[syzbot] [kernel?] WARNING in follow_pte

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 734610514cb0 Merge tag 'erofs-for-6.10-rc7-fixes' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14d97066980000
kernel config: https://syzkaller.appspot.com/x/.config?x=de2d4dc103148cd6
dashboard link: https://syzkaller.appspot.com/bug?extid=35a4414f6e247f515443
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16c21fa9980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16008dc6980000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-73461051.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d390d5c7156f/vmlinux-73461051.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b56ef48ffa7e/bzImage-73461051.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+35a441...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 3 PID: 5192 at include/linux/rwsem.h:195 rwsem_assert_held include/linux/rwsem.h:195 [inline]
WARNING: CPU: 3 PID: 5192 at include/linux/rwsem.h:195 mmap_assert_locked include/linux/mmap_lock.h:65 [inline]
WARNING: CPU: 3 PID: 5192 at include/linux/rwsem.h:195 follow_pte+0x414/0x4c0 mm/memory.c:5980
Modules linked in:
CPU: 3 PID: 5192 Comm: syz-executor340 Not tainted 6.10.0-rc6-syzkaller-00055-g734610514cb0 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:rwsem_assert_held include/linux/rwsem.h:195 [inline]
RIP: 0010:mmap_assert_locked include/linux/mmap_lock.h:65 [inline]
RIP: 0010:follow_pte+0x414/0x4c0 mm/memory.c:5980
Code: bf 98 01 00 00 be ff ff ff ff e8 e7 76 15 09 31 ff 41 89 c4 89 c6 e8 1b 0c bc ff 45 85 e4 0f 85 80 fc ff ff e8 0d 11 bc ff 90 <0f> 0b 90 e9 72 fc ff ff e8 ff 10 bc ff 90 0f 0b 48 c7 c7 d8 73 e4
RSP: 0018:ffffc900032af4d0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00007f9c68e60000 RCX: ffffffff81d1d2f5
RDX: ffff88802306a440 RSI: ffffffff81d1d303 RDI: 0000000000000005
RBP: ffff8880209db5d0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 000000000000010a R12: 0000000000000000
R13: ffffc900032af530 R14: ffffc900032af550 R15: ffff88802abf1c80
FS: 00005555908da380(0000) GS:ffff88806b300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000c80 CR3: 000000002cfae000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
follow_phys arch/x86/mm/pat/memtype.c:957 [inline]
get_pat_info+0xf2/0x510 arch/x86/mm/pat/memtype.c:991
untrack_pfn+0xf7/0x4d0 arch/x86/mm/pat/memtype.c:1104
unmap_single_vma+0x1bd/0x2b0 mm/memory.c:1819
zap_page_range_single+0x326/0x560 mm/memory.c:1920
unmap_mapping_range_vma mm/memory.c:3684 [inline]
unmap_mapping_range_tree mm/memory.c:3701 [inline]
unmap_mapping_pages mm/memory.c:3767 [inline]
unmap_mapping_range+0x1ee/0x280 mm/memory.c:3804
truncate_pagecache+0x53/0x90 mm/truncate.c:731
simple_setattr+0xf2/0x120 fs/libfs.c:886
notify_change+0xec6/0x11f0 fs/attr.c:499
do_truncate+0x15c/0x220 fs/open.c:65
handle_truncate fs/namei.c:3308 [inline]
do_open fs/namei.c:3658 [inline]
path_openat+0x2860/0x2e50 fs/namei.c:3813
do_filp_open+0x1dc/0x430 fs/namei.c:3840
do_sys_openat2+0x17a/0x1e0 fs/open.c:1413
do_sys_open fs/open.c:1428 [inline]
__do_sys_openat fs/open.c:1444 [inline]
__se_sys_openat fs/open.c:1439 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1439
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f31b1f21859
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4ff07208 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f31b1f6a0de RCX: 00007f31b1f21859
RDX: 0000000000000300 RSI: 0000000020000c80 RDI: ffffffffffffff9c
RBP: 00007f31b1f6a0bc R08: 0000000000000006 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f31b1f6f07c
R13: 00007f31b1f6a07c R14: 0000000000000001 R15: 0000000000000001
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Lizhi Xu]

Fixes: c5541ba378e3 ("mm: follow_pte() improvements")
It introduced mmap_assert_locked(mm) in follow_pte.
This case content does not hold mm lock.

