general protection fault in btrfs_scan_one

general protection fault in btrfs_scan_one_device
Status: auto-closed as invalid on 2019/08/02 02:01
Reported-by: syzbot+46048b9c7ec2fe0d4885@syzkaller.appspotmail.com
First crash: 616d, last: 536d

Sample crash report:

RBP: 0000000020000100 R08: 00007f2e78bd9b30 R09: 00007f2e78bd9ad0
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000000000000 R14: 00000000004db9a8 R15: 0000000000000003
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 20382 Comm: syz-executor1 Not tainted 5.0.0-rc4+ #58
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:device_list_add+0x3fc/0x14c0 fs/btrfs/volumes.c:960
Code: 3a e5 ca fe 31 ff 4c 89 ee e8 d0 e6 ca fe 48 8d 7b 20 4d 85 ed 48 b8 00 00 00 00 00 fc ff df 48 89 fa 41 0f 95 c5 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 1c 0f 00 00 44 88 6b 20 48 89 de 48
RSP: 0018:ffff888059a37560 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffffff82a4f6e0
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000014
RBP: ffff888059a37640 R08: ffff88809ebb4480 R09: ffffed1015d05bd0
R10: ffffed1015d05bcf R11: ffff8880ae82de7b R12: ffff888090ed6000
R13: 0000001000000001 R14: ffff888091dea0d0 R15: ffff888090ed623b
FS:  00007f2e78bda700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc8c389f68 CR3: 0000000090808000 CR4: 00000000001406f0
Call Trace:
 btrfs_scan_one_device+0x36f/0x1000 fs/btrfs/volumes.c:1489
 btrfs_mount_root+0x718/0x1220 fs/btrfs/super.c:1514
 mount_fs+0x106/0x3ff fs/super.c:1258
 vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:959
 vfs_kern_mount+0x40/0x60 fs/namespace.c:949
 btrfs_mount+0x2b5/0x15b6 fs/btrfs/super.c:1614
 mount_fs+0x106/0x3ff fs/super.c:1258
 vfs_kern_mount.part.0+0x6f/0x410 fs/namespace.c:959
 vfs_kern_mount fs/namespace.c:949 [inline]
 do_new_mount fs/namespace.c:2513 [inline]
 do_mount+0x581/0x2d30 fs/namespace.c:2847
 ksys_mount+0xdb/0x150 fs/namespace.c:3063
 __do_sys_mount fs/namespace.c:3077 [inline]
 __se_sys_mount fs/namespace.c:3074 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3074
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a8aa
Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 2d 8e fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 0a 8e fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007f2e78bd9a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f2e78bd9b30 RCX: 000000000045a8aa
RDX: 00007f2e78bd9ad0 RSI: 0000000020000100 RDI: 00007f2e78bd9af0
RBP: 0000000020000100 R08: 00007f2e78bd9b30 R09: 00007f2e78bd9ad0
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000000000000 R14: 00000000004db9a8 R15: 0000000000000003
Modules linked in:
kobject: 'loop0' (000000005c77a710): kobject_uevent_env
---[ end trace 3f2ff4a5df63d056 ]---
kobject: 'loop0' (000000005c77a710): fill_kobj_path: path = '/devices/virtual/block/loop0'
RIP: 0010:device_list_add+0x3fc/0x14c0 fs/btrfs/volumes.c:960
kobject: 'loop1' (000000001dca1e81): kobject_uevent_env
kobject: 'loop1' (000000001dca1e81): fill_kobj_path: path = '/devices/virtual/block/loop1'
Code: 3a e5 ca fe 31 ff 4c 89 ee e8 d0 e6 ca fe 48 8d 7b 20 4d 85 ed 48 b8 00 00 00 00 00 fc ff df 48 89 fa 41 0f 95 c5 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 1c 0f 00 00 44 88 6b 20 48 89 de 48
kobject: 'loop5' (00000000f67dcc62): kobject_uevent_env
RSP: 0018:ffff888059a37560 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffffff82a4f6e0
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000014
RBP: ffff888059a37640 R08: ffff88809ebb4480 R09: ffffed1015d05bd0
kobject: 'loop5' (00000000f67dcc62): fill_kobj_path: path = '/devices/virtual/block/loop5'
R10: ffffed1015d05bcf R11: ffff8880ae82de7b R12: ffff888090ed6000
R13: 0000001000000001 R14: ffff888091dea0d0 R15: ffff888090ed623b
FS:  00007f2e78bda700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kobject: 'loop5' (00000000f67dcc62): kobject_uevent_env
CR2: 000000c41f2c9f00 CR3: 0000000090808000 CR4: 00000000001406f0
kobject: 'loop5' (00000000f67dcc62): fill_kobj_path: path = '/devices/virtual/block/loop5'

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-upstream-kasan-gce-root	2019/02/03 02:00	upstream	12491ed3	c198d5dd	.config	log	report			clm@fb.com, dsterba@suse.com, josef@toxicpanda.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org
ci-upstream-linux-next-kasan-gce-root	2018/11/15 00:59	linux-next	442b8cea	5f5f6d14	.config	log	report			clm@fb.com, dsterba@suse.com, josef@toxicpanda.com, linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org