syzbot


general protection fault in dqput

Status: upstream: reported C repro on 2020/12/06 06:39
Reported-by: syzbot+bad133ed4f314c43527c@syzkaller.appspotmail.com
First crash: 565d, last: 545d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in dqput C done 1 544d 544d 1/1 fixed on 2021/01/27 05:38
linux-4.19 general protection fault in dqput C done 2 544d 558d 1/1 fixed on 2021/01/26 16:42

Sample crash report:
Quota error (device loop0): qtree_write_dquot: Error -28 occurred while creating quota
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 350 Comm: syz-executor361 Not tainted 5.4.85-syzkaller-00188-g8657d5d6282f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:sb_has_quota_usage_enabled include/linux/quotaops.h:132 [inline]
RIP: 0010:sb_has_quota_loaded include/linux/quotaops.h:157 [inline]
RIP: 0010:sb_has_quota_active include/linux/quotaops.h:167 [inline]
RIP: 0010:dqput+0x50c/0x770 fs/quota/dquot.c:775
Code: 68 48 83 c5 74 48 89 e8 48 c1 e8 03 42 8a 04 28 84 c0 0f 85 f1 01 00 00 44 8b 75 00 48 81 c3 28 01 00 00 48 89 d8 48 c1 e8 03 <42> 8a 04 28 84 c0 0f 85 f0 01 00 00 8b 1b bd 01 00 00 00 44 89 f1
RSP: 0018:ffff8881e8d6f7e0 EFLAGS: 00010203
RAX: 000b6a7de00b6a9b RBX: 005b53ef005b54de RCX: ffffffff81b2f774
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff85874e5c
RBP: ffffffff85874e68 R08: dffffc0000000000 R09: fffffbfff0b0e9cc
R10: fffffbfff0b0e9cc R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: 00000000005b542a R15: ffffffff85874e58
FS:  0000000001de1880(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004c4008 CR3: 000000000540e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 dqput_all fs/quota/dquot.c:396 [inline]
 __dquot_drop fs/quota/dquot.c:1578 [inline]
 dquot_drop+0x1e5/0x2a0 fs/quota/dquot.c:1603
 ext4_clear_inode+0x4c/0x170 fs/ext4/super.c:1189
 ext4_evict_inode+0x714/0x1a70 fs/ext4/inode.c:349
 evict+0x29b/0x6a0 fs/inode.c:576
 dispose_list fs/inode.c:611 [inline]
 evict_inodes+0x608/0x690 fs/inode.c:661
 generic_shutdown_super+0x8f/0x2a0 fs/super.c:454
 kill_block_super+0x79/0xd0 fs/super.c:1444
 deactivate_locked_super+0xaf/0x100 fs/super.c:335
 deactivate_super+0x1b8/0x280 fs/super.c:366
 cleanup_mnt+0x432/0x4e0 fs/namespace.c:1102
 task_work_run+0x176/0x1a0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xcc2/0x2830 kernel/exit.c:811
 do_group_exit+0x155/0x2b0 kernel/exit.c:909
 __do_sys_exit_group+0x13/0x20 kernel/exit.c:920
 __se_sys_exit_group+0x10/0x10 kernel/exit.c:918
 __x64_sys_exit_group+0x37/0x40 kernel/exit.c:918
 do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x443a28
Code: Bad RIP value.
RSP: 002b:00007ffd76818848 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000443a28
RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
RBP: 00000000004c3fd0 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d6180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 8a94edbf5091c039 ]---
RIP: 0010:sb_has_quota_usage_enabled include/linux/quotaops.h:132 [inline]
RIP: 0010:sb_has_quota_loaded include/linux/quotaops.h:157 [inline]
RIP: 0010:sb_has_quota_active include/linux/quotaops.h:167 [inline]
RIP: 0010:dqput+0x50c/0x770 fs/quota/dquot.c:775
Code: 68 48 83 c5 74 48 89 e8 48 c1 e8 03 42 8a 04 28 84 c0 0f 85 f1 01 00 00 44 8b 75 00 48 81 c3 28 01 00 00 48 89 d8 48 c1 e8 03 <42> 8a 04 28 84 c0 0f 85 f0 01 00 00 8b 1b bd 01 00 00 00 44 89 f1
RSP: 0018:ffff8881e8d6f7e0 EFLAGS: 00010203
RAX: 000b6a7de00b6a9b RBX: 005b53ef005b54de RCX: ffffffff81b2f774
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff85874e5c
RBP: ffffffff85874e68 R08: dffffc0000000000 R09: fffffbfff0b0e9cc
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-android-5-4-kasan 2020/12/26 20:25 android12-5.4 8657d5d6282f 821e0b09 .config log report syz C
ci2-android-5-4-kasan 2020/12/06 06:38 android12-5.4 616dba5e94cf 50503117 .config log report syz C