syzbot

 sign-in | mailing list | source | docs
🐞 Open [977] ≡ Subsystems 🐞 Fixed [5207] 🐞 Invalid [12453] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

kernel BUG at fs/inode.c:LINE!

Status: fixed on 2019/04/12 21:13
Subsystems: autofs
[Documentation on labels]
Reported-by: syzbot+5399ed0832693e29f392@syzkaller.appspotmail.com
Fix commit: 9bf964c9cee4 autofs: simplify parse_options() function call
First crash: 1948d, last: 1947d
Cause bisection: the cause commit could be any of (bisect log):
  cd4f2a664851 lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk
  df3f18d39e85 fls: change parameter to unsigned int
  9067c8d5a70b lib/find_bit_benchmark.c: align test_find_next_and_bit with others
  c28248294d6d include/linux/printk.h: drop silly "static inline asmlinkage" from dump_stack()
  26e88a473db9 checkpatch: warn on const char foo[] = "bar"; declarations
  e98eceb86c8d drivers/dma-buf/udmabuf.c: convert to use vm_fault_t
  5b6bf71dd716 build_bug.h: remove most of dummy BUILD_BUG_ON stubs for Sparse
  f34c9474a605 fs/epoll: remove max_nests argument from ep_call_nested()
  56f6c16e9c74 build_bug.h: remove negative-array fallback for BUILD_BUG_ON()
  cd2f11e61b44 fs/epoll: simplify ep_send_events_proc() ready-list loop
  74a37b909676 Documentation/process/coding-style.rst: don't use "extern" with function prototypes
  ab1909a85fd1 fs/epoll: drop ovflist branch prediction
  499aeb579641 proc/sysctl: fix return error for proc_doulongvec_minmax()
  b7fa8017e2d8 fs/epoll: robustify ep->mtx held checks
  d877fd0940d6 fs/proc/base.c: slightly faster /proc/*/limits
  f2c378628c9a fs/epoll: reduce the scope of wq lock in epoll_wait()
  860705c8f868 fs-epoll-reduce-the-scope-of-wq-lock-in-epoll_wait-fix
  c62975fb8b24 fs/proc/inode.c: delete unnecessary variable in proc_alloc_inode()
  9460069d503e fs/proc/util.c: include fs/proc/internal.h for name_to_int()
  ea5f967a21f8 fs/epoll: avoid barrier after an epoll_wait(2) timeout
  b61909d2c451 fs-epoll-avoid-barrier-after-an-epoll_wait2-timeout-fix
  c768eca025a8 fs/proc/base.c: use ns_capable instead of capable for timerslack_ns
  81553cde8e95 fs/epoll: rename check_events label to send_events
  b6af7800c71d fs/buffer.c: add debug print for __getblk_gfp() stall problem
  11193e1694b0 mm/page_owner: align with pageblock_nr pages
  349afd96fede fs/epoll: deal with wait_queue only once
  393af37c974b fs-epoll-deal-with-wait_queue-only-once-fix
  c20187bf3233 mm/page_owner: align with pageblock_nr_pages
  20fbef314e7a mm: don't expose page to fast gup before it's ready
  ad4f37b82fbe init/main.c: make "initcall_level_names[]" const char *
  0bcbe611ca3c autofs: improve ioctl sbi checks
  69ab6b147504 mm: fix race between swapoff and mincore
  b783d2617cc2 autofs-improve-ioctl-sbi-checks-fix
  de44564f9f0a mm, swap: fix race between swapoff and some swap operations
  010a80ffc404 mm, swap: fix race between swapoff and some swap operations
  9c82e3b85818 autofs: fix possible inode leak in autofs_fill_super()
  855b7de10b91 mm/page_alloc.c: remove software prefetching in __free_pages_core()
  cd4d5fa95d41 autofs: simplify parse_options() function call
  e8fed6664aa4 memory_hotplug-free-pages-as-higher-order-fix-fix
  f7aa1250f5ba autofs: change catatonic setting to a bit flag
  578f64582207 autofs: add strictexpire mount option
  71e7f022722f memory_hotplug-free-pages-as-higher-order-fix
  8286148bbc1c mm/page_alloc.c: memory hotplug: free pages as higher order
  e5d8e8947b85 hfsplus: return file attributes on statx
  728804fa0331 include/uapi/linux/msdos_fs.h: use MSDOS_NAME for volume label size
