syzbot


panic: Incrementing non-positive count ADDR on tmpfs.inode (3)

Status: fixed on 2023/05/26 03:35
Fix commit: 283b80a456aa Fix logic bug in attaching mounts.
First crash: 588d, last: 566d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: Incrementing non-positive count ADDR on tmpfs.inode syz 2 1472d 1472d 0/26 fixed on 2020/11/18 07:03
gvisor panic: Incrementing non-positive count ADDR on tmpfs.inode (4) C 24 375d 377d 26/26 fixed on 2023/11/17 08:30
gvisor panic: Incrementing non-positive count ADDR on tmpfs.inode (2) C 56 726d 727d 14/26 fixed on 2022/12/01 12:27

Sample crash report:
panic: Incrementing non-positive count 0xc0044fd058 on tmpfs.inode

goroutine 64 [running]:
panic({0x11c9bc0, 0xc001f56d30})
	GOROOT/src/runtime/panic.go:987 +0x3bb fp=0xc004fd3468 sp=0xc004fd33a8 pc=0x436afb
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inodeRefs).IncRef(0xc0044fd058)
	bazel-out/k8-fastbuild/bin/pkg/sentry/fsimpl/tmpfs/inode_refs.go:80 +0x134 fp=0xc004fd34d0 sp=0xc004fd3468 pc=0x8a95d4
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inode).incRef(...)
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:544
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*dentry).IncRef(...)
	pkg/sentry/fsimpl/tmpfs/tmpfs.go:401
gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).GetDentryAt(0xc0004781e0?, {0x164f798, 0xc00053d500}, 0xc00630e000, {0x13?})
	pkg/sentry/fsimpl/tmpfs/filesystem.go:255 +0x225 fp=0xc004fd3540 sp=0xc004fd34d0 pc=0x8a1345
gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).GetDentryAt(0x40db08?, {0x164f798, 0xc00053d500}, 0x84edf7?, 0xc004fd3600?, 0xc004fd35f5)
	pkg/sentry/vfs/vfs.go:248 +0xa6 fp=0xc004fd35a8 sp=0xc004fd3540 pc=0x78dde6
gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).UmountAt(0xc0004781e0, {0x164f798, 0xc00053d500}, 0xc000837400?, 0xc008ccad00?, 0xc004fd380c)
	pkg/sentry/vfs/mount.go:459 +0x108 fp=0xc004fd3780 sp=0xc004fd35a8 pc=0x77f948
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Umount2(0xc00053d500, 0x3d?, {{0x7f76daf8d640}, {0xa}, {0xc}, {0x0}, {0x25fbd910}, {0x438}})
	pkg/sentry/syscalls/linux/sys_mount.go:171 +0x2fa fp=0xc004fd3918 sp=0xc004fd3780 pc=0xb3a1da
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc00053d500, 0xa6, {{0x7f76daf8d640}, {0xa}, {0xc}, {0x0}, {0x25fbd910}, {0x438}})
	pkg/sentry/kernel/task_syscall.go:142 +0x80b fp=0xc004fd3c58 sp=0xc004fd3918 pc=0x9cd42b
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc00053d500, 0x0?, {{0x7f76daf8d640}, {0xa}, {0xc}, {0x0}, {0x25fbd910}, {0x438}})
	pkg/sentry/kernel/task_syscall.go:322 +0x54 fp=0xc004fd3cb8 sp=0xc004fd3c58 pc=0x9cea14
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc00015a5e0?, 0xc004fd3e00?, {{0x7f76daf8d640}, {0xa}, {0xc}, {0x0}, {0x25fbd910}, {0x438}})
	pkg/sentry/kernel/task_syscall.go:282 +0x85 fp=0xc004fd3d18 sp=0xc004fd3cb8 pc=0x9ce605
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc00083e630?)
	pkg/sentry/kernel/task_syscall.go:257 +0x3ac fp=0xc004fd3e10 sp=0xc004fd3d18 pc=0x9ce2cc
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc00053d500?, 0xc00053d500)
	pkg/sentry/kernel/task_run.go:269 +0x144a fp=0xc004fd3f48 sp=0xc004fd3e10 pc=0x9bfe4a
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc00053d500, 0x1c)
	pkg/sentry/kernel/task_run.go:98 +0x25c fp=0xc004fd3fc0 sp=0xc004fd3f48 pc=0x9be2fc
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
	pkg/sentry/kernel/task_start.go:377 +0x2a fp=0xc004fd3fe0 sp=0xc004fd3fc0 pc=0x9cb8aa
runtime.goexit()
	src/runtime/asm_amd64.s:1598 +0x1 fp=0xc004fd3fe8 sp=0xc004fd3fe0 pc=0x46d561
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:377 +0x105

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/05/10 12:56 gvisor a1006d486d30 14b12a99 .config console log report info ci-gvisor-kvm-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/05/06 20:38 gvisor 554de195b8c6 90c93c40 console log report info ci-gvisor-systrap-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/05/05 13:34 gvisor ff424dce7f0f abac29b5 .config console log report info ci-gvisor-systrap-1-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/05/05 13:14 gvisor ff424dce7f0f abac29b5 console log report info ci-gvisor-ptrace-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/04/18 07:55 gvisor e69c018749ed 436577a9 .config console log report info ci-gvisor-ptrace-1-cover panic: Incrementing non-positive count ADDR on tmpfs.inode
2023/05/06 22:49 gvisor 554de195b8c6 90c93c40 console log report info ci-gvisor-arm64-systrap-1 panic: Incrementing non-positive count ADDR on tmpfs.inode
* Struck through repros no longer work on HEAD.