syzbot

 sign-in | mailing list | source | docs
🐞 Open [70]
🐞 Fixed [22]
🐞 Invalid [333]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

BUG: unable to handle kernel paging request in dqput

Status: auto-obsoleted due to no activity on 2023/04/17 15:54
Reported-by: syzbot+43f28429314a2121afb9@syzkaller.appspotmail.com
First crash: 1520d, last: 1425d
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel paging request in dqput (2) C error 5 709d 802d 0/1 upstream: reported C repro on 2022/09/11 16:38
linux-4.14 BUG: unable to handle kernel paging request in dqput C done 9 1430d 1520d 1/1 fixed on 2021/01/22 19:25
upstream BUG: unable to handle kernel paging request in dqput ext4 C done 7 1447d 1516d 19/28 fixed on 2021/03/10 01:48
linux-4.19 BUG: unable to handle kernel paging request in dqput C done 8 1439d 1508d 1/1 fixed on 2021/01/12 18:45
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2023/04/17 15:40 13m retest repro android12-5.4 OK log
2023/04/17 14:40 16m retest repro android12-5.4 OK log
2023/04/17 13:40 13m retest repro android12-5.4 OK log
2023/04/17 12:40 13m retest repro android12-5.4 OK log

Sample crash report:
Quota error (device loop0): qtree_write_dquot: Error -1986711217 occurred while creating quota
EXT4-fs error (device loop0): ext4_mb_generate_buddy:747: group 0, block bitmap and bg descriptor inconsistent: 32768 vs 25 free clusters
Quota error (device loop0): write_blk: dquota write failed
Quota error (device loop0): qtree_write_dquot: Error -28 occurred while creating quota
BUG: unable to handle page fault for address: fffffbfff132a636
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23fff3067 P4D 23fff3067 PUD 23ffb6067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 362 Comm: syz-executor261 Not tainted 5.4.82-syzkaller-00051-g6d7fe6dcb2e2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:91 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:108 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:134 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:181 [inline]
RIP: 0010:check_memory_region+0x70/0x2f0 mm/kasan/generic.c:191
Code: 49 bd 01 00 00 00 00 fc ff df 4d 01 ea 4d 89 d6 4d 29 ce 49 83 fe 10 7f 2b 4d 85 f6 0f 84 b9 01 00 00 4c 89 cb 4c 29 d3 66 90 <45> 0f b6 19 45 84 db 0f 85 03 02 00 00 49 ff c1 48 ff c3 75 eb e9
RSP: 0018:ffff8881e8f677b0 EFLAGS: 00010297
RAX: 50fdfe7bf52dec01 RBX: ffffffffffffffff RCX: ffffffff81b2f374
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff899531b3
RBP: ffffffff8995314f R08: dffffc0000000000 R09: fffffbfff132a636
R10: fffffbfff132a637 R11: 0000000000000004 R12: 1ffffffff132a636
R13: dffffc0000000001 R14: 0000000000000001 R15: ffffffff899531b3
FS:  0000000001255880(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff132a636 CR3: 00000001e1f42000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
 dqput+0x74/0x770 fs/quota/dquot.c:771
 dqput_all fs/quota/dquot.c:396 [inline]
 __dquot_drop fs/quota/dquot.c:1578 [inline]
 dquot_drop+0x1dd/0x2a0 fs/quota/dquot.c:1603
 ext4_clear_inode+0x4c/0x170 fs/ext4/super.c:1189
 ext4_evict_inode+0x714/0x1a70 fs/ext4/inode.c:349
 evict+0x29b/0x6a0 fs/inode.c:576
 dispose_list fs/inode.c:611 [inline]
 evict_inodes+0x608/0x690 fs/inode.c:661
 generic_shutdown_super+0x8f/0x2a0 fs/super.c:454
 kill_block_super+0x79/0xd0 fs/super.c:1444
 deactivate_locked_super+0xaf/0x100 fs/super.c:335
 deactivate_super+0x1b8/0x280 fs/super.c:366
 cleanup_mnt+0x432/0x4e0 fs/namespace.c:1102
 task_work_run+0x176/0x1a0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xcc2/0x2830 kernel/exit.c:811
