syzbot

 sign-in | mailing list | source | docs
🐞 Open [1261]
≡ Subsystems
🐞 Fixed [5698]
🐞 Invalid [13891]
⬇ Missing Backports [96]
Kernel Health Bugs/Month Bug Lifetimes Fuzzing Crashes
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

BUG: unable to handle kernel paging request in dqput

Status: fixed on 2021/03/10 01:48
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+f816042a7ae2225f25ba@syzkaller.appspotmail.com
Fix commit: 11c514a99bb9 quota: Sanity-check quota file headers on load
First crash: 1475d, last: 1402d
Cause bisection: introduced by (bisect log) :
commit 1d0f953086f090a022f2c0e1448300c15372db46
Author: Ioan-Adrian Ratiu <adi@adirat.com>
Date: Wed Jan 4 22:37:46 2017 +0000

  ALSA: usb-audio: Fix irq/process data synchronization

Crash: WARNING in nf_unregister_net_hook (log)
Repro: C syz .config
  
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[PATCH 4.14 000/242] 4.14.213-rc1 review 245 (245) 2021/01/13 01:20
[PATCH 5.10 00/40] 5.10.3-rc1 review 60 (60) 2021/01/06 23:56
[PATCH 4.19 000/346] 4.19.164-rc1 review 356 (356) 2021/01/02 11:29
[PATCH 5.4 000/453] 5.4.86-rc1 review 465 (465) 2020/12/30 09:22
[PATCH 0/2] quota: Handle corrupted quota file better 6 (6) 2020/11/03 08:57
BUG: unable to handle kernel paging request in dqput 2 (3) 2020/09/29 14:30
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel paging request in dqput (2) C error 5 664d 756d 0/1 upstream: reported C repro on 2022/09/11 16:38
android-54 BUG: unable to handle kernel paging request in dqput C 14 1380d 1475d 0/2 auto-obsoleted due to no activity on 2023/04/17 15:54
linux-4.14 BUG: unable to handle kernel paging request in dqput C done 9 1385d 1474d 1/1 fixed on 2021/01/22 19:25
linux-4.19 BUG: unable to handle kernel paging request in dqput C done 8 1394d 1463d 1/1 fixed on 2021/01/12 18:45

Sample crash report:
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
Quota error (device loop0): qtree_write_dquot: Error -669470953 occurred while creating quota
Quota error (device loop0): qtree_write_dquot: Error -1224736762 occurred while creating quota
EXT4-fs error (device loop0): __ext4_new_inode:1067: comm syz-executor912: reserved inode found cleared - inode=1
BUG: unable to handle page fault for address: fffffbfff6e00022
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffe9067 P4D 23ffe9067 PUD 23ffe8067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8476 Comm: syz-executor912 Not tainted 5.10.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:91 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:108 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:134 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:183 [inline]
RIP: 0010:check_memory_region+0xdb/0x180 mm/kasan/generic.c:192
Code: 80 38 00 74 f2 48 89 c2 b8 01 00 00 00 48 85 d2 75 56 5b 5d 41 5c c3 48 85 d2 74 5e 48 01 ea eb 09 48 83 c0 01 48 39 d0 74 50 <80> 38 00 74 f2 eb d4 41 bc 08 00 00 00 48 89 ea 45 29 dc 4d 8d 1c
RSP: 0018:ffffc90000eaf6b0 EFLAGS: 00010286
RAX: fffffbfff6e00022 RBX: fffffbfff6e00024 RCX: ffffffff81dfd4df
RDX: fffffbfff6e00024 RSI: 0000000000000004 RDI: ffffffffb7000116
RBP: fffffbfff6e00022 R08: 0000000000000000 R09: ffffffffb7000119
R10: fffffbfff6e00023 R11: 0000000000000000 R12: ffffffffb7000136
R13: ffffffffb7000116 R14: 0000000000000009 R15: 1ffffffff6e00022
FS:  000000000120a880(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff6e00022 CR3: 0000000012cc6000 CR4: 0000000000350ef0
Call Trace:
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
 dqput.part.0+0xaf/0x870 fs/quota/dquot.c:770
 dqput fs/quota/dquot.c:757 [inline]
 dqput_all fs/quota/dquot.c:397 [inline]
 __dquot_drop+0x19c/0x270 fs/quota/dquot.c:1577
 dquot_drop fs/quota/dquot.c:1602 [inline]
 dquot_drop+0x14b/0x1a0 fs/quota/dquot.c:1580
 __ext4_new_inode+0x2ba6/0x5520 fs/ext4/ialloc.c:1352
 ext4_tmpfile+0x208/0x480 fs/ext4/namei.c:2685
 vfs_tmpfile+0x201/0x380 fs/namei.c:3284
 do_tmpfile fs/namei.c:3317 [inline]
 path_openat+0x1667/0x2730 fs/namei.c:3360
 do_filp_open+0x17e/0x3c0 fs/namei.c:3396
 do_sys_openat2+0x16d/0x420 fs/open.c:1168
 do_sys_open fs/open.c:1184 [inline]
 __do_sys_openat fs/open.c:1200 [inline]
 __se_sys_openat fs/open.c:1195 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1195
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x444969
Code: 8d d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc49f30038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000444969
RDX: 0000000000410481 RSI: 0000000020000000 RDI: ffffffffffffff9c
RBP: 00000000006cf018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402550
R13: 00000000004025e0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: fffffbfff6e00022
---[ end trace cda9436d066dbe74 ]---
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:91 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:108 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:134 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:183 [inline]
RIP: 0010:check_memory_region+0xdb/0x180 mm/kasan/generic.c:192
Code: 80 38 00 74 f2 48 89 c2 b8 01 00 00 00 48 85 d2 75 56 5b 5d 41 5c c3 48 85 d2 74 5e 48 01 ea eb 09 48 83 c0 01 48 39 d0 74 50 <80> 38 00 74 f2 eb d4 41 bc 08 00 00 00 48 89 ea 45 29 dc 4d 8d 1c
RSP: 0018:ffffc90000eaf6b0 EFLAGS: 00010286
RAX: fffffbfff6e00022 RBX: fffffbfff6e00024 RCX: ffffffff81dfd4df
RDX: fffffbfff6e00024 RSI: 0000000000000004 RDI: ffffffffb7000116
RBP: fffffbfff6e00022 R08: 0000000000000000 R09: ffffffffb7000119
R10: fffffbfff6e00023 R11: 0000000000000000 R12: ffffffffb7000136
R13: ffffffffb7000116 R14: 0000000000000009 R15: 1ffffffff6e00022
FS:  000000000120a880(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff6e00022 CR3: 0000000012cc6000 CR4: 0000000000350ef0

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/05 08:46 upstream e87297fa080a 20366b87 .config console log report syz C ci-upstream-kasan-gce-root
2020/12/03 14:25 upstream 34816d20f173 e6b0d314 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/10/09 00:08 upstream 3d006ee42dde 92390980 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/10/04 15:25 upstream 22fbc037cd32 5ef9c291 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/09/22 21:02 upstream 98477740630f 3e8f6c27 .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/09/29 15:50 upstream fb0155a09b02 1b88c6d5 .config console log report info ci-upstream-kasan-gce-selinux-root
2020/09/22 20:37 upstream 98477740630f 3e8f6c27 .config console log report info ci-upstream-kasan-gce-smack-root
* Struck through repros no longer work on HEAD.