syzbot


general protection fault in fix_nodes

Status: upstream: reported C repro on 2022/12/08 10:03
Reported-by: syzbot+666b46ca78661410fbb0@syzkaller.appspotmail.com
First crash: 526d, last: 526d
Fix bisection: failed (error log, bisect log)
  
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in fix_nodes syz error 1 520d 520d 0/1 upstream: reported syz repro on 2022/12/15 05:04
linux-6.1 KASAN: null-ptr-deref Read in fix_nodes origin:upstream missing-backport C done 6 138d 397d 0/3 upstream: reported C repro on 2023/04/17 07:27
upstream KASAN: null-ptr-deref Read in fix_nodes reiserfs C done done 17 134d 403d 0/26 auto-obsoleted due to no activity on 2024/04/13 10:42
linux-5.15 KASAN: null-ptr-deref Read in fix_nodes origin:upstream C 7 27d 398d 0/3 upstream: reported C repro on 2023/04/15 23:10

Sample crash report:
REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 1 0(1) DIR], item_len 35, item_location 4029, free_space(entry_count) 2
REISERFS error (device loop0): vs-5150 search_by_key: invalid format found in block 544. Fsck?
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8876 Comm: syz-executor420 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:317 [inline]
RIP: 0010:buffer_locked include/linux/buffer_head.h:123 [inline]
RIP: 0010:fix_nodes+0x460/0x7840 fs/reiserfs/fix_node.c:2582
Code: 02 00 00 89 de 89 ef e8 be 9a 90 ff 39 dd 0f 85 b4 43 00 00 e8 c1 99 90 ff 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 04 6c 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff8880ab467318 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000024 RCX: ffffffff81d1eba2
RDX: 0000000000000000 RSI: ffffffff81d1ebaf RDI: 0000000000000004
RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000024
R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88808ac62780 R14: ffff8880922ae380 R15: ffff8880ab467640
FS:  00007ffaa9268700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc8cbeb9c0 CR3: 00000000992b9000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 reiserfs_cut_from_item+0x24c/0x1960 fs/reiserfs/stree.c:1752
 reiserfs_do_truncate+0x64a/0x10c0 fs/reiserfs/stree.c:1983
 reiserfs_truncate_file+0x1b1/0x1030 fs/reiserfs/inode.c:2320
 reiserfs_setattr+0xdc2/0x1090 fs/reiserfs/inode.c:3412
 notify_change+0x70b/0xfc0 fs/attr.c:334
 do_truncate+0x134/0x1f0 fs/open.c:63
 do_sys_ftruncate+0x492/0x560 fs/open.c:194
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ffab12fec29
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffaa92682f8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 00007ffab13847c0 RCX: 00007ffab12fec29
RDX: 00007ffaa9268700 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007ffab13511d8 R08: 00007ffaa9268700 R09: 0000000000000000
R10: 00007ffaa9268700 R11: 0000000000000246 R12: 0030656c69662f2e
R13: 7366726573696572 R14: 0031656c69662f2e R15: 00007ffab13847c8
Modules linked in:
REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): checking transaction log (loop2)
---[ end trace b2e53cf0d22a3b33 ]---
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:317 [inline]
RIP: 0010:buffer_locked include/linux/buffer_head.h:123 [inline]
RIP: 0010:fix_nodes+0x460/0x7840 fs/reiserfs/fix_node.c:2582
REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal
Code: 02 00 00 89 de 89 ef e8 be 9a 90 ff 39 dd 0f 85 b4 43 00 00 e8 c1 99 90 ff 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 04 6c 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b
REISERFS (device loop4): using ordered data mode
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): using 3.5.x disk format
reiserfs: using flush barriers
REISERFS (device loop3): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
RSP: 0018:ffff8880ab467318 EFLAGS: 00010246
REISERFS (device loop3): using ordered data mode
REISERFS (device loop4): checking transaction log (loop4)
reiserfs: using flush barriers
REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal
REISERFS (device loop1): using ordered data mode
REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
RAX: dffffc0000000000 RBX: 0000000000000024 RCX: ffffffff81d1eba2
RDX: 0000000000000000 RSI: ffffffff81d1ebaf RDI: 0000000000000004
reiserfs: using flush barriers
RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000024
REISERFS (device loop3): checking transaction log (loop3)
R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88808ac62780 R14: ffff8880922ae380 R15: ffff8880ab467640
FS:  00007ffaa9268700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
REISERFS (device loop1): checking transaction log (loop1)
REISERFS (device loop4): Using r5 hash to sort names
REISERFS (device loop1): Using r5 hash to sort names
CR2: 00007ffc8cacdfc8 CR3: 00000000992b9000 CR4: 00000000003406f0
REISERFS (device loop1): using 3.5.x disk format
REISERFS (device loop4): using 3.5.x disk format
REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage.
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	02 00                	add    (%rax),%al
   2:	00 89 de 89 ef e8    	add    %cl,-0x17107622(%rcx)
   8:	be 9a 90 ff 39       	mov    $0x39ff909a,%esi
   d:	dd 0f                	fisttpll (%rdi)
   f:	85 b4 43 00 00 e8 c1 	test   %esi,-0x3e180000(%rbx,%rax,2)
  16:	99                   	cltd
  17:	90                   	nop
  18:	ff 4c 89 e2          	decl   -0x1e(%rcx,%rcx,4)
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 04 6c 00 00    	jne    0x6c38
  34:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  3b:	fc ff df
  3e:	49                   	rex.WB
  3f:	8b                   	.byte 0x8b

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/12/08 10:03 linux-4.19.y 3f8a27f9e27b d88f3abb .config console log report syz C [disk image] [vmlinux] [mounted in repro] ci2-linux-4-19 general protection fault in fix_nodes
* Struck through repros no longer work on HEAD.