divide error in get_scan_count
6 views
Skip to first unread message
syzbot
Oct 31, 2021, 5:32:19 AM10/31/21
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 2138e7367558 ANDROID: Incremental fs: Fix dentry get/put i..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=17fccd18b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=8844969a6709ae53
dashboard link: https://syzkaller.appspot.com/bug?extid=4aaec9051c8b9549405a
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4aaec9...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 10312 Comm: syz-executor.0 Not tainted 5.4.147-syzkaller-00040-g2138e7367558 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:get_scan_count+0x42d/0x1490 mm/vmscan.c:2515
Code: 49 be 00 00 00 00 00 fc ff df 4c 89 e7 48 89 de e8 a8 ae e0 ff 49 39 dc 4c 0f 46 e3 48 8b 4c 24 20 48 0f af d9 48 89 d8 31 d2 <49> f7 f4 49 89 cc 49 29 c4 bf 20 00 00 00 4c 89 e6 e8 ad b0 e0 ff
RSP: 0018:ffff8881cd767360 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8881cd767470 R08: ffffffff818022b8 R09: ffffed103dccbc24
R10: ffffed103dccbc24 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8881cd767700 R14: dffffc0000000000 R15: 000000000000000f
FS: 00007f75dd50b700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f520000 CR3: 000000012a4e1000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
shrink_node_memcg+0x158/0x1000 mm/vmscan.c:2588
shrink_node+0x37a/0x12c0 mm/vmscan.c:2831
shrink_zones+0x406/0x8b0 mm/vmscan.c:3048
do_try_to_free_pages+0x20b/0x980 mm/vmscan.c:3106
try_to_free_pages+0x548/0xce0 mm/vmscan.c:3320
__perform_reclaim mm/page_alloc.c:4223 [inline]
__alloc_pages_direct_reclaim mm/page_alloc.c:4244 [inline]
__alloc_pages_slowpath+0xfec/0x1b70 mm/page_alloc.c:4661
__alloc_pages_nodemask+0x42a/0x740 mm/page_alloc.c:4875
alloc_buffer_page drivers/staging/android/ion/heaps/ion_system_heap.c:55 [inline]
alloc_largest_available drivers/staging/android/ion/heaps/ion_system_heap.c:89 [inline]
ion_system_heap_allocate+0x2a7/0xb10 drivers/staging/android/ion/heaps/ion_system_heap.c:120
ion_buffer_create drivers/staging/android/ion/ion_buffer.c:51 [inline]
ion_buffer_alloc+0x238/0x6b0 drivers/staging/android/ion/ion_buffer.c:157
ion_dmabuf_alloc+0x73/0x190 drivers/staging/android/ion/ion_dma_buf.c:369
ion_alloc_fd drivers/staging/android/ion/ion.c:54 [inline]
ion_ioctl+0x1ed/0x830 drivers/staging/android/ion/ion.c:194
do_vfs_ioctl+0x6fb/0x15b0 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f75df794ae9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f75dd50b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f75df8a7f60 RCX: 00007f75df794ae9
RDX: 0000000020000080 RSI: 00000000c0184900 RDI: 0000000000000003
RBP: 00007f75df7eef25 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcec0346af R14: 00007f75dd50b300 R15: 0000000000022000
Modules linked in:
----------------
Code disassembly (best guess):
0: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
7: fc ff df
a: 4c 89 e7 mov %r12,%rdi
d: 48 89 de mov %rbx,%rsi
10: e8 a8 ae e0 ff callq 0xffe0aebd
15: 49 39 dc cmp %rbx,%r12
18: 4c 0f 46 e3 cmovbe %rbx,%r12
1c: 48 8b 4c 24 20 mov 0x20(%rsp),%rcx
21: 48 0f af d9 imul %rcx,%rbx
25: 48 89 d8 mov %rbx,%rax
28: 31 d2 xor %edx,%edx
* 2a: 49 f7 f4 div %r12 <-- trapping instruction
2d: 49 89 cc mov %rcx,%r12
30: 49 29 c4 sub %rax,%r12
33: bf 20 00 00 00 mov $0x20,%edi
38: 4c 89 e6 mov %r12,%rsi
3b: e8 ad b0 e0 ff callq 0xffe0b0ed
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 2138e7367558 ANDROID: Incremental fs: Fix dentry get/put i..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=17fccd18b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=8844969a6709ae53
dashboard link: https://syzkaller.appspot.com/bug?extid=4aaec9051c8b9549405a
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4aaec9...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 10312 Comm: syz-executor.0 Not tainted 5.4.147-syzkaller-00040-g2138e7367558 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:get_scan_count+0x42d/0x1490 mm/vmscan.c:2515
