syzbot

 sign-in | mailing list | source | docs
🐞 Open [106]
🐞 Fixed [70]
🐞 Invalid [176]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: Dentry still in use in unmount

Status: fixed on 2022/02/25 03:20
Reported-by: syzbot+1ef2d95db299942fba18@syzkaller.appspotmail.com
Fix commit: 6f915dd2af92 ANDROID: incremental-fs: remove index and incomplete dir on umount
First crash: 1016d, last: 1003d
Cause bisection: introduced by (bisect log) :
commit fd4c6594f5ce87eb3f6d53bd73eb14689305fdf1
Author: Tadeusz Struk <tadeusz.struk@linaro.org>
Date: Wed Jan 12 21:52:50 2022 +0000

  ANDROID: incremental-fs: fix mount_fs issue

Crash: BUG: Dentry still in use in unmount (log)
Repro: C syz .config
  
▶ ▼ Similar bugs (18)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: Dentry still in use in unmount f2fs C done 58 342d 819d 25/28 fixed on 2024/01/20 21:18
android-5-10 BUG: Dentry still in use [unmount of ext4 loop0] C error 63 1087d 1126d 0/2 closed as dup on 2021/10/28 13:08
android-54 BUG: Dentry still in use [unmount of ramfs ramfs] C 476 1022d 1344d 0/2 auto-obsoleted due to no activity on 2023/04/21 02:49
android-54 BUG: Dentry still in use [unmount of tmpfs tmpfs] C 10 1220d 1390d 0/2 auto-obsoleted due to no activity on 2023/04/20 14:51
upstream BUG: Dentry still in use [unmount of tmpfs tmpfs] fs 2 1994d 1993d 12/28 fixed on 2019/07/10 21:40
upstream BUG: Dentry still in use [unmount of tmpfs tmpfs] (2) fs 3 1470d 1466d 0/28 auto-closed as invalid on 2021/02/11 21:17
android-54 BUG: Dentry still in use [unmount of incremental-fs incremental-fs] C 13 1123d 1393d 0/2 auto-obsoleted due to no activity on 2023/04/22 16:04
android-5-10 BUG: Dentry still in use [unmount of incremental-fs incremental-fs] syz 2 1123d 1123d 0/2 closed as dup on 2021/10/28 13:08
android-5-10 BUG: Dentry still in use [unmount of ramfs ramfs] C error 3 1126d 1128d 1/2 fixed on 2021/12/01 19:46
android-54 BUG: Dentry still in use [unmount of vfat loop2] 5 1126d 1246d 0/2 auto-closed as invalid on 2022/02/21 04:30
upstream KASAN: stack-out-of-bounds Read in iput ntfs3 C unreliable done 10 514d 794d 0/28 auto-obsoleted due to no activity on 2023/10/05 12:37
upstream KASAN: use-after-free Read in iput (2) gfs2 6 1257d 1461d 0/28 auto-closed as invalid on 2021/10/12 21:28
upstream BUG: corrupted list in list_lru_add bcachefs mm syz 1 4d16h 16h00m 0/28 upstream: reported syz repro on 2024/11/22 12:30
upstream BUG: unable to handle kernel paging request in list_lru_add mm C done done 11367 133d 445d 27/28 fixed on 2024/08/28 10:02
upstream general protection fault in list_lru_add mm C done 1125 686d 975d 22/28 fixed on 2023/02/24 13:51
android-5-10 BUG: Dentry still in use [unmount of overlay overlay] C error 2 1121d 1121d 0/2 closed as dup on 2021/10/29 08:14
android-54 BUG: Dentry still in use [unmount of overlay overlay] C 20 1130d 1429d 0/2 auto-obsoleted due to no activity on 2023/04/22 01:46
android-54 BUG: Dentry still in use [unmount of vfat loop3] 6 1235d 1403d 0/2 auto-closed as invalid on 2021/11/04 02:41
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2022/02/16 17:27 13m tadeusz.struk@linaro.org https://android.googlesource.com/kernel/common android12-5.10 OK

