WARNING in deactivate_locked_super

8 views
Skip to first unread message

syzbot

unread,
Jun 9, 2019, 7:43:08 PM6/9/19
to syzkaller...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: e6a95d88 Linux 4.14.124
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1587f001a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=ab7251aa14ac721d
dashboard link: https://syzkaller.appspot.com/bug?extid=6907109007182934fd61
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+690710...@syzkaller.appspotmail.com

__build_skb+0x35/0x2e0 net/core/skbuff.c:281
build_skb+0x1f/0x160 net/core/skbuff.c:312
kobject: 'loop2' (ffff8880a49626e0): fill_kobj_path: path
= '/devices/virtual/block/loop2'
bpf_prog_test_run_skb+0x157/0x9a0 net/bpf/test_run.c:122
------------[ cut here ]------------
WARNING: CPU: 0 PID: 11899 at fs/super.c:1163 kill_block_super+0xc9/0xf0
fs/super.c:1163
Kernel panic - not syncing: panic_on_warn set ...

bpf_prog_test_run kernel/bpf/syscall.c:1258 [inline]
SYSC_bpf kernel/bpf/syscall.c:1520 [inline]
SyS_bpf+0x749/0x38f3 kernel/bpf/syscall.c:1469
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x459279
RSP: 002b:00007f12dadfbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f12dadfbc90 RCX: 0000000000459279
RDX: 0000000000000028 RSI: 00000000200000c0 RDI: 000000000000000a
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f12dadfc6d4
R13: 00000000004bf56e R14: 00000000004d0b58 R15: 0000000000000004
CPU: 0 PID: 11899 Comm: syz-executor.4 Not tainted 4.14.124 #18
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
panic+0x1f2/0x426 kernel/panic.c:182
__warn.cold+0x2f/0x36 kernel/panic.c:546
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:960
RIP: 0010:kill_block_super+0xc9/0xf0 fs/super.c:1163
RSP: 0018:ffff88808e447b98 EFLAGS: 00010246
RAX: 0000000000040000 RBX: 0000000000000000 RCX: ffffc9000bc6c000
RDX: 0000000000040000 RSI: ffffffff818d9929 RDI: ffff88808892a5a0
RBP: ffff88808e447bb0 R08: ffff888067674740 R09: 0000000000000001
R10: 0000000000000000 R11: ffff888067674740 R12: ffff888067a7cbc0
R13: ffff88808892a200 R14: ffff888067a7cbc0 R15: dffffc0000000000
deactivate_locked_super+0x74/0xe0 fs/super.c:319
sget_userns+0x9d9/0xc30 fs/super.c:537
sget+0xd6/0x120 fs/super.c:572
mount_bdev+0xd5/0x370 fs/super.c:1107
jfs_do_mount+0x35/0x40 fs/jfs/super.c:703
mount_fs+0x97/0x2a1 fs/super.c:1237
vfs_kern_mount.part.0+0x5e/0x3d0 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0x417/0x27d0 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xab/0x120 fs/namespace.c:3072
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45bcca
RSP: 002b:00007fcbb007fa88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fcbb007fb40 RCX: 000000000045bcca
RDX: 00007fcbb007fae0 RSI: 0000000020000080 RDI: 00007fcbb007fb00
RBP: 0000000000000000 R08: 00007fcbb007fb40 R09: 00007fcbb007fae0
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000005
R13: 00000000004c8211 R14: 00000000004dea48 R15: 0000000000000004
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Oct 31, 2020, 5:51:18 PM10/31/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: 2b791501 Linux 4.14.203
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1592100c500000
kernel config: https://syzkaller.appspot.com/x/.config?x=e52bb6f2a595a463
dashboard link: https://syzkaller.appspot.com/bug?extid=6907109007182934fd61
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=149dc192500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13ab241a500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+690710...@syzkaller.appspotmail.com

fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
------------[ cut here ]------------
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc mm/slab.c:3376 [inline]
kmem_cache_alloc+0x28e/0x3c0 mm/slab.c:3550
kmem_cache_zalloc include/linux/slab.h:651 [inline]
alloc_buffer_head+0x20/0x110 fs/buffer.c:3445
WARNING: CPU: 0 PID: 9458 at fs/super.c:1163 kill_block_super+0xbe/0xe0 fs/super.c:1163
alloc_page_buffers+0xb3/0x1f0 fs/buffer.c:874
Kernel panic - not syncing: panic_on_warn set ...

