 c7 c6 ff ff ff ff e8 d0 68 5c f2 49 89 c7 41 b4 01 eb 0b 48 ff c3 49 ff c6 45 84 ed 74 31 45 84 e4 74 23 <44> 0f b6 2b 48 89 df e8 6c 5a 5c f2 0f b6 00 84 c0 74 dd f6 d0 44 RSP: 0018:ffff888100273858 EFLAGS: 00010202 RAX: ffff88810025ac08 RBX: 00006c656e72656b RCX: 0000000000000000 RDX: ffff88801d513538 RSI: ffff88813fffaaf0 RDI: 00006c656e72656b RBP: ffff888100273880 R08: ffffea000000000f R09: ffffffff82d145f0 R10: 0000000000000002 R11: ffff88810025a0c0 R12: 0000000000000001 R13: 0000000000000000 R14: ffffffffffffffff R15: ffff88810025ac08 FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00006c656e72656b CR3: 00000000134c8000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 41 54 push %r12 2: 53 push %rbx 3: 48 89 fb mov %rdi,%rbx 6: 49 c7 c6 ff ff ff ff mov $0xffffffffffffffff,%r14 d: e8 d0 68 5c f2 call 0xf25c68e2 12: 49 89 c7 mov %rax,%r15 15: 41 b4 01 mov $0x1,%r12b 18: eb 0b jmp 0x25 1a: 48 ff c3 inc %rbx 1d: 49 ff c6 inc %r14 20: 45 84 ed test %r13b,%r13b 23: 74 31 je 0x56 25: 45 84 e4 test %r12b,%r12b 28: 74 23 je 0x4d * 2a: 44 0f b6 2b movzbl (%rbx),%r13d <-- trapping instruction 2e: 48 89 df mov %rbx,%rdi 31: e8 6c 5a 5c f2 call 0xf25c5aa2 36: 0f b6 00 movzbl (%rax),%eax 39: 84 c0 test %al,%al 3b: 74 dd je 0x1a 3d: f6 d0 not %al 3f: 44 rex.R --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
