syzbot

 sign-in | mailing list | source | docs
🐞 Open [717]
🐞 Fixed [181]
🐞 Invalid [640]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in get_block (2)

Status: upstream: reported C repro on 2022/12/09 08:52
Reported-by: syzbot+c896e28ce85bdbf20c04@syzkaller.appspotmail.com
First crash: 713d, last: 630d
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in get_block C done 60 1559d 1710d 1/1 fixed on 2020/09/15 07:46
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in get_block C done 45 1563d 1710d 1/1 fixed on 2020/09/10 09:33
linux-6.1 KASAN: null-ptr-deref Write in get_block origin:upstream missing-backport C done 4 476d 521d 3/3 fixed on 2023/10/02 12:03
upstream KASAN: null-ptr-deref Write in get_block (2) fs C error 11 515d 548d 23/28 fixed on 2023/09/28 17:51
linux-5.15 KASAN: null-ptr-deref Write in get_block origin:upstream missing-backport C done 2 477d 523d 3/3 fixed on 2023/10/03 00:08
upstream KASAN: slab-out-of-bounds Read in get_block (2) fs 1 682d 682d 0/28 auto-obsoleted due to no activity on 2023/05/09 01:15
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2023/03/02 05:06 23m bisect fix linux-4.14.y OK (0) job log log
2023/01/30 02:14 27m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
sysv_free_block: flc_count > flc_size
sysv_free_block: flc_count > flc_size
sysv_free_block: flc_count > flc_size
sysv_free_block: flc_count > flc_size
sysv_free_block: flc_count > flc_size
BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: test_and_set_bit arch/x86/include/asm/bitops.h:220 [inline]
IP: test_and_set_bit_lock arch/x86/include/asm/bitops.h:234 [inline]
IP: trylock_buffer include/linux/buffer_head.h:401 [inline]
IP: lock_buffer include/linux/buffer_head.h:407 [inline]
IP: alloc_branch fs/sysv/itree.c:148 [inline]
IP: get_block+0x4ab/0x1230 fs/sysv/itree.c:251
PGD a6e15067 P4D a6e15067 PUD 9e63b067 PMD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 7992 Comm: syz-executor122 Not tainted 4.14.301-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff8880b4530280 task.stack: ffff8880b2df0000
RIP: 0010:test_and_set_bit arch/x86/include/asm/bitops.h:220 [inline]
RIP: 0010:test_and_set_bit_lock arch/x86/include/asm/bitops.h:234 [inline]
RIP: 0010:trylock_buffer include/linux/buffer_head.h:401 [inline]
RIP: 0010:lock_buffer include/linux/buffer_head.h:407 [inline]
RIP: 0010:alloc_branch fs/sysv/itree.c:148 [inline]
RIP: 0010:get_block+0x4ab/0x1230 fs/sysv/itree.c:251
RSP: 0018:ffff8880b2df77f8 EFLAGS: 00010246
RAX: 0000000000000007 RBX: ffff8880b2df7928 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff8880b45302a4
RBP: ffff8880b2df79b0 R08: ffffea000238b400 R09: 0000000000000002
R10: 0000000000000000 R11: ffff8880b4530280 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88808dfae958 R15: 0000000054445f42
FS:  0000555556ab13c0(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000a16f4000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __block_write_begin_int+0x35c/0x11d0 fs/buffer.c:2038
 __block_write_begin fs/buffer.c:2088 [inline]
 block_write_begin+0x58/0x270 fs/buffer.c:2147
 sysv_write_begin+0x35/0xc0 fs/sysv/itree.c:485
 generic_perform_write+0x1d5/0x430 mm/filemap.c:3055
 __generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
 generic_file_write_iter+0x36f/0x650 mm/filemap.c:3208
 call_write_iter include/linux/fs.h:1780 [inline]
 new_sync_write fs/read_write.c:469 [inline]
 __vfs_write+0x44c/0x630 fs/read_write.c:482
 vfs_write+0x17f/0x4d0 fs/read_write.c:544
 SYSC_write fs/read_write.c:590 [inline]
 SyS_write+0xf2/0x210 fs/read_write.c:582
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f57ae67aa49
RSP: 002b:00007ffeabc23b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f57ae67aa49
RDX: 00000000fffffd5e RSI: 000000002000ad00 RDI: 0000000000000004
RBP: 00007ffeabc23b80 R08: 00007ffeabc23ba0 R09: 00007ffeabc23ba0
R10: 0000000000009e07 R11: 0000000000000246 R12: 0000000000000003
R13: 00007ffeabc23b60 R14: 00007ffeabc23b58 R15: 00007ffeabc23ba0
Code: 0b 00 00 49 8b bc 24 28 01 00 00 b9 08 00 00 00 e8 fb 98 95 ff 31 d2 be 96 01 00 00 48 c7 c7 a0 63 aa 87 49 89 c4 e8 f5 a6 3b ff <f0> 49 0f ba 2c 24 02 0f 82 16 07 00 00 e8 93 c3 57 ff 4d 8d 7c 
RIP: test_and_set_bit arch/x86/include/asm/bitops.h:220 [inline] RSP: ffff8880b2df77f8
RIP: test_and_set_bit_lock arch/x86/include/asm/bitops.h:234 [inline] RSP: ffff8880b2df77f8
RIP: trylock_buffer include/linux/buffer_head.h:401 [inline] RSP: ffff8880b2df77f8
RIP: lock_buffer include/linux/buffer_head.h:407 [inline] RSP: ffff8880b2df77f8
RIP: alloc_branch fs/sysv/itree.c:148 [inline] RSP: ffff8880b2df77f8
RIP: get_block+0x4ab/0x1230 fs/sysv/itree.c:251 RSP: ffff8880b2df77f8
CR2: 0000000000000000
---[ end trace 3d6c673a50a58217 ]---
----------------
Code disassembly (best guess):
   0:	0b 00                	or     (%rax),%eax
   2:	00 49 8b             	add    %cl,-0x75(%rcx)
   5:	bc 24 28 01 00       	mov    $0x12824,%esp
   a:	00 b9 08 00 00 00    	add    %bh,0x8(%rcx)
  10:	e8 fb 98 95 ff       	callq  0xff959910
  15:	31 d2                	xor    %edx,%edx
  17:	be 96 01 00 00       	mov    $0x196,%esi
  1c:	48 c7 c7 a0 63 aa 87 	mov    $0xffffffff87aa63a0,%rdi
  23:	49 89 c4             	mov    %rax,%r12
  26:	e8 f5 a6 3b ff       	callq  0xff3ba720
* 2b:	f0 49 0f ba 2c 24 02 	lock btsq $0x2,(%r12) <-- trapping instruction
  32:	0f 82 16 07 00 00    	jb     0x74e
  38:	e8 93 c3 57 ff       	callq  0xff57c3d0
  3d:	4d                   	rex.WRB
  3e:	8d                   	.byte 0x8d
  3f:	7c                   	.byte 0x7c

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/12/09 08:52 linux-4.14.y 65afe34ac33d 1034e5fa .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 BUG: unable to handle kernel NULL pointer dereference in get_block
* Struck through repros no longer work on HEAD.