syzbot
general protection fault in cancel_dirty_page
Status:
public: reported C repro on 2019/10/17 07:25
Reported-by: syzbot+6f6e4f6efef7ffb4fdd8@syzkaller.appspotmail.com
First crash: 2504d, last: 2459d
Sample crash report:
random: crng init done
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 2037 Comm: syz-executor301 Not tainted 4.9.194+ #0
task: 00000000f47c99b9 task.stack: 00000000f1ff0cf8
RIP: 0010:[<ffffffff81ae5d7a>] [<000000004968afb4>] bdev_get_queue include/linux/blkdev.h:847 [inline]
RIP: 0010:[<ffffffff81ae5d7a>] [<000000004968afb4>] blk_get_backing_dev_info+0x4a/0x70 block/blk-core.c:118
RSP: 0018:ffff8801cf08f6c8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff10039e11f0a
RDX: 00000000000000a6 RSI: ffffffff81ae5d3d RDI: 0000000000000530
RBP: ffff8801cf08f6d0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000001 R12: ffffea00073e3d00
R13: ffff8801d4798948 R14: ffff8801d4798750 R15: ffffffff833f1db8
FS: 00000000025f5880(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5d41dc7000 CR3: 00000001d39dd000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffff8801da49a200 ffff8801cf08f710 ffffffff8143e202 ffff8801d4798948
ffff8801d4798948 ffffea00073e3d00 ffffea00073e3d20 ffff8801d4798948
0000000000000000 ffff8801cf08f740 ffffffff8144a790 dffffc0000000000
Call Trace:
[<000000000af72750>] inode_to_bdi include/linux/backing-dev.h:186 [inline]
[<000000000af72750>] mapping_cap_account_dirty include/linux/backing-dev.h:234 [inline]
[<000000000af72750>] cancel_dirty_page+0x1a2/0x3d0 mm/page-writeback.c:2609
[<00000000db6b5bc5>] truncate_complete_page mm/truncate.c:126 [inline]
[<00000000db6b5bc5>] truncate_inode_page+0x130/0x260 mm/truncate.c:167
[<000000002054041c>] truncate_inode_pages_range+0x20e/0xfe0 mm/truncate.c:291
[<00000000299b88a8>] truncate_inode_pages mm/truncate.c:401 [inline]
[<00000000299b88a8>] truncate_inode_pages_final+0x81/0xc0 mm/truncate.c:452
[<0000000094db4c38>] bdev_evict_inode+0x21/0x190 fs/block_dev.c:639
[<000000005e22accb>] evict+0x2e9/0x630 fs/inode.c:553
[<0000000030b01926>] iput_final fs/inode.c:1516 [inline]
[<0000000030b01926>] iput fs/inode.c:1543 [inline]
[<0000000030b01926>] iput+0x370/0x900 fs/inode.c:1528
[<00000000a9b1fe28>] bdput fs/block_dev.c:775 [inline]
[<00000000a9b1fe28>] bd_forget+0xf0/0x1a0 fs/block_dev.c:826
[<00000000fb923266>] evict+0x485/0x630 fs/inode.c:559
[<0000000030b01926>] iput_final fs/inode.c:1516 [inline]
[<0000000030b01926>] iput fs/inode.c:1543 [inline]
[<0000000030b01926>] iput+0x370/0x900 fs/inode.c:1528
[<000000001d2921a5>] dentry_unlink_inode+0x277/0x330 fs/dcache.c:369
[<00000000da54fab4>] __dentry_kill+0x333/0x580 fs/dcache.c:571
[<00000000015d033a>] dentry_kill fs/dcache.c:612 [inline]
[<00000000015d033a>] dput.part.0+0x5d9/0x7c0 fs/dcache.c:829
[<000000003b1b80f0>] dput fs/dcache.c:791 [inline]
[<000000003b1b80f0>] do_one_tree+0x44/0x50 fs/dcache.c:1483
[<0000000037117740>] shrink_dcache_for_umount+0x67/0x160 fs/dcache.c:1497
[<000000000f2c2dae>] generic_shutdown_super+0x6d/0x300 fs/super.c:432
[<0000000045682902>] kill_anon_super+0x3f/0x60 fs/super.c:978
[<00000000ca6c79c4>] fuse_kill_sb_anon+0x42/0x50 fs/fuse/inode.c:1223
[<00000000fac3314b>] deactivate_locked_super+0x79/0xe0 fs/super.c:320
[<000000002ccdc27c>] deactivate_super fs/super.c:351 [inline]
[<000000002ccdc27c>] deactivate_super+0x8a/0xb0 fs/super.c:347
[<00000000597227e9>] cleanup_mnt+0xb2/0x160 fs/namespace.c:1143
[<00000000d94d44ec>] __cleanup_mnt+0x16/0x20 fs/namespace.c:1150
[<00000000bc55be8c>] task_work_run+0x108/0x180 kernel/task_work.c:116
[<00000000d8591e2f>] exit_task_work include/linux/task_work.h:21 [inline]
[<00000000d8591e2f>] do_exit+0x78f/0x2aa0 kernel/exit.c:842
[<0000000043be58fd>] do_group_exit+0x111/0x300 kernel/exit.c:946
[<00000000e1a12f6b>] SYSC_exit_group kernel/exit.c:957 [inline]
[<00000000e1a12f6b>] SyS_exit_group+0x1d/0x20 kernel/exit.c:955
[<0000000028b3aca0>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
[<0000000002949558>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: 89 fa 48 c1 ea 03 80 3c 02 00 75 35 48 8b 9b e0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 30 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 17 48 8b 83 30 05 00 00 5b 5d 48 05 20 02 00 00
RIP [<000000004968afb4>] bdev_get_queue include/linux/blkdev.h:847 [inline]
RIP [<000000004968afb4>] blk_get_backing_dev_info+0x4a/0x70 block/blk-core.c:118
RSP <ffff8801cf08f6c8>
---[ end trace eecfcf013845c8f5 ]---
* Struck through repros no longer work on HEAD.