divide error in dbNextAG (2)

6 Aufrufe
Direkt zur ersten ungelesenen Nachricht

syzbot

ungelesen,
17.03.2022, 10:18:2917.03.22
an syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13e1edad700000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=0c326bb9c3fc03e783e0
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e912d5700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0c326b...@syzkaller.appspotmail.com

IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8383 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dbNextAG+0xff/0x530 fs/jfs/jfs_dmap.c:615
Code: df 48 89 c1 48 89 04 24 83 e0 07 48 c1 e9 03 0f b6 0c 11 48 89 c2 83 c2 03 38 ca 7c 08 84 c9 0f 85 8a 03 00 00 44 89 f0 31 d2 <41> f7 74 24 14 49 89 c6 49 8d 44 24 20 48 89 c2 48 89 44 24 18 48
RSP: 0018:ffff88809d827ac0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880b3964480 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888093facdc8
RBP: ffff88808b087550 R08: 0000000000000000 R09: ffffed10127f5a42
R10: ffff888093fad217 R11: 0000000000074071 R12: ffff888093facdc0
R13: ffff88808b0864e8 R14: 0000000000000000 R15: 0000000000000001
FS: 00007f46498ea700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f46498ea718 CR3: 00000000b43bd000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
diAlloc+0x7ea/0x1440 fs/jfs/jfs_imap.c:1380
ialloc+0x8c/0x970 fs/jfs/jfs_inode.c:69
jfs_mkdir.part.0+0x131/0x870 fs/jfs/namei.c:237
jfs_mkdir+0x3f/0x60 fs/jfs/namei.c:222
vfs_mkdir+0x508/0x7a0 fs/namei.c:3819
do_mkdirat+0x262/0x2d0 fs/namei.c:3842
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f464a196049
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f46498ea168 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f464a2a9030 RCX: 00007f464a196049
RDX: 0000000000000020 RSI: 0000000020000300 RDI: 0000000000000005
RBP: 00007f464a1f008d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffe78ac44f R14: 00007f46498ea300 R15: 0000000000022000
Modules linked in:
---[ end trace cd60d601ec14d1dd ]---
RIP: 0010:dbNextAG+0xff/0x530 fs/jfs/jfs_dmap.c:615
Code: df 48 89 c1 48 89 04 24 83 e0 07 48 c1 e9 03 0f b6 0c 11 48 89 c2 83 c2 03 38 ca 7c 08 84 c9 0f 85 8a 03 00 00 44 89 f0 31 d2 <41> f7 74 24 14 49 89 c6 49 8d 44 24 20 48 89 c2 48 89 44 24 18 48
RSP: 0018:ffff88809d827ac0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880b3964480 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888093facdc8
RBP: ffff88808b087550 R08: 0000000000000000 R09: ffffed10127f5a42
R10: ffff888093fad217 R11: 0000000000074071 R12: ffff888093facdc0
R13: ffff88808b0864e8 R14: 0000000000000000 R15: 0000000000000001
FS: 00007f46498ea700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f46498ea718 CR3: 00000000b43bd000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: df 48 89 fisttps -0x77(%rax)
3: c1 48 89 04 rorl $0x4,-0x77(%rax)
7: 24 83 and $0x83,%al
9: e0 07 loopne 0x12
b: 48 c1 e9 03 shr $0x3,%rcx
f: 0f b6 0c 11 movzbl (%rcx,%rdx,1),%ecx
13: 48 89 c2 mov %rax,%rdx
16: 83 c2 03 add $0x3,%edx
19: 38 ca cmp %cl,%dl
1b: 7c 08 jl 0x25
1d: 84 c9 test %cl,%cl
1f: 0f 85 8a 03 00 00 jne 0x3af
25: 44 89 f0 mov %r14d,%eax
28: 31 d2 xor %edx,%edx
* 2a: 41 f7 74 24 14 divl 0x14(%r12) <-- trapping instruction
2f: 49 89 c6 mov %rax,%r14
32: 49 8d 44 24 20 lea 0x20(%r12),%rax
37: 48 89 c2 mov %rax,%rdx
3a: 48 89 44 24 18 mov %rax,0x18(%rsp)
3f: 48 rex.W


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

syzbot

ungelesen,
24.10.2022, 14:05:4224.10.22
an syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14afbb72880000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=0c326bb9c3fc03e783e0
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17315cf2880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=179bfd6e880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/aa24ddc93a72/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0c326b...@syzkaller.appspotmail.com

divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8101 Comm: syz-executor362 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
RIP: 0010:dbNextAG+0xff/0x530 fs/jfs/jfs_dmap.c:615
Code: df 48 89 c1 48 89 04 24 83 e0 07 48 c1 e9 03 0f b6 0c 11 48 89 c2 83 c2 03 38 ca 7c 08 84 c9 0f 85 8a 03 00 00 44 89 f0 31 d2 <41> f7 74 24 14 49 89 c6 49 8d 44 24 20 48 89 c2 48 89 44 24 18 48
RSP: 0018:ffff8880b1477238 EFLAGS: 00010246
RAX: 00000000932f7300 RBX: ffff8880a50381c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8880b057c548
RBP: ffff8880b057c540 R08: 0000000000000000 R09: ffffed10160af932
R10: ffff8880b057c997 R11: 0000000000074071 R12: ffff8880b057c540
R13: 0000000000000001 R14: 00000000932f7300 R15: ffff88808b04c180
FS: 0000555556599300(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f89014c46c0 CR3: 00000000ab3a3000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dbAlloc+0x44b/0xb00 fs/jfs/jfs_dmap.c:857
dtSplitUp+0x365/0x4e70 fs/jfs/jfs_dtree.c:987
dtInsert+0x7fd/0xa00 fs/jfs/jfs_dtree.c:876
jfs_create.part.0+0x3c6/0x880 fs/jfs/namei.c:150
jfs_create+0x3f/0x60 fs/jfs/namei.c:90
lookup_open+0x893/0x1a20 fs/namei.c:3235
do_last fs/namei.c:3327 [inline]
path_openat+0x1094/0x2df0 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7faa49b4be19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe840ce398 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faa49b4be19
RDX: 000000000000275a RSI: 00000000200001c0 RDI: 00000000ffffff9c
RBP: 00007faa49b0b680 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000073
R13: 0000000000000000 R14: 00080000000000fc R15: 0000000000000000
Modules linked in:
---[ end trace 7b75155e2b03922c ]---
RIP: 0010:dbNextAG+0xff/0x530 fs/jfs/jfs_dmap.c:615
Code: df 48 89 c1 48 89 04 24 83 e0 07 48 c1 e9 03 0f b6 0c 11 48 89 c2 83 c2 03 38 ca 7c 08 84 c9 0f 85 8a 03 00 00 44 89 f0 31 d2 <41> f7 74 24 14 49 89 c6 49 8d 44 24 20 48 89 c2 48 89 44 24 18 48
RSP: 0018:ffff8880b1477238 EFLAGS: 00010246
RAX: 00000000932f7300 RBX: ffff8880a50381c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8880b057c548
RBP: ffff8880b057c540 R08: 0000000000000000 R09: ffffed10160af932
R10: ffff8880b057c997 R11: 0000000000074071 R12: ffff8880b057c540
R13: 0000000000000001 R14: 00000000932f7300 R15: ffff88808b04c180
FS: 0000555556599300(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f89014c46c0 CR3: 00000000ab3a3000 CR4: 00000000003406e0
Allen antworten
Antwort an Autor
Weiterleiten
0 neue Nachrichten