syzbot


kernel BUG at fs/inode.c:LINE!

Status: upstream: reported C repro on 2020/08/27 14:35
Reported-by: syzbot+2325e7076a87674793be@syzkaller.appspotmail.com
First crash: 830d, last: 821d
similar bugs (7):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 kernel BUG in iput C error 2 260d 260d 2/2 fixed on 2022/03/29 10:01
linux-4.19 kernel BUG in iput C error 42 66d 553d 0/1 upstream: reported C repro on 2021/06/01 01:19
linux-4.19 kernel BUG at fs/inode.c:LINE! syz done 2 825d 855d 1/1 fixed on 2020/10/01 20:29
linux-4.19 kernel BUG at fs/inode.c:LINE! (2) C done 5 588d 727d 1/1 fixed on 2021/05/29 15:40
linux-4.14 kernel BUG at fs/inode.c:LINE! 1 939d 939d 0/1 auto-closed as invalid on 2020/09/07 09:12
upstream kernel BUG at fs/inode.c:LINE! C done 2 1451d 1450d 13/24 fixed on 2019/04/12 21:13
upstream kernel BUG at fs/inode.c:LINE! (2) C done unreliable 103 2d00h 829d 0/24 upstream: reported C repro on 2020/08/28 13:18
Patch testing requests:
Created Duration User Patch Repo Result
2022/08/28 22:27 0m retest repro https://android.googlesource.com/kernel/common android-5.4 error
2022/08/28 19:27 0m retest repro https://android.googlesource.com/kernel/common android-5.4 error
2022/08/28 18:27 0m retest repro https://android.googlesource.com/kernel/common android-5.4 error
2022/08/28 17:27 0m retest repro https://android.googlesource.com/kernel/common android-5.4 error

Sample crash report:
------------[ cut here ]------------
kernel BUG at fs/inode.c:1588!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5442 Comm: syz-executor513 Not tainted 5.4.61-syzkaller-00885-g8453279c7cd4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:iput+0x748/0x750 fs/inode.c:1588
Code: f4 ff e9 a1 fc ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c d4 fe ff ff 4c 89 e7 e8 12 e1 f4 ff e9 c7 fe ff ff e8 98 a8 c6 ff <0f> 0b 66 0f 1f 44 00 00 55 41 57 41 56 53 48 89 f5 48 89 fb 49 bf
RSP: 0018:ffff8881c27f7db0 EFLAGS: 00010293
RAX: ffffffff817b6098 RBX: ffff8881c2899b58 RCX: ffff8881cf470f80
RDX: 0000000000000000 RSI: 0000000000000040 RDI: 0000000000000000
RBP: 0000000000000040 R08: ffffffff817b59b1 R09: ffffed103a4c33e1
R10: ffffed103a4c33e1 R11: 0000000000000000 R12: 1ffff1103851334c
R13: ffff8881c2899ac0 R14: dffffc0000000000 R15: ffff8881c2899a60
FS:  0000000002390940(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200000c0 CR3: 00000001d4401006 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __sock_release net/socket.c:603 [inline]
 sock_close+0x1b7/0x250 net/socket.c:1269
 __fput+0x27d/0x6c0 fs/file_table.c:280
 task_work_run+0x176/0x1a0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop arch/x86/entry/common.c:163 [inline]
 prepare_exit_to_usermode+0x286/0x2e0 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x409941
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 24 1a 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007fffdbeba5e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000409941
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00000000006e7a0c R08: 00000000004b3a0f R09: 00000000004b3a0f
R10: 00000000004b3a0f R11: 0000000000000293 R12: 00000000006e7a10
R13: 0000000000000000 R14: 000000000000002d R15: 20c49ba5e353f7cf
Modules linked in:
---[ end trace 3d5a942c08bc7b0f ]---
RIP: 0010:iput+0x748/0x750 fs/inode.c:1588
Code: f4 ff e9 a1 fc ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c d4 fe ff ff 4c 89 e7 e8 12 e1 f4 ff e9 c7 fe ff ff e8 98 a8 c6 ff <0f> 0b 66 0f 1f 44 00 00 55 41 57 41 56 53 48 89 f5 48 89 fb 49 bf
RSP: 0018:ffff8881c27f7db0 EFLAGS: 00010293
RAX: ffffffff817b6098 RBX: ffff8881c2899b58 RCX: ffff8881cf470f80
RDX: 0000000000000000 RSI: 0000000000000040 RDI: 0000000000000000
RBP: 0000000000000040 R08: ffffffff817b59b1 R09: ffffed103a4c33e1
R10: ffffed103a4c33e1 R11: 0000000000000000 R12: 1ffff1103851334c
R13: ffff8881c2899ac0 R14: dffffc0000000000 R15: ffff8881c2899a60
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (5):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-android-5-4-kasan 2020/09/02 07:35 https://android.googlesource.com/kernel/common android-5.4 8453279c7cd4 abf9ba4f .config log report syz C
ci2-android-5-4-kasan 2020/09/05 15:05 https://android.googlesource.com/kernel/common android-5.4 3f20ba7d5d1d abf9ba4f .config log report syz
ci2-android-5-4-kasan 2020/09/03 16:18 https://android.googlesource.com/kernel/common android-5.4 0ede4657b27f abf9ba4f .config log report syz
ci2-android-5-4-kasan 2020/08/27 14:35 https://android.googlesource.com/kernel/common android-5.4 4915c32a2f6b 816e0689 .config log report syz
ci2-android-5-4-kasan 2020/08/27 15:21 https://android.googlesource.com/kernel/common android-5.4 4915c32a2f6b 816e0689 .config log report
* Struck through repros no longer work on HEAD.