#syz test: upstream 734610514cb0

diff --git a/arch/x86/mm/pat/memtype.c b/arch/x86/mm/pat/memtype.c
index bdc2a240c2aa..0f2cfe595686 100644
--- a/arch/x86/mm/pat/memtype.c
+++ b/arch/x86/mm/pat/memtype.c
@@ -954,8 +954,12 @@ static int follow_phys(struct vm_area_struct *vma, unsigned long *prot,
pte_t *ptep, pte;
spinlock_t *ptl;

- if (follow_pte(vma, vma->vm_start, &ptep, &ptl))
+ mmap_read_lock(vma->mm);
+ if (follow_pte(vma, vma->vm_start, &ptep, &ptl)) {
+ mmap_read_unlock(current->mm);
return -EINVAL;
+ }
+ mmap_read_unlock(vma->mm);

pte = ptep_get(ptep);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

arch/x86/mm/pat/memtype.c:957:27: error: 'struct vm_area_struct' has no member named 'mm'
arch/x86/mm/pat/memtype.c:962:29: error: 'struct vm_area_struct' has no member named 'mm'


Tested on:

commit: 73461051 Merge tag 'erofs-for-6.10-rc7-fixes' of git:/..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=de2d4dc103148cd6
dashboard link: https://syzkaller.appspot.com/bug?extid=35a4414f6e247f515443
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=152339d1980000

[Lizhi Xu]

Fixes: c5541ba378e3 ("mm: follow_pte() improvements")
It introduced mmap_assert_locked(mm) in follow_pte.
This case content does not hold mm lock.

#syz test: upstream 734610514cb0

diff --git a/arch/x86/mm/pat/memtype.c b/arch/x86/mm/pat/memtype.c

index bdc2a240c2aa..0b215d1b89a7 100644

--- a/arch/x86/mm/pat/memtype.c
+++ b/arch/x86/mm/pat/memtype.c
@@ -954,8 +954,12 @@ static int follow_phys(struct vm_area_struct *vma, unsigned long *prot,
pte_t *ptep, pte;
spinlock_t *ptl;

- if (follow_pte(vma, vma->vm_start, &ptep, &ptl))

+ mmap_read_lock(vma->vm_mm);

+ if (follow_pte(vma, vma->vm_start, &ptep, &ptl)) {

+ mmap_read_unlock(vma->vm_mm);
return -EINVAL;
+ }
+ mmap_read_unlock(vma->vm_mm);

pte = ptep_get(ptep);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in get_pat_info

======================================================
WARNING: possible circular locking dependency detected
6.10.0-rc6-syzkaller-00055-g734610514cb0-dirty #0 Not tainted
------------------------------------------------------
syz.0.15/5748 is trying to acquire lock:
ffff888024dc6098 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:144 [inline]
ffff888024dc6098 (&mm->mmap_lock){++++}-{3:3}, at: follow_phys arch/x86/mm/pat/memtype.c:957 [inline]
ffff888024dc6098 (&mm->mmap_lock){++++}-{3:3}, at: get_pat_info+0xfe/0x640 arch/x86/mm/pat/memtype.c:995

but task is already holding lock:
ffff88801992cb00 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: i_mmap_lock_read include/linux/fs.h:523 [inline]
ffff88801992cb00 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: unmap_mapping_pages mm/memory.c:3765 [inline]
ffff88801992cb00 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: unmap_mapping_range+0xd7/0x280 mm/memory.c:3804

