syzbot


general protection fault in blk_get_backing_dev_info (2)

Status: public: reported C repro on 2019/04/14 08:51
Reported-by: syzbot+6ca4c78e0661758aae9f@syzkaller.appspotmail.com
First crash: 2093d, last: 2092d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 general protection fault in blk_get_backing_dev_info 2 2291d 2293d 0/2 auto-closed as invalid on 2019/02/22 12:31
android-49 general protection fault in blk_get_backing_dev_info 3 2378d 2392d 0/3 auto-closed as invalid on 2019/02/22 14:34

Sample crash report:
random: crng init done
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 2092 Comm: syz-executor816 Not tainted 4.9.155+ #27
task: ffff8801d01d8000 task.stack: ffff8801cded0000
RIP: 0010:[<ffffffff81ac46ca>]  [<ffffffff81ac46ca>] bdev_get_queue include/linux/blkdev.h:847 [inline]
RIP: 0010:[<ffffffff81ac46ca>]  [<ffffffff81ac46ca>] blk_get_backing_dev_info+0x4a/0x70 block/blk-core.c:118
RSP: 0018:ffff8801cded76c8  EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff10039bdaf0a
RDX: 00000000000000a6 RSI: ffffffff81ac468d RDI: 0000000000000530
RBP: ffff8801cded76d0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000001 R12: ffffea000737a0c0
R13: ffff8801d9188948 R14: ffff8801d9188750 R15: ffffffff833ef0f8
FS:  0000000000f36880(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000049f400 CR3: 0000000003022000 CR4: 00000000001606b0
Stack:
 ffff8801da48a200 ffff8801cded7710 ffffffff81434c92 ffff8801d9188948
 ffff8801d9188948 ffffea000737a0c0 ffffea000737a0e0 ffff8801d9188948
 0000000000000000 ffff8801cded7740 ffffffff814411e0 dffffc0000000000
Call Trace:
 [<ffffffff81434c92>] inode_to_bdi include/linux/backing-dev.h:186 [inline]
 [<ffffffff81434c92>] mapping_cap_account_dirty include/linux/backing-dev.h:234 [inline]
 [<ffffffff81434c92>] cancel_dirty_page+0x1a2/0x3d0 mm/page-writeback.c:2609
 [<ffffffff814411e0>] truncate_complete_page mm/truncate.c:126 [inline]
 [<ffffffff814411e0>] truncate_inode_page+0x130/0x260 mm/truncate.c:167
 [<ffffffff814415ce>] truncate_inode_pages_range+0x20e/0xfe0 mm/truncate.c:291
 [<ffffffff81442451>] truncate_inode_pages mm/truncate.c:401 [inline]
 [<ffffffff81442451>] truncate_inode_pages_final+0x81/0xc0 mm/truncate.c:452
 [<ffffffff815c8121>] bdev_evict_inode+0x21/0x190 fs/block_dev.c:639
 [<ffffffff81564d59>] evict+0x2e9/0x630 fs/inode.c:553
 [<ffffffff81566080>] iput_final fs/inode.c:1516 [inline]
 [<ffffffff81566080>] iput fs/inode.c:1543 [inline]
 [<ffffffff81566080>] iput+0x370/0x900 fs/inode.c:1528
 [<ffffffff815cf5a0>] bdput fs/block_dev.c:775 [inline]
 [<ffffffff815cf5a0>] bd_forget+0xf0/0x1a0 fs/block_dev.c:826
 [<ffffffff81564ef5>] evict+0x485/0x630 fs/inode.c:559
 [<ffffffff81566080>] iput_final fs/inode.c:1516 [inline]
 [<ffffffff81566080>] iput fs/inode.c:1543 [inline]
 [<ffffffff81566080>] iput+0x370/0x900 fs/inode.c:1528
 [<ffffffff81552747>] dentry_unlink_inode+0x277/0x330 fs/dcache.c:368
 [<ffffffff81556ec3>] __dentry_kill+0x333/0x580 fs/dcache.c:570
 [<ffffffff81558419>] dentry_kill fs/dcache.c:611 [inline]
 [<ffffffff81558419>] dput.part.0+0x5d9/0x7c0 fs/dcache.c:828
 [<ffffffff81558ed4>] dput fs/dcache.c:790 [inline]
 [<ffffffff81558ed4>] do_one_tree+0x44/0x50 fs/dcache.c:1482
 [<ffffffff8155c1e7>] shrink_dcache_for_umount+0x67/0x160 fs/dcache.c:1496
 [<ffffffff815137ed>] generic_shutdown_super+0x6d/0x300 fs/super.c:432
 [<ffffffff8151404f>] kill_anon_super+0x3f/0x60 fs/super.c:978
 [<ffffffff8188e272>] fuse_kill_sb_anon+0x42/0x50 fs/fuse/inode.c:1223
 [<ffffffff815148f9>] deactivate_locked_super+0x79/0xe0 fs/super.c:320
 [<ffffffff8151665a>] deactivate_super fs/super.c:351 [inline]
 [<ffffffff8151665a>] deactivate_super+0x8a/0xb0 fs/super.c:347
 [<ffffffff815754d2>] cleanup_mnt+0xb2/0x160 fs/namespace.c:1143
 [<ffffffff81575606>] __cleanup_mnt+0x16/0x20 fs/namespace.c:1150
 [<ffffffff8113cf88>] task_work_run+0x108/0x180 kernel/task_work.c:116
 [<ffffffff810e5bbb>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff810e5bbb>] do_exit+0x78b/0x2aa0 kernel/exit.c:841
 [<ffffffff810ec2c1>] do_group_exit+0x111/0x300 kernel/exit.c:945
 [<ffffffff810ec4cd>] SYSC_exit_group kernel/exit.c:956 [inline]
 [<ffffffff810ec4cd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:954
 [<ffffffff810056bd>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
 [<ffffffff82816a93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: 89 fa 48 c1 ea 03 80 3c 02 00 75 35 48 8b 9b e0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 30 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 17 48 8b 83 30 05 00 00 5b 5d 48 05 20 02 00 00 
RIP  [<ffffffff81ac46ca>] bdev_get_queue include/linux/blkdev.h:847 [inline]
RIP  [<ffffffff81ac46ca>] blk_get_backing_dev_info+0x4a/0x70 block/blk-core.c:118
 RSP <ffff8801cded76c8>
---[ end trace c0e9ac57524983b2 ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/02/28 15:11 https://android.googlesource.com/kernel/common android-4.9 1597fdfe52ba 09aeeba4 .config console log report syz C ci-android-49-kasan-gce-root
2019/02/28 16:29 https://android.googlesource.com/kernel/common android-4.9 1597fdfe52ba 09aeeba4 .config console log report ci-android-49-kasan-gce-root
2019/02/28 14:30 https://android.googlesource.com/kernel/common android-4.9 1597fdfe52ba 09aeeba4 .config console log report ci-android-49-kasan-gce-root
* Struck through repros no longer work on HEAD.