syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in mount_fs

Status: fixed on 2021/08/12 11:53
Reported-by: syzbot+c53e0cf24da650c7fd78@syzkaller.appspotmail.com
Fix commit: 5485fe228f97 ext4: return error code when ext4_fill_flex_info() fails
First crash: 1243d, last: 1012d
Fix bisection: fixed by (bisect log) :
commit 5485fe228f9771190de24f8936c43879fa52fc25
Author: Yang Yingliang <yangyingliang@huawei.com>
Date: Mon May 10 11:10:51 2021 +0000

  ext4: return error code when ext4_fill_flex_info() fails

  
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in mount_fs hfs C 1 2207d 2207d 8/26 fixed on 2018/08/28 17:48
linux-4.14 general protection fault in mount_fs 1 1125d 1125d 0/1 auto-closed as invalid on 2021/07/19 06:52
▶ ▼ Fix bisection attempts (5)
Created Duration User Patch Repo Result
2021/08/11 09:17 4h19m bisect fix linux-4.19.y job log (1)
2021/07/04 07:12 23m bisect fix linux-4.19.y job log (0) log
2021/06/04 06:40 31m bisect fix linux-4.19.y job log (0) log
2021/05/05 06:02 22m bisect fix linux-4.19.y job log (0) log
2021/01/01 15:28 23m bisect fix linux-4.19.y job log (0) log

