syzbot


BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (3)

Status: upstream: reported C repro on 2024/04/28 08:01
Subsystems: overlayfs
[Documentation on labels]
Reported-by: syzbot+94891a5155abdf6821b7@syzkaller.appspotmail.com
First crash: 210d, last: 12h56m
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: BUG: unable to handle kernel NULL pointer dereference in lookup_slow (log)
Repro: C syz .config
  
Discussions (5)
Title Replies (including bot) Last reply
[syzbot] Monthly overlayfs report (Nov 2024) 0 (1) 2024/11/20 13:31
[PATCH RESEND] fs/bfs: fix possible NULL pointer dereference caused by empty i_op/i_fop 1 (1) 2024/10/18 16:22
[PATCH] fs/bfs: fix possible NULL pointer dereference caused by empty i_op/i_fop 2 (2) 2024/10/08 16:57
[syzbot] [overlayfs?] BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (3) 0 (3) 2024/09/29 00:45
[syzbot] Monthly overlayfs report (Jun 2024) 0 (1) 2024/06/15 17:49
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow reiserfs C inconclusive done 3 1374d 1514d 19/28 fixed on 2021/03/10 01:48
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (2) C done 15 1196d 1320d 1/1 fixed on 2021/09/13 16:54
upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (2) reiserfs C inconclusive 4 1234d 1318d 0/28 auto-obsoleted due to no activity on 2023/04/14 10:28
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow C done 23 1353d 1511d 1/1 fixed on 2021/04/10 11:48
Last patch testing requests (6)
Created Duration User Patch Repo Result
2024/11/02 04:57 52m retest repro upstream report log
2024/11/02 04:57 16m retest repro upstream report log
2024/09/29 00:45 20m andrew.kanner@gmail.com patch upstream OK log
2024/09/03 22:39 1h13m andrew.kanner@gmail.com git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs.git overlayfs-next report log
2024/08/06 13:10 17m retest repro upstream report log
2024/05/17 21:02 11m retest repro upstream report log

Sample crash report:
loop0: detected capacity change from 0 to 64
overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 8000000021d98067 P4D 8000000021d98067 PUD 2e130067 PMD 0 
Oops: Oops: 0010 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 5218 Comm: syz-executor169 Not tainted 6.11.0-rc5-syzkaller-00176-g20371ba12063 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc9000355f558 EFLAGS: 00010246
RAX: 1ffffffff17f1868 RBX: ffffffff8bf8c340 RCX: ffff88807f5b8000
RDX: 0000000000000000 RSI: ffff8880255dabc0 RDI: ffff888079ef8018
RBP: ffffc9000355f670 R08: ffffffff820c2f53 R09: 1ffffffff29ad8e9
R10: dffffc0000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff8880255dabc0 R14: 1ffff11004abb578 R15: 1ffff920006abeb0
FS:  0000555572776380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000075370000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __lookup_slow+0x28c/0x3f0 fs/namei.c:1718
 lookup_slow fs/namei.c:1735 [inline]
 lookup_one_unlocked+0x1a4/0x290 fs/namei.c:2898
 ovl_lookup_positive_unlocked fs/overlayfs/namei.c:210 [inline]
 ovl_lookup_single+0x200/0xbd0 fs/overlayfs/namei.c:240
 ovl_lookup_layer+0x417/0x510 fs/overlayfs/namei.c:333
 ovl_lookup+0xcf7/0x2a60 fs/overlayfs/namei.c:1124
 lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1633
 filename_create+0x297/0x540 fs/namei.c:3980
 do_mknodat+0x18b/0x5b0 fs/namei.c:4125
 __do_sys_mknod fs/namei.c:4171 [inline]
 __se_sys_mknod fs/namei.c:4169 [inline]
 __x64_sys_mknod+0x8c/0xa0 fs/namei.c:4169
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc4b42b2839
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffef3368b58 EFLAGS: 00000246 ORIG_RAX: 0000000000000085
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fc4b42b2839
RDX: 0000000000000700 RSI: 0000000000002000 RDI: 0000000020000140
RBP: 00007fc4b4325610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffef3368d28 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc9000355f558 EFLAGS: 00010246
RAX: 1ffffffff17f1868 RBX: ffffffff8bf8c340 RCX: ffff88807f5b8000
RDX: 0000000000000000 RSI: ffff8880255dabc0 RDI: ffff888079ef8018
RBP: ffffc9000355f670 R08: ffffffff820c2f53 R09: 1ffffffff29ad8e9
R10: dffffc0000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff8880255dabc0 R14: 1ffff11004abb578 R15: 1ffff920006abeb0
FS:  0000555572776380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000075370000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (132):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/30 11:10 upstream 20371ba12063 ee2602b8 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/24 08:19 upstream 9d1ddab261f3 21339d7b .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/20 16:45 upstream bf9aa14fc523 4fca1650 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/20 04:06 upstream 158f238aa69d 7d02db5a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/19 09:37 upstream 23acd177540d 571351cb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/19 01:10 upstream 23acd177540d 571351cb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/18 08:47 upstream adc218676eef cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/18 07:10 upstream f66d6acccbc0 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/17 18:53 upstream 4a5df3796467 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/17 11:48 upstream 4a5df3796467 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/17 03:15 upstream b5a24181e461 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/16 20:24 upstream e8bdb3c8be08 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/16 01:00 upstream f868cd251776 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/15 17:00 upstream cfaaa7d010d1 f6ede3a3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/13 09:11 upstream 3022e9d00ebe 62026c85 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/12 12:40 upstream 2d5404caa8c7 75bb1b32 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/12 03:04 upstream 2d5404caa8c7 97fe5517 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/11 20:58 upstream 2d5404caa8c7 0c4b1325 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/11 05:58 upstream a9cda7c0ffed 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/10 23:28 upstream a9cda7c0ffed 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/10 21:16 upstream a9cda7c0ffed 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/10 12:12 upstream de2f378f2b77 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/10 07:54 upstream de2f378f2b77 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/10 01:33 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 22:58 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 21:17 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 19:56 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 17:57 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 15:47 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 14:12 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 12:02 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 10:58 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 06:11 upstream f1dce1f09380 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 05:03 upstream f1dce1f09380 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/09 01:57 upstream f1dce1f09380 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 22:57 upstream f1dce1f09380 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 21:34 upstream f1dce1f09380 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 20:25 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 14:42 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 10:21 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 09:14 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 08:06 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 05:47 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 04:10 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/11/08 02:17 upstream 906bd684e4b1 867e44df .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/14 03:03 upstream 36c254515dc6 084d8178 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/19 05:20 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/19 16:38 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
* Struck through repros no longer work on HEAD.