  e93a0c0df5f0 include/linux/memory_hotplug.h: remove duplicate declaration of offline_pages()
  3d991a59b7ee ptrace: take into account saved_sigmask in PTRACE_{GET,SET}SIGMASK
  a7b166088b8a mm/mmu_notifier: contextual information for event triggering invalidation v2
  302092c98415 mm-mmu_notifier-use-structure-for-invalidate_range_start-end-calls-v2-checkpatch-fixes
  cdd7a0aa15aa fork: fix some -Wmissing-prototypes warnings
  137d92bd73b1 mm/mmu_notifier: use structure for invalidate_range_start/end calls v2
  b89cf7313cf4 exec: load_script: don't blindly truncate shebang string
  429056415279 mm-mmu_notifier-use-structure-for-invalidate_range_start-end-callback-fix-fix
  ad2539c7ee8f exec: increase BINPRM_BUF_SIZE to 256
  0db734c6271d mm/mmu_notifier: use structure for invalidate_range_start/end callback
  c09b6daf5330 exec: separate MM_ANONPAGES and RLIMIT_STACK accounting
  37ba86cc38a3 hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
  dc98b12477d0 exec-separate-mm_anonpages-and-rlimit_stack-accounting-fix
  282860544780 exec-separate-mm_anonpages-and-rlimit_stack-accounting-checkpatch-fixes
  b08acb2001e2 mm-kmemleak-little-optimization-while-scanning-fix
  27faeb703e40 bfs: extra sanity checking and static inode bitmap
  79d0fd910ad9 mm, kmemleak: little optimization while scanning
  232619fcc076 lib/ioremap: ensure break-before-make is used for huge p4d mappings
  7a489f5ddefe panic: add options to print system info when panic happens
  784bedb57bef kernel/sysctl: add panic_print into sysctl
  e5dfd59eb5a0 lib/ioremap: ensure phys_addr actually corresponds to a physical address
  5f8d4992524c kernel/kcov.c: mark write_comp_data() as notrace
  7bdcb055b9de x86/pgtable: drop pXd_none() checks from pXd_free_pYd_table()
  0aa19fc12472 arm64: mmu: drop pXd_present() checks from pXd_free_pYd_table()
  7ab8b68af104 scripts/gdb: fix lx-version string output
  b2581b704c88 initramfs: cleanup incomplete rootfs
  ee095458b3ef ioremap: rework pXd_free_pYd_page() API
  ce10bcf4b4e6 mm/page_alloc.c: calculate first_deferred_pfn directly
  efae80911ae5 ipc: allow boot time extension of IPCMNI from 32k to 8M
  ab7db927b364 ipc-allow-boot-time-extension-of-ipcmni-from-32k-to-8m-checkpatch-fixes
  f163b82faef5 mm/filemap.c: remove useless check in pagecache_get_page()
  399e0a806ad8 mm/page_io.c: fix polled swap page in
  d04978ca88ab ipc: conserve sequence numbers in extended IPCMNI mode
  07365469c2a1 Merge branch 'akpm-current/current'
   
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
kernel BUG at fs/inode.c:LINE! 31 (33) 2019/04/12 19:46
▶ ▼ Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 kernel BUG in iput C error 2 757d 757d 2/2 fixed on 2022/03/29 10:01
linux-4.19 kernel BUG in iput C error 42 563d 1050d 0/1 upstream: reported C repro on 2021/06/01 01:19
linux-4.19 kernel BUG at fs/inode.c:LINE! syz done 2 1322d 1352d 1/1 fixed on 2020/10/01 20:29
linux-4.19 kernel BUG at fs/inode.c:LINE! (2) C done 5 1085d 1224d 1/1 fixed on 2021/05/29 15:40
linux-4.14 kernel BUG at fs/inode.c:LINE! 1 1436d 1436d 0/1 auto-closed as invalid on 2020/09/07 09:12
android-54 kernel BUG at fs/inode.c:LINE! C 5 1318d 1327d 0/2 auto-obsoleted due to no activity on 2023/04/15 08:56
upstream kernel BUG at fs/inode.c:LINE! (2) btrfs ntfs3 C done unreliable 319 3d06h 1326d 0/26 upstream: reported C repro on 2020/08/28 13:18

Sample crash report:
 slab_pre_alloc_hook mm/slab.h:423 [inline]
 slab_alloc mm/slab.c:3365 [inline]
 kmem_cache_alloc+0x2c4/0x730 mm/slab.c:3539
 __d_alloc+0xc8/0xb90 fs/dcache.c:1599
------------[ cut here ]------------
kernel BUG at fs/inode.c:1566!
