syzbot


BUG: corrupted list in __dentry_kill

Status: auto-obsoleted due to no activity on 2023/08/01 17:00
Reported-by: syzbot+dd261f7b8f5879d63ea2@syzkaller.appspotmail.com
First crash: 469d, last: 469d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: corrupted list in __dentry_kill fs C 35 2278d 2298d 5/27 fixed on 2018/05/08 18:30
android-54 BUG: corrupted list in __dentry_kill (2) C 1 26d 110d 0/2 upstream: reported C repro on 2024/03/27 11:32
linux-4.19 BUG: corrupted list in __dentry_kill 1 1551d 1551d 0/1 auto-closed as invalid on 2020/08/15 07:34
android-5-10 BUG: corrupted list in __dentry_kill C inconclusive 5 2d02h 110d 0/2 upstream: reported C repro on 2024/03/27 10:55
upstream BUG: corrupted list in __dentry_kill (2) fs C done 4945 1678d 1678d 15/27 fixed on 2020/02/18 14:31
android-6-1 BUG: corrupted list in __dentry_kill 1 3d09h 3d09h 0/2 premoderation: reported on 2024/07/13 01:23

Sample crash report:
 do_sys_open+0x39c/0x810 fs/open.c:1113
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
---[ end trace 7481dcc65bdc2e04 ]---
list_del corruption. prev->next should be ffff8881a134cf70, but was ffff8881a6111f80
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 17294 Comm: syz-executor.4 Tainted: G        W         5.4.233-syzkaller-00029-g0e0b8c9892c8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
RIP: 0010:__list_del_entry_valid+0x107/0x120 lib/list_debug.c:59
Code: 4c 89 f6 e8 2c 5c 0f 02 0f 0b 48 c7 c7 60 bd d9 84 4c 89 f6 e8 1b 5c 0f 02 0f 0b 48 c7 c7 c0 bd d9 84 4c 89 f6 e8 0a 5c 0f 02 <0f> 0b 48 c7 c7 20 be d9 84 4c 89 f6 e8 f9 5b 0f 02 0f 0b 66 0f 1f
RSP: 0018:ffff88819ad97748 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff8881a6111f80 RCX: 6a49f2a823ab1f00
RDX: ffffc90004767000 RSI: 000000000003ffff RDI: 0000000000040000
RBP: ffff8881a134cef0 R08: ffffffff814ca4f6 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881a134cf38 R14: ffff8881a134cf70 R15: ffff8881a6111f80
FS:  00007fd594f8b700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff25000 CR3: 00000001eb553000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_del_entry include/linux/list.h:131 [inline]
 dentry_unlist fs/dcache.c:522 [inline]
 __dentry_kill+0x242/0x630 fs/dcache.c:575
 dentry_kill+0xb8/0x280 fs/dcache.c:673
 dput+0x154/0x2f0 fs/dcache.c:859
 ovl_destroy_inode+0x3c/0xe0 fs/overlayfs/super.c:211
 destroy_inode fs/inode.c:281 [inline]
 evict+0x59d/0x6a0 fs/inode.c:592
 ovl_create_object+0x256/0x2f0 fs/overlayfs/dir.c:634
 lookup_open fs/namei.c:3309 [inline]
 do_last fs/namei.c:3401 [inline]
 path_openat+0x181b/0x3480 fs/namei.c:3614
 do_filp_open+0x20b/0x450 fs/namei.c:3644
 do_sys_open+0x39c/0x810 fs/open.c:1113
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
Modules linked in:
---[ end trace 7481dcc65bdc2e05 ]---
RIP: 0010:__list_del_entry_valid+0x107/0x120 lib/list_debug.c:59
Code: 4c 89 f6 e8 2c 5c 0f 02 0f 0b 48 c7 c7 60 bd d9 84 4c 89 f6 e8 1b 5c 0f 02 0f 0b 48 c7 c7 c0 bd d9 84 4c 89 f6 e8 0a 5c 0f 02 <0f> 0b 48 c7 c7 20 be d9 84 4c 89 f6 e8 f9 5b 0f 02 0f 0b 66 0f 1f
RSP: 0018:ffff88819ad97748 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff8881a6111f80 RCX: 6a49f2a823ab1f00
RDX: ffffc90004767000 RSI: 000000000003ffff RDI: 0000000000040000
RBP: ffff8881a134cef0 R08: ffffffff814ca4f6 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881a134cf38 R14: ffff8881a134cf70 R15: ffff8881a6111f80
FS:  00007fd594f8b700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff25000 CR3: 00000001eb553000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/04/03 16:59 android12-5.4 0e0b8c9892c8 41147e3e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-4-kasan BUG: corrupted list in __dentry_kill
* Struck through repros no longer work on HEAD.