Syzkaller found a bug: general protection fault in x86_pmu_enable_event

[Sanan Hasanov]

Good day,

We found a bug using a modified kernel configuration file used by syzbot.
We enhanced the coverage of the configuration file using our tool, klocalizer.
config and reproducer files are attached.
Branch:(HEAD detached at 33c9805860e58)
Reproducer can be executed as follows:
Thank you!

general protection fault, probably for non-canonical address
0xdffffc0000000033: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000198-0x000000000000019f]
CPU: 0 PID: 7030 Comm: systemd-udevd Not tainted
6.1.0-rc1-00010-gbb1a1146467a #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:x86_pmu_enable_event+0x61/0x2b0
Code: 00 e8 93 95 3a 00 48 c7 c7 40 59 60 85 e8 47 17 a4 02 48 8d bb
98 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6
04 02 65 48 8b 2d 0b 46 a1 7d 84 c0 74 08 3c 03 0f 8e f3 01
RSP: 0000:ffff88811ae09ce8 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8260e90d
RDX: 0000000000000033 RSI: ffffffff85605940 RDI: 0000000000000198
RBP: ffff88811ae21e20 R08: 0000000000000001 R09: ffffed10235c43c5
R10: ffff88811ae21e27 R11: ffffed10235c43c4 R12: 0000000000000007
R13: ffff88811ae21c20 R14: fffffbfff0cf1d0f R15: 0000000000000004
FS:  00007f2607dbb8c0(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005606fbe35108 CR3: 000000010c384000 CR4: 0000000000350ef0
DR0: 0000000003be2348 DR1: 0000000003be2348 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 amd_pmu_enable_all+0x101/0x160
 x86_pmu_enable+0x367/0xcb0
 perf_pmu_enable+0xb6/0xf0
 perf_mux_hrtimer_handler+0x4c0/0x880
 __hrtimer_run_queues+0x2cf/0x6c0
 hrtimer_interrupt+0x2f3/0x700
 __sysvec_apic_timer_interrupt+0x114/0x370
 sysvec_apic_timer_interrupt+0x89/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x70
Code: 00 00 00 e9 f5 b6 a4 02 48 89 f7 e9 cd fc ff ff 66 66 2e 0f 1f
84 00 00 00 00 00 66 90 65 8b 05 19 ee 66 7d 89 c6 48 8b 0c 24 <81> e6
00 01 00 00 65 48 8b 14 25 00 6d 02 00 a9 00 01 ff 00 74 0e
RSP: 0000:ffff888111adfd18 EFLAGS: 00000246
RAX: 0000000080000000 RBX: ffff88800a90ba00 RCX: ffffffff84f039aa
RDX: ffff88811137e480 RSI: 0000000080000000 RDI: ffff88800a90baf0
RBP: ffff88800a90ba08 R08: 0000000000000001 R09: ffffed10011c59a0
R10: ffff888008e2ccff R11: ffffed10011c599f R12: ffff88800a90ba1c
R13: 0000000000000003 R14: 00005606fbe35108 R15: dffffc0000000000
 mt_find+0x23a/0x9a0
 find_vma+0x77/0xa0
 do_user_addr_fault+0x268/0xe80
 exc_page_fault+0x78/0x120
 asm_exc_page_fault+0x22/0x30
RIP: 0033:0x7f2606bcae74
Code: fa ff ff 48 3b 5a 28 0f 85 28 04 00 00 48 8b 4b 28 48 3b 59 20
0f 85 1a 04 00 00 48 83 78 20 00 0f 84 3a 04 00 00 48 8b 43 28 <48> 89
42 28 48 8b 43 28 48 89 50 20 e9 5a fa ff ff 0f 1f 00 49 8b
RSP: 002b:00007ffdefeb6a10 EFLAGS: 00010206
RAX: 00005606fbe350e0 RBX: 00005606fbe350e0 RCX: 00005606fbe350e0
RDX: 00005606fbe350e0 RSI: 0000000000000000 RDI: 00007f2606eecb00
RBP: 00007f2606eecb00 R08: 00000000ffffffff R09: 000000000000001e
R10: 00007f2607dbb8c0 R11: 00005606fa0729a0 R12: 0000000000000000
R13: 0000000000005140 R14: 00005606fbe3a220 R15: 0000000000001010
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:x86_pmu_enable_event+0x61/0x2b0
Code: 00 e8 93 95 3a 00 48 c7 c7 40 59 60 85 e8 47 17 a4 02 48 8d bb
98 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6
04 02 65 48 8b 2d 0b 46 a1 7d 84 c0 74 08 3c 03 0f 8e f3 01
RSP: 0000:ffff88811ae09ce8 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8260e90d
RDX: 0000000000000033 RSI: ffffffff85605940 RDI: 0000000000000198
RBP: ffff88811ae21e20 R08: 0000000000000001 R09: ffffed10235c43c5
R10: ffff88811ae21e27 R11: ffffed10235c43c4 R12: 0000000000000007
R13: ffff88811ae21c20 R14: fffffbfff0cf1d0f R15: 0000000000000004
FS:  00007f2607dbb8c0(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005606fbe35108 CR3: 000000010c384000 CR4: 0000000000350ef0
DR0: 0000000003be2348 DR1: 0000000003be2348 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0: 00 e8                 add    %ch,%al
   2: 93                   xchg   %eax,%ebx
   3: 95                   xchg   %eax,%ebp
   4: 3a 00                 cmp    (%rax),%al
   6: 48 c7 c7 40 59 60 85 mov    $0xffffffff85605940,%rdi
   d: e8 47 17 a4 02       callq  0x2a41759
  12: 48 8d bb 98 01 00 00 lea    0x198(%rbx),%rdi
  19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
  20: fc ff df
  23: 48 89 fa             mov    %rdi,%rdx
  26: 48 c1 ea 03           shr    $0x3,%rdx
* 2a: 0f b6 04 02           movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e: 65 48 8b 2d 0b 46 a1 mov    %gs:0x7da1460b(%rip),%rbp        # 0x7da14641
  35: 7d
  36: 84 c0                 test   %al,%al
  38: 74 08                 je     0x42
  3a: 3c 03                 cmp    $0x3,%al
  3c: 0f                   .byte 0xf
  3d: 8e f3                 mov    %ebx,%?
  3f: 01                   .byte 0x1

Attachment: repro.prog
Description: Binary data

Attachment: core.c.config
Description: Binary data