syzbot


general protection fault in open_fs_devices

Status: fixed on 2018/08/28 17:48
Subsystems: btrfs
[Documentation on labels]
Reported-by: syzbot+909a5177749d7990ffa4@syzkaller.appspotmail.com
Fix commit: 81ffd56b5745 btrfs: fix mount and ioctl device scan ioctl race
First crash: 2144d, last: 2112d
Discussions (3)
Title Replies (including bot) Last reply
[PATCH 4.18 000/197] 4.18.8-stable review 205 (205) 2018/09/17 04:57
general protection fault in open_fs_devices 4 (6) 2018/06/19 18:27
WARNING in close_fs_devices 2 (6) 2018/06/19 17:42

Sample crash report:
BTRFS: device fsid ecf6f2a2-2997-48ae-b81e-1b00920efd9a devid 0 transid 0 /dev/loop0
print_req_error: I/O error, dev loop1, sector 128
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
CPU: 0 PID: 4585 Comm: syz-executor809 Not tainted 4.18.0-rc1+ #108
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:open_fs_devices+0x7f0/0xc80 fs/btrfs/volumes.c:1124
Code: 48 8b 85 e0 fe ff ff 41 c7 87 14 01 00 00 01 00 00 00 48 8d b8 a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ab 03 00 00 48 8b 85 e0 fe ff ff 49 8d 7f 50 48 
RSP: 0018:ffff8801d8fa71d8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff82ca7517
RDX: 0000000000000014 RSI: ffffffff82ca7525 RDI: 00000000000000a0
RBP: ffff8801d8fa7348 R08: ffff8801d8bc8540 R09: ffff8801d8fa7240
R10: ffffed003b1f4e5c R11: ffff8801d8fa72e7 R12: ffff8801d8880d58
R13: ffff8801d8880cd8 R14: dffffc0000000000 R15: ffff8801d8880c80
FS:  0000000001c9a880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 00000001d8a45000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 btrfs_open_devices+0xc0/0xd0 fs/btrfs/volumes.c:1155
 btrfs_mount_root+0x942/0x1e90 fs/btrfs/super.c:1568
 mount_fs+0xae/0x328 fs/super.c:1277
 vfs_kern_mount.part.34+0xdc/0x4e0 fs/namespace.c:1037
 vfs_kern_mount+0x40/0x60 fs/namespace.c:1027
 btrfs_mount+0x4a9/0x215e fs/btrfs/super.c:1661
 mount_fs+0xae/0x328 fs/super.c:1277
 vfs_kern_mount.part.34+0xdc/0x4e0 fs/namespace.c:1037
 vfs_kern_mount fs/namespace.c:1027 [inline]
 do_new_mount fs/namespace.c:2518 [inline]
 do_mount+0x581/0x30e0 fs/namespace.c:2848
 ksys_mount+0x12d/0x140 fs/namespace.c:3064
 __do_sys_mount fs/namespace.c:3078 [inline]
 __se_sys_mount fs/namespace.c:3075 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3075
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446fca
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 1d aa fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 fa a9 fb ff c3 66 0f 1f 84 00 00 00 00 00 
RSP: 002b:00007ffee8ad8698 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffee8ad86b0 RCX: 0000000000446fca
RDX: 00007ffee8ad86b0 RSI: 00000000200000c0 RDI: 00007ffee8ad86d0
RBP: 0000000000000001 R08: 00007ffee8ad8710 R09: 000000000000000a
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000001
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace 9f351a86bc83ada4 ]---
RIP: 0010:open_fs_devices+0x7f0/0xc80 fs/btrfs/volumes.c:1124
Code: 48 8b 85 e0 fe ff ff 41 c7 87 14 01 00 00 01 00 00 00 48 8d b8 a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ab 03 00 00 48 8b 85 e0 fe ff ff 49 8d 7f 50 48 
RSP: 0018:ffff8801d8fa71d8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff82ca7517
RDX: 0000000000000014 RSI: ffffffff82ca7525 RDI: 00000000000000a0
RBP: ffff8801d8fa7348 R08: ffff8801d8bc8540 R09: ffff8801d8fa7240
R10: ffffed003b1f4e5c R11: ffff8801d8fa72e7 R12: ffff8801d8880d58
R13: ffff8801d8880cd8 R14: dffffc0000000000 R15: ffff8801d8880c80
FS:  0000000001c9a880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 00000001d8a45000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/06/18 22:53 upstream 9ffc59d57228 45c54f75 .config console log report syz C ci-upstream-kasan-gce-root
2018/06/06 10:30 upstream af6c5d5e01ad 41f9540d .config console log report syz C ci-upstream-kasan-gce-root
2018/07/08 08:37 upstream b2d44d145d2a c9a7a4dc .config console log report ci-upstream-kasan-gce-root
2018/07/07 12:30 upstream 29119529d8de 6c0c0099 .config console log report ci-upstream-kasan-gce-root
2018/07/06 06:14 upstream c42c12a90545 d3b2a0e2 .config console log report ci-upstream-kasan-gce-root
2018/06/28 12:07 upstream f57494321cbf dba0b50e .config console log report ci-upstream-kasan-gce-root
2018/06/09 15:22 upstream 7d3bf613e99a 866118af .config console log report ci-upstream-kasan-gce-root
2018/06/06 10:39 upstream af6c5d5e01ad 41f9540d .config console log report ci-upstream-kasan-gce-root
* Struck through repros no longer work on HEAD.