audit: type=1804 audit(1677979446.508:15): pid=10517 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir2556892766/syzkaller.4OvM1F/52/bus" dev="sda1" ino=14029 res=1 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 8006 Comm: syz-executor.0 Not tainted 4.14.307-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 task: ffff88809a79e480 task.stack: ffff88809cef0000 RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline] RIP: 0010:update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682 RSP: 0018:ffff88809cef7558 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff8880b34906c0 RCX: 0000000000000060 RDX: 0000000000000000 RSI: 1ffff11013cd5a7c RDI: ffff8880a2ab0020 RBP: ffff8880a2ab0000 R08: ffff88809c824680 R09: ffffed101440c90a R10: ffff8880a2064854 R11: ffff88809a79e480 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000000 R15: 0000000000000001 FS: 00005555556bc400(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e03f10da0 CR3: 000000009ba60000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: refresh_sit_entry+0x2c/0x730 fs/f2fs/segment.c:1728 allocate_data_block+0x47d/0xf60 fs/f2fs/segment.c:2372 do_write_page+0x222/0x7f0 fs/f2fs/segment.c:2402 write_node_page+0x6f/0x230 fs/f2fs/segment.c:2442 __write_node_page+0x483/0xc20 fs/f2fs/node.c:1414 sync_node_pages+0xd65/0x10a0 fs/f2fs/node.c:1653 block_operations+0x215/0x6d0 fs/f2fs/checkpoint.c:1090 write_checkpoint+0x203/0x45f0 fs/f2fs/checkpoint.c:1377 f2fs_sync_fs+0x178/0x3f0 fs/f2fs/super.c:873 __sync_filesystem fs/sync.c:39 [inline] sync_filesystem fs/sync.c:67 [inline] sync_filesystem+0x185/0x230 fs/sync.c:48 generic_shutdown_super+0x70/0x370 fs/super.c:432 kill_block_super+0x95/0xe0 fs/super.c:1161 deactivate_locked_super+0x6c/0xd0 fs/super.c:319 deactivate_super+0x7f/0xa0 fs/super.c:350 cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183 task_work_run+0x11f/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7f6a5413c567 RSP: 002b:00007ffdbbafdf78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6a5413c567 RDX: 00007ffdbbafe048 RSI: 000000000000000a RDI: 00007ffdbbafe040 RBP: 00007ffdbbafe040 R08: 00000000ffffffff R09: 00007ffdbbafde10 R10: 00005555556bd8e3 R11: 0000000000000246 R12: 00007f6a54195b24 R13: 00007ffdbbaff100 R14: 00005555556bd810 R15: 00007ffdbbaff140 Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 6c 0e 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 75 20 4d 01 e6 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 57 0e 00 RIP: f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline] RSP: ffff88809cef7558 RIP: update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682 RSP: ffff88809cef7558 EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue audit: type=1804 audit(1677979446.508:16): pid=10517 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir2556892766/syzkaller.4OvM1F/52/bus" dev="sda1" ino=14029 res=1 ---[ end trace ac7952cb35b8e721 ]--- ---------------- Code disassembly (best guess), 1 bytes skipped: 0: df 48 89 fisttps -0x77(%rax) 3: fa cli 4: 48 c1 ea 03 shr $0x3,%rdx 8: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) c: 0f 85 6c 0e 00 00 jne 0xe7e 12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 19: fc ff df 1c: 4c 8b 75 20 mov 0x20(%rbp),%r14 20: 4d 01 e6 add %r12,%r14 23: 4c 89 f2 mov %r14,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction 2e: 4c 89 f2 mov %r14,%rdx 31: 83 e2 07 and $0x7,%edx 34: 38 d0 cmp %dl,%al 36: 7f 08 jg 0x40 38: 84 c0 test %al,%al 3a: 0f .byte 0xf 3b: 85 57 0e test %edx,0xe(%rdi)