 d_alloc_anon fs/dcache.c:1698 [inline]
 d_make_root+0x43/0xc0 fs/dcache.c:1885
 autofs_fill_super+0x6f1/0x1c30 fs/autofs/inode.c:273
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 6100 Comm: syz-executor637 Not tainted 4.20.0-rc6-next-20181214+ #171
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:iput+0x915/0xa90 fs/inode.c:1566
Code: e4 0f 84 a8 fe ff ff e8 e9 fe a6 ff 48 89 df e8 61 f4 ff ff 48 8b bd f0 fe ff ff e8 35 41 08 06 e9 69 fd ff ff e8 cb fe a6 ff <0f> 0b e8 c4 fe a6 ff 0f 0b e9 d5 fb ff ff e8 b8 fe a6 ff 0f 0b e9
RSP: 0018:ffff8881c0ff76b8 EFLAGS: 00010293
RAX: ffff8881c0fdc100 RBX: ffff8881b25f44a0 RCX: ffffffff81d8fc14
RDX: 0000000000000000 RSI: ffffffff81d90455 RDI: 0000000000000007
RBP: ffff8881c0ff77f0 R08: ffff8881c0fdc100 R09: 0000000000000006
R10: 0000000000000000 R11: ffff8881c0fdc100 R12: 0000000000000040
R13: ffff8881c0ff7910 R14: 00000000ffffffea R15: ffff8881d0c4d200
 mount_nodev+0x73/0x120 fs/super.c:1402
FS:  0000000001e1a880(0000) GS:ffff8881dad00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 autofs_mount+0x34/0x40 fs/autofs/init.c:16
CR2: 00000000006cd0a0 CR3: 00000001b2c56000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 legacy_get_tree+0x12f/0x260 fs/fs_context.c:714
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 vfs_get_tree+0x1cb/0x5c0 fs/super.c:1795
 do_new_mount fs/namespace.c:2716 [inline]
 do_mount+0x82a/0x1ff0 fs/namespace.c:3042
 autofs_fill_super+0x15fb/0x1c30 fs/autofs/inode.c:352
 ksys_mount+0x12d/0x140 fs/namespace.c:3258
 __do_sys_mount fs/namespace.c:3272 [inline]
 __se_sys_mount fs/namespace.c:3269 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3269
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 mount_nodev+0x73/0x120 fs/super.c:1402
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
 autofs_mount+0x34/0x40 fs/autofs/init.c:16
RIP: 0033:0x441be9
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
 legacy_get_tree+0x12f/0x260 fs/fs_context.c:714
RSP: 002b:00007ffff6330f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441be9
 vfs_get_tree+0x1cb/0x5c0 fs/super.c:1795
RDX: 0000000020000180 RSI: 0000000020000100 RDI: 0000000000000000
RBP: 00007ffff6330fe0 R08: 0000000000000000 R09: 0000000000000100
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
 do_new_mount fs/namespace.c:2716 [inline]
 do_mount+0x82a/0x1ff0 fs/namespace.c:3042
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 6107 Comm: syz-executor637 Not tainted 4.20.0-rc6-next-20181214+ #171
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 ksys_mount+0x12d/0x140 fs/namespace.c:3258
 __do_sys_mount fs/namespace.c:3272 [inline]
 __se_sys_mount fs/namespace.c:3269 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3269
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold.4+0xa/0x17 lib/fault-inject.c:149
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
 __should_failslab+0x124/0x180 mm/failslab.c:32
RIP: 0033:0x441be9
 should_failslab+0x9/0x14 mm/slab_common.c:1576
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
 slab_pre_alloc_hook mm/slab.h:423 [inline]
 slab_alloc mm/slab.c:3365 [inline]
 kmem_cache_alloc+0x2c4/0x730 mm/slab.c:3539
RSP: 002b:00007ffff6330f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441be9
RDX: 0000000020000180 RSI: 0000000020000100 RDI: 0000000000000000
 __d_alloc+0xc8/0xb90 fs/dcache.c:1599
RBP: 00007ffff6330fe0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
 d_alloc_anon fs/dcache.c:1698 [inline]
 d_make_root+0x43/0xc0 fs/dcache.c:1885
 autofs_fill_super+0x6f1/0x1c30 fs/autofs/inode.c:273
 mount_nodev+0x73/0x120 fs/super.c:1402
 autofs_mount+0x34/0x40 fs/autofs/init.c:16
 legacy_get_tree+0x12f/0x260 fs/fs_context.c:714
 vfs_get_tree+0x1cb/0x5c0 fs/super.c:1795
------------[ cut here ]------------
 do_new_mount fs/namespace.c:2716 [inline]
 do_mount+0x82a/0x1ff0 fs/namespace.c:3042
kernel BUG at fs/inode.c:1566!
