syzbot

 sign-in | mailing list | source | docs
🐞 Open [679]
🐞 Fixed [61]
🐞 Invalid [698]
⬇ Missing Backports [72]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

WARNING in reiserfs_lookup (2)

Status: upstream: reported C repro on 2024/03/31 03:45
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+00b28ba809541778dca3@syzkaller.appspotmail.com
First crash: 288d, last: 23d
▶ ▼ Bug presence (3)
Date Name Commit Repro Result
2024/12/21 linux-5.15.y (ToT) 91786f140358 C [report] WARNING in reiserfs_lookup
2024/11/06 upstream (ToT) 2e1b3cc9d7f7 C [report] WARNING in reiserfs_lookup
2024/12/21 upstream (ToT) 499551201b5f C Didn't crash
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 WARNING in reiserfs_lookup 3 540d 581d 0/3 auto-obsoleted due to no activity on 2023/10/31 18:44
linux-6.1 WARNING in reiserfs_lookup 6 274d 444d 0/3 auto-obsoleted due to no activity on 2024/07/23 04:34
upstream WARNING in reiserfs_lookup reiserfs C inconclusive done 1259 363d 872d 0/28 auto-obsoleted due to no activity on 2024/04/28 17:50
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2024/11/12 10:03 13m retest repro linux-5.15.y report log

Sample crash report:
REISERFS warning (device loop0): jdm-20006 create_privroot: xattrs/ACLs enabled and couldn't find/create .reiserfs_priv. Failing mount.
loop0: detected capacity change from 0 to 64
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 0 PID: 4164 at kernel/locking/mutex.c:575 __mutex_lock_common+0x1614/0x2154 kernel/locking/mutex.c:575
Modules linked in:
CPU: 0 PID: 4164 Comm: syz-executor418 Not tainted 5.15.169-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mutex_lock_common+0x1614/0x2154 kernel/locking/mutex.c:575
lr : __mutex_lock_common+0x1614/0x2154 kernel/locking/mutex.c:575
sp : ffff8000210972c0
x29: ffff800021097450 x28: dfff800000000000 x27: 1ffff000036e2ba4
x26: ffff80001b715000 x25: ffff700004212e74 x24: 0000000000000000
x23: 0000000000000000 x22: ffff800008d140ac x21: 0000000000000000
x20: 0000000000000000 x19: ffff0000d57c9828 x18: 0000000000000001
x17: 0000000000000000 x16: ffff800011ab8424 x15: 00000000ffffffff
x14: ffff0000c2309b40 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 1381e75438518f00
x8 : 1381e75438518f00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800021096a38 x4 : ffff800014b905e0 x3 : ffff800008556e88
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000028
Call trace:
 __mutex_lock_common+0x1614/0x2154 kernel/locking/mutex.c:575
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
 reiserfs_lookup+0x130/0x3c4 fs/reiserfs/namei.c:364
 lookup_open fs/namei.c:3440 [inline]
 open_last_lookups fs/namei.c:3532 [inline]
 path_openat+0xd9c/0x26cc fs/namei.c:3739
 do_filp_open+0x1a8/0x3b4 fs/namei.c:3769
 do_sys_openat2+0x128/0x3e0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1280
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 25469
hardirqs last  enabled at (25469): [<ffff8000088d54b8>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (25468): [<ffff8000088d5478>] kasan_quarantine_put+0x9c/0x204 mm/kasan/quarantine.c:204
softirqs last  enabled at (24784): [<ffff8000080308b0>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31
softirqs last disabled at (24782): [<ffff80000803087c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18
---[ end trace 3a92832c45e116ac ]---
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:130:9
index 13647 is out of range for type 'unsigned long[8]'
CPU: 0 PID: 4164 Comm: syz-executor418 Tainted: G        W         5.15.169-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 ubsan_epilogue lib/ubsan.c:151 [inline]
 __ubsan_handle_out_of_bounds+0x108/0x15c lib/ubsan.c:282
 decode_tail kernel/locking/qspinlock.c:130 [inline]
 queued_spin_lock_slowpath+0x854/0x938 kernel/locking/qspinlock.c:468
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0xb8/0x10c kernel/locking/spinlock.c:154
 __mutex_lock_common+0x380/0x2154 kernel/locking/mutex.c:608
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
 reiserfs_lookup+0x130/0x3c4 fs/reiserfs/namei.c:364
 lookup_open fs/namei.c:3440 [inline]
 open_last_lookups fs/namei.c:3532 [inline]
 path_openat+0xd9c/0x26cc fs/namei.c:3739
 do_filp_open+0x1a8/0x3b4 fs/namei.c:3769
 do_sys_openat2+0x128/0x3e0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1280
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
================================================================================
==================================================================
BUG: KASAN: use-after-free in queued_spin_lock_slowpath+0x364/0x938 kernel/locking/qspinlock.c:471
Write of size 8 at addr ffff0000256bbd20 by task syz-executor418/4164

CPU: 0 PID: 4164 Comm: syz-executor418 Tainted: G        W         5.15.169-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x174/0x1e4 mm/kasan/report.c:451
 __asan_report_store8_noabort+0x44/0x50 mm/kasan/report_generic.c:314
 queued_spin_lock_slowpath+0x364/0x938 kernel/locking/qspinlock.c:471
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0xb8/0x10c kernel/locking/spinlock.c:154
 __mutex_lock_common+0x380/0x2154 kernel/locking/mutex.c:608
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
 reiserfs_lookup+0x130/0x3c4 fs/reiserfs/namei.c:364
 lookup_open fs/namei.c:3440 [inline]
 open_last_lookups fs/namei.c:3532 [inline]
 path_openat+0xd9c/0x26cc fs/namei.c:3739
 do_filp_open+0x1a8/0x3b4 fs/namei.c:3769
 do_sys_openat2+0x128/0x3e0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1280
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

The buggy address belongs to the page:
page:0000000010f14c63 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x656bb
flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff)
raw: 01ffc00000000000 fffffc000095aec8 fffffc000095aec8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000256bbc00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000256bbc80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000256bbd00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                               ^
 ffff0000256bbd80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000256bbe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/10/27 14:26 linux-5.15.y 74cdd62cb470 65e8686b .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-linux-5-15-kasan-arm64 WARNING in reiserfs_lookup
2024/10/21 01:26 linux-5.15.y 584a40a22cb9 cd6fc0a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan WARNING in reiserfs_lookup
2024/09/08 23:59 linux-5.15.y 14e468424d3e 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan WARNING in reiserfs_lookup
2024/07/01 06:41 linux-5.15.y 4878aadf2d15 757f06b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan WARNING in reiserfs_lookup
2024/04/08 07:45 linux-5.15.y 9465fef4ae35 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan WARNING in reiserfs_lookup
2024/04/01 23:41 linux-5.15.y 9465fef4ae35 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan WARNING in reiserfs_lookup
2024/10/03 02:27 linux-5.15.y 3a5928702e71 a4c7fd36 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 WARNING in reiserfs_lookup
2024/03/31 03:45 linux-5.15.y 9465fef4ae35 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 WARNING in reiserfs_lookup
* Struck through repros no longer work on HEAD.