syzbot


panic: Incrementing non-positive count ADDR on tmpfs.inode (4)

Status: fixed on 2023/11/17 08:30
Fix commit: 77b137ffd8ec Fix umount not unmounting all the mounts it is supposed to.
First crash: 377d, last: 375d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: Incrementing non-positive count ADDR on tmpfs.inode syz 2 1472d 1472d 0/26 fixed on 2020/11/18 07:03
gvisor panic: Incrementing non-positive count ADDR on tmpfs.inode (2) C 56 726d 727d 14/26 fixed on 2022/12/01 12:27
gvisor panic: Incrementing non-positive count ADDR on tmpfs.inode (3) 6 566d 588d 26/26 fixed on 2023/05/26 03:35

Sample crash report:
panic: Incrementing non-positive count 0xc000801c58 on tmpfs.inode

goroutine 338 [running]:
panic({0xfe2ce0?, 0xc000697160?})
	GOROOT/src/runtime/panic.go:1017 +0x3ac fp=0xc0008c9360 sp=0xc0008c92b0 pc=0x43a72c
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inodeRefs).IncRef(0xc000801c58)
	bazel-out/k8-fastbuild/bin/pkg/sentry/fsimpl/tmpfs/inode_refs.go:81 +0xe8 fp=0xc0008c93c8 sp=0xc0008c9360 pc=0x89d9e8
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inode).incRef(...)
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:591
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*dentry).IncRef(...)
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:447
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).GetDentryAt(0xc00001a1d8?, {0x1442c78, 0xc0008c0000}, 0xc000566000, {0x0?})
	pkg/sentry/fsimpl/tmpfs/filesystem.go:256 +0x18a fp=0xc0008c9438 sp=0xc0008c93c8 pc=0x896d4a
gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).GetDentryAt(0xc000560c00?, {0x1442c78, 0xc0008c0000}, 0x40?, 0x100?, 0xc0008c94df)
	pkg/sentry/vfs/vfs.go:263 +0x8b fp=0xc0008c94a0 sp=0xc0008c9438 pc=0x76b4cb
gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).BindAt(0xc00001a1d8, {0x1442c78, 0xc0008c0000}, 0xc000801400?, 0xc000560c00?, 0x7?, 0x0)
	pkg/sentry/vfs/mount.go:491 +0x78 fp=0xc0008c9638 sp=0xc0008c94a0 pc=0x75b6f8
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Mount(0xc0008c0000, 0xc00056c200?, {{0x20000000}, {0x20000080}, {0x0}, {0x1000}, {0x0}, {0x7f2448c2ebb0}})
	pkg/sentry/syscalls/linux/sys_mount.go:113 +0x718 fp=0xc0008c9918 sp=0xc0008c9638 pc=0xad2d18
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc0008c0000, 0xa5, {{0x20000000}, {0x20000080}, {0x0}, {0x1000}, {0x0}, {0x7f2448c2ebb0}})
	pkg/sentry/kernel/task_syscall.go:142 +0x673 fp=0xc0008c9c58 sp=0xc0008c9918 pc=0x992c13
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc0008c0000, 0xc000814c68?, {{0x20000000}, {0x20000080}, {0x0}, {0x1000}, {0x0}, {0x7f2448c2ebb0}})
	pkg/sentry/kernel/task_syscall.go:322 +0x45 fp=0xc0008c9cb8 sp=0xc0008c9c58 pc=0x993d85
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc0008c9cf8?, 0x126afd0?, {{0x20000000}, {0x20000080}, {0x0}, {0x1000}, {0x0}, {0x7f2448c2ebb0}})
	pkg/sentry/kernel/task_syscall.go:282 +0x59 fp=0xc0008c9d18 sp=0xc0008c9cb8 pc=0x993a99
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc0004fe4e0?)
	pkg/sentry/kernel/task_syscall.go:257 +0x2d5 fp=0xc0008c9e10 sp=0xc0008c9d18 pc=0x993835
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc000580400?, 0xc0008c0000)
	pkg/sentry/kernel/task_run.go:269 +0xfb7 fp=0xc0008c9f48 sp=0xc0008c9e10 pc=0x987b17
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc0008c0000, 0xf)
	pkg/sentry/kernel/task_run.go:98 +0x1ef fp=0xc0008c9fc0 sp=0xc0008c9f48 pc=0x9864af
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
	pkg/sentry/kernel/task_start.go:391 +0x25 fp=0xc0008c9fe0 sp=0xc0008c9fc0 pc=0x991525
runtime.goexit()
	src/runtime/asm_amd64.s:1650 +0x1 fp=0xc0008c9fe8 sp=0xc0008c9fe0 pc=0x471241
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 254
	pkg/sentry/kernel/task_start.go:391 +0xe5

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/11/15 13:52 gvisor 3ab01aedb874 cb976f63 console log report syz C ci-gvisor-ptrace-2 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 12:07 gvisor 3ab01aedb874 cb976f63 console log report syz C ci-gvisor-systrap-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 10:37 gvisor 3ab01aedb874 cb976f63 console log report syz C ci-gvisor-arm64-ptrace-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 16:45 gvisor 201a046299b7 cb976f63 .config console log report info ci-gvisor-ptrace-3-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 15:41 gvisor 201a046299b7 cb976f63 console log report info ci-gvisor-ptrace-3 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 14:54 gvisor 201a046299b7 cb976f63 .config console log report info ci-gvisor-ptrace-3-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 14:39 gvisor 201a046299b7 cb976f63 .config console log report info ci-gvisor-ptrace-3-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 14:31 gvisor 201a046299b7 cb976f63 .config console log report info ci-gvisor-ptrace-3-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 11:11 gvisor 201a046299b7 cb976f63 .config console log report info ci-gvisor-systrap-1-race panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 07:46 gvisor ceb1b69e35ec cb976f63 console log report info ci-gvisor-ptrace-3 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 07:41 gvisor ceb1b69e35ec cb976f63 .config console log report info ci-gvisor-systrap-1-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 21:33 gvisor ceb1b69e35ec cb976f63 .config console log report info ci-gvisor-kvm-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 21:20 gvisor ceb1b69e35ec cb976f63 .config console log report info ci-gvisor-ptrace-3-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 21:04 gvisor ceb1b69e35ec cb976f63 .config console log report info ci-gvisor-kvm-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 18:58 gvisor 3ab01aedb874 cb976f63 console log report info ci-gvisor-ptrace-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 07:34 gvisor 3ab01aedb874 cb976f63 .config console log report info ci-gvisor-systrap-1-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 10:20 gvisor 201a046299b7 cb976f63 console log report info ci-gvisor-arm64-systrap-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/16 00:28 gvisor ceb1b69e35ec cb976f63 .config console log report info ci-gvisor-arm64-ptrace-1-race panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 21:42 gvisor 7bf7830078c6 cb976f63 console log report info ci-gvisor-arm64-systrap-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 17:54 gvisor ceb1b69e35ec cb976f63 console log report info ci-gvisor-arm64-systrap-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 15:17 gvisor ceb1b69e35ec cb976f63 console log report info ci-gvisor-arm64-systrap-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 14:24 gvisor 3ab01aedb874 cb976f63 .config console log report info ci-gvisor-arm64-ptrace-1-race panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 08:17 gvisor ceb1b69e35ec cb976f63 console log report info ci-gvisor-arm64-systrap-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/11/15 07:45 gvisor 3ab01aedb874 cb976f63 .config console log report info ci-gvisor-arm64-ptrace-1-race panic: Incrementing non-positive count ADDR on tmpfs.inode
* Struck through repros no longer work on HEAD.