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
CPU: 1 PID: 6105 Comm: syz-executor637 Tainted: G      D           4.20.0-rc6-next-20181214+ #171
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:iput+0x915/0xa90 fs/inode.c:1566
Code: e4 0f 84 a8 fe ff ff e8 e9 fe a6 ff 48 89 df e8 61 f4 ff ff 48 8b bd f0 fe ff ff e8 35 41 08 06 e9 69 fd ff ff e8 cb fe a6 ff <0f> 0b e8 c4 fe a6 ff 0f 0b e9 d5 fb ff ff e8 b8 fe a6 ff 0f 0b e9
 ksys_mount+0x12d/0x140 fs/namespace.c:3258
RSP: 0018:ffff8881b4f276b8 EFLAGS: 00010293
 __do_sys_mount fs/namespace.c:3272 [inline]
 __se_sys_mount fs/namespace.c:3269 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3269
RAX: ffff8881c170a580 RBX: ffff8881b2687880 RCX: ffffffff81d8fc14
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
RDX: 0000000000000000 RSI: ffffffff81d90455 RDI: 0000000000000007
RBP: ffff8881b4f277f0 R08: ffff8881c170a580 R09: ffffed103b5a5b77
R10: ffffed103b5a5b77 R11: ffff8881dad2dbbb R12: 0000000000000040
R13: ffff8881b4f27910 R14: 00000000ffffffea R15: ffff8881d0c4af00
FS:  0000000001e1a880(0000) GS:ffff8881dad00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000002497000 CR3: 00000001b3373000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
RIP: 0033:0x441be9
Call Trace:
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffff6330f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441be9
RDX: 0000000020000180 RSI: 0000000020000100 RDI: 0000000000000000
RBP: 00007ffff6330fe0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
------------[ cut here ]------------
kernel BUG at fs/inode.c:1566!
 autofs_fill_super+0x15fb/0x1c30 fs/autofs/inode.c:352
CPU: 0 PID: 6109 Comm: syz-executor637 Tainted: G      D           4.20.0-rc6-next-20181214+ #171
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold.4+0xa/0x17 lib/fault-inject.c:149
 mount_nodev+0x73/0x120 fs/super.c:1402
 autofs_mount+0x34/0x40 fs/autofs/init.c:16
 legacy_get_tree+0x12f/0x260 fs/fs_context.c:714
 vfs_get_tree+0x1cb/0x5c0 fs/super.c:1795
 __should_failslab+0x124/0x180 mm/failslab.c:32
 do_new_mount fs/namespace.c:2716 [inline]
 do_mount+0x82a/0x1ff0 fs/namespace.c:3042
 should_failslab+0x9/0x14 mm/slab_common.c:1576
 slab_pre_alloc_hook mm/slab.h:423 [inline]
 slab_alloc mm/slab.c:3365 [inline]
 kmem_cache_alloc+0x2c4/0x730 mm/slab.c:3539
 __d_alloc+0xc8/0xb90 fs/dcache.c:1599
 ksys_mount+0x12d/0x140 fs/namespace.c:3258
 __do_sys_mount fs/namespace.c:3272 [inline]
 __se_sys_mount fs/namespace.c:3269 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3269
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 d_alloc_anon fs/dcache.c:1698 [inline]
 d_make_root+0x43/0xc0 fs/dcache.c:1885
 autofs_fill_super+0x6f1/0x1c30 fs/autofs/inode.c:273
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441be9
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffff6330f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441be9
RDX: 0000000020000180 RSI: 0000000020000100 RDI: 0000000000000000
RBP: 00007ffff6330fe0 R08: 0000000000000000 R09: 0000000000000100
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
 mount_nodev+0x73/0x120 fs/super.c:1402
 autofs_mount+0x34/0x40 fs/autofs/init.c:16
 legacy_get_tree+0x12f/0x260 fs/fs_context.c:714
 vfs_get_tree+0x1cb/0x5c0 fs/super.c:1795
 do_new_mount fs/namespace.c:2716 [inline]
 do_mount+0x82a/0x1ff0 fs/namespace.c:3042
 ksys_mount+0x12d/0x140 fs/namespace.c:3258
 __do_sys_mount fs/namespace.c:3272 [inline]
 __se_sys_mount fs/namespace.c:3269 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3269
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441be9
