syzbot


general protection fault in xfs_destroy_mount_workqueues

Status: upstream: reported on 2024/05/19 15:13
Subsystems: xfs
[Documentation on labels]
Reported-by: syzbot+8905ded1b49ae88b96a6@syzkaller.appspotmail.com
First crash: 44d, last: 2d03h
Discussions (2)
Title Replies (including bot) Last reply
[syzbot] Monthly xfs report (May 2024) 0 (1) 2024/05/31 06:48
[syzbot] [xfs?] general protection fault in xfs_destroy_mount_workqueues 0 (1) 2024/05/19 15:13
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-use-after-free Write in xfs_destroy_mount_workqueues xfs 1 445d 441d 0/27 closed as dup on 2023/04/03 05:23

Sample crash report:
XFS (loop3): Unmounting Filesystem a2f82aab-77f8-4286-afd4-a8f747a74bab
XFS (loop3): Uncorrected metadata errors detected; please run xfs_repair.
Oops: general protection fault, probably for non-canonical address 0xfd801bfff1100d67: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xec00ffff88806b38-0xec00ffff88806b3f]
CPU: 3 PID: 8054 Comm: syz-executor.3 Not tainted 6.9.0-syzkaller-12124-g6d69b6c12fce #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:__lock_acquire+0xe3e/0x3b30 kernel/locking/lockdep.c:5005
Code: 11 00 00 39 05 63 68 27 12 0f 82 be 05 00 00 ba 01 00 00 00 e9 e4 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 82 1f 00 00 49 81 3c 24 e0 fd e9 92 0f 84 98 f2
RSP: 0018:ffffc90003bdfab8 EFLAGS: 00010802
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 1d801ffff1100d67 RSI: ffff888029d8a440 RDI: ec00ffff88806b3b
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8fe45197 R11: 0000000000000003 R12: ec00ffff88806b3b
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
FS:  000055557e440480(0000) GS:ffff88806b300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3302e000 CR3: 000000010a54e000 CR4: 0000000000350ef0
DR0: 0000000000002800 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 lock_acquire kernel/locking/lockdep.c:5754 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irq+0x36/0x50 kernel/locking/spinlock.c:170
 put_pwq_unlocked kernel/workqueue.c:1662 [inline]
 put_pwq_unlocked kernel/workqueue.c:1655 [inline]
 destroy_workqueue+0x5df/0xaa0 kernel/workqueue.c:5851
 xfs_destroy_mount_workqueues+0xe7/0x150 fs/xfs/xfs_super.c:605
 xfs_fs_put_super+0xdf/0x110 fs/xfs/xfs_super.c:1152
 generic_shutdown_super+0x159/0x3d0 fs/super.c:642
 kill_block_super+0x3b/0x90 fs/super.c:1676
 xfs_kill_sb+0x15/0x50 fs/xfs/xfs_super.c:2045
 deactivate_locked_super+0xbe/0x1a0 fs/super.c:473
 deactivate_super+0xde/0x100 fs/super.c:506
 cleanup_mnt+0x222/0x450 fs/namespace.c:1267
 task_work_run+0x14e/0x250 kernel/task_work.c:180
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x278/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fda1667e217
Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fffb0e8e5f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fda1667e217
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffb0e8e6b0
RBP: 00007fffb0e8e6b0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffb0e8f770
R13: 00007fda166c8336 R14: 0000000000067055 R15: 0000000000000005
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0xe3e/0x3b30 kernel/locking/lockdep.c:5005
Code: 11 00 00 39 05 63 68 27 12 0f 82 be 05 00 00 ba 01 00 00 00 e9 e4 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 82 1f 00 00 49 81 3c 24 e0 fd e9 92 0f 84 98 f2
RSP: 0018:ffffc90003bdfab8 EFLAGS: 00010802
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 1d801ffff1100d67 RSI: ffff888029d8a440 RDI: ec00ffff88806b3b
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8fe45197 R11: 0000000000000003 R12: ec00ffff88806b3b
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
FS:  000055557e440480(0000) GS:ffff88806b300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3302e000 CR3: 000000010a54e000 CR4: 0000000000350ef0
DR0: 0000000000002800 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	11 00                	adc    %eax,(%rax)
   2:	00 39                	add    %bh,(%rcx)
   4:	05 63 68 27 12       	add    $0x12276863,%eax
   9:	0f 82 be 05 00 00    	jb     0x5cd
   f:	ba 01 00 00 00       	mov    $0x1,%edx
  14:	e9 e4 00 00 00       	jmp    0xfd
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	4c 89 e2             	mov    %r12,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 82 1f 00 00    	jne    0x1fb6
  34:	49 81 3c 24 e0 fd e9 	cmpq   $0xffffffff92e9fde0,(%r12)
  3b:	92
  3c:	0f                   	.byte 0xf
  3d:	84                   	.byte 0x84
  3e:	98                   	cwtl
  3f:	f2                   	repnz

Crashes (36):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/24 12:24 upstream 6d69b6c12fce c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in xfs_destroy_mount_workqueues
2024/05/03 22:23 upstream 3d25a941ea50 610f2a54 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in xfs_destroy_mount_workqueues
2024/06/15 01:14 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/14 20:20 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/13 05:17 upstream cea2a26553ac c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/11 20:37 upstream 83a7eefedc9b c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/09 11:14 upstream 061d1af7b030 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/03 23:22 upstream f06ce441457d c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/03 18:41 upstream f06ce441457d c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/03 15:54 upstream c3f38fa61af7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/03 09:16 upstream c3f38fa61af7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/03 04:38 upstream c3f38fa61af7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/02 09:27 upstream ec9eeb89e60d c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/06/01 07:58 upstream d8ec19857b09 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/30 20:48 upstream 4a4be1ad3a6e c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/30 10:50 upstream 4a4be1ad3a6e c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/30 04:40 upstream 4a4be1ad3a6e c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/29 01:14 upstream e0cce98fe279 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/28 16:41 upstream 2bfcfd584ff5 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/28 06:15 upstream 2bfcfd584ff5 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/26 08:22 upstream 54f71b0369c9 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/25 18:23 upstream 56fb6f92854f c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/25 05:24 upstream 02c438bbfffe c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/24 12:47 upstream 6d69b6c12fce c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/23 17:25 upstream c760b3725e52 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/23 06:56 upstream 5f16eb0549ab c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/22 19:53 upstream 29c73fc794c8 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/21 11:42 upstream 8f6a15f095a6 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/20 12:21 upstream eb6a9339efeb c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/20 10:51 upstream eb6a9339efeb c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/19 22:15 upstream 0450d2083be6 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/19 21:50 upstream 0450d2083be6 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/19 15:12 upstream 0450d2083be6 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/18 04:53 upstream ff2632d7d08e c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/17 12:28 upstream ea5f6ad9ad96 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
2024/05/14 17:45 upstream 6bfd2d442af5 fdb4c10c .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in xfs_destroy_mount_workqueues
* Struck through repros no longer work on HEAD.