grow_dev_page fs/buffer.c:1025 [inline]
grow_buffers fs/buffer.c:1077 [inline]
__getblk_slow+0x2d6/0x7a0 fs/buffer.c:1104
__getblk_gfp fs/buffer.c:1383 [inline]
__bread_gfp+0x206/0x2e0 fs/buffer.c:1428
sb_bread include/linux/buffer_head.h:309 [inline]
fat_fill_super+0x2f9/0x31b0 fs/fat/inode.c:1637
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x44e51a
RSP: 002b:00007f069ce4eb28 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f069ce4eb30 RCX: 000000000044e51a
RDX: 0000000020000440 RSI: 0000000020000100 RDI: 00007f069ce4eb30
RBP: 0000000000000007 R08: 00007f069ce4eb70 R09: 6f6f6c2f7665642f
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000006
R13: 0000000000000000 R14: 00007f069ce4eb70 R15: 00007f069ce4f6d4
CPU: 0 PID: 9458 Comm: syz-executor438 Not tainted 4.14.203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x4b kernel/panic.c:547
report_bug+0x208/0x249 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:kill_block_super+0xbe/0xe0 fs/super.c:1163
RSP: 0018:ffff888091d17bc8 EFLAGS: 00010297
RAX: ffff88809b9cc440 RBX: 0000000000000000 RCX: 1ffff1101373999e
RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8880b1dcfbb0
RBP: ffff888095d4a740 R08: ffffffff8b9bd4c0 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88809b9cc440 R12: ffff8880b1dcf700
R13: ffffffff890abed0 R14: ffffffff88f44d80 R15: dffffc0000000000
deactivate_locked_super+0x6c/0xd0 fs/super.c:319
sget_userns+0x9c4/0xc10 fs/super.c:537
sget+0xd1/0x110 fs/super.c:572
mount_bdev+0xcd/0x360 fs/super.c:1107
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x44e51a
RSP: 002b:00007f069ce4eb28 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f069ce4eb30 RCX: 000000000044e51a
RDX: 0000000020000440 RSI: 0000000020000100 RDI: 00007f069ce4eb30
RBP: 0000000000000007 R08: 00007f069ce4eb70 R09: 6f6f6c2f7665642f
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000006
R13: 0000000000000000 R14: 00007f069ce4eb70 R15: 00007f069ce4f6d4
CPU: 1 PID: 9449 Comm: syz-executor438 Not tainted 4.14.203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10a/0x154 lib/fault-inject.c:149
should_failslab+0xd6/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc mm/slab.c:3376 [inline]
kmem_cache_alloc+0x28e/0x3c0 mm/slab.c:3550
kmem_cache_zalloc include/linux/slab.h:651 [inline]
alloc_buffer_head+0x20/0x110 fs/buffer.c:3445
alloc_page_buffers+0xb3/0x1f0 fs/buffer.c:874
grow_dev_page fs/buffer.c:1025 [inline]
grow_buffers fs/buffer.c:1077 [inline]
__getblk_slow+0x2d6/0x7a0 fs/buffer.c:1104
__getblk_gfp fs/buffer.c:1383 [inline]
__bread_gfp+0x206/0x2e0 fs/buffer.c:1428
sb_bread include/linux/buffer_head.h:309 [inline]
fat_fill_super+0x2f9/0x31b0 fs/fat/inode.c:1637
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x44e51a
RSP: 002b:00007f069ce2db28 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f069ce2db30 RCX: 000000000044e51a
RDX: 0000000020000440 RSI: 0000000020000100 RDI: 00007f069ce2db30
RBP: 0000000000000006 R08: 00007f069ce2db70 R09: 6f6f6c2f7665642f
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000005
R13: 0000000000000000 R14: 00007f069ce2db70 R15: 00007f069ce2e6d4
Reply all
Reply to author
Forward
0 new messages