Sample crash report:
 kobject_add_varg lib/kobject.c:382 [inline]
 kobject_init_and_add+0x101/0x160 lib/kobject.c:453
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
 ext4_register_sysfs+0xb5/0x270 fs/ext4/sysfs.c:379
 ext4_fill_super+0x7bcb/0xc820 fs/ext4/super.c:4532
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8187 Comm: syz-executor090 Not tainted 4.19.161-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 mount_bdev+0x2fc/0x3b0 fs/super.c:1158
RIP: 0010:mount_fs+0xe0/0x30c fs/super.c:1266
Code: 81 fc 00 f0 ff ff 0f 87 eb 01 00 00 e8 79 91 be ff 49 8d bc 24 c8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ed 01 00 00 4d 8b ac 24 c8 00 00 00 4d 85 ed 0f
 mount_fs+0xa3/0x30c fs/super.c:1261
RSP: 0018:ffff888096687ce0 EFLAGS: 00010202
 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
RAX: dffffc0000000000 RBX: ffffffff8a0a8980 RCX: ffffffff81a63e65
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2469 [inline]
 do_mount+0x113c/0x2f10 fs/namespace.c:2799
RDX: 0000000000000019 RSI: ffffffff81a63e77 RDI: 00000000000000c8
RBP: 0000000000000000 R08: 0000000000400000 R09: fffffffffffff000
R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880938aa6c0 R14: 0000000000000000 R15: ffff8880b2814000
FS:  000000000142b880(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0f7783a008 CR3: 00000000b3c2c000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 ksys_mount+0xcf/0x130 fs/namespace.c:3015
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 __do_sys_mount fs/namespace.c:3029 [inline]
 __se_sys_mount fs/namespace.c:3026 [inline]
 __x64_sys_mount+0xba/0x150 fs/namespace.c:3026
Call Trace:
 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2469 [inline]
 do_mount+0x113c/0x2f10 fs/namespace.c:2799
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x447eea
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed a3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ca a3 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc9b420b98 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc9b420bf0 RCX: 0000000000447eea
RDX: 0000000020000080 RSI: 0000000020000100 RDI: 00007ffc9b420bb0
RBP: 00007ffc9b420bb0 R08: 00007ffc9b420bf0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004
 ksys_mount+0xcf/0x130 fs/namespace.c:3015
R13: 0000000000000006 R14: 0000000000000005 R15: 0000000000000005
 __do_sys_mount fs/namespace.c:3029 [inline]
 __se_sys_mount fs/namespace.c:3026 [inline]
 __x64_sys_mount+0xba/0x150 fs/namespace.c:3026
kobject_add_internal failed for loop1 (error: -12 parent: ext4)
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x447eea
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed a3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ca a3 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc9b420b98 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc9b420bf0 RCX: 0000000000447eea
RDX: 0000000020000080 RSI: 0000000020000100 RDI: 00007ffc9b420bb0
RBP: 00007ffc9b420bb0 R08: 00007ffc9b420bf0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004
R13: 0000000000000006 R14: 0000000000000005 R15: 0000000000000005
Modules linked in:
CPU: 1 PID: 8173 Comm: syz-executor090 Tainted: G      D           4.19.161-syzkaller #0
EXT4-fs (loop1): mount failed
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0x14 lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0xf mm/slab_common.c:1588
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc+0x277/0x370 mm/slab.c:3557
 kmem_cache_zalloc include/linux/slab.h:699 [inline]
 __kernfs_new_node+0xd2/0x680 fs/kernfs/dir.c:633
 kernfs_new_node+0x92/0x120 fs/kernfs/dir.c:693
 __kernfs_create_file+0x51/0x33f fs/kernfs/file.c:992
 sysfs_add_file_mode_ns+0x226/0x540 fs/sysfs/file.c:306
 sysfs_create_file_ns+0x131/0x1b0 fs/sysfs/file.c:331
 sysfs_create_file include/linux/sysfs.h:513 [inline]
 populate_dir lib/kobject.c:75 [inline]
 create_dir lib/kobject.c:92 [inline]
 kobject_add_internal+0x4f0/0x9c0 lib/kobject.c:247
 kobject_add_varg lib/kobject.c:382 [inline]
 kobject_init_and_add+0x101/0x160 lib/kobject.c:453
 ext4_register_sysfs+0xb5/0x270 fs/ext4/sysfs.c:379
 ext4_fill_super+0x7bcb/0xc820 fs/ext4/super.c:4532
 mount_bdev+0x2fc/0x3b0 fs/super.c:1158
 mount_fs+0xa3/0x30c fs/super.c:1261
 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2469 [inline]
 do_mount+0x113c/0x2f10 fs/namespace.c:2799
 ksys_mount+0xcf/0x130 fs/namespace.c:3015
 __do_sys_mount fs/namespace.c:3029 [inline]
 __se_sys_mount fs/namespace.c:3026 [inline]
 __x64_sys_mount+0xba/0x150 fs/namespace.c:3026
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x447eea
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed a3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ca a3 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc9b420b98 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc9b420bf0 RCX: 0000000000447eea
RDX: 0000000020000080 RSI: 0000000020000100 RDI: 00007ffc9b420bb0
RBP: 00007ffc9b420bb0 R08: 00007ffc9b420bf0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004
R13: 0000000000000006 R14: 0000000000000005 R15: 0000000000000005
CPU: 0 PID: 8185 Comm: syz-executor090 Tainted: G      D           4.19.161-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0x14 lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0xf mm/slab_common.c:1588
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc+0x277/0x370 mm/slab.c:3557
 kmem_cache_zalloc include/linux/slab.h:699 [inline]
 __kernfs_new_node+0xd2/0x680 fs/kernfs/dir.c:633
---[ end trace 67104e9470620285 ]---
RIP: 0010:mount_fs+0xe0/0x30c fs/super.c:1266
Code: 81 fc 00 f0 ff ff 0f 87 eb 01 00 00 e8 79 91 be ff 49 8d bc 24 c8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ed 01 00 00 4d 8b ac 24 c8 00 00 00 4d 85 ed 0f
 kernfs_new_node fs/kernfs/dir.c:693 [inline]
 kernfs_create_dir_ns+0x9e/0x230 fs/kernfs/dir.c:1019
 sysfs_create_dir_ns+0x127/0x280 fs/sysfs/dir.c:58
RSP: 0018:ffff888096687ce0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff8a0a8980 RCX: ffffffff81a63e65
 create_dir lib/kobject.c:88 [inline]
 kobject_add_internal+0x2a5/0x9c0 lib/kobject.c:247
RDX: 0000000000000019 RSI: ffffffff81a63e77 RDI: 00000000000000c8
 kobject_add_varg lib/kobject.c:382 [inline]
 kobject_init_and_add+0x101/0x160 lib/kobject.c:453
RBP: 0000000000000000 R08: 0000000000400000 R09: fffffffffffff000
R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000
 ext4_register_sysfs+0xb5/0x270 fs/ext4/sysfs.c:379
kobject_add_internal failed for loop0 (error: -12 parent: ext4)
 ext4_fill_super+0x7bcb/0xc820 fs/ext4/super.c:4532
R13: ffff8880938aa6c0 R14: 0000000000000000 R15: ffff8880b2814000
 mount_bdev+0x2fc/0x3b0 fs/super.c:1158
 mount_fs+0xa3/0x30c fs/super.c:1261
 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2469 [inline]
 do_mount+0x113c/0x2f10 fs/namespace.c:2799
EXT4-fs (loop0): mount failed
FS:  000000000142b880(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 ksys_mount+0xcf/0x130 fs/namespace.c:3015
 __do_sys_mount fs/namespace.c:3029 [inline]
 __se_sys_mount fs/namespace.c:3026 [inline]
 __x64_sys_mount+0xba/0x150 fs/namespace.c:3026
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x447eea
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed a3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ca a3 fb ff c3 66 0f 1f 84 00 00 00 00 00
CR2: 00007f0f7784d000 CR3: 00000000b3c2c000 CR4: 00000000001406e0
RSP: 002b:00007ffc9b420b98 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc9b420bf0 RCX: 0000000000447eea
RDX: 0000000020000080 RSI: 0000000020000100 RDI: 00007ffc9b420bb0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
RBP: 00007ffc9b420bb0 R08: 00007ffc9b420bf0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004
R13: 0000000000000006 R14: 0000000000000005 R15: 0000000000000005
kobject_add_internal failed for loop2 (error: -12 parent: ext4)
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
EXT4-fs (loop2): mount failed

