EXT4-fs error (device loop1): ext4_fill_super:4450: inode #2: comm syz-executor143: iget: root inode unallocated EXT4-fs (loop1): get root inode failed EXT4-fs (loop1): mount failed ------------[ cut here ]------------ kernel BUG at fs/buffer.c:3049! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8484 Comm: syz-executor143 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:submit_bh_wbc+0x5e5/0x760 fs/buffer.c:3049 Code: 10 4c 8d 7b 20 48 89 44 24 08 e9 3e fc ff ff e8 41 98 b1 ff f0 80 63 01 f7 e9 4d fb ff ff e8 32 98 b1 ff 0f 0b e8 2b 98 b1 ff <0f> 0b e8 24 98 b1 ff 0f 0b e8 1d 98 b1 ff 0f 0b e8 16 98 b1 ff 0f RSP: 0018:ffff88809f1ef8f8 EFLAGS: 00010293 RAX: ffff8880a86d03c0 RBX: ffff88808a40cbd0 RCX: ffffffff81b0e7d1 RDX: 0000000000000000 RSI: ffffffff81b0ed45 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000003000 R13: 0000000000000000 R14: 0000000000000000 R15: 000000001ac3f9cf FS: 00007f61dd00b700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f61dd0b0088 CR3: 00000000aac72000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: read_mmp_block+0x133/0x610 fs/ext4/mmp.c:91 ext4_multi_mount_protect+0x4f6/0xac0 fs/ext4/mmp.c:358 ext4_fill_super+0xa050/0xc850 fs/ext4/super.c:4287 mount_bdev+0x2fc/0x3b0 fs/super.c:1158 mount_fs+0xa3/0x310 fs/super.c:1261 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961 vfs_kern_mount fs/namespace.c:951 [inline] do_new_mount fs/namespace.c:2492 [inline] do_mount+0x115c/0x2f50 fs/namespace.c:2822 ksys_mount+0xcf/0x130 fs/namespace.c:3038 __do_sys_mount fs/namespace.c:3052 [inline] __se_sys_mount fs/namespace.c:3049 [inline] __x64_sys_mount+0xba/0x150 fs/namespace.c:3049 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f61dd0603da Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f61dd00b108 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f61dd0603da RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f61dd00b170 RBP: 0000000000000004 R08: 00007f61dd00b1b0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 R13: 00000000200002f0 R14: 00007f61dd00b170 R15: 0000000020000100 Modules linked in: ---[ end trace 4f0cc6f7bbbcc78f ]--- RIP: 0010:submit_bh_wbc+0x5e5/0x760 fs/buffer.c:3049 Code: 10 4c 8d 7b 20 48 89 44 24 08 e9 3e fc ff ff e8 41 98 b1 ff f0 80 63 01 f7 e9 4d fb ff ff e8 32 98 b1 ff 0f 0b e8 2b 98 b1 ff <0f> 0b e8 24 98 b1 ff 0f 0b e8 1d 98 b1 ff 0f 0b e8 16 98 b1 ff 0f kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access EXT4-fs error (device loop3): ext4_fill_super:4450: inode #2: comm syz-executor143: iget: root inode unallocated general protection fault: 0000 [#2] PREEMPT SMP KASAN EXT4-fs error (device loop5): ext4_fill_super:4450: inode #2: comm syz-executor143: iget: root inode unallocated CPU: 1 PID: 8533 Comm: kmmpd-loop5 Tainted: G D 4.19.211-syzkaller #0 EXT4-fs (loop3): get root inode failed Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:bdevname+0x29/0x110 block/partition-generic.c:49 Code: 00 41 55 41 54 49 89 f4 55 53 48 89 fb e8 df 46 fb fd 48 8d bb d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c7 00 00 00 48 8b ab d0 00 00 00 48 b8 00 00 00 EXT4-fs (loop5): get root inode failed RSP: 0018:ffff88808f897dd8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88808aeba400 RDX: 000000000000001a RSI: ffffffff83673e91 RDI: 00000000000000d0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88808aeba450 R13: dffffc0000000000 R14: ffff8880912b0e40 R15: ffff88808aeba400 FS: 0000000000000000(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000080 CR3: 0000000097e7b000 CR4: 00000000003406e0 EXT4-fs (loop3): mount failed DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kmmpd+0x279/0xa80 fs/ext4/mmp.c:158 EXT4-fs (loop5): mount failed RSP: 0018:ffff88809f1ef8f8 EFLAGS: 00010293 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Modules linked in: ---[ end trace 4f0cc6f7bbbcc790 ]--- RAX: ffff8880a86d03c0 RBX: ffff88808a40cbd0 RCX: ffffffff81b0e7d1 RIP: 0010:submit_bh_wbc+0x5e5/0x760 fs/buffer.c:3049 RDX: 0000000000000000 RSI: ffffffff81b0ed45 RDI: 0000000000000001 Code: 10 4c 8d 7b 20 48 89 44 24 08 e9 3e fc ff ff e8 41 98 b1 ff f0 80 63 01 f7 e9 4d fb ff ff e8 32 98 b1 ff 0f 0b e8 2b 98 b1 ff <0f> 0b e8 24 98 b1 ff 0f 0b e8 1d 98 b1 ff 0f 0b e8 16 98 b1 ff 0f RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 RSP: 0018:ffff88809f1ef8f8 EFLAGS: 00010293 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000003000 RAX: ffff8880a86d03c0 RBX: ffff88808a40cbd0 RCX: ffffffff81b0e7d1 R13: 0000000000000000 R14: 0000000000000000 R15: 000000001ac3f9cf RDX: 0000000000000000 RSI: ffffffff81b0ed45 RDI: 0000000000000001 FS: 00007f61dd00b700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000003000 CR2: 00007f61dcfea718 CR3: 00000000aac72000 CR4: 00000000003406f0 R13: 0000000000000000 R14: 0000000000000000 R15: 000000001ac3f9cf DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 ---------------- Code disassembly (best guess): 0: 00 41 55 add %al,0x55(%rcx) 3: 41 54 push %r12 5: 49 89 f4 mov %rsi,%r12 8: 55 push %rbp 9: 53 push %rbx a: 48 89 fb mov %rdi,%rbx d: e8 df 46 fb fd callq 0xfdfb46f1 12: 48 8d bb d0 00 00 00 lea 0xd0(%rbx),%rdi 19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 20: fc ff df 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 c7 00 00 00 jne 0xfb 34: 48 8b ab d0 00 00 00 mov 0xd0(%rbx),%rbp 3b: 48 rex.W 3c: b8 .byte 0xb8 3d: 00 00 add %al,(%rax)