BUG: unable to handle kernel paging request in dqput
10 views
Skip to first unread message
syzbot
Sep 23, 2020, 1:47:19 PM9/23/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1164ecbb900000
kernel config: https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link: https://syzkaller.appspot.com/bug?extid=b261701f02d8a7b36733
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b26170...@syzkaller.appspotmail.com
EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs error (device loop4): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 32768 vs 25 free clusters
BUG: unable to handle kernel paging request at fffffbfff000014f
IP: __read_once_size include/linux/compiler.h:183 [inline]
IP: atomic_read arch/x86/include/asm/atomic.h:27 [inline]
IP: dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761
PGD 21ffec067 P4D 21ffec067 PUD 21ffeb067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 20275 Comm: syz-executor.4 Not tainted 4.14.198-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880519b2300 task.stack: ffff8880342e8000
RIP: 0010:__read_once_size include/linux/compiler.h:183 [inline]
RIP: 0010:atomic_read arch/x86/include/asm/atomic.h:27 [inline]
RIP: 0010:dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761
RSP: 0018:ffff8880342ef870 EFLAGS: 00010286
RAX: dffffc0000000000 RBX: ffffffff80000980 RCX: 0000000000003a3c
RDX: 1ffffffff0f82502 RSI: 0000000000000001 RDI: ffffffff87c12804
RBP: dffffc0000000000 R08: ffffffff8a099b60 R09: 00000000000401ca
R10: ffff8880519b2bd8 R11: ffff8880519b2300 R12: 0000000000000003
R13: fffffbfff000014f R14: ffffffff80000a98 R15: ffffffff80000a78
FS: 00007fc6672e6700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff000014f CR3: 00000000a4462000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dqput fs/quota/dquot.c:748 [inline]
dqput_all fs/quota/dquot.c:391 [inline]
__dquot_initialize+0x47c/0xa70 fs/quota/dquot.c:1517
ext4_xattr_set+0xaa/0x230 fs/ext4/xattr.c:2494
__vfs_setxattr+0xdc/0x130 fs/xattr.c:150
__vfs_setxattr_noperm+0xfd/0x3d0 fs/xattr.c:181
__vfs_setxattr_locked+0x14d/0x250 fs/xattr.c:239
vfs_setxattr+0xcf/0x230 fs/xattr.c:256
setxattr+0x1a9/0x300 fs/xattr.c:523
path_setxattr+0x118/0x130 fs/xattr.c:542
SYSC_setxattr fs/xattr.c:557 [inline]
SyS_setxattr+0x36/0x50 fs/xattr.c:553
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e179
RSP: 002b:00007fc6672e5c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 0000000000032580 RCX: 000000000045e179
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000020000040
RBP: 000000000118cf90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffcb95519cf R14: 