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/02 15:28 linux-4.19.y daefdc9eb24b eff43e99 .config console log report syz C ci2-linux-4-19
2021/07/12 08:57 linux-4.19.y fcfbdfe9626e a4869c92 .config console log report info ci2-linux-4-19 general protection fault in mount_fs
2021/04/05 06:02 linux-4.19.y 2034d6f0838e 6a81331a .config console log report info ci2-linux-4-19 general protection fault in mount_fs
2021/03/11 09:29 linux-4.19.y 2cae3e25b706 c2ca1f2a .config console log report info ci2-linux-4-19 general protection fault in mount_fs
2021/03/02 14:46 linux-4.19.y 2d19be4653f5 92ead296 .config console log report info ci2-linux-4-19 general protection fault in mount_fs
2021/02/23 07:10 linux-4.19.y 255b58a2b3af fcc6d71b .config console log report info ci2-linux-4-19 general protection fault in mount_fs
2021/02/21 11:39 linux-4.19.y 255b58a2b3af 3e5ed8b4 .config console log report info ci2-linux-4-19 general protection fault in mount_fs
2021/02/05 06:06 linux-4.19.y 811218eceeaa 23a562df .config console log report info ci2-linux-4-19 general protection fault in mount_fs
2021/01/20 16:48 linux-4.19.y 43d555d83c3f d4f4eca5 .config console log report info ci2-linux-4-19 general protection fault in mount_fs
2020/12/02 14:48 linux-4.19.y daefdc9eb24b eff43e99 .config console log report info ci2-linux-4-19
2020/11/23 21:07 linux-4.19.y 76bda503e640 878fb17a .config console log report info ci2-linux-4-19
2020/11/23 06:03 linux-4.19.y 76bda503e640 0d27f508 .config console log report info ci2-linux-4-19
* Struck through repros no longer work on HEAD.