syzbot

 sign-in | mailing list | source | docs
🐞 Open [1595]
≡ Subsystems
🐞 Fixed [6231]
🐞 Invalid [15771]
⬇ Missing Backports [183]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

general protection fault in do_move_mount (3)

Status: upstream: reported C repro on 2025/05/14 17:39
Subsystems: xfs
[Documentation on labels]
Reported-by: syzbot+799d4cf78a7476483ba2@syzkaller.appspotmail.com
First crash: 5d09h, last: 35m
Cause bisection: introduced by (bisect log) :
commit 267fc3a06a37bec30cc5b4d97fb8409102bc7a9d
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Tue Apr 29 01:43:23 2025 +0000

  do_move_mount(): don't leak MNTNS_PROPAGATING on failures

Crash: BUG: unable to handle kernel NULL pointer dereference in do_move_mount (log)
Repro: C syz .config
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [xfs?] general protection fault in do_move_mount (3) 3 (7) 2025/05/14 19:49
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in do_move_mount (2) fs syz done 7 2150d 2158d 12/28 fixed on 2019/07/29 13:39
upstream general protection fault in do_move_mount fs 3 2199d 2198d 12/28 fixed on 2019/06/14 18:22
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2025/05/14 18:46 26m viro@zeniv.linux.org.uk git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git cfaefc95bfa7eb92dd837ea9fb38bc84e62d79b5 OK log
2025/05/14 18:21 2m viro@zeniv.linux.org.uk git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git 8a6d8037a5deb2a9d5184f299f9adb60b0c0ae04 error
2025/05/14 18:05 0m viro@zeniv.linux.org.uk git://git.kernel.org//pub/scm/linux/kernel/git/viro/vfs.git fixes error

Sample crash report:
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
XFS (loop0): Quotacheck: Done.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 UID: 0 PID: 5821 Comm: syz-executor358 Not tainted 6.15.0-rc5-syzkaller-00275-gbec6f00f120e #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:is_anon_ns fs/mount.h:165 [inline]
RIP: 0010:do_move_mount+0x27d/0xb10 fs/namespace.c:3725
Code: e8 98 53 85 ff 41 be ea ff ff ff 49 bd 00 00 00 00 00 fc ff df 48 8b 6c 24 18 4c 8b 7c 24 08 48 8d 5d 48 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 54 22 e5 ff 48 8b 1b 31 ff 48 89
RSP: 0018:ffffc90004197d50 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000032 RCX: ffff888034268000
RDX: 0000000000000000 RSI: ffffffff8d9214e1 RDI: ffff88801b2d77b8
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8238eb99 R12: ffffffff8dde9718
R13: dffffc0000000000 R14: 00000000ffffffea R15: ffff88803401e480
FS:  0000555582a39380(0000) GS:ffff888126200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000066c7e0 CR3: 000000003414c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __do_sys_move_mount fs/namespace.c:4678 [inline]
 __se_sys_move_mount+0x41e/0x580 fs/namespace.c:4616
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7effb3efc739
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcb2b585e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001ad
RAX: ffffffffffffffda RBX: 00007ffcb2b587b8 RCX: 00007effb3efc739
RDX: 00000000ffffff9c RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007effb3f78610 R08: 0000000000000224 R09: 00007ffcb2b587b8
R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffcb2b587a8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:is_anon_ns fs/mount.h:165 [inline]
RIP: 0010:do_move_mount+0x27d/0xb10 fs/namespace.c:3725
Code: e8 98 53 85 ff 41 be ea ff ff ff 49 bd 00 00 00 00 00 fc ff df 48 8b 6c 24 18 4c 8b 7c 24 08 48 8d 5d 48 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 54 22 e5 ff 48 8b 1b 31 ff 48 89
RSP: 0018:ffffc90004197d50 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000032 RCX: ffff888034268000
RDX: 0000000000000000 RSI: ffffffff8d9214e1 RDI: ffff88801b2d77b8
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8238eb99 R12: ffffffff8dde9718
R13: dffffc0000000000 R14: 00000000ffffffea R15: ffff88803401e480
FS:  0000555582a39380(0000) GS:ffff888126200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000066c7e0 CR3: 000000003414c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	e8 98 53 85 ff       	call   0xff85539d
   5:	41 be ea ff ff ff    	mov    $0xffffffea,%r14d
   b:	49 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%r13
  12:	fc ff df
  15:	48 8b 6c 24 18       	mov    0x18(%rsp),%rbp
  1a:	4c 8b 7c 24 08       	mov    0x8(%rsp),%r15
  1f:	48 8d 5d 48          	lea    0x48(%rbp),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 54 22 e5 ff       	call   0xffe5228d
  39:	48 8b 1b             	mov    (%rbx),%rbx
  3c:	31 ff                	xor    %edi,%edi
  3e:	48                   	rex.W
  3f:	89                   	.byte 0x89

