syzbot


BUG: unable to handle kernel paging request in fuse_dev_do_write

Status: upstream: reported C repro on 2020/12/15 11:21
Reported-by: syzbot+6f69172f54597343c14f@syzkaller.appspotmail.com
First crash: 721d, last: 143d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 BUG: unable to handle kernel paging request in fuse_dev_do_write C 46 1145d 1334d 0/3 public: reported C repro on 2019/04/13 00:00

Sample crash report:
BUG: unable to handle page fault for address: ffffed105bc1dbff
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23fff3067 P4D 23fff3067 PUD 23fff1067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 305 Comm: syz-executor155 Not tainted 5.4.190-syzkaller-00033-ga4d27a2c85c9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:fuse_dev_do_write+0x1f8e/0x49e0 fs/fuse/dev.c:1939
Code: 48 89 d8 48 c1 e8 03 48 bd 00 00 00 00 00 fc ff df 8a 04 28 84 c0 0f 85 ea 25 00 00 8b 1b ff cb 4c 01 f3 48 89 d8 48 c1 e8 03 <8a> 04 28 84 c0 0f 85 ee 25 00 00 c6 03 00 41 80 3c 2f 00 74 08 4c
RSP: 0018:ffff8881e1347bd0 EFLAGS: 00010a07
RAX: 1ffff1105bc1dbff RBX: ffff8882de0edfff RCX: ffff8881defcaf40
RDX: 0000000000000000 RSI: 00000000000007e0 RDI: ffff8881e135fe20
RBP: dffffc0000000000 R08: ffffffff81d12e78 R09: fffff94000ef5667
R10: fffff94000ef5667 R11: 1ffffd4000ef5666 R12: ffff8881de0ed340
R13: ffff8881de0ed360 R14: ffff8881de0ee000 R15: 1ffff1103bc1da6c
FS:  00007f2fde013700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed105bc1dbff CR3: 00000001de22c000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 fuse_dev_write+0xff/0x160 fs/fuse/dev.c:1976
 call_write_iter include/linux/fs.h:1976 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0x4f9/0x6a0 fs/read_write.c:496
 vfs_write+0x210/0x4f0 fs/read_write.c:558
 ksys_write+0x158/0x260 fs/read_write.c:611
 do_syscall_64+0xcb/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f2fde0617c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2fde0132f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f2fde0ed4c0 RCX: 00007f2fde0617c9
RDX: 0000000000000010 RSI: 00000000200042c0 RDI: 0000000000000003
RBP: 00007f2fde0bb0d4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2fde0b70c8
R13: 00007f2fde0b90d0 R14: 2f30656c69662f2e R15: 00007f2fde0ed4c8
Modules linked in:
CR2: ffffed105bc1dbff
---[ end trace 79d36eaf1b8e1f05 ]---
RIP: 0010:fuse_dev_do_write+0x1f8e/0x49e0 fs/fuse/dev.c:1939
Code: 48 89 d8 48 c1 e8 03 48 bd 00 00 00 00 00 fc ff df 8a 04 28 84 c0 0f 85 ea 25 00 00 8b 1b ff cb 4c 01 f3 48 89 d8 48 c1 e8 03 <8a> 04 28 84 c0 0f 85 ee 25 00 00 c6 03 00 41 80 3c 2f 00 74 08 4c
RSP: 0018:ffff8881e1347bd0 EFLAGS: 00010a07
RAX: 1ffff1105bc1dbff RBX: ffff8882de0edfff RCX: ffff8881defcaf40
RDX: 0000000000000000 RSI: 00000000000007e0 RDI: ffff8881e135fe20
RBP: dffffc0000000000 R08: ffffffff81d12e78 R09: fffff94000ef5667
R10: fffff94000ef5667 R11: 1ffffd4000ef5666 R12: ffff8881de0ed340
R13: ffff8881de0ed360 R14: ffff8881de0ee000 R15: 1ffff1103bc1da6c
FS:  00007f2fde013700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed105bc1dbff CR3: 00000001de22c000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	48 89 d8             	mov    %rbx,%rax
   3:	48 c1 e8 03          	shr    $0x3,%rax
   7:	48 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbp
   e:	fc ff df
  11:	8a 04 28             	mov    (%rax,%rbp,1),%al
  14:	84 c0                	test   %al,%al
  16:	0f 85 ea 25 00 00    	jne    0x2606
  1c:	8b 1b                	mov    (%rbx),%ebx
  1e:	ff cb                	dec    %ebx
  20:	4c 01 f3             	add    %r14,%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	8a 04 28             	mov    (%rax,%rbp,1),%al <-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	0f 85 ee 25 00 00    	jne    0x2623
  35:	c6 03 00             	movb   $0x0,(%rbx)
  38:	41 80 3c 2f 00       	cmpb   $0x0,(%r15,%rbp,1)
  3d:	74 08                	je     0x47
  3f:	4c                   	rex.WR