Code: 49 be 00 00 00 00 00 fc ff df 4c 89 e7 48 89 de e8 a8 ae e0 ff 49 39 dc 4c 0f 46 e3 48 8b 4c 24 20 48 0f af d9 48 89 d8 31 d2 <49> f7 f4 49 89 cc 49 29 c4 bf 20 00 00 00 4c 89 e6 e8 ad b0 e0 ff
RSP: 0018:ffff8881cd767360 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8881cd767470 R08: ffffffff818022b8 R09: ffffed103dccbc24
R10: ffffed103dccbc24 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8881cd767700 R14: dffffc0000000000 R15: 000000000000000f
FS: 00007f75dd50b700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f520000 CR3: 000000012a4e1000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
shrink_node_memcg+0x158/0x1000 mm/vmscan.c:2588
shrink_node+0x37a/0x12c0 mm/vmscan.c:2831
shrink_zones+0x406/0x8b0 mm/vmscan.c:3048
do_try_to_free_pages+0x20b/0x980 mm/vmscan.c:3106
try_to_free_pages+0x548/0xce0 mm/vmscan.c:3320
__perform_reclaim mm/page_alloc.c:4223 [inline]
__alloc_pages_direct_reclaim mm/page_alloc.c:4244 [inline]
__alloc_pages_slowpath+0xfec/0x1b70 mm/page_alloc.c:4661
__alloc_pages_nodemask+0x42a/0x740 mm/page_alloc.c:4875
alloc_buffer_page drivers/staging/android/ion/heaps/ion_system_heap.c:55 [inline]
alloc_largest_available drivers/staging/android/ion/heaps/ion_system_heap.c:89 [inline]
ion_system_heap_allocate+0x2a7/0xb10 drivers/staging/android/ion/heaps/ion_system_heap.c:120
ion_buffer_create drivers/staging/android/ion/ion_buffer.c:51 [inline]
ion_buffer_alloc+0x238/0x6b0 drivers/staging/android/ion/ion_buffer.c:157
ion_dmabuf_alloc+0x73/0x190 drivers/staging/android/ion/ion_dma_buf.c:369
ion_alloc_fd drivers/staging/android/ion/ion.c:54 [inline]
ion_ioctl+0x1ed/0x830 drivers/staging/android/ion/ion.c:194
do_vfs_ioctl+0x6fb/0x15b0 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f75df794ae9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f75dd50b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f75df8a7f60 RCX: 00007f75df794ae9
RDX: 0000000020000080 RSI: 00000000c0184900 RDI: 0000000000000003
RBP: 00007f75df7eef25 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcec0346af R14: 00007f75dd50b300 R15: 0000000000022000
Modules linked in:
----------------
Code disassembly (best guess):
0: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
7: fc ff df
a: 4c 89 e7 mov %r12,%rdi
d: 48 89 de mov %rbx,%rsi
10: e8 a8 ae e0 ff callq 0xffe0aebd
15: 49 39 dc cmp %rbx,%r12
18: 4c 0f 46 e3 cmovbe %rbx,%r12
1c: 48 8b 4c 24 20 mov 0x20(%rsp),%rcx
21: 48 0f af d9 imul %rcx,%rbx
25: 48 89 d8 mov %rbx,%rax
28: 31 d2 xor %edx,%edx
* 2a: 49 f7 f4 div %r12 <-- trapping instruction
2d: 49 89 cc mov %rcx,%r12
30: 49 29 c4 sub %rax,%r12
33: bf 20 00 00 00 mov $0x20,%edi
38: 4c 89 e6 mov %r12,%rsi
3b: e8 ad b0 e0 ff callq 0xffe0b0ed
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Oct 31, 2021, 7:28:23 AM10/31/21
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 2138e7367558 ANDROID: Incremental fs: Fix dentry get/put i..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=17c985f2b00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=104513bab00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4aaec9...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 927 Comm: syz-executor555 Not tainted 5.4.147-syzkaller-00040-g2138e7367558 #0
R10: ffffed103bbd8c24 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88804789f700 R14: dffffc0000000000 R15: 000000000000000f
FS: 0000555556f58300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
RIP: 0033:0x7fbcaf99ab09
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff9d19eac8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbcaf99ab09
R10: 00007fff9d19eaf0 R11: 0000000000000246 R12: 00007fff9d19eaec
R13: 00007fff9d19eb00 R14: 00007fff9d19eb40 R15: 0000000000000124
Modules linked in:
---[ end trace 8abd2c634eb864a1 ]---
R10: ffffed103bbd8c24 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88804789f700 R14: dffffc0000000000 R15: 000000000000000f
FS: 0000555556f58300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
HEAD commit: 2138e7367558 ANDROID: Incremental fs: Fix dentry get/put i..