Crashes (202):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/10 19:08 upstream bec6f00f120e 77908e5f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs general protection fault in do_move_mount
2025/05/10 18:47 upstream bec6f00f120e 77908e5f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs general protection fault in do_move_mount
2025/05/16 02:43 upstream fee3e843b309 cfde8269 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/15 22:04 upstream 088d13246a46 d6b2ee52 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/15 21:48 upstream 088d13246a46 d6b2ee52 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/15 18:59 upstream 088d13246a46 cfde8269 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/15 16:19 upstream 088d13246a46 d6b2ee52 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/15 11:24 upstream c94d59a126cb d6b2ee52 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/15 08:40 upstream 546bce579204 a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/15 05:57 upstream 1a80a098c606 a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/14 23:49 upstream 1a80a098c606 a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/14 16:54 upstream 9f35e33144ae a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/14 15:01 upstream 9f35e33144ae a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/14 13:53 upstream 9f35e33144ae 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/14 10:20 upstream 9f35e33144ae 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/14 09:10 upstream 9f35e33144ae 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/14 07:25 upstream 405e6c37c89e 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/14 06:08 upstream 9f35e33144ae 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/14 02:50 upstream e9565e23cd89 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/14 01:30 upstream 405e6c37c89e 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/14 00:23 upstream e9565e23cd89 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/13 22:41 upstream e9565e23cd89 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/13 21:27 upstream e9565e23cd89 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/13 20:15 upstream e9565e23cd89 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/13 15:42 upstream e9565e23cd89 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/13 13:20 upstream e9565e23cd89 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in do_move_mount
2025/05/13 12:20 upstream e9565e23cd89 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in do_move_mount
2025/05/13 10:52 upstream e9565e23cd89 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in do_move_mount
2025/05/13 07:03 upstream 627277ba7c23 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/13 04:41 upstream 627277ba7c23 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/13 01:59 upstream 82f2b0b97b36 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/13 00:54 upstream 627277ba7c23 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/12 21:41 upstream 627277ba7c23 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/12 18:06 upstream 82f2b0b97b36 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/12 16:05 upstream 82f2b0b97b36 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/12 15:00 upstream 82f2b0b97b36 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/12 08:24 upstream cd802e7e5f1e 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/12 05:36 upstream cd802e7e5f1e 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/11 23:59 upstream cd802e7e5f1e 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/11 23:28 upstream 3ce9925823c7 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/11 15:09 upstream 3ce9925823c7 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/15 00:57 upstream 1a80a098c606 a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in do_move_mount
2025/05/13 05:59 upstream 627277ba7c23 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in do_move_mount
2025/05/13 00:20 upstream 627277ba7c23 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in do_move_mount
2025/05/12 06:39 upstream 82f2b0b97b36 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in do_move_mount
2025/05/11 19:59 upstream 3ce9925823c7 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in do_move_mount
2025/05/13 08:51 upstream e9565e23cd89 9497799b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in do_move_mount
2025/05/11 17:54 upstream 3ce9925823c7 77908e5f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in do_move_mount
2025/05/11 13:34 upstream 3ce9925823c7 77908e5f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in do_move_mount
2025/05/14 04:30 upstream 405e6c37c89e 7344edeb .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in do_move_mount
2025/05/13 09:40 upstream e9565e23cd89 9497799b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in do_move_mount
2025/05/12 12:33 upstream 82f2b0b97b36 77908e5f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in do_move_mount
2025/05/11 21:34 upstream cd802e7e5f1e 77908e5f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in do_move_mount
2025/05/13 18:40 upstream e9565e23cd89 9497799b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/13 17:34 upstream e9565e23cd89 9497799b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte BUG: unable to handle kernel NULL pointer dereference in do_move_mount
2025/05/13 14:26 upstream e9565e23cd89 9497799b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel NULL pointer dereference in do_move_mount
2025/05/10 23:37 upstream bec6f00f120e 77908e5f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte BUG: unable to handle kernel NULL pointer dereference in do_move_mount
2025/05/14 20:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c919f08732cc a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/14 20:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c919f08732cc a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/14 17:56 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci c919f08732cc a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
* Struck through repros no longer work on HEAD.