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&mapping->i_mmap_rwsem){++++}-{3:3}:
down_write+0x3a/0x50 kernel/locking/rwsem.c:1579
i_mmap_lock_write include/linux/fs.h:503 [inline]
vma_link_file+0x7d/0x120 mm/mmap.c:402
mmap_region+0xdec/0x2760 mm/mmap.c:2959
do_mmap+0xbc7/0xf60 mm/mmap.c:1397
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:573
vm_mmap+0x8e/0xc0 mm/util.c:592
elf_map fs/binfmt_elf.c:381 [inline]
elf_load+0x3de/0x880 fs/binfmt_elf.c:408
load_elf_binary+0xc61/0x4db0 fs/binfmt_elf.c:1132
search_binary_handler fs/exec.c:1797 [inline]
exec_binprm fs/exec.c:1839 [inline]
bprm_execve fs/exec.c:1891 [inline]
bprm_execve+0x703/0x19b0 fs/exec.c:1867
kernel_execve+0x3cf/0x4e0 fs/exec.c:2058
try_to_run_init_process init/main.c:1395 [inline]
kernel_init+0x14a/0x2b0 init/main.c:1523
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 (&mm->mmap_lock){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5137
lock_acquire kernel/locking/lockdep.c:5754 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
down_read+0x9a/0x330 kernel/locking/rwsem.c:1526
mmap_read_lock include/linux/mmap_lock.h:144 [inline]
follow_phys arch/x86/mm/pat/memtype.c:957 [inline]
get_pat_info+0xfe/0x640 arch/x86/mm/pat/memtype.c:995
untrack_pfn+0xf7/0x4d0 arch/x86/mm/pat/memtype.c:1108

unmap_single_vma+0x1bd/0x2b0 mm/memory.c:1819
zap_page_range_single+0x326/0x560 mm/memory.c:1920
unmap_mapping_range_vma mm/memory.c:3684 [inline]
unmap_mapping_range_tree mm/memory.c:3701 [inline]
unmap_mapping_pages mm/memory.c:3767 [inline]
unmap_mapping_range+0x1ee/0x280 mm/memory.c:3804
truncate_pagecache+0x53/0x90 mm/truncate.c:731
simple_setattr+0xf2/0x120 fs/libfs.c:886
notify_change+0xec6/0x11f0 fs/attr.c:499
do_truncate+0x15c/0x220 fs/open.c:65
handle_truncate fs/namei.c:3308 [inline]
do_open fs/namei.c:3658 [inline]
path_openat+0x2860/0x2e50 fs/namei.c:3813
do_filp_open+0x1dc/0x430 fs/namei.c:3840
do_sys_openat2+0x17a/0x1e0 fs/open.c:1413
do_sys_open fs/open.c:1428 [inline]
__do_sys_openat fs/open.c:1444 [inline]
__se_sys_openat fs/open.c:1439 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1439
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
rlock(&mapping->i_mmap_rwsem);
lock(&mm->mmap_lock);
lock(&mapping->i_mmap_rwsem);
rlock(&mm->mmap_lock);

*** DEADLOCK ***

3 locks held by syz.0.15/5748:
#0: ffff88801d5e2420 (sb_writers#4){.+.+}-{0:0}, at: do_open fs/namei.c:3647 [inline]
#0: ffff88801d5e2420 (sb_writers#4){.+.+}-{0:0}, at: path_openat+0x23f0/0x2e50 fs/namei.c:3813
#1: ffff88801992c830 (&sb->s_type->i_mutex_key#9){++++}-{3:3}, at: inode_lock include/linux/fs.h:791 [inline]
#1: ffff88801992c830 (&sb->s_type->i_mutex_key#9){++++}-{3:3}, at: do_truncate+0x14b/0x220 fs/open.c:63
#2: ffff88801992cb00 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: i_mmap_lock_read include/linux/fs.h:523 [inline]
#2: ffff88801992cb00 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: unmap_mapping_pages mm/memory.c:3765 [inline]
#2: ffff88801992cb00 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: unmap_mapping_range+0xd7/0x280 mm/memory.c:3804

stack backtrace:
CPU: 1 PID: 5748 Comm: syz.0.15 Not tainted 6.10.0-rc6-syzkaller-00055-g734610514cb0-dirty #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5137
lock_acquire kernel/locking/lockdep.c:5754 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
down_read+0x9a/0x330 kernel/locking/rwsem.c:1526
mmap_read_lock include/linux/mmap_lock.h:144 [inline]
follow_phys arch/x86/mm/pat/memtype.c:957 [inline]
get_pat_info+0xfe/0x640 arch/x86/mm/pat/memtype.c:995
untrack_pfn+0xf7/0x4d0 arch/x86/mm/pat/memtype.c:1108

unmap_single_vma+0x1bd/0x2b0 mm/memory.c:1819
zap_page_range_single+0x326/0x560 mm/memory.c:1920
unmap_mapping_range_vma mm/memory.c:3684 [inline]
unmap_mapping_range_tree mm/memory.c:3701 [inline]
unmap_mapping_pages mm/memory.c:3767 [inline]
unmap_mapping_range+0x1ee/0x280 mm/memory.c:3804
truncate_pagecache+0x53/0x90 mm/truncate.c:731
simple_setattr+0xf2/0x120 fs/libfs.c:886
notify_change+0xec6/0x11f0 fs/attr.c:499
do_truncate+0x15c/0x220 fs/open.c:65
handle_truncate fs/namei.c:3308 [inline]
do_open fs/namei.c:3658 [inline]
path_openat+0x2860/0x2e50 fs/namei.c:3813
do_filp_open+0x1dc/0x430 fs/namei.c:3840
do_sys_openat2+0x17a/0x1e0 fs/open.c:1413
do_sys_open fs/open.c:1428 [inline]
__do_sys_openat fs/open.c:1444 [inline]
__se_sys_openat fs/open.c:1439 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1439
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f9279375b99
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f927a12d048 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f9279503f60 RCX: 00007f9279375b99

RDX: 0000000000000300 RSI: 0000000020000c80 RDI: ffffffffffffff9c

RBP: 00007f92793e4a7a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f9279503f60 R15: 00007fff16c5b6f8
</TASK>

Tested on:

commit: 73461051 Merge tag 'erofs-for-6.10-rc7-fixes' of git:/..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=15a417ae980000

kernel config: https://syzkaller.appspot.com/x/.config?x=de2d4dc103148cd6
dashboard link: https://syzkaller.appspot.com/bug?extid=35a4414f6e247f515443
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1775b399980000

[Lizhi Xu]

Fixes: c5541ba378e3 ("mm: follow_pte() improvements")
It introduced mmap_assert_locked(mm) in follow_pte.
This case content does not hold mm lock.

#syz test: upstream 734610514cb0

diff --git a/mm/memory.c b/mm/memory.c
index 25a77c4fe4a0..18bc74dd0b72 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1909,6 +1909,7 @@ void zap_page_range_single(struct vm_area_struct *vma, unsigned long address,
lru_add_drain();
mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma->vm_mm,
address, end);
+ mmap_read_lock(vma->vm_mm);
hugetlb_zap_begin(vma, &range.start, &range.end);
tlb_gather_mmu(&tlb, vma->vm_mm);
update_hiwater_rss(vma->vm_mm);
@@ -1921,6 +1922,7 @@ void zap_page_range_single(struct vm_area_struct *vma, unsigned long address,
mmu_notifier_invalidate_range_end(&range);
tlb_finish_mmu(&tlb);
hugetlb_zap_end(vma, details);
+ mmap_read_unlock(vma->vm_mm);
}

/**

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

442 004144454141424e
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020
info registers vcpu 2

CPU#2
RAX=0000000000025c7c RBX=0000000000000002 RCX=ffffffff8ae75899 RDX=ffffed100d646fde
RSI=ffffffff8b8ff580 RDI=ffffffff8166387c RBP=ffffed1002fd9000 RSP=ffffc90000197e08
R8 =0000000000000000 R9 =ffffed100d646fdd R10=ffff88806b237eeb R11=0000000000000000
R12=0000000000000002 R13=ffff888017ec8000 R14=ffffffff8fe44110 R15=0000000000000000
RIP=ffffffff8ae76c8f RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88806b200000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe000008f000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f8cbb1a9b50 CR3=000000002a590000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=000000001000c0d0 Opmask01=0000000080000000 Opmask02=000000000000ffdf Opmask03=0000000000000000
Opmask04=00000000ffdfffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055de380b4540 000055de3808da00
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000ff0000000000 00000000ff000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ff000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3130323a30696368 2f306963682f6874 6f6f7465756c622f 6c6175747269762f
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f6f742079617272 6120656c75722079 7261726f706d6574 002a3f005b3f2a00
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4a4a51055c445757 440540495057055c 5744574a55484051 000f1a005b1a0f00
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000041 0000000000000000 000000003130323a 306963682f306963
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3031313837333033 0000000000000021 0000000000007374
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 68303e3b3a38253b 3a253e3a6e68303b 21383b657a687438 2739243c3b243b27
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 69305f474f5b647c 6930382432273f39 7b27697a787c7a30 23333a3a38263342
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4f45454d41490054 454e5f4449692e6e 6524004452414f42 4e4f5f454d414e5f
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4445414d41450000 454e4c4449452e41 002400444c414442 004144454141424e
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020
info registers vcpu 3

CPU#3
RAX=00000000000277bc RBX=0000000000000003 RCX=ffffffff8ae75899 RDX=ffffed100d666fde
RSI=ffffffff8b8ff580 RDI=ffffffff8166387c RBP=ffffed1002fd9488 RSP=ffffc900001a7e08
R8 =0000000000000000 R9 =ffffed100d666fdd R10=ffff88806b337eeb R11=0000000000000000
R12=0000000000000003 R13=ffff888017eca440 R14=ffffffff8fe44110 R15=0000000000000000
RIP=ffffffff8ae76c8f RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88806b300000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe00000d6000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f94bd905a6c CR3=000000002a590000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=000000001000c0d0 Opmask01=0000000080000000 Opmask02=000000000000ffdf Opmask03=0000000000000000
Opmask04=00000000ffdfffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000055de380b4540 000055de3808da00
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000ff0000000000 00000000ff000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ff000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3130323a30696368 2f306963682f6874 6f6f7465756c622f 6c6175747269762f
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f6f742079617272 6120656c75722079 7261726f706d6574 002a3f005b3f2a00
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4a4a51055c445757 440540495057055c 5744574a55484051 000f1a005b1a0f00
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000041 0000000000000000 000000003130323a 306963682f306963
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3031313837333033 0000000000000021 0000000000007374
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 68303e3b3a38253b 3a253e3a6e68303b 21383b657a687438 2739243c3b243b27
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 69305f474f5b647c 6930382432273f39 7b27697a787c7a30 23333a3a38263342
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4f45454d41490054 454e5f4449692e6e 6524004452414f42 4e4f5f454d414e5f
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4445414d41450000 454e4c4449452e41 002400444c414442 004144454141424e
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2952157381=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 1ecfa2d85
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=1ecfa2d8506efdae0483eedc0b425db8537b6e80 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240702-162210'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"1ecfa2d8506efdae0483eedc0b425db8537b6e80\"
/usr/bin/ld: /tmp/ccFcxoKa.o: in function `test_cover_filter()':
executor.cc:(.text+0x133fb): warning: the use of `tempnam' is dangerous, better use `mkstemp'
/usr/bin/ld: /tmp/ccFcxoKa.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x1a0): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
# Temporal hack to pre-created removed syz-fuzzer,
# since old version of syz-ci still wants to copy it.
touch ./bin/linux_amd64/syz-fuzzer


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15574d15980000

Tested on:

commit: 73461051 Merge tag 'erofs-for-6.10-rc7-fixes' of git:/..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=de2d4dc103148cd6
dashboard link: https://syzkaller.appspot.com/bug?extid=35a4414f6e247f515443
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=168779c1980000