syzbot


kernel BUG at mm/hugetlb.c:LINE!

Status: fixed on 2020/09/16 22:51
Reported-by: syzbot+d6ec23007e951dadf3de@syzkaller.appspotmail.com
Fix commit: 15568299b7d9 hugetlbfs: prevent filesystem stacking of hugetlbfs
First crash: 973d, last: 856d

Cause bisection: introduced by (bisect log) :
commit e950564b97fd0f541b02eb207685d0746f5ecf29
Author: Miklos Szeredi <mszeredi@redhat.com>
Date: Tue Jul 24 13:01:55 2018 +0000

  vfs: don't evict uninitialized inode

Crash: BUG: corrupted list in inode_insert5 (log)
Repro: C syz .config

Fix bisection: failed (bisect log)
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 kernel BUG at mm/hugetlb.c:LINE! C error 3 810d 987d 0/1 upstream: reported C repro on 2020/03/19 05:51

Sample crash report:
kernel BUG at mm/hugetlb.c:3932!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9929 Comm: syz-executor996 Not tainted 5.8.0-rc7-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
RIP: 0010:__unmap_hugepage_range+0xa03/0xba0 mm/hugetlb.c:3932
Code: 00 48 c7 c7 40 be 55 88 e8 2a 3c a0 ff e9 b0 fd ff ff e8 90 19 c4 ff 0f 0b e9 de f7 ff ff e8 84 19 c4 ff 0f 0b e8 7d 19 c4 ff <0f> 0b e8 76 19 c4 ff 83 8c 24 c0 00 00 00 01 48 8d bc 24 a0 00 00
RSP: 0018:ffffc900013d79c8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffffff8c92ae20 RCX: ffffffff81af9b7b
RDX: ffff888025a54980 RSI: ffffffff81afa353 RDI: 0000000000000007
RBP: 0000000020000000 R08: 0000000000000000 R09: ffff88801d797887
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000003000
R13: 0000000000000000 R14: 0000000020003000 R15: 0000000000200000
FS:  0000000001cf0880(0000) GS:ffff88802cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f99a22499b8 CR3: 0000000022bd9000 CR4: 0000000000340ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __unmap_hugepage_range_final+0x30/0x70 mm/hugetlb.c:4023
 unmap_single_vma+0x23a/0x300 mm/memory.c:1305
 unmap_vmas+0x16f/0x2f0 mm/memory.c:1341
 exit_mmap+0x2b1/0x510 mm/mmap.c:3162
 __mmput+0x122/0x470 kernel/fork.c:1093
 mmput+0x53/0x60 kernel/fork.c:1114
 exit_mm kernel/exit.c:482 [inline]
 do_exit+0xa8f/0x2a40 kernel/exit.c:792
 do_group_exit+0x125/0x310 kernel/exit.c:903
 __do_sys_exit_group kernel/exit.c:914 [inline]
 __se_sys_exit_group kernel/exit.c:912 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:912
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x432a78
Code: Bad RIP value.
RSP: 002b:00007fff26ea1ec8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000432a78
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004a6930 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000010012 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006b8180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 23545166e9817fda ]---
RIP: 0010:__unmap_hugepage_range+0xa03/0xba0 mm/hugetlb.c:3932
Code: 00 48 c7 c7 40 be 55 88 e8 2a 3c a0 ff e9 b0 fd ff ff e8 90 19 c4 ff 0f 0b e9 de f7 ff ff e8 84 19 c4 ff 0f 0b e8 7d 19 c4 ff <0f> 0b e8 76 19 c4 ff 83 8c 24 c0 00 00 00 01 48 8d bc 24 a0 00 00
RSP: 0018:ffffc900013d79c8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffffff8c92ae20 RCX: ffffffff81af9b7b
RDX: ffff888025a54980 RSI: ffffffff81afa353 RDI: 0000000000000007
RBP: 0000000020000000 R08: 0000000000000000 R09: ffff88801d797887
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000003000
R13: 0000000000000000 R14: 0000000020003000 R15: 0000000000200000
FS:  0000000001cf0880(0000) GS:ffff88802cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f99a22499b8 CR3: 0000000022bd9000 CR4: 0000000000340ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (10):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-qemu-upstream 2020/07/28 02:40 upstream 92ed30191993 cb93dc6a .config log report syz C
ci-qemu-upstream 2020/05/16 05:18 upstream 12bf0b632ed0 37bccd4e .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/04/13 04:51 upstream 4f8a3cc1183c 36b0b050 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/04/13 00:00 upstream 4f8a3cc1183c 36b0b050 .config log report syz C
ci-upstream-kasan-gce-root 2020/04/11 09:07 upstream ab6f762f0f53 a8c6a3f8 .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/04/07 15:47 upstream 7e63420847ae 99a96044 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/04/07 05:59 upstream 7e63420847ae 99a96044 .config log report syz C
ci-upstream-kasan-gce-root 2020/04/02 03:01 upstream 1a323ea5356e a34e2c33 .config log report syz C
ci-upstream-linux-next-kasan-gce-root 2020/04/15 23:23 linux-next ac935d227366 3f3c5574 .config log report syz C
ci-upstream-linux-next-kasan-gce-root 2020/04/11 06:17 linux-next 11ecafc691e1 a8c6a3f8 .config log report syz C
* Struck through repros no longer work on HEAD.