syzbot


general protection fault in inode_wait_for_writeback (2)

Status: upstream: reported C repro on 2024/02/23 17:33
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+7d9c7e735d83f1951f5f@syzkaller.appspotmail.com
First crash: 272d, last: 15d
Bug presence (1)
Date Name Commit Repro Result
2024/11/20 upstream (ToT) bf9aa14fc523 C [report] KASAN: out-of-bounds Write in end_buffer_read_sync
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 general protection fault in inode_wait_for_writeback 3 407d 472d 0/3 auto-obsoleted due to no activity on 2024/01/19 05:43
upstream BUG: unable to handle kernel paging request in inode_wait_for_writeback ntfs3 1 929d 929d 0/28 auto-obsoleted due to no activity on 2022/09/04 00:33
Last patch testing requests (1)
Created Duration User Patch Repo Result
2024/11/19 22:26 17m retest repro linux-5.15.y OK log
Fix bisection attempts (6)
Created Duration User Patch Repo Result
2024/11/05 17:54 2h12m bisect fix linux-5.15.y OK (0) job log log
2024/10/04 14:35 3h35m fix candidate upstream OK (0) job log log
2024/09/18 06:00 2h52m bisect fix linux-5.15.y OK (0) job log log
2024/08/14 20:05 1h54m bisect fix linux-5.15.y OK (0) job log log
2024/06/10 23:21 2h30m bisect fix linux-5.15.y OK (0) job log log
2024/03/25 05:51 2h39m bisect fix linux-5.15.y OK (0) job log log

Sample crash report:
loop3: detected capacity change from 0 to 4096
ntfs3: loop3: Different NTFS' sector size (1024) and media sector size (512)
general protection fault, probably for non-canonical address 0x5a21ec7b72183f83: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 6674 Comm: syz-executor159 Not tainted 5.15.156-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
RIP: 0010:_raw_spin_lock+0x29/0x40 kernel/locking/spinlock.c:154
Code: 00 53 48 89 fb bf 01 00 00 00 e8 72 47 30 f7 48 8d 7b 18 31 f6 31 d2 31 c9 41 b8 01 00 00 00 45 31 c9 ff 74 24 08 e8 a6 92 3b <f7> 48 83 c4 08 48 89 df 5b e9 39 07 3d f7 66 0f 1f 84 00 00 00 00
RSP: 0018:ffffc9000b0cf928 EFLAGS: 00010246
RAX: 5a21ec7b72184000 RBX: ffff88807029e2b8 RCX: ffffffff81636522
RDX: dffffc0000000000 RSI: ffffffff8a8b3c20 RDI: ffffffff8ad8f380
RBP: ffffc9000b0cfa40 R08: dffffc0000000000 R09: fffffbfff1f7ec32
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807029e2b8
R13: dffffc0000000000 R14: ffff88807029e230 R15: ffffc9000b0cf980
FS:  00005555571e6480(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007febceeeec00 CR3: 000000001a088000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 spin_lock include/linux/spinlock.h:363 [inline]
 inode_wait_for_writeback+0x89/0x280 fs/fs-writeback.c:1527
 evict+0x277/0x620 fs/inode.c:584
 ntfs_fill_super+0x3b47/0x4350 fs/ntfs3/super.c:1185
 get_tree_bdev+0x3fe/0x620 fs/super.c:1312
 vfs_get_tree+0x88/0x270 fs/super.c:1517
 do_new_mount+0x2ba/0xb40 fs/namespace.c:3005
 do_mount fs/namespace.c:3348 [inline]
 __do_sys_mount fs/namespace.c:3556 [inline]
 __se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3533
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7febd712f9da
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5427f338 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffd5427f350 RCX: 00007febd712f9da
RDX: 000000002001f700 RSI: 000000002001f740 RDI: 00007ffd5427f350
RBP: 0000000000000004 R08: 00007ffd5427f390 R09: 000000000001f6c1
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
R13: 00007ffd5427f390 R14: 0000000000000003 R15: 0000000000200000
 </TASK>
Modules linked in:
---[ end trace d7708e0407dfabf4 ]---
RIP: 0010:__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
RIP: 0010:_raw_spin_lock+0x29/0x40 kernel/locking/spinlock.c:154
Code: 00 53 48 89 fb bf 01 00 00 00 e8 72 47 30 f7 48 8d 7b 18 31 f6 31 d2 31 c9 41 b8 01 00 00 00 45 31 c9 ff 74 24 08 e8 a6 92 3b <f7> 48 83 c4 08 48 89 df 5b e9 39 07 3d f7 66 0f 1f 84 00 00 00 00
RSP: 0018:ffffc9000b0cf928 EFLAGS: 00010246
RAX: 5a21ec7b72184000 RBX: ffff88807029e2b8 RCX: ffffffff81636522
RDX: dffffc0000000000 RSI: ffffffff8a8b3c20 RDI: ffffffff8ad8f380
RBP: ffffc9000b0cfa40 R08: dffffc0000000000 R09: fffffbfff1f7ec32
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807029e2b8
R13: dffffc0000000000 R14: ffff88807029e230 R15: ffffc9000b0cf980
FS:  00005555571e6480(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007febceeeec00 CR3: 000000001a088000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/26 02:56 linux-5.15.y c52b9710c83d 8bdc0f22 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan general protection fault in inode_wait_for_writeback
2024/07/03 04:37 linux-5.15.y 4878aadf2d15 1ecfa2d8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in inode_wait_for_writeback
2024/05/11 11:29 linux-5.15.y 284087d4f7d5 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in inode_wait_for_writeback
2024/04/12 03:25 linux-5.15.y cdfd0a7f0139 27de0a5c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan general protection fault in inode_wait_for_writeback
2024/02/23 17:32 linux-5.15.y 458ce51d0356 8d446f15 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan general protection fault in inode_wait_for_writeback
* Struck through repros no longer work on HEAD.