git tree: android12-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=8844969a6709ae53
dashboard link: https://syzkaller.appspot.com/bug?extid=4aaec9051c8b9549405a
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124dbf8cb00000
dashboard link: https://syzkaller.appspot.com/bug?extid=4aaec9051c8b9549405a
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=104513bab00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4aaec9...@syzkaller.appspotmail.com
divide error: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:get_scan_count+0x42d/0x1490 mm/vmscan.c:2515
Code: 49 be 00 00 00 00 00 fc ff df 4c 89 e7 48 89 de e8 a8 ae e0 ff 49 39 dc 4c 0f 46 e3 48 8b 4c 24 20 48 0f af d9 48 89 d8 31 d2 <49> f7 f4 49 89 cc 49 29 c4 bf 20 00 00 00 4c 89 e6 e8 ad b0 e0 ff
RSP: 0018:ffff88804789f360 EFLAGS: 00010246
RIP: 0010:get_scan_count+0x42d/0x1490 mm/vmscan.c:2515
Code: 49 be 00 00 00 00 00 fc ff df 4c 89 e7 48 89 de e8 a8 ae e0 ff 49 39 dc 4c 0f 46 e3 48 8b 4c 24 20 48 0f af d9 48 89 d8 31 d2 <49> f7 f4 49 89 cc 49 29 c4 bf 20 00 00 00 4c 89 e6 e8 ad b0 e0 ff
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88804789f470 R08: ffffffff818022b8 R09: ffffed103bbd8c24
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
R10: ffffed103bbd8c24 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88804789f700 R14: dffffc0000000000 R15: 000000000000000f
FS: 0000555556f58300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbcafa05138 CR3: 000000004f406000 CR4: 00000000003406e0
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff9d19eac8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbcaf99ab09
RDX: 0000000020000080 RSI: 00000000c0184900 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fff9d19eaf0 R09: 00007fff9d19eaf0
R10: 00007fff9d19eaf0 R11: 0000000000000246 R12: 00007fff9d19eaec
R13: 00007fff9d19eb00 R14: 00007fff9d19eb40 R15: 0000000000000124
Modules linked in:
---[ end trace 8abd2c634eb864a1 ]---
RIP: 0010:get_scan_count+0x42d/0x1490 mm/vmscan.c:2515
Code: 49 be 00 00 00 00 00 fc ff df 4c 89 e7 48 89 de e8 a8 ae e0 ff 49 39 dc 4c 0f 46 e3 48 8b 4c 24 20 48 0f af d9 48 89 d8 31 d2 <49> f7 f4 49 89 cc 49 29 c4 bf 20 00 00 00 4c 89 e6 e8 ad b0 e0 ff
RSP: 0018:ffff88804789f360 EFLAGS: 00010246
Code: 49 be 00 00 00 00 00 fc ff df 4c 89 e7 48 89 de e8 a8 ae e0 ff 49 39 dc 4c 0f 46 e3 48 8b 4c 24 20 48 0f af d9 48 89 d8 31 d2 <49> f7 f4 49 89 cc 49 29 c4 bf 20 00 00 00 4c 89 e6 e8 ad b0 e0 ff
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88804789f470 R08: ffffffff818022b8 R09: ffffed103bbd8c24
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
R10: ffffed103bbd8c24 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88804789f700 R14: dffffc0000000000 R15: 000000000000000f
FS: 0000555556f58300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4b9197d88d CR3: 000000004f406000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
syzbot
Apr 22, 2023, 12:17:36 PM4/22/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages