[syzbot] general protection fault in dtSplitUp

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5a77386984b5 Merge tag 'drm-fixes-2022-09-30-1' of git://a..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15c1e370880000
kernel config: https://syzkaller.appspot.com/x/.config?x=755695d26ad09807
dashboard link: https://syzkaller.appspot.com/bug?extid=172bdd582e5d63486948
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13f2dc48880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1027d814880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/87931d29c9af/disk-5a773869.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/afb91893f060/vmlinux-5a773869.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+172bdd...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 32768
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 3612 Comm: syz-executor263 Not tainted 6.0.0-rc7-syzkaller-00162-g5a77386984b5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
RIP: 0010:dtExtendPage fs/jfs/jfs_dtree.c:1661 [inline]
RIP: 0010:dtSplitUp+0x1528/0x5120 fs/jfs/jfs_dtree.c:1034
Code: c6 74 11 e8 3a 46 a1 fe 48 8b 44 24 20 49 8d 5e e8 48 89 18 e8 29 46 a1 fe 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 90 35 00 00 4c 8b 33 31 ff 4c 89 f6 e8 e1 42 a1
RSP: 0018:ffffc9000395f2c8 EFLAGS: 00010256
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff82dac1f7 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888073ee333a R14: ffffc9000395f7f0 R15: ffff888073ee3270
FS: 00005555556d7300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599fad45028 CR3: 000000001d4a7000 CR4: 0000000000350ee0
Call Trace:
<TASK>
dtInsert+0x82b/0xa10 fs/jfs/jfs_dtree.c:863
jfs_create+0x5b7/0xac0 fs/jfs/namei.c:137
lookup_open.isra.0+0xf05/0x12a0 fs/namei.c:3413
open_last_lookups fs/namei.c:3481 [inline]
path_openat+0x996/0x28f0 fs/namei.c:3688
do_filp_open+0x1b6/0x400 fs/namei.c:3718
do_sys_openat2+0x16d/0x4c0 fs/open.c:1313
do_sys_open fs/open.c:1329 [inline]
__do_sys_openat fs/open.c:1345 [inline]
__se_sys_openat fs/open.c:1340 [inline]
__x64_sys_openat+0x13f/0x1f0 fs/open.c:1340
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f1da668d019
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff79c19d48 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f1da668d019
RDX: 0000000000161842 RSI: 000000002000c380 RDI: 00000000ffffff9c
RBP: 00007f1da664c7e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000f8008000
R13: 0000000000000000 R14: 0000000a00030083 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dtExtendPage fs/jfs/jfs_dtree.c:1661 [inline]
RIP: 0010:dtSplitUp+0x1528/0x5120 fs/jfs/jfs_dtree.c:1034
Code: c6 74 11 e8 3a 46 a1 fe 48 8b 44 24 20 49 8d 5e e8 48 89 18 e8 29 46 a1 fe 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 90 35 00 00 4c 8b 33 31 ff 4c 89 f6 e8 e1 42 a1
RSP: 0018:ffffc9000395f2c8 EFLAGS: 00010256
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff82dac1f7 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888073ee333a R14: ffffc9000395f7f0 R15: ffff888073ee3270
FS: 00005555556d7300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005584d071b470 CR3: 000000001d4a7000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 74 11 je 0x13
2: e8 3a 46 a1 fe callq 0xfea14641
7: 48 8b 44 24 20 mov 0x20(%rsp),%rax
c: 49 8d 5e e8 lea -0x18(%r14),%rbx
10: 48 89 18 mov %rbx,(%rax)
13: e8 29 46 a1 fe callq 0xfea14641
18: 48 89 da mov %rbx,%rdx
1b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
22: fc ff df
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 0f 85 90 35 00 00 jne 0x35c3
33: 4c 8b 33 mov (%rbx),%r14
36: 31 ff xor %edi,%edi
38: 4c 89 f6 mov %r14,%rsi
3b: e8 .byte 0xe8
3c: e1 42 loope 0x80
3e: a1 .byte 0xa1


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 6f861765464f43a71462d52026fbddfc858239a5
Author: Jan Kara <ja...@suse.cz>
Date: Wed Nov 1 17:43:10 2023 +0000

fs: Block writes to mounted block devices

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1268fc69e80000
start commit: a70385240892 Merge tag 'perf_urgent_for_v6.1_rc2' of git:/..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=ea03ca45176080bc
dashboard link: https://syzkaller.appspot.com/bug?extid=172bdd582e5d63486948
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15692dba880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15017b2c880000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: fs: Block writes to mounted block devices

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Jan Kara]

On Thu 11-01-24 19:39:03, syzbot wrote:
> syzbot suspects this issue was fixed by commit:
>
> commit 6f861765464f43a71462d52026fbddfc858239a5
> Author: Jan Kara <ja...@suse.cz>
> Date: Wed Nov 1 17:43:10 2023 +0000
>
> fs: Block writes to mounted block devices
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1268fc69e80000
> start commit: a70385240892 Merge tag 'perf_urgent_for_v6.1_rc2' of git:/..
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/x/.config?x=ea03ca45176080bc
> dashboard link: https://syzkaller.appspot.com/bug?extid=172bdd582e5d63486948
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15692dba880000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15017b2c880000
>
> If the result looks correct, please mark the issue as fixed by replying with:

Makes sense. When I'm looking at the dashboard I can see there's another
(older) reproducer which is not marked as not reproducing anymore. I
suppose this is because syzbot tests only the latest reproducer? Anyway,
let's close this, if syzbot can find another reproducer for the problem
with writes to mounted devices disabled, it'll surely tell us :)

#syz fix: fs: Block writes to mounted block devices

Honza
--
Jan Kara <ja...@suse.com>
SUSE Labs, CR