syzbot


general protection fault in __bfs (2)

Status: upstream: reported C repro on 2022/10/16 12:07
Reported-by: syzbot+105f44d0574afa3585e2@syzkaller.appspotmail.com
First crash: 109d, last: 6d10h
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in __bfs 4 692d 836d 0/1 auto-closed as invalid on 2021/07/10 18:06
upstream general protection fault in __bfs C 4 1484d 1513d 0/24 closed as dup on 2018/12/12 11:02
upstream general protection fault in __bfs (2) C done done 16 992d 1472d 0/24 auto-obsoleted due to no activity on 2022/09/16 03:13
upstream KASAN: slab-out-of-bounds Read in __bfs 1 474d 470d 0/24 auto-closed as invalid on 2022/01/14 09:46
upstream KASAN: slab-out-of-bounds Read in __bfs (2) 21 36d 288d 0/24 upstream: reported on 2022/04/20 20:21

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 7986 Comm: syz-executor394 Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
task: ffff8880982d4200 task.stack: ffff8880b3330000
RIP: 0010:lock_accessed kernel/locking/lockdep.c:979 [inline]
RIP: 0010:__bfs.part.0+0x20e/0x470 kernel/locking/lockdep.c:1045
RSP: 0018:ffff8880b3337370 EFLAGS: 00010007
RAX: 0000000001d0dd96 RBX: ffffffff8bb1d250 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010
RBP: ffff8880b3337428 R08: 0000000000000000 R09: 0000000000001c26
R10: 0000000000000002 R11: 0000000000000001 R12: ffffffff8140f610
R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000555555759300(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200000c4 CR3: 00000000b0305000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __bfs kernel/locking/lockdep.c:1424 [inline]
 __bfs_backwards kernel/locking/lockdep.c:1082 [inline]
 find_usage_backwards kernel/locking/lockdep.c:1424 [inline]
 check_usage_backwards+0x167/0x2c0 kernel/locking/lockdep.c:2713
 mark_lock_irq kernel/locking/lockdep.c:2804 [inline]
 mark_lock+0x3c7/0x1050 kernel/locking/lockdep.c:3194
 mark_irqflags kernel/locking/lockdep.c:3078 [inline]
 __lock_acquire+0x594/0x3f20 kernel/locking/lockdep.c:3448
 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
 down_read+0x36/0x80 kernel/locking/rwsem.c:24
 nilfs_bmap_lookup_at_level+0x6b/0x380 fs/nilfs2/bmap.c:77
 nilfs_bmap_lookup fs/nilfs2/bmap.h:179 [inline]
 nilfs_mdt_submit_block.constprop.0+0x152/0x970 fs/nilfs2/mdt.c:151
 nilfs_mdt_read_block+0x7c/0x320 fs/nilfs2/mdt.c:184
 nilfs_mdt_get_block+0xc7/0xb90 fs/nilfs2/mdt.c:259
 nilfs_palloc_get_block+0xb2/0x250 fs/nilfs2/alloc.c:225
 nilfs_palloc_get_entry_block+0x17d/0x230 fs/nilfs2/alloc.c:327
 nilfs_ifile_get_inode_block+0xb4/0x150 fs/nilfs2/ifile.c:152
 __nilfs_read_inode fs/nilfs2/inode.c:492 [inline]
 nilfs_iget+0x1c2/0x810 fs/nilfs2/inode.c:601
 nilfs_get_root_dentry+0x24/0x1f0 fs/nilfs2/super.c:918
 nilfs_fill_super fs/nilfs2/super.c:1092 [inline]
 nilfs_mount+0x984/0xd00 fs/nilfs2/super.c:1331
 mount_fs+0x92/0x2a0 fs/super.c:1237
 vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
 vfs_kern_mount fs/namespace.c:1036 [inline]
 do_new_mount fs/namespace.c:2572 [inline]
 do_mount+0xe65/0x2a30 fs/namespace.c:2905
 SYSC_mount fs/namespace.c:3121 [inline]
 SyS_mount+0xa8/0x120 fs/namespace.c:3098
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f5ca2a4d6aa
RSP: 002b:00007ffca0d61138 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5ca2a4d6aa
RDX: 00000000200000c0 RSI: 0000000020000100 RDI: 00007ffca0d61150
RBP: 00007ffca0d61150 R08: 00007ffca0d61190 R09: 00005555557592c0
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000004
R13: 00007ffca0d61190 R14: 0000000000000039 R15: 0000000020000758
Code: 78 01 00 00 4d 8b 36 4c 39 f3 74 78 49 8d 7e 10 4c 89 f0 4c 8b 0d a3 69 a7 0a 48 89 fa 48 2d 60 9a c8 8b 48 c1 ea 03 48 c1 f8 06 <42> 80 3c 3a 00 0f 85 28 01 00 00 49 8b 4e 10 4c 8d 41 2c 4c 89 
RIP: lock_accessed kernel/locking/lockdep.c:979 [inline] RSP: ffff8880b3337370
RIP: __bfs.part.0+0x20e/0x470 kernel/locking/lockdep.c:1045 RSP: ffff8880b3337370
---[ end trace cacd434ed93c8ae1 ]---
----------------
Code disassembly (best guess):
   0:	78 01                	js     0x3
   2:	00 00                	add    %al,(%rax)
   4:	4d 8b 36             	mov    (%r14),%r14
   7:	4c 39 f3             	cmp    %r14,%rbx
   a:	74 78                	je     0x84
   c:	49 8d 7e 10          	lea    0x10(%r14),%rdi
  10:	4c 89 f0             	mov    %r14,%rax
  13:	4c 8b 0d a3 69 a7 0a 	mov    0xaa769a3(%rip),%r9        # 0xaa769bd
  1a:	48 89 fa             	mov    %rdi,%rdx
  1d:	48 2d 60 9a c8 8b    	sub    $0xffffffff8bc89a60,%rax
  23:	48 c1 ea 03          	shr    $0x3,%rdx
  27:	48 c1 f8 06          	sar    $0x6,%rax
* 2b:	42 80 3c 3a 00       	cmpb   $0x0,(%rdx,%r15,1) <-- trapping instruction
  30:	0f 85 28 01 00 00    	jne    0x15e
  36:	49 8b 4e 10          	mov    0x10(%r14),%rcx
  3a:	4c 8d 41 2c          	lea    0x2c(%rcx),%r8
  3e:	4c                   	rex.WR
  3f:	89                   	.byte 0x89

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-linux-4-14 2023/01/27 12:58 linux-4.14.y 3949d1610004 b31320fc .config console log report syz C
ci2-linux-4-14 2022/11/18 19:12 linux-4.14.y e911713e40ca b31320fc .config console log report syz C
* Struck through repros no longer work on HEAD.
Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-linux-4-14 2022/10/19 18:51 linux-4.14.y 9d5c0b3a8e1a b31320fc .config console log report syz C [disk image] [vmlinux] [mounted in repro] general protection fault in __bfs
ci2-linux-4-14 2022/10/16 12:06 linux-4.14.y 9d5c0b3a8e1a 67cb024c .config console log report syz C [disk image] [vmlinux] [mounted in repro] general protection fault in __bfs
* Struck through repros no longer work on HEAD.