bisecting fixing commit since 9f84340f012ee60c12aacc03662bcdd67419a31a building syzkaller on 8f5a7b8cde529e0a19a53f79bdf9c6cad306827b testing commit 9f84340f012ee60c12aacc03662bcdd67419a31a compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 36d0f8598d9111fc76645b85403362bdda605f2edd2ffad86a4ee8a83e933bb0 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow testing current HEAD b172b44fcb1771e083aad806fa96f3f60e2ddfac testing commit b172b44fcb1771e083aad806fa96f3f60e2ddfac compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 3eebe51c718ebf7dd55d7db8fbcca09845a8b53a4060f6ee5085b598628a23f8 all runs: OK # git bisect start b172b44fcb1771e083aad806fa96f3f60e2ddfac 9f84340f012ee60c12aacc03662bcdd67419a31a Bisecting: 412 revisions left to test after this (roughly 9 steps) [600942d2fd49b90e44857d20c774b20d16f3130f] virtio-blk: Fix memory leak among suspend/resume procedure testing commit 600942d2fd49b90e44857d20c774b20d16f3130f compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 2b240562d768d3dddc50bd80252de404040f7971c512613f166e1c2bf725e411 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 600942d2fd49b90e44857d20c774b20d16f3130f Bisecting: 206 revisions left to test after this (roughly 8 steps) [fdb90238e5f54868e9c4a176d2b11e6f2105d23c] tulip: windbond-840: Fix missing pci_disable_device() in probe and remove testing commit fdb90238e5f54868e9c4a176d2b11e6f2105d23c compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: e6940f8cb1c46c714221afce777e68a511dee9d238001c3a1a1f691bf41b2f41 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow run #4: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good fdb90238e5f54868e9c4a176d2b11e6f2105d23c Bisecting: 103 revisions left to test after this (roughly 7 steps) [0bc8d39791e65d2812746b6a07df4e1d482b7e08] ppp: Fix generating ifname when empty IFLA_IFNAME is specified testing commit 0bc8d39791e65d2812746b6a07df4e1d482b7e08 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 1385a9ce4d6e6188ef1a0dacab09197a77d6fdfcc05ac77f5df0293d88a5e4ec all runs: OK # git bisect bad 0bc8d39791e65d2812746b6a07df4e1d482b7e08 Bisecting: 51 revisions left to test after this (roughly 6 steps) [92bb8520970470028aab5a1ea7875a798d2ba4c8] usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers testing commit 92bb8520970470028aab5a1ea7875a798d2ba4c8 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: efa8bde05af070cb1c08e0943906815a3decc2ada13f1ebabb46785b22b6e355 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 92bb8520970470028aab5a1ea7875a798d2ba4c8 Bisecting: 25 revisions left to test after this (roughly 5 steps) [addba38e7c3bc19036a05c83bcce7878dc644d87] Linux 4.19.203 testing commit addba38e7c3bc19036a05c83bcce7878dc644d87 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: b47b4a44edb457e70036c03bf38a1626fcd4a40984e38eb73d252b69e2dbfc20 all runs: OK # git bisect bad addba38e7c3bc19036a05c83bcce7878dc644d87 Bisecting: 12 revisions left to test after this (roughly 4 steps) [0d631eeedf40ab717f8472fb5d743a16416e5218] MIPS: Malta: Do not byte-swap accesses to the CBUS UART testing commit 0d631eeedf40ab717f8472fb5d743a16416e5218 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 0903a88bc9f68a629408cec7fbfb01d0c851e8bec8b32c4a35d20ca388124871 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 0d631eeedf40ab717f8472fb5d743a16416e5218 Bisecting: 6 revisions left to test after this (roughly 3 steps) [8d0f60617bc108e866c26fbd1a9f11cc5f3c3014] qmi_wwan: add network device usage statistics for qmimux devices testing commit 8d0f60617bc108e866c26fbd1a9f11cc5f3c3014 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 8bccf7f9ec6f74904ad72f12c995ad1c0cd039c00875ea5e0d533e1761fbad34 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 8d0f60617bc108e866c26fbd1a9f11cc5f3c3014 Bisecting: 3 revisions left to test after this (roughly 2 steps) [4d7ee5d0a6a960f1790be3c9a0c71573405df63a] reiserfs: check directory items on read from disk