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffff6330f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441be9
RDX: 0000000020000180 RSI: 0000000020000100 RDI: 0000000000000000
RBP: 00007ffff6330fe0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
CPU: 1 PID: 6101 Comm: syz-executor637 Tainted: G      D           4.20.0-rc6-next-20181214+ #171
invalid opcode: 0000 [#3] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
CPU: 0 PID: 6102 Comm: syz-executor637 Tainted: G      D           4.20.0-rc6-next-20181214+ #171
Call Trace:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
RIP: 0010:iput+0x915/0xa90 fs/inode.c:1566
Code: e4 0f 84 a8 fe ff ff e8 e9 fe a6 ff 48 89 df e8 61 f4 ff ff 48 8b bd f0 fe ff ff e8 35 41 08 06 e9 69 fd ff ff e8 cb fe a6 ff <0f> 0b e8 c4 fe a6 ff 0f 0b e9 d5 fb ff ff e8 b8 fe a6 ff 0f 0b e9
RSP: 0000:ffff8881cca776b8 EFLAGS: 00010293
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold.4+0xa/0x17 lib/fault-inject.c:149
RAX: ffff8881d105c540 RBX: ffff8881b26768c0 RCX: ffffffff81d8fc14
RDX: 0000000000000000 RSI: ffffffff81d90455 RDI: 0000000000000007
RBP: ffff8881cca777f0 R08: ffff8881d105c540 R09: ffffed103b585b77
R10: ffffed103b585b77 R11: ffff8881dac2dbbb R12: 0000000000000040
R13: ffff8881cca77910 R14: 00000000ffffffea R15: ffff8881d0c4d000
FS:  0000000001e1a880(0000) GS:ffff8881dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 00000001d824d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 __should_failslab+0x124/0x180 mm/failslab.c:32
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 should_failslab+0x9/0x14 mm/slab_common.c:1576
Call Trace:
 slab_pre_alloc_hook mm/slab.h:423 [inline]
 slab_alloc mm/slab.c:3365 [inline]
 kmem_cache_alloc+0x2c4/0x730 mm/slab.c:3539
 __d_alloc+0xc8/0xb90 fs/dcache.c:1599
 autofs_fill_super+0x15fb/0x1c30 fs/autofs/inode.c:352
 d_alloc_anon fs/dcache.c:1698 [inline]
 d_make_root+0x43/0xc0 fs/dcache.c:1885
 autofs_fill_super+0x6f1/0x1c30 fs/autofs/inode.c:273
 mount_nodev+0x73/0x120 fs/super.c:1402
 autofs_mount+0x34/0x40 fs/autofs/init.c:16
 legacy_get_tree+0x12f/0x260 fs/fs_context.c:714
 vfs_get_tree+0x1cb/0x5c0 fs/super.c:1795
 do_new_mount fs/namespace.c:2716 [inline]
 do_mount+0x82a/0x1ff0 fs/namespace.c:3042
 mount_nodev+0x73/0x120 fs/super.c:1402
 autofs_mount+0x34/0x40 fs/autofs/init.c:16
 legacy_get_tree+0x12f/0x260 fs/fs_context.c:714
 vfs_get_tree+0x1cb/0x5c0 fs/super.c:1795
 ksys_mount+0x12d/0x140 fs/namespace.c:3258
 do_new_mount fs/namespace.c:2716 [inline]
 do_mount+0x82a/0x1ff0 fs/namespace.c:3042
 __do_sys_mount fs/namespace.c:3272 [inline]
 __se_sys_mount fs/namespace.c:3269 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3269
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 ksys_mount+0x12d/0x140 fs/namespace.c:3258
 __do_sys_mount fs/namespace.c:3272 [inline]
 __se_sys_mount fs/namespace.c:3269 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3269
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
RIP: 0033:0x441be9
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffff6330f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441be9
RDX: 0000000020000180 RSI: 0000000020000100 RDI: 0000000000000000
RBP: 00007ffff6330fe0 R08: 0000000000000000 R09: 0000000000000100
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Modules linked in:
RIP: 0033:0x441be9
------------[ cut here ]------------
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
kernel BUG at fs/inode.c:1566!
