kernel BUG in hfs_bnode_put
9 views
Skip to first unread message
syzbot
Dec 7, 2022, 4:36:42 AM12/7/22
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=151c646d880000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=3b67f7623706f6c58417
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17c8fb37880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13bd13f3880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/07689b9cc9a9/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3b67f7...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/hfs/bnode.c:478!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 213 Comm: kworker/u4:3 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:hfs_bnode_put.part.0+0x20d/0x260 fs/hfs/bnode.c:478
Code: 65 ff 48 89 ef e8 f3 f8 ff ff 48 8b 3c 24 e8 ea fd 1b 06 48 89 ef e8 52 72 00 00 48 89 ef e8 ba fa ff ff eb c5 e8 43 33 65 ff <0f> 0b 48 8b 7c 24 08 e8 97 0f 9b ff e9 c8 fe ff ff 4c 89 ef e8 8a
RSP: 0018:ffff8880b4dd76c8 EFLAGS: 00010293
RAX: ffff8880b4fd6640 RBX: 0000000000000000 RCX: ffffffff81fd509c
RDX: 0000000000000000 RSI: ffffffff81fd522d RDI: 0000000000000005
RBP: ffff8880a8e49100 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff88809cd70c40
R13: ffff8880a8e49178 R14: 0000000000000000 R15: ffff88809ce11a28
FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feba8849f70 CR3: 00000000aa2e6000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hfs_bnode_put+0x1b/0x30 fs/hfs/bnode.c:471
hfs_btree_write+0x3ba/0x470 fs/hfs/btree.c:185
hfs_write_inode+0x56d/0x930 fs/hfs/inode.c:438
write_inode fs/fs-writeback.c:1244 [inline]
__writeback_single_inode+0x733/0x11d0 fs/fs-writeback.c:1442
writeback_sb_inodes+0x537/0xef0 fs/fs-writeback.c:1647
__writeback_inodes_wb+0xc6/0x280 fs/fs-writeback.c:1716
wb_writeback+0x841/0xcc0 fs/fs-writeback.c:1822
wb_check_start_all fs/fs-writeback.c:1946 [inline]
wb_do_writeback fs/fs-writeback.c:1972 [inline]
wb_workfn+0xbf4/0x1250 fs/fs-writeback.c:2006
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace b03018190d96a4da ]---
RIP: 0010:hfs_bnode_put.part.0+0x20d/0x260 fs/hfs/bnode.c:478
Code: 65 ff 48 89 ef e8 f3 f8 ff ff 48 8b 3c 24 e8 ea fd 1b 06 48 89 ef e8 52 72 00 00 48 89 ef e8 ba fa ff ff eb c5 e8 43 33 65 ff <0f> 0b 48 8b 7c 24 08 e8 97 0f 9b ff e9 c8 fe ff ff 4c 89 ef e8 8a
RSP: 0018:ffff8880b4dd76c8 EFLAGS: 00010293
RAX: ffff8880b4fd6640 RBX: 0000000000000000 RCX: ffffffff81fd509c
RDX: 0000000000000000 RSI: ffffffff81fd522d RDI: 0000000000000005
RBP: ffff8880a8e49100 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff88809cd70c40
R13: ffff8880a8e49178 R14: 0000000000000000 R15: ffff88809ce11a28
FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feba8849f70 CR3: 00000000aa2e6000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=151c646d880000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=3b67f7623706f6c58417
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17c8fb37880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13bd13f3880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/07689b9cc9a9/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3b67f7...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/hfs/bnode.c:478!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 213 Comm: kworker/u4:3 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:hfs_bnode_put.part.0+0x20d/0x260 fs/hfs/bnode.c:478
Code: 65 ff 48 89 ef e8 f3 f8 ff ff 48 8b 3c 24 e8 ea fd 1b 06 48 89 ef e8 52 72 00 00 48 89 ef e8 ba fa ff ff eb c5 e8 43 33 65 ff <0f> 0b 48 8b 7c 24 08 e8 97 0f 9b ff e9 c8 fe ff ff 4c 89 ef e8 8a
RSP: 0018:ffff8880b4dd76c8 EFLAGS: 00010293
RAX: ffff8880b4fd6640 RBX: 0000000000000000 RCX: ffffffff81fd509c
RDX: 0000000000000000 RSI: ffffffff81fd522d RDI: 0000000000000005
RBP: ffff8880a8e49100 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff88809cd70c40
R13: ffff8880a8e49178 R14: 0000000000000000 R15: ffff88809ce11a28
FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feba8849f70 CR3: 00000000aa2e6000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hfs_bnode_put+0x1b/0x30 fs/hfs/bnode.c:471
hfs_btree_write+0x3ba/0x470 fs/hfs/btree.c:185
hfs_write_inode+0x56d/0x930 fs/hfs/inode.c:438