 do_group_exit+0x155/0x2b0 kernel/exit.c:909
 __do_sys_exit_group+0x13/0x20 kernel/exit.c:920
 __se_sys_exit_group+0x10/0x10 kernel/exit.c:918
 __x64_sys_exit_group+0x37/0x40 kernel/exit.c:918
 do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x443828
Code: Bad RIP value.
RSP: 002b:00007ffc859291c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000443828
RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
RBP: 00000000004c3d10 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 00007ffc859290c0 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d6180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: fffffbfff132a636
---[ end trace c1bef2e5dae93ca0 ]---
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:91 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:108 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:134 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:181 [inline]
RIP: 0010:check_memory_region+0x70/0x2f0 mm/kasan/generic.c:191
Code: 49 bd 01 00 00 00 00 fc ff df 4d 01 ea 4d 89 d6 4d 29 ce 49 83 fe 10 7f 2b 4d 85 f6 0f 84 b9 01 00 00 4c 89 cb 4c 29 d3 66 90 <45> 0f b6 19 45 84 db 0f 85 03 02 00 00 49 ff c1 48 ff c3 75 eb e9
RSP: 0018:ffff8881e8f677b0 EFLAGS: 00010297
RAX: 50fdfe7bf52dec01 RBX: ffffffffffffffff RCX: ffffffff81b2f374
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff899531b3
RBP: ffffffff8995314f R08: dffffc0000000000 R09: fffffbfff132a636
R10: fffffbfff132a637 R11: 0000000000000004 R12: 1ffffffff132a636
R13: dffffc0000000001 R14: 0000000000000001 R15: ffffffff899531b3
FS:  0000000001255880(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004437fe CR3: 00000001e1f42000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/12 15:18 android12-5.4 6d7fe6dcb2e2 bca53db9 .config console log report syz C ci2-android-5-4-kasan
2020/09/24 08:13 https://android.googlesource.com/kernel/common android-5.4 63d1c2f0b547 54289b08 .config console log report syz C ci2-android-5-4-kasan
2020/09/23 18:45 https://android.googlesource.com/kernel/common android-5.4 63d1c2f0b547 287cd75a .config console log report syz C ci2-android-5-4-kasan
2020/09/22 22:09 https://android.googlesource.com/kernel/common android-5.4 63d1c2f0b547 3e8f6c27 .config console log report syz C ci2-android-5-4-kasan
2020/12/27 10:40 android12-5.4 8657d5d6282f 821e0b09 .config console log report info ci2-android-5-4-kasan
2020/12/25 19:28 android12-5.4 8657d5d6282f b982b3ea .config console log report info ci2-android-5-4-kasan
2020/12/22 06:24 android12-5.4 4aa7a7c97391 04201c06 .config console log report info ci2-android-5-4-kasan
2020/10/08 00:21 android12-5.4 489646b879ed 1880b4a9 .config console log report info ci2-android-5-4-kasan
2020/10/06 18:55 android12-5.4 ab402fc4c187 1880b4a9 .config console log report info ci2-android-5-4-kasan
2020/10/05 01:05 android12-5.4 9d0d630081ae 5ef9c291 .config console log report info ci2-android-5-4-kasan
2020/10/01 17:11 android12-5.4 2a7d52383a14 4103fce0 .config console log report info ci2-android-5-4-kasan
2020/09/27 09:42 android12-5.4 c43f5a389e8c 5dd8aee8 .config console log report info ci2-android-5-4-kasan
2020/09/24 15:43 https://android.googlesource.com/kernel/common android-5.4 63d1c2f0b547 54289b08 .config console log report info ci2-android-5-4-kasan
2020/09/24 09:23 https://android.googlesource.com/kernel/common android-5.4 63d1c2f0b547 54289b08 .config console log report info ci2-android-5-4-kasan
* Struck through repros no longer work on HEAD.