general protection fault in __radix_tree_lookup

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: a844dc4c Linux 4.14.158
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13ce5851e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c02bef505ffc02ff
dashboard link: https://syzkaller.appspot.com/bug?extid=3457adbba7d10bb313af
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3457ad...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
kobject: 'loop3' (ffff8880a41c6ca0): kobject_uevent_env
Modules linked in:
CPU: 0 PID: 7108 Comm: syz-fuzzer Not tainted 4.14.158-syzkaller #0
kobject: 'loop3' (ffff8880a41c6ca0): fill_kobj_path: path
= '/devices/virtual/block/loop3'
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff88808a206140 task.stack: ffff888085d28000
RIP: 0010:__read_once_size include/linux/compiler.h:183 [inline]
RIP: 0010:radix_tree_load_root lib/radix-tree.c:602 [inline]
RIP: 0010:__radix_tree_lookup+0x47/0x2f0 lib/radix-tree.c:1040
RSP: 0000:ffff888085d2f940 EFLAGS: 00010297
RAX: dffffedffffff95c RBX: 1ffff11010ba5f36 RCX: ffff888085d2f9d0
RDX: 0000000000000000 RSI: 0003fffffff6ffff RDI: 000016ffffffcad8
RBP: ffff888085d2f9a0 R08: 0000000000000000 R09: ffff88808a206a08
R10: ffff88808a2069e8 R11: ffff88808a206140 R12: 000016ffffffcad8
R13: 0003fffffff6ffff R14: dffffc0000000000 R15: dffffc0000000000
FS: 000000c420040490(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kasan: CONFIG_KASAN_INLINE enabled
CR2: 0000000000960004 CR3: 0000000099294000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
radix_tree_lookup_slot+0x63/0xa0 lib/radix-tree.c:1079
kasan: GPF could be caused by NULL-ptr deref or user memory access
find_get_entry+0x8c/0x680 mm/filemap.c:1355
pagecache_get_page+0x4a/0x9e0 mm/filemap.c:1465
find_get_page include/linux/pagemap.h:276 [inline]
lookup_swap_cache+0xc8/0x390 mm/swap_state.c:338
swap_readahead_detect+0x154/0x670 mm/swap_state.c:675
do_swap_page+0x5d1/0x19f0 mm/memory.c:2886
handle_pte_fault mm/memory.c:3993 [inline]
__handle_mm_fault+0x16f8/0x33d0 mm/memory.c:4113
handle_mm_fault+0x293/0x7c0 mm/memory.c:4150
__do_page_fault+0x4c1/0xb80 arch/x86/mm/fault.c:1420
do_page_fault+0x71/0x511 arch/x86/mm/fault.c:1495
page_fault+0x45/0x50 arch/x86/entry/entry_64.S:1122
RIP: 0033:0x45a2a3
RSP: 002b:000000c42004bf08 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000038000 RCX: 000000000003a000
RDX: 00007f2882103398 RSI: 000000000000001d RDI: 000000c441306000
RBP: 000000c42004bf50 R08: 000000c000000000 R09: 000000000001099e
R10: 0000000000000003 R11: 0000000000000006 R12: 00ffffffffffffff
R13: 00000000000000ff R14: 00000000000000ff R15: 0000000000000002
Code: 83 ec 38 48 89 45 a0 48 c1 e8 03 4c 01 f0 48 89 7d c0 48 89 75 c8 48
89 55 b0 48 89 4d a8 48 89 45 b8 e8 5d 8f fd fa 48 8b 45 b8 <80> 38 00 0f
85 5c 02 00 00 48 8b 45 c0 48 8b 58 08 48 89 d8 83
RIP: __read_once_size include/linux/compiler.h:183 [inline] RSP:
ffff888085d2f940
RIP: radix_tree_load_root lib/radix-tree.c:602 [inline] RSP:
ffff888085d2f940
RIP: __radix_tree_lookup+0x47/0x2f0 lib/radix-tree.c:1040 RSP:
ffff888085d2f940
general protection fault: 0000 [#2] PREEMPT SMP KASAN
---[ end trace 8d233b9187bb66b5 ]---
Modules linked in:
CPU: 1 PID: 7122 Comm: syz-fuzzer Tainted: G D
4.14.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8880857c2380 task.stack: ffff8880846f8000
RIP: 0010:__read_once_size include/linux/compiler.h:183 [inline]
RIP: 0010:radix_tree_load_root lib/radix-tree.c:602 [inline]
RIP: 0010:__radix_tree_lookup+0x47/0x2f0 lib/radix-tree.c:1040
RSP: 0000:ffff8880846ff940 EFLAGS: 00010297
RAX: dffffedffffffa70 RBX: 1ffff110108dff36 RCX: ffff8880846ff9d0
RDX: 0000000000000000 RSI: 0003fffffff87fff RDI: 000016ffffffd378
RBP: ffff8880846ff9a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffff8880857c2380 R12: 000016ffffffd378
R13: 0003fffffff87fff R14: dffffc0000000000 R15: dffffc0000000000
FS: 000000c420821090(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31222000 CR3: 0000000099294000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
radix_tree_lookup_slot+0x63/0xa0 lib/radix-tree.c:1079
find_get_entry+0x8c/0x680 mm/filemap.c:1355
pagecache_get_page+0x4a/0x9e0 mm/filemap.c:1465
find_get_page include/linux/pagemap.h:276 [inline]
lookup_swap_cache+0xc8/0x390 mm/swap_state.c:338


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.