general protection fault in bdevname (2)

4 views
Skip to first unread message

syzbot

unread,
Mar 17, 2022, 10:52:25 PM3/17/22
to syzkaller-a...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 49216514f3a3 UPSTREAM: arm64: Use the clearbhb instruction..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=16eb279d700000
kernel config: https://syzkaller.appspot.com/x/.config?x=fd73375ff21e4f01
dashboard link: https://syzkaller.appspot.com/bug?extid=4b1192c620073dc1170a
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d50789700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1393b315700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4b1192...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 1112 Comm: kmmpd-loop0 Not tainted 5.4.161-syzkaller-00052-g49216514f3a3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bdevname+0x2d/0x160 block/partition-generic.c:49
Code: 41 56 41 55 41 54 53 49 89 f6 48 89 fb 49 bc 00 00 00 00 00 fc ff df e8 01 d0 4b ff 48 8d bb 80 00 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 b7 ea 78 ff 4c 8b ab 80 00 00 00 48 83 c3
RSP: 0018:ffff8881e3567de8 EFLAGS: 00010202
RAX: 0000000000000010 RBX: 0000000000000000 RCX: ffff8881e67b8000
RDX: 0000000000000000 RSI: ffff8881ecd65450 RDI: 0000000000000080
RBP: ffff8881dc417ab0 R08: ffffffff81c0abf9 R09: ffffed103e14b231
R10: ffffed103e14b231 R11: 0000000000000000 R12: dffffc0000000000
R13: 000000000000000a R14: ffff8881ecd65450 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020011600 CR3: 00000001defdc000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kmmpd+0x1dc/0x9c0 fs/ext4/mmp.c:158
kthread+0x30f/0x330 kernel/kthread.c:288
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 763cde391e6b0cda ]---
RIP: 0010:bdevname+0x2d/0x160 block/partition-generic.c:49
Code: 41 56 41 55 41 54 53 49 89 f6 48 89 fb 49 bc 00 00 00 00 00 fc ff df e8 01 d0 4b ff 48 8d bb 80 00 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 b7 ea 78 ff 4c 8b ab 80 00 00 00 48 83 c3
RSP: 0018:ffff8881e3567de8 EFLAGS: 00010202
RAX: 0000000000000010 RBX: 0000000000000000 RCX: ffff8881e67b8000
RDX: 0000000000000000 RSI: ffff8881ecd65450 RDI: 0000000000000080
RBP: ffff8881dc417ab0 R08: ffffffff81c0abf9 R09: ffffed103e14b231
R10: ffffed103e14b231 R11: 0000000000000000 R12: dffffc0000000000
R13: 000000000000000a R14: ffff8881ecd65450 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020011600 CR3: 00000001defdc000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 41 56 push %r14
2: 41 55 push %r13
4: 41 54 push %r12
6: 53 push %rbx
7: 49 89 f6 mov %rsi,%r14
a: 48 89 fb mov %rdi,%rbx
d: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12
14: fc ff df
17: e8 01 d0 4b ff callq 0xff4bd01d
1c: 48 8d bb 80 00 00 00 lea 0x80(%rbx),%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 74 05 je 0x36
31: e8 b7 ea 78 ff callq 0xff78eaed
36: 4c 8b ab 80 00 00 00 mov 0x80(%rbx),%r13
3d: 48 rex.W
3e: 83 .byte 0x83
3f: c3 retq


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Reply all
Reply to author
Forward
0 new messages