Crashes (172):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-android-5-4-kasan 2022/06/02 13:17 android12-5.4 a4d27a2c85c9 6e12f05f .config log report syz C BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2020/12/16 15:29 android12-5.4 3f2fbc0cdc98 649595c6 .config log report syz C
ci2-android-5-4-kasan 2020/12/16 15:09 android12-5.4 3f2fbc0cdc98 649595c6 .config log report syz C
ci2-android-5-4-kasan 2020/12/16 14:49 android12-5.4 3f2fbc0cdc98 649595c6 .config log report syz C
ci2-android-5-4-kasan 2020/12/15 11:43 android12-5.4 30fc30201c19 97183ed7 .config log report syz C
ci2-android-5-4-kasan 2022/07/16 13:44 android12-5.4 330fa791a029 95cb00d1 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/06/28 11:47 android12-5.4 9ce4508d6de9 ef82eb2c .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/06/24 09:27 android12-5.4 9ce4508d6de9 a5dbd430 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/06/08 11:32 android12-5.4 b9c3a995e377 b2706118 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/06/07 03:30 android12-5.4 3716b22823c5 c8857892 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/06/02 16:31 android12-5.4 a4d27a2c85c9 6e12f05f .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/06/02 15:29 android12-5.4 a4d27a2c85c9 6e12f05f .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/06/02 12:51 android12-5.4 a4d27a2c85c9 6e12f05f .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/06/02 12:21 android12-5.4 a4d27a2c85c9 6e12f05f .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/04/15 21:53 android12-5.4 b730087e9a5d 8bcc32a6 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/03/19 11:06 android12-5.4 49216514f3a3 e2d91b1d .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/03/18 22:07 android12-5.4 49216514f3a3 e2d91b1d .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/03/05 14:17 android12-5.4 8a3679a75730 45a13a73 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/02/27 18:40 android12-5.4 961dd91cc692 45a13a73 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/02/23 22:59 android12-5.4 cae20698ffbf 6e821dbf .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/02/16 18:13 android12-5.4 2426795494c7 8b9ca619 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/02/08 21:34 android12-5.4 2159354389cf 0b33604d .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/01/21 01:17 android12-5.4 6140ec56536b b838eb76 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/01/19 22:50 android12-5.4 946eff433f93 5da9499f .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/01/18 05:42 android12-5.4 37c7c8d4f085 731a2d23 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/01/09 05:37 android12-5.4 5b673be0c6b0 2ca0d385 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2022/01/09 03:17 android12-5.4 5b673be0c6b0 2ca0d385 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/12/09 06:46 android12-5.4 93698d0219f2 a4a2a501 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/12/07 19:29 android12-5.4 93698d0219f2 0230ba3e .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/12/07 15:09 android12-5.4 93698d0219f2 0230ba3e .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/11/23 06:44 android12-5.4 697fba25ed27 545ab074 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/10/17 23:49 android12-5.4 73e6d86c30ee 0c5d9412 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/10/17 22:24 android12-5.4 73e6d86c30ee 0c5d9412 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/10/17 21:06 android12-5.4 73e6d86c30ee 0c5d9412 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/10/04 06:02 android12-5.4 1e429b8f9eb9 db0f5787 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/10/04 00:58 android12-5.4 1e429b8f9eb9 db0f5787 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/10/03 23:25 android12-5.4 1e429b8f9eb9 db0f5787 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/09/16 06:09 android12-5.4 4614f5de0f95 07e953c1 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/09/05 08:38 android12-5.4 ae94e015273b d236a457 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/08/23 13:01 android12-5.4 3ce13296e72d b599f2fc .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/08/20 20:59 android12-5.4 085ebe864e39 b599f2fc .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/08/20 15:52 android12-5.4 085ebe864e39 b599f2fc .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/07/30 20:06 android12-5.4 e7e1f9adf836 6c236867 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/07/30 15:26 android12-5.4 e7e1f9adf836 c585c7b0 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/07/28 02:52 android12-5.4 1325ae070036 17d6ab15 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/07/19 21:35 android12-5.4 94c8a99d3d53 e6a17580 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/07/19 17:36 android12-5.4 18f5581af79d e6a17580 .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/07/15 12:05 android12-5.4 bbf5a2eaba8d b9a2f64e .config log report info BUG: unable to handle kernel paging request in fuse_dev_do_write
ci2-android-5-4-kasan 2021/01/02 04:26 android12-5.4 e627b02af655 79264ae3 .config log report info
ci2-android-5-4-kasan 2020/12/15 11:20 android12-5.4 30fc30201c19 97183ed7 .config log report info
* Struck through repros no longer work on HEAD.