syzbot


BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (3)

Status: upstream: reported C repro on 2024/04/28 08:01
Subsystems: overlayfs
[Documentation on labels]
Reported-by: syzbot+94891a5155abdf6821b7@syzkaller.appspotmail.com
First crash: 174d, last: 1d12h
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: BUG: unable to handle kernel NULL pointer dereference in lookup_slow (log)
Repro: C syz .config
  
Discussions (3)
Title Replies (including bot) Last reply
[PATCH] fs/bfs: fix possible NULL pointer dereference caused by empty i_op/i_fop 2 (2) 2024/10/08 16:57
[syzbot] [overlayfs?] BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (3) 0 (3) 2024/09/29 00:45
[syzbot] Monthly overlayfs report (Jun 2024) 0 (1) 2024/06/15 17:49
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow reiserfs C inconclusive done 3 1338d 1478d 19/28 fixed on 2021/03/10 01:48
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (2) C done 15 1160d 1284d 1/1 fixed on 2021/09/13 16:54
upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (2) reiserfs C inconclusive 4 1198d 1282d 0/28 auto-obsoleted due to no activity on 2023/04/14 10:28
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow C done 23 1317d 1475d 1/1 fixed on 2021/04/10 11:48
Last patch testing requests (4)
Created Duration User Patch Repo Result
2024/09/29 00:45 20m andrew.kanner@gmail.com patch upstream OK log
2024/09/03 22:39 1h13m andrew.kanner@gmail.com git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs.git overlayfs-next report log
2024/08/06 13:10 17m retest repro upstream report log
2024/05/17 21:02 11m retest repro upstream report log

Sample crash report:
loop0: detected capacity change from 0 to 64
overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 8000000021d98067 P4D 8000000021d98067 PUD 2e130067 PMD 0 
Oops: Oops: 0010 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 5218 Comm: syz-executor169 Not tainted 6.11.0-rc5-syzkaller-00176-g20371ba12063 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc9000355f558 EFLAGS: 00010246
RAX: 1ffffffff17f1868 RBX: ffffffff8bf8c340 RCX: ffff88807f5b8000
RDX: 0000000000000000 RSI: ffff8880255dabc0 RDI: ffff888079ef8018
RBP: ffffc9000355f670 R08: ffffffff820c2f53 R09: 1ffffffff29ad8e9
R10: dffffc0000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff8880255dabc0 R14: 1ffff11004abb578 R15: 1ffff920006abeb0
FS:  0000555572776380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000075370000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __lookup_slow+0x28c/0x3f0 fs/namei.c:1718
 lookup_slow fs/namei.c:1735 [inline]
 lookup_one_unlocked+0x1a4/0x290 fs/namei.c:2898
 ovl_lookup_positive_unlocked fs/overlayfs/namei.c:210 [inline]
 ovl_lookup_single+0x200/0xbd0 fs/overlayfs/namei.c:240
 ovl_lookup_layer+0x417/0x510 fs/overlayfs/namei.c:333
 ovl_lookup+0xcf7/0x2a60 fs/overlayfs/namei.c:1124
 lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1633
 filename_create+0x297/0x540 fs/namei.c:3980
 do_mknodat+0x18b/0x5b0 fs/namei.c:4125
 __do_sys_mknod fs/namei.c:4171 [inline]
 __se_sys_mknod fs/namei.c:4169 [inline]
 __x64_sys_mknod+0x8c/0xa0 fs/namei.c:4169
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc4b42b2839
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffef3368b58 EFLAGS: 00000246 ORIG_RAX: 0000000000000085
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fc4b42b2839
RDX: 0000000000000700 RSI: 0000000000002000 RDI: 0000000020000140
RBP: 00007fc4b4325610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffef3368d28 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc9000355f558 EFLAGS: 00010246
RAX: 1ffffffff17f1868 RBX: ffffffff8bf8c340 RCX: ffff88807f5b8000
RDX: 0000000000000000 RSI: ffff8880255dabc0 RDI: ffff888079ef8018
RBP: ffffc9000355f670 R08: ffffffff820c2f53 R09: 1ffffffff29ad8e9
R10: dffffc0000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff8880255dabc0 R14: 1ffff11004abb578 R15: 1ffff920006abeb0
FS:  0000555572776380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000075370000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (52):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/30 11:10 upstream 20371ba12063 ee2602b8 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/24 08:19 upstream 9d1ddab261f3 21339d7b .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/14 19:28 upstream 6485cf5ea253 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/12 16:38 upstream 09f6b0c8904b 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/10 05:37 upstream d3d1556696c1 0278d004 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/09 10:28 upstream 75b607fab38d 402f1df0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/09 08:11 upstream 5b7c893ed5ed 402f1df0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/08 05:36 upstream 87d6aab2389e 402f1df0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/07 16:00 upstream 8cf0b93919e1 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/06 23:57 upstream 8f602276d390 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/06 13:24 upstream 8f602276d390 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/05 10:28 upstream 27cc6fdf7201 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/05 00:04 upstream 360c1f1f24c6 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/04 04:29 upstream 7ec462100ef9 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/02 10:29 upstream e32cde8d2bd7 ea2b66a6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/09/15 19:08 upstream d42f7708e27c 08d8a733 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/08/30 10:05 upstream 20371ba12063 ee2602b8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/07/23 12:18 upstream 66ebbdfdeb09 708c10c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/23 13:35 upstream 5f583a3162ff edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/23 13:34 upstream 5f583a3162ff edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/21 10:42 upstream 50736169ecc8 dac2aa43 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/21 04:27 upstream 50736169ecc8 dac2aa43 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/19 20:55 upstream 2ccbdf43d5e7 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/12 20:14 upstream cea2a26553ac f815599d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/11 07:39 upstream 83a7eefedc9b b7d9eb04 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/11 07:07 upstream 83a7eefedc9b b7d9eb04 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/05/03 20:17 upstream f03359bca01b dd26401e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/28 20:23 upstream 2c8159388952 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/28 16:02 upstream 2c8159388952 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/27 16:48 upstream 5eb4573ea63d 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/27 00:31 upstream c942a0cd3603 059e9963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/26 03:06 upstream e33c4963bf53 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/25 23:56 upstream e33c4963bf53 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/25 16:42 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/25 13:18 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/25 11:22 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/25 11:20 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/24 22:39 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/24 22:06 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/24 13:07 upstream 9d1ddab261f3 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/24 10:46 upstream 9d1ddab261f3 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/24 08:05 upstream 9d1ddab261f3 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/04/24 07:50 upstream 9d1ddab261f3 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/14 03:03 upstream 36c254515dc6 084d8178 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/10/08 18:04 upstream 87d6aab2389e 402f1df0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/09/28 05:39 upstream e477dba5442c 440b26ec .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/09/07 11:40 upstream b31c44928842 9750182a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/19 05:20 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/16 11:52 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/19 16:38 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2024/06/19 13:46 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
* Struck through repros no longer work on HEAD.