write_inode fs/fs-writeback.c:1244 [inline]
__writeback_single_inode+0x733/0x11d0 fs/fs-writeback.c:1442
writeback_sb_inodes+0x537/0xef0 fs/fs-writeback.c:1647
__writeback_inodes_wb+0xc6/0x280 fs/fs-writeback.c:1716
wb_writeback+0x841/0xcc0 fs/fs-writeback.c:1822
wb_check_start_all fs/fs-writeback.c:1946 [inline]
wb_do_writeback fs/fs-writeback.c:1972 [inline]
wb_workfn+0xbf4/0x1250 fs/fs-writeback.c:2006
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace b03018190d96a4da ]---
RIP: 0010:hfs_bnode_put.part.0+0x20d/0x260 fs/hfs/bnode.c:478
Code: 65 ff 48 89 ef e8 f3 f8 ff ff 48 8b 3c 24 e8 ea fd 1b 06 48 89 ef e8 52 72 00 00 48 89 ef e8 ba fa ff ff eb c5 e8 43 33 65 ff <0f> 0b 48 8b 7c 24 08 e8 97 0f 9b ff e9 c8 fe ff ff 4c 89 ef e8 8a
RSP: 0018:ffff8880b4dd76c8 EFLAGS: 00010293
RAX: ffff8880b4fd6640 RBX: 0000000000000000 RCX: ffffffff81fd509c
RDX: 0000000000000000 RSI: ffffffff81fd522d RDI: 0000000000000005
RBP: ffff8880a8e49100 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff88809cd70c40
R13: ffff8880a8e49178 R14: 0000000000000000 R15: ffff88809ce11a28
FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feba8849f70 CR3: 00000000aa2e6000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Dec 12, 2022, 6:46:40 PM12/12/22
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 65afe34ac33d Linux 4.14.301
syzbot found the following issue on:
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=123b0ecd880000
kernel config: https://syzkaller.appspot.com/x/.config?x=5dfc73e3d697d68d
dashboard link: https://syzkaller.appspot.com/bug?extid=ce6809214b439f81b641
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14969bc7880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1286c48b880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cba1bf735bc1/disk-65afe34a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/640415e88522/vmlinux-65afe34a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8c2d360d5af4/bzImage-65afe34a.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/841fd34fc22d/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
------------[ cut here ]------------
kernel BUG at fs/hfs/bnode.c:482!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 8870 Comm: syz-executor255 Not tainted 4.14.301-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff8880ab5d8200 task.stack: ffff8880937a8000
RIP: 0010:hfs_bnode_put+0x1cc/0x220 fs/hfs/bnode.c:482
RSP: 0018:ffff8880937af590 EFLAGS: 00010297
RAX: ffff8880ab5d8200 RBX: ffff8880abb1a540 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880abca9600
RBP: ffff8880abca9600 R08: ffffffff8b9ad508 R09: 0000000000000003
R10: 0000000000000000 R11: ffff8880ab5d8200 R12: ffff8880abb1a540
R13: ffff8880abca9678 R14: ffff8880abca9600 R15: 00000000000000f8
FS: 00007f3bda92e700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3bda92e718 CR3: 00000000af1de000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hfs_bmap_alloc+0x422/0x530 fs/hfs/btree.c:287
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hfs_bnode_split+0xad/0xcf0 fs/hfsplus/brec.c:244
hfs_brec_insert+0x27c/0xa70 fs/hfs/brec.c:102
hfs_cat_create+0x3b1/0x920 fs/hfs/catalog.c:118
hfs_create+0x63/0xe0 fs/hfs/dir.c:208
lookup_open+0x77a/0x1750 fs/namei.c:3241
do_last fs/namei.c:3334 [inline]
path_openat+0xe08/0x2970 fs/namei.c:3571
do_filp_open+0x179/0x3c0 fs/namei.c:3605
do_sys_open+0x296/0x410 fs/open.c:1081
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f3be2d9b899
RSP: 002b:00007f3bda92e2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f3be2e207b0 RCX: 00007f3be2d9b899
RDX: 0000000000141842 RSI: 0000000020000380 RDI: 00000000ffffff9c
RBP: 00007f3be2ded544 R08: 00007f3bda92e700 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e
R13: f6f2cbf92df09e20 R14: 0031656c69662f2e R15: 00007f3be2e207b8
Code: 66 80 ff 48 89 ef e8 a4 f9 ff ff 48 8b 3c 24 e8 cb d4 4f 05 48 89 ef e8 83 67 00 00 48 89 ef e8 6b fb ff ff eb c5 e8 84 66 80 ff <0f> 0b 4c 89 ef e8 0a 27 aa ff e9 96 fe ff ff e8 70 27 aa ff e9
RIP: hfs_bnode_put+0x1cc/0x220 fs/hfs/bnode.c:482 RSP: ffff8880937af590
---[ end trace fd06b4e609583ba0 ]---
Reply all
Reply to author
Forward
0 new messages