syzbot


general protection fault in blk_cgroup_bio_start

Status: auto-obsoleted due to no activity on 2023/07/24 14:41
Subsystems: block cgroups
[Documentation on labels]
Reported-by: syzbot+b75f58f484cce0cf5b01@syzkaller.appspotmail.com
First crash: 509d, last: 419d

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
CPU: 1 PID: 4943 Comm: syz-executor.0 Not tainted 6.3.0-syzkaller-00436-g173ea743bf7a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline]
RIP: 0010:percpu_ref_get_many include/linux/percpu-refcount.h:204 [inline]
RIP: 0010:percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
RIP: 0010:blk_cgroup_bio_start+0x469/0x770 block/blk-cgroup.c:2063
Code: 89 c6 e8 ba 80 87 fd 85 db 58 0f 85 8f 00 00 00 e8 5c 84 87 fd 48 8d 7d 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 02 00 00 48 8b 5d 38 31 ff 49 89 dc 41 83 e4
RSP: 0018:ffffc90005647010 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90003e71000
RDX: 0000000000000007 RSI: ffffffff83fba234 RDI: 0000000000000038
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000094001 R12: ffffe8ffffb064f8
R13: ffff88802aeae800 R14: 0000000000000001 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880b9900000(0063) knlGS:00000000f7f32b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002c024000 CR3: 000000001c7ff000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 submit_bio_noacct_nocheck+0x7e/0xb90 block/blk-core.c:687
 submit_bio_noacct+0x952/0x1a30 block/blk-core.c:807
 submit_bio block/blk-core.c:843 [inline]
 submit_bio+0x8f/0x1c0 block/blk-core.c:831
 mpage_bio_submit fs/mpage.c:64 [inline]
 mpage_readahead+0x41c/0x580 fs/mpage.c:359
 read_pages+0x1a2/0xd40 mm/readahead.c:161
 page_cache_ra_unbounded+0x477/0x5e0 mm/readahead.c:270
 do_page_cache_ra mm/readahead.c:300 [inline]
 page_cache_ra_order+0x6ec/0xa00 mm/readahead.c:560
 ondemand_readahead+0x6b3/0x1080 mm/readahead.c:682
 page_cache_sync_ra+0x1c9/0x200 mm/readahead.c:709
 page_cache_sync_readahead include/linux/pagemap.h:1208 [inline]
 filemap_get_pages+0x28d/0x1620 mm/filemap.c:2598
 filemap_read+0x35e/0xc70 mm/filemap.c:2693
 blkdev_read_iter+0x3eb/0x760 block/fops.c:606
 call_read_iter include/linux/fs.h:1845 [inline]
 generic_file_splice_read+0x182/0x4b0 fs/splice.c:403
 do_splice_to+0x1b9/0x240 fs/splice.c:886
 splice_direct_to_actor+0x2ab/0x8a0 fs/splice.c:957
 do_splice_direct+0x1ab/0x280 fs/splice.c:1066
 do_sendfile+0xb19/0x12c0 fs/read_write.c:1254
 __do_compat_sys_sendfile fs/read_write.c:1343 [inline]
 __se_compat_sys_sendfile fs/read_write.c:1326 [inline]
 __ia32_compat_sys_sendfile+0x1e1/0x220 fs/read_write.c:1326
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f37579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7f325cc EFLAGS: 00000296 ORIG_RAX: 00000000000000bb
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000000004
RDX: 0000000000000000 RSI: 000000000008a002 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline]
RIP: 0010:percpu_ref_get_many include/linux/percpu-refcount.h:204 [inline]
RIP: 0010:percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
RIP: 0010:blk_cgroup_bio_start+0x469/0x770 block/blk-cgroup.c:2063
Code: 89 c6 e8 ba 80 87 fd 85 db 58 0f 85 8f 00 00 00 e8 5c 84 87 fd 48 8d 7d 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 02 00 00 48 8b 5d 38 31 ff 49 89 dc 41 83 e4
RSP: 0018:ffffc90005647010 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90003e71000
RDX: 0000000000000007 RSI: ffffffff83fba234 RDI: 0000000000000038
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000094001 R12: ffffe8ffffb064f8
R13: ffff88802aeae800 R14: 0000000000000001 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880b9900000(0063) knlGS:00000000f7f32b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002c024000 CR3: 000000001c7ff000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	89 c6                	mov    %eax,%esi
   2:	e8 ba 80 87 fd       	callq  0xfd8780c1
   7:	85 db                	test   %ebx,%ebx
   9:	58                   	pop    %rax
   a:	0f 85 8f 00 00 00    	jne    0x9f
  10:	e8 5c 84 87 fd       	callq  0xfd878471
  15:	48 8d 7d 38          	lea    0x38(%rbp),%rdi
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 dd 02 00 00    	jne    0x311
  34:	48 8b 5d 38          	mov    0x38(%rbp),%rbx
  38:	31 ff                	xor    %edi,%edi
  3a:	49 89 dc             	mov    %rbx,%r12
  3d:	41                   	rex.B
  3e:	83                   	.byte 0x83
  3f:	e4                   	.byte 0xe4

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/04/25 14:41 upstream 173ea743bf7a 65320f8e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in blk_cgroup_bio_start
2023/01/25 13:00 net-old 2a48216cff7a 9dfcf09c .config console log report info ci-upstream-net-this-kasan-gce general protection fault in blk_cgroup_bio_start
2023/04/04 05:45 bpf-next 16b7c970cc81 7db618d0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce general protection fault in blk_cgroup_bio_start
* Struck through repros no longer work on HEAD.