RSP: 002b:00007ffff6330f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
invalid opcode: 0000 [#4] PREEMPT SMP KASAN
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441be9
CPU: 0 PID: 6109 Comm: syz-executor637 Tainted: G      D           4.20.0-rc6-next-20181214+ #171
RDX: 0000000020000180 RSI: 0000000020000100 RDI: 0000000000000000
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RBP: 00007ffff6330fe0 R08: 0000000000000000 R09: 0000000000000100
RIP: 0010:iput+0x915/0xa90 fs/inode.c:1566
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
Code: e4 0f 84 a8 fe ff ff e8 e9 fe a6 ff 48 89 df e8 61 f4 ff ff 48 8b bd f0 fe ff ff e8 35 41 08 06 e9 69 fd ff ff e8 cb fe a6 ff <0f> 0b e8 c4 fe a6 ff 0f 0b e9 d5 fb ff ff e8 b8 fe a6 ff 0f 0b e9
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
RSP: 0000:ffff8881d2b476b8 EFLAGS: 00010293
---[ end trace c981ed50117a38b3 ]---
RAX: ffff8881d96ec080 RBX: ffff8881b269a8c0 RCX: ffffffff81d8fc14
RIP: 0010:iput+0x915/0xa90 fs/inode.c:1566
RDX: 0000000000000000 RSI: ffffffff81d90455 RDI: 0000000000000007
RBP: ffff8881d2b477f0 R08: ffff8881d96ec080 R09: ffffed103b585b77
R10: ffffed103b585b77 R11: ffff8881dac2dbbb R12: 0000000000000040
R13: ffff8881d2b47910 R14: 00000000ffffffea R15: ffff8881d0c4a200
FS:  0000000001e1a880(0000) GS:ffff8881dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 00000001b7099000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Code: e4 0f 84 a8 fe ff ff e8 e9 fe a6 ff 48 89 df e8 61 f4 ff ff 48 8b bd f0 fe ff ff e8 35 41 08 06 e9 69 fd ff ff e8 cb fe a6 ff <0f> 0b e8 c4 fe a6 ff 0f 0b e9 d5 fb ff ff e8 b8 fe a6 ff 0f 0b e9
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
RSP: 0018:ffff8881c0ff76b8 EFLAGS: 00010293
RAX: ffff8881c0fdc100 RBX: ffff8881b25f44a0 RCX: ffffffff81d8fc14
 autofs_fill_super+0x15fb/0x1c30 fs/autofs/inode.c:352
RDX: 0000000000000000 RSI: ffffffff81d90455 RDI: 0000000000000007
RBP: ffff8881c0ff77f0 R08: ffff8881c0fdc100 R09: 0000000000000006
R10: 0000000000000000 R11: ffff8881c0fdc100 R12: 0000000000000040
R13: ffff8881c0ff7910 R14: 00000000ffffffea R15: ffff8881d0c4d200
 mount_nodev+0x73/0x120 fs/super.c:1402
 autofs_mount+0x34/0x40 fs/autofs/init.c:16
FS:  0000000001e1a880(0000) GS:ffff8881dad00000(0000) knlGS:0000000000000000
 legacy_get_tree+0x12f/0x260 fs/fs_context.c:714
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 vfs_get_tree+0x1cb/0x5c0 fs/super.c:1795
 do_new_mount fs/namespace.c:2716 [inline]
 do_mount+0x82a/0x1ff0 fs/namespace.c:3042
CR2: 0000000002497000 CR3: 00000001b3373000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 ksys_mount+0x12d/0x140 fs/namespace.c:3258
 __do_sys_mount fs/namespace.c:3272 [inline]
 __se_sys_mount fs/namespace.c:3269 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3269

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/16 05:47 linux-next d14b746c6c1c def91db3 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/12/16 01:48 linux-next d14b746c6c1c def91db3 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.