syzbot


divide error in do_journal_end (3)

Status: upstream: reported C repro on 2023/01/27 02:59
Subsystems: reiserfs
[Documentation on labels]
Reported-by: syzbot+aeadcafb8320c83999a8@syzkaller.appspotmail.com
First crash: 514d, last: 514d
Fix bisection: failed (error log, bisect log)
  
Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream divide error in do_journal_end reiserfs 2 1312d 1339d 0/27 auto-closed as invalid on 2021/03/19 22:00
linux-4.14 divide error in do_journal_end (2) C error 1 664d 1152d 0/1 upstream: reported C repro on 2021/04/28 16:52
upstream divide error in do_journal_end (3) reiserfs C error done 83 168d 549d 0/27 auto-obsoleted due to no activity on 2024/04/14 06:39
upstream divide error in do_journal_end (2) reiserfs C inconclusive 2 1139d 1138d 20/27 fixed on 2021/11/10 00:50
linux-5.15 divide error in do_journal_end origin:upstream C 65 34d 351d 0/3 upstream: reported C repro on 2023/07/08 18:42
linux-4.19 divide error in do_journal_end (2) C done 4 1078d 1189d 1/1 fixed on 2021/08/12 11:53
linux-6.1 divide error in do_journal_end origin:upstream C 36 10d 177d 0/3 upstream: reported C repro on 2023/12/30 01:46
linux-4.14 divide error in do_journal_end C done 1 1262d 1322d 1/1 fixed on 2021/02/21 17:18
linux-4.19 divide error in do_journal_end C done 2 1274d 1334d 1/1 fixed on 2021/01/27 05:38

Sample crash report:
REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop0): checking transaction log (loop0)
REISERFS (device loop0): Using r5 hash to sort names
REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
audit: type=1800 audit(1674788210.910:2): pid=8118 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor349" name="bus" dev="loop0" ino=4 res=0
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8118 Comm: syz-executor349 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
RIP: 0010:do_journal_end+0x15be/0x4840 fs/reiserfs/journal.c:4103
Code: c6 41 84 f0 0f 85 51 2b 00 00 83 e2 07 38 d1 40 0f 9e c6 84 c9 0f 95 c2 40 84 d6 0f 85 3a 2b 00 00 8b 4b 14 48 8d 7d 18 31 d2 <48> f7 f1 4a 8d 34 2a 48 89 fa 48 b8 00 00 00 00 00 fc ff df 48 c1
RSP: 0018:ffff8880b14a7a08 EFLAGS: 00010246
RAX: 0000000000000003 RBX: ffff88809ed7e000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880afc0d458
RBP: ffff8880afc0d440 R08: 0000000000000001 R09: ffffed101606fdff
R10: ffff8880b037effb R11: 0000000000000000 R12: 0000000000001000
R13: 0000000000000000 R14: ffff88808db0dbd0 R15: ffffc90001b22000
FS:  000055555704a300(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e15eda4f8 CR3: 00000000a110b000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 reiserfs_sync_fs+0xf8/0x120 fs/reiserfs/super.c:78
 __sync_filesystem fs/sync.c:39 [inline]
 sync_filesystem+0x105/0x250 fs/sync.c:64
 generic_shutdown_super+0x70/0x370 fs/super.c:442
 kill_block_super+0x97/0xf0 fs/super.c:1185
 deactivate_locked_super+0x94/0x160 fs/super.c:329
 deactivate_super+0x174/0x1a0 fs/super.c:360
 cleanup_mnt+0x1a8/0x290 fs/namespace.c:1098
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
 do_group_exit+0x125/0x310 kernel/exit.c:967
 __do_sys_exit_group kernel/exit.c:978 [inline]
 __se_sys_exit_group kernel/exit.c:976 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:976
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5e15e95af9
Code: Bad RIP value.
RSP: 002b:00007fff3de333b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f5e15f0b350 RCX: 00007f5e15e95af9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f5e15f05e40
R10: 000000000001ff01 R11: 0000000000000246 R12: 00007f5e15f0b350
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
Modules linked in:
---[ end trace 166482dce4a0b3ea ]---
RIP: 0010:do_journal_end+0x15be/0x4840 fs/reiserfs/journal.c:4103
Code: c6 41 84 f0 0f 85 51 2b 00 00 83 e2 07 38 d1 40 0f 9e c6 84 c9 0f 95 c2 40 84 d6 0f 85 3a 2b 00 00 8b 4b 14 48 8d 7d 18 31 d2 <48> f7 f1 4a 8d 34 2a 48 89 fa 48 b8 00 00 00 00 00 fc ff df 48 c1
RSP: 0018:ffff8880b14a7a08 EFLAGS: 00010246
RAX: 0000000000000003 RBX: ffff88809ed7e000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880afc0d458
RBP: ffff8880afc0d440 R08: 0000000000000001 R09: ffffed101606fdff
R10: ffff8880b037effb R11: 0000000000000000 R12: 0000000000001000
R13: 0000000000000000 R14: ffff88808db0dbd0 R15: ffffc90001b22000
FS:  000055555704a300(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f40ac039108 CR3: 00000000b5be1000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	c6 41 84 f0          	movb   $0xf0,-0x7c(%rcx)
   4:	0f 85 51 2b 00 00    	jne    0x2b5b
   a:	83 e2 07             	and    $0x7,%edx
   d:	38 d1                	cmp    %dl,%cl
   f:	40 0f 9e c6          	setle  %sil
  13:	84 c9                	test   %cl,%cl
  15:	0f 95 c2             	setne  %dl
  18:	40 84 d6             	test   %dl,%sil
  1b:	0f 85 3a 2b 00 00    	jne    0x2b5b
  21:	8b 4b 14             	mov    0x14(%rbx),%ecx
  24:	48 8d 7d 18          	lea    0x18(%rbp),%rdi
  28:	31 d2                	xor    %edx,%edx
* 2a:	48 f7 f1             	div    %rcx <-- trapping instruction
  2d:	4a 8d 34 2a          	lea    (%rdx,%r13,1),%rsi
  31:	48 89 fa             	mov    %rdi,%rdx
  34:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  3b:	fc ff df
  3e:	48                   	rex.W
  3f:	c1                   	.byte 0xc1

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/01/27 02:58 linux-4.19.y 3f8a27f9e27b 9dfcf09c .config console log report syz C [disk image] [vmlinux] [mounted in repro] ci2-linux-4-19 divide error in do_journal_end
* Struck through repros no longer work on HEAD.