Sample crash report:
BUG: Dentry ffff88811a123990{i=474,n=.incomplete}  still in use (1) [unmount of incremental-fs incremental-fs]
------------[ cut here ]------------
WARNING: CPU: 0 PID: 366 at fs/dcache.c:1616 umount_check+0x18d/0x1d0 fs/dcache.c:1607
Modules linked in:
CPU: 0 PID: 366 Comm: syz-executor978 Not tainted 5.10.101-syzkaller-00961-gc194212a0332 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:umount_check+0x18d/0x1d0 fs/dcache.c:1607
Code: 8b 0b 49 81 c6 f8 03 00 00 48 c7 c7 c0 4e 2e 85 4c 89 e6 48 8b 55 d0 4c 89 e1 45 89 f8 31 c0 41 56 e8 7e aa 9e ff 48 83 c4 08 <0f> 0b e9 f1 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c c9 fe ff
RSP: 0018:ffffc9000026fab8 EFLAGS: 00010286
RAX: 000000000000006e RBX: ffffffff866d6800 RCX: 9cf54cac26e34200
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc9000026fae8 R08: ffffffff815456c8 R09: 0000000000000003
R10: fffff5200004dea9 R11: 0000000000000004 R12: ffff88811a123990
R13: dffffc0000000000 R14: ffff88811d87b3f8 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8fc34c51d0 CR3: 000000000640f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 d_walk+0x309/0x540 fs/dcache.c:1326
 do_one_tree fs/dcache.c:1623 [inline]
 shrink_dcache_for_umount+0x8e/0x1b0 fs/dcache.c:1639
 generic_shutdown_super+0x66/0x2c0 fs/super.c:447
 incfs_kill_sb+0x4b/0x80 fs/incfs/vfs.c:1908
 deactivate_locked_super+0xb0/0x100 fs/super.c:335
 deactivate_super+0xa5/0xd0 fs/super.c:366
 cleanup_mnt+0x45f/0x510 fs/namespace.c:1118
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1125
 task_work_run+0x147/0x1b0 kernel/task_work.c:154
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0x70e/0x23a0 kernel/exit.c:813
 do_group_exit+0x16a/0x2d0 kernel/exit.c:910
 __do_sys_exit_group+0x17/0x20 kernel/exit.c:921
 __se_sys_exit_group+0x14/0x20 kernel/exit.c:919
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:919
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f8fc3450569
Code: Unable to access opcode bytes at RIP 0x7f8fc345053f.
RSP: 002b:00007ffccf626068 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f8fc34c4330 RCX: 00007f8fc3450569
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f8fc34bee40
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8fc34c4330
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
---[ end trace f4ad954bcafe1b96 ]---
BUG: Dentry ffff88811a123cc0{i=473,n=.index}  still in use (1) [unmount of incremental-fs incremental-fs]
------------[ cut here ]------------
WARNING: CPU: 0 PID: 366 at fs/dcache.c:1616 umount_check+0x18d/0x1d0 fs/dcache.c:1607
Modules linked in:
CPU: 0 PID: 366 Comm: syz-executor978 Tainted: G        W         5.10.101-syzkaller-00961-gc194212a0332 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:umount_check+0x18d/0x1d0 fs/dcache.c:1607
Code: 8b 0b 49 81 c6 f8 03 00 00 48 c7 c7 c0 4e 2e 85 4c 89 e6 48 8b 55 d0 4c 89 e1 45 89 f8 31 c0 41 56 e8 7e aa 9e ff 48 83 c4 08 <0f> 0b e9 f1 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c c9 fe ff
RSP: 0018:ffffc9000026fab8 EFLAGS: 00010286
RAX: 0000000000000069 RBX: ffffffff866d6800 RCX: 9cf54cac26e34200
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc9000026fae8 R08: ffffffff815456c8 R09: ffffed103ee0a5d8
R10: ffffed103ee0a5d8 R11: 0000000000000000 R12: ffff88811a123cc0
R13: dffffc0000000000 R14: ffff88811d87b3f8 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8fc34c51d0 CR3: 000000000640f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 d_walk+0x309/0x540 fs/dcache.c:1326
 do_one_tree fs/dcache.c:1623 [inline]
 shrink_dcache_for_umount+0x8e/0x1b0 fs/dcache.c:1639
 generic_shutdown_super+0x66/0x2c0 fs/super.c:447
 incfs_kill_sb+0x4b/0x80 fs/incfs/vfs.c:1908
 deactivate_locked_super+0xb0/0x100 fs/super.c:335
 deactivate_super+0xa5/0xd0 fs/super.c:366
 cleanup_mnt+0x45f/0x510 fs/namespace.c:1118
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1125
 task_work_run+0x147/0x1b0 kernel/task_work.c:154
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0x70e/0x23a0 kernel/exit.c:813
 do_group_exit+0x16a/0x2d0 kernel/exit.c:910
 __do_sys_exit_group+0x17/0x20 kernel/exit.c:921
 __se_sys_exit_group+0x14/0x20 kernel/exit.c:919
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:919
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f8fc3450569
Code: Unable to access opcode bytes at RIP 0x7f8fc345053f.
RSP: 002b:00007ffccf626068 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f8fc34c4330 RCX: 00007f8fc3450569
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f8fc34bee40
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8fc34c4330
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
---[ end trace f4ad954bcafe1b97 ]---

Crashes (1184):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/02/22 12:44 android12-5.10-lts c194212a0332 6e821dbf .config console log report syz C ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/18 15:34 android12-5.10-lts c194212a0332 3cd800e4 .config console log report syz C ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/10 22:38 android12-5.10-lts ca562bf79c65 0b33604d .config console log report syz C ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 10:14 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 09:11 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 07:47 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 06:42 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 05:38 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 05:19 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 04:13 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 03:11 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/23 02:01 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 23:06 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 22:28 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 21:23 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 20:17 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 18:52 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 17:33 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 16:11 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 15:57 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 14:51 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 13:47 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 11:12 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 09:03 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 08:12 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 06:39 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 05:24 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/22 03:13 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 23:08 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 22:01 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 20:54 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 20:39 android12-5.10-lts c194212a0332 6e821dbf .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 19:34 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 18:28 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 17:09 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 16:13 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 15:13 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 13:22 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 12:12 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 11:47 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 10:32 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 09:23 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 08:05 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 06:39 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/21 05:55 android12-5.10-lts c194212a0332 3cd800e4 .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
2022/02/10 18:56 android12-5.10-lts ca562bf79c65 0b33604d .config console log report info ci2-android-5-10 BUG: Dentry still in use in unmount
* Struck through repros no longer work on HEAD.