syzbot


BUG: unable to handle kernel paging request in dqput

Status: fixed on 2021/03/10 01:48
Reported-by: syzbot+f816042a7ae2225f25ba@syzkaller.appspotmail.com
Fix commit: 11c514a99bb9 quota: Sanity-check quota file headers on load
First crash: 643d, last: 570d

Cause bisection: introduced by (bisect log) :
commit 1d0f953086f090a022f2c0e1448300c15372db46
Author: Ioan-Adrian Ratiu <adi@adirat.com>
Date: Wed Jan 4 22:37:46 2017 +0000

  ALSA: usb-audio: Fix irq/process data synchronization

Crash: WARNING in nf_unregister_net_hook (log)
Repro: C syz .config
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 BUG: unable to handle kernel paging request in dqput C 14 547d 643d 0/2 upstream: reported C repro on 2020/09/22 22:10
linux-4.14 BUG: unable to handle kernel paging request in dqput C done 9 552d 642d 1/1 fixed on 2021/01/22 19:25
linux-4.19 BUG: unable to handle kernel paging request in dqput C done 8 561d 630d 1/1 fixed on 2021/01/12 18:45

Sample crash report:
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
Quota error (device loop0): qtree_write_dquot: Error -669470953 occurred while creating quota
Quota error (device loop0): qtree_write_dquot: Error -1224736762 occurred while creating quota
EXT4-fs error (device loop0): __ext4_new_inode:1067: comm syz-executor912: reserved inode found cleared - inode=1
BUG: unable to handle page fault for address: fffffbfff6e00022
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffe9067 P4D 23ffe9067 PUD 23ffe8067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8476 Comm: syz-executor912 Not tainted 5.10.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:91 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:108 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:134 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:183 [inline]
RIP: 0010:check_memory_region+0xdb/0x180 mm/kasan/generic.c:192
Code: 80 38 00 74 f2 48 89 c2 b8 01 00 00 00 48 85 d2 75 56 5b 5d 41 5c c3 48 85 d2 74 5e 48 01 ea eb 09 48 83 c0 01 48 39 d0 74 50 <80> 38 00 74 f2 eb d4 41 bc 08 00 00 00 48 89 ea 45 29 dc 4d 8d 1c
RSP: 0018:ffffc90000eaf6b0 EFLAGS: 00010286
RAX: fffffbfff6e00022 RBX: fffffbfff6e00024 RCX: ffffffff81dfd4df
RDX: fffffbfff6e00024 RSI: 0000000000000004 RDI: ffffffffb7000116
RBP: fffffbfff6e00022 R08: 0000000000000000 R09: ffffffffb7000119
R10: fffffbfff6e00023 R11: 0000000000000000 R12: ffffffffb7000136
R13: ffffffffb7000116 R14: 0000000000000009 R15: 1ffffffff6e00022
FS:  000000000120a880(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff6e00022 CR3: 0000000012cc6000 CR4: 0000000000350ef0
Call Trace:
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
 dqput.part.0+0xaf/0x870 fs/quota/dquot.c:770
 dqput fs/quota/dquot.c:757 [inline]
 dqput_all fs/quota/dquot.c:397 [inline]
 __dquot_drop+0x19c/0x270 fs/quota/dquot.c:1577
 dquot_drop fs/quota/dquot.c:1602 [inline]
 dquot_drop+0x14b/0x1a0 fs/quota/dquot.c:1580
 __ext4_new_inode+0x2ba6/0x5520 fs/ext4/ialloc.c:1352
 ext4_tmpfile+0x208/0x480 fs/ext4/namei.c:2685
 vfs_tmpfile+0x201/0x380 fs/namei.c:3284
 do_tmpfile fs/namei.c:3317 [inline]
 path_openat+0x1667/0x2730 fs/namei.c:3360
 do_filp_open+0x17e/0x3c0 fs/namei.c:3396
 do_sys_openat2+0x16d/0x420 fs/open.c:1168
 do_sys_open fs/open.c:1184 [inline]
 __do_sys_openat fs/open.c:1200 [inline]
 __se_sys_openat fs/open.c:1195 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1195
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x444969
Code: 8d d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc49f30038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000444969
RDX: 0000000000410481 RSI: 0000000020000000 RDI: ffffffffffffff9c
RBP: 00000000006cf018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402550
R13: 00000000004025e0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: fffffbfff6e00022
---[ end trace cda9436d066dbe74 ]---
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:91 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:108 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:134 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:183 [inline]
RIP: 0010:check_memory_region+0xdb/0x180 mm/kasan/generic.c:192
Code: 80 38 00 74 f2 48 89 c2 b8 01 00 00 00 48 85 d2 75 56 5b 5d 41 5c c3 48 85 d2 74 5e 48 01 ea eb 09 48 83 c0 01 48 39 d0 74 50 <80> 38 00 74 f2 eb d4 41 bc 08 00 00 00 48 89 ea 45 29 dc 4d 8d 1c
RSP: 0018:ffffc90000eaf6b0 EFLAGS: 00010286
RAX: fffffbfff6e00022 RBX: fffffbfff6e00024 RCX: ffffffff81dfd4df
RDX: fffffbfff6e00024 RSI: 0000000000000004 RDI: ffffffffb7000116
RBP: fffffbfff6e00022 R08: 0000000000000000 R09: ffffffffb7000119
R10: fffffbfff6e00023 R11: 0000000000000000 R12: ffffffffb7000136
R13: ffffffffb7000116 R14: 0000000000000009 R15: 1ffffffff6e00022
FS:  000000000120a880(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff6e00022 CR3: 0000000012cc6000 CR4: 0000000000350ef0

Crashes (7):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2020/12/05 08:46 upstream e87297fa080a 20366b87 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/12/03 14:25 upstream 34816d20f173 e6b0d314 .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/10/09 00:08 upstream 3d006ee42dde 92390980 .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/10/04 15:25 upstream 22fbc037cd32 5ef9c291 .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/09/22 21:02 upstream 98477740630f 3e8f6c27 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/09/29 15:50 upstream fb0155a09b02 1b88c6d5 .config log report info
ci-upstream-kasan-gce-smack-root 2020/09/22 20:37 upstream 98477740630f 3e8f6c27 .config log report info