syzbot


divide error in squashfs_readpage

Status: closed as dup on 2021/05/11 08:53
Subsystems: squashfs
[Documentation on labels]
Reported-by: syzbot+e8f781243ce16ac2f962@syzkaller.appspotmail.com
Fix commit: d6e621de1fce squashfs: fix divide error in calculate_skip()
First crash: 1082d, last: 1082d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: divide error in squashfs_readpage (log)
Repro: C syz .config
  
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
divide error in fill_meta_index squashfs C inconclusive 1 1081d 1080d
Discussions (12)
Title Replies (including bot) Last reply
[PATCH 4.19 000/425] 4.19.191-rc1 review 438 (438) 2021/06/24 10:04
[PATCH 5.10 000/289] 5.10.38-rc1 review 304 (304) 2021/05/27 04:25
[PATCH 4.9 000/240] 4.9.269-rc1 review 245 (245) 2021/05/21 16:52
[PATCH 4.14 000/323] 4.14.233-rc1 review 326 (326) 2021/05/21 05:55
[PATCH 4.4 000/190] 4.4.269-rc1 review 196 (196) 2021/05/20 21:46
[PATCH 5.4 000/141] 5.4.120-rc1 review 152 (152) 2021/05/20 08:31
[PATCH 5.11 000/329] 5.11.22-rc1 review 336 (336) 2021/05/18 21:20
[PATCH 5.12 000/363] 5.12.5-rc1 review 377 (377) 2021/05/18 14:35
[patch 05/13] squashfs: fix divide error in calculate_skip() 1 (1) 2021/05/15 00:27
[PATCH] squashfs: fix divide error in calculate_skip() 1 (1) 2021/05/07 15:26
[PATCH] squashfs: fix divide error 1 (1) 2021/05/04 08:05
[syzbot] divide error in squashfs_readpage 0 (1) 2021/05/03 17:20
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 divide error in squashfs_readpage C error 1 1092d 1221d 0/1 upstream: reported C repro on 2020/12/15 07:21
linux-4.14 divide error in squashfs_readpage C 1 425d 1241d 0/1 upstream: reported C repro on 2020/11/25 03:06
Last patch testing requests (1)
Created Duration User Patch Repo Result
2021/05/03 20:18 16m paskripkin@gmail.com https://linux.googlesource.com/linux/kernel/git/torvalds/linux refs/changes/76/10676/1 OK

Sample crash report:
loop0: detected capacity change from 0 to 8
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8394 Comm: syz-executor613 Not tainted 5.12.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:fill_meta_index fs/squashfs/file.c:243 [inline]
RIP: 0010:read_blocklist fs/squashfs/file.c:332 [inline]
RIP: 0010:squashfs_readpage+0xa0d/0x2210 fs/squashfs/file.c:469
Code: 3c 24 31 d2 48 63 8c 24 b4 00 00 00 49 8b 47 c8 48 89 cf 48 c1 e1 0b c1 e7 0b 89 7c 24 4c 31 ff 48 89 44 24 60 48 63 44 24 70 <48> f7 f1 49 89 c6 89 c6 48 89 44 24 58 89 44 24 1c 89 44 24 48 e8
RSP: 0018:ffffc9000188f3e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000099 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8221fc4d RDI: 0000000000000000
RBP: 000000000000000c R08: ffffffffffffffff R09: 000000000000000c
R10: ffffffff8221fc3e R11: 000000000000003f R12: 00000000000000de
R13: ffff888033290088 R14: 0000000000000000 R15: ffff888033290038
FS:  00000000024ae300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffe4921df8 CR3: 0000000014fc9000 CR4: 0000000000350ee0
Call Trace:
 read_pages+0x5c5/0x8d0 mm/readahead.c:145
 page_cache_ra_unbounded+0x61f/0x920 mm/readahead.c:238
 do_page_cache_ra mm/readahead.c:267 [inline]
 ondemand_readahead+0x65c/0x1190 mm/readahead.c:550
 page_cache_sync_ra+0x1cb/0x200 mm/readahead.c:578
 page_cache_sync_readahead include/linux/pagemap.h:864 [inline]
 filemap_get_pages+0x29f/0x1920 mm/filemap.c:2442
 filemap_read+0x2ca/0xe40 mm/filemap.c:2525
 generic_file_read_iter+0x397/0x4f0 mm/filemap.c:2676
 __kernel_read+0x58d/0xa90 fs/read_write.c:454
 kernel_read+0x52/0x70 fs/read_write.c:472
 prepare_binprm fs/exec.c:1650 [inline]
 search_binary_handler fs/exec.c:1704 [inline]
 exec_binprm fs/exec.c:1761 [inline]
 bprm_execve fs/exec.c:1830 [inline]
 bprm_execve+0x740/0x19a0 fs/exec.c:1792
 do_execveat_common+0x626/0x7c0 fs/exec.c:1919
 do_execveat fs/exec.c:1998 [inline]
 __do_sys_execveat fs/exec.c:2074 [inline]
 __se_sys_execveat fs/exec.c:2066 [inline]
 __x64_sys_execveat+0xed/0x130 fs/exec.c:2066
 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x443c09
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdd2359618 EFLAGS: 00000246 ORIG_RAX: 0000000000000142
RAX: ffffffffffffffda RBX: 00000000004004a0 RCX: 0000000000443c09
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000005
RBP: 00000000004034a0 R08: 0000000000000000 R09: 00000000004004a0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000403530
R13: 0000000000000000 R14: 00000000004b1018 R15: 00000000004004a0
Modules linked in:
---[ end trace eb837301c73b908d ]---
RIP: 0010:fill_meta_index fs/squashfs/file.c:243 [inline]
RIP: 0010:read_blocklist fs/squashfs/file.c:332 [inline]
RIP: 0010:squashfs_readpage+0xa0d/0x2210 fs/squashfs/file.c:469
Code: 3c 24 31 d2 48 63 8c 24 b4 00 00 00 49 8b 47 c8 48 89 cf 48 c1 e1 0b c1 e7 0b 89 7c 24 4c 31 ff 48 89 44 24 60 48 63 44 24 70 <48> f7 f1 49 89 c6 89 c6 48 89 44 24 58 89 44 24 1c 89 44 24 48 e8
RSP: 0018:ffffc9000188f3e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000099 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8221fc4d RDI: 0000000000000000
RBP: 000000000000000c R08: ffffffffffffffff R09: 000000000000000c
R10: ffffffff8221fc3e R11: 000000000000003f R12: 00000000000000de
R13: ffff888033290088 R14: 0000000000000000 R15: ffff888033290038
FS:  00000000024ae300(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2f175e5030 CR3: 0000000014fc9000 CR4: 0000000000350ef0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/05/03 12:55 upstream d2b6f8a17919 77e2b668 .config console log report syz C ci-upstream-kasan-gce-root divide error in squashfs_readpage
* Struck through repros no longer work on HEAD.