testing commit 4d7ee5d0a6a960f1790be3c9a0c71573405df63a compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 281cfe988b5cdc3dcdedb9c276fcdf55b6ff7a2326250e60ad2e539d9fe7b21a all runs: OK # git bisect bad 4d7ee5d0a6a960f1790be3c9a0c71573405df63a Bisecting: 0 revisions left to test after this (roughly 1 step) [df2f583b63637f9f882ba604cf23e0336de82220] reiserfs: add check for root_inode in reiserfs_fill_super testing commit df2f583b63637f9f882ba604cf23e0336de82220 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 5e38f12654fb602611c688f84075e09473d17d6401f562f52d16ec22517945f0 all runs: OK # git bisect bad df2f583b63637f9f882ba604cf23e0336de82220 Bisecting: 0 revisions left to test after this (roughly 0 steps) [5d4f303010b717a05ec560dc1228918116f58637] libata: fix ata_pio_sector for CONFIG_HIGHMEM testing commit 5d4f303010b717a05ec560dc1228918116f58637 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 30ada7de3ef8bc04ccc87f727d91e9f8264f3a1726e45f86006290fa5966a7d3 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow # git bisect good 5d4f303010b717a05ec560dc1228918116f58637 df2f583b63637f9f882ba604cf23e0336de82220 is the first bad commit commit df2f583b63637f9f882ba604cf23e0336de82220 Author: Yu Kuai Date: Fri Jul 2 12:07:43 2021 +0800 reiserfs: add check for root_inode in reiserfs_fill_super [ Upstream commit 2acf15b94d5b8ea8392c4b6753a6ffac3135cd78 ] Our syzcaller report a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 116e95067 P4D 116e95067 PUD 1080b5067 PMD 0 Oops: 0010 [#1] SMP KASAN CPU: 7 PID: 592 Comm: a.out Not tainted 5.13.0-next-20210629-dirty #67 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 0018:ffff888114e779b8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff110229cef39 RCX: ffffffffaa67e1aa RDX: 0000000000000000 RSI: ffff88810a58ee00 RDI: ffff8881233180b0 RBP: ffffffffac38e9c0 R08: ffffffffaa67e17e R09: 0000000000000001 R10: ffffffffb91c5557 R11: fffffbfff7238aaa R12: ffff88810a58ee00 R13: ffff888114e77aa0 R14: 0000000000000000 R15: ffff8881233180b0 FS: 00007f946163c480(0000) GS:ffff88839f1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001099c1000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __lookup_slow+0x116/0x2d0 ? page_put_link+0x120/0x120 ? __d_lookup+0xfc/0x320 ? d_lookup+0x49/0x90 lookup_one_len+0x13c/0x170 ? __lookup_slow+0x2d0/0x2d0 ? reiserfs_schedule_old_flush+0x31/0x130 reiserfs_lookup_privroot+0x64/0x150 reiserfs_fill_super+0x158c/0x1b90 ? finish_unfinished+0xb10/0xb10 ? bprintf+0xe0/0xe0 ? __mutex_lock_slowpath+0x30/0x30 ? __kasan_check_write+0x20/0x30 ? up_write+0x51/0xb0 ? set_blocksize+0x9f/0x1f0 mount_bdev+0x27c/0x2d0 ? finish_unfinished+0xb10/0xb10 ? reiserfs_kill_sb+0x120/0x120 get_super_block+0x19/0x30 legacy_get_tree+0x76/0xf0 vfs_get_tree+0x49/0x160 ? capable+0x1d/0x30 path_mount+0xacc/0x1380 ? putname+0x97/0xd0 ? finish_automount+0x450/0x450 ? kmem_cache_free+0xf8/0x5a0 ? putname+0x97/0xd0 do_mount+0xe2/0x110 ? path_mount+0x1380/0x1380 ? copy_mount_options+0x69/0x140 __x64_sys_mount+0xf0/0x190 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae This is because 'root_inode' is initialized with wrong mode, and it's i_op is set to 'reiserfs_special_inode_operations'. Thus add check for 'root_inode' to fix the problem. Link: https://lore.kernel.org/r/20210702040743.1918552-1-yukuai3@huawei.com Signed-off-by: Yu Kuai Signed-off-by: Jan Kara Signed-off-by: Sasha Levin fs/reiserfs/super.c | 8 ++++++++ 1 file changed, 8 insertions(+) culprit signature: 5e38f12654fb602611c688f84075e09473d17d6401f562f52d16ec22517945f0 parent signature: 30ada7de3ef8bc04ccc87f727d91e9f8264f3a1726e45f86006290fa5966a7d3 revisions tested: 12, total time: 3h15m16.276024141s (build: 1h56m6.090155317s, test: 1h17m54.142564403s) first good commit: df2f583b63637f9f882ba604cf23e0336de82220 reiserfs: add check for root_inode in reiserfs_fill_super recipients (to): ["jack@suse.cz" "sashal@kernel.org" "yukuai3@huawei.com"] recipients (cc): []