general protection fault in fix

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.14	general protection fault in fix_nodes	syz		error	1	496d	496d	0/1	upstream: reported syz repro on 2022/12/15 05:04
linux-6.1	KASAN: null-ptr-deref Read in fix_nodes origin:upstream missing-backport	C		done	6	114d	373d	0/3	upstream: reported C repro on 2023/04/17 07:27
upstream	KASAN: null-ptr-deref Read in fix_nodes reiserfs	C	done	done	17	111d	379d	0/26	auto-obsoleted due to no activity on 2024/04/13 10:42
linux-5.15	KASAN: null-ptr-deref Read in fix_nodes origin:upstream	C			7	3d20h	374d	0/3	upstream: reported C repro on 2023/04/15 23:10

REISERFS warning: reiserfs-5093 is_leaf: item entry count seems wrong *3.5*[2 1 0(1) DIR], item_len 35, item_location 4029, free_space(entry_count) 2 REISERFS error (device loop0): vs-5150 search_by_key: invalid format found in block 544. Fsck? kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8876 Comm: syz-executor420 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:317 [inline] RIP: 0010:buffer_locked include/linux/buffer_head.h:123 [inline] RIP: 0010:fix_nodes+0x460/0x7840 fs/reiserfs/fix_node.c:2582 Code: 02 00 00 89 de 89 ef e8 be 9a 90 ff 39 dd 0f 85 b4 43 00 00 e8 c1 99 90 ff 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 04 6c 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b RSP: 0018:ffff8880ab467318 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000024 RCX: ffffffff81d1eba2 RDX: 0000000000000000 RSI: ffffffff81d1ebaf RDI: 0000000000000004 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000024 R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88808ac62780 R14: ffff8880922ae380 R15: ffff8880ab467640 FS: 00007ffaa9268700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc8cbeb9c0 CR3: 00000000992b9000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: reiserfs_cut_from_item+0x24c/0x1960 fs/reiserfs/stree.c:1752 reiserfs_do_truncate+0x64a/0x10c0 fs/reiserfs/stree.c:1983 reiserfs_truncate_file+0x1b1/0x1030 fs/reiserfs/inode.c:2320 reiserfs_setattr+0xdc2/0x1090 fs/reiserfs/inode.c:3412 notify_change+0x70b/0xfc0 fs/attr.c:334 do_truncate+0x134/0x1f0 fs/open.c:63 do_sys_ftruncate+0x492/0x560 fs/open.c:194 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7ffab12fec29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffaa92682f8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d RAX: ffffffffffffffda RBX: 00007ffab13847c0 RCX: 00007ffab12fec29 RDX: 00007ffaa9268700 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007ffab13511d8 R08: 00007ffaa9268700 R09: 0000000000000000 R10: 00007ffaa9268700 R11: 0000000000000246 R12: 0030656c69662f2e R13: 7366726573696572 R14: 0031656c69662f2e R15: 00007ffab13847c8 Modules linked in: REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 REISERFS (device loop2): checking transaction log (loop2) ---[ end trace b2e53cf0d22a3b33 ]--- RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:317 [inline] RIP: 0010:buffer_locked include/linux/buffer_head.h:123 [inline] RIP: 0010:fix_nodes+0x460/0x7840 fs/reiserfs/fix_node.c:2582 REISERFS (device loop4): found reiserfs format "3.5" with non-standard journal Code: 02 00 00 89 de 89 ef e8 be 9a 90 ff 39 dd 0f 85 b4 43 00 00 e8 c1 99 90 ff 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 04 6c 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b REISERFS (device loop4): using ordered data mode REISERFS (device loop2): Using r5 hash to sort names REISERFS (device loop2): using 3.5.x disk format reiserfs: using flush barriers REISERFS (device loop3): found reiserfs format "3.5" with non-standard journal REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 RSP: 0018:ffff8880ab467318 EFLAGS: 00010246 REISERFS (device loop3): using ordered data mode REISERFS (device loop4): checking transaction log (loop4) reiserfs: using flush barriers REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal REISERFS (device loop1): using ordered data mode REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 RAX: dffffc0000000000 RBX: 0000000000000024 RCX: ffffffff81d1eba2 RDX: 0000000000000000 RSI: ffffffff81d1ebaf RDI: 0000000000000004 reiserfs: using flush barriers RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000024 REISERFS (device loop3): checking transaction log (loop3) R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88808ac62780 R14: ffff8880922ae380 R15: ffff8880ab467640 FS: 00007ffaa9268700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 REISERFS (device loop1): checking transaction log (loop1) REISERFS (device loop4): Using r5 hash to sort names REISERFS (device loop1): Using r5 hash to sort names CR2: 00007ffc8cacdfc8 CR3: 00000000992b9000 CR4: 00000000003406f0 REISERFS (device loop1): using 3.5.x disk format REISERFS (device loop4): using 3.5.x disk format REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage. DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 02 00 add (%rax),%al 2: 00 89 de 89 ef e8 add %cl,-0x17107622(%rcx) 8: be 9a 90 ff 39 mov $0x39ff909a,%esi d: dd 0f fisttpll (%rdi) f: 85 b4 43 00 00 e8 c1 test %esi,-0x3e180000(%rbx,%rax,2) 16: 99 cltd 17: 90 nop 18: ff 4c 89 e2 decl -0x1e(%rcx,%rcx,4) 1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 23: fc ff df 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 04 6c 00 00 jne 0x6c38 34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 3b: fc ff df 3e: 49 rex.WB 3f: 8b .byte 0x8b

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2022/12/08 10:03	linux-4.19.y	3f8a27f9e27b	d88f3abb	.config	console log	report	syz	C		[disk image] [vmlinux] [mounted in repro]	ci2-linux-4-19	general protection fault in fix_nodes

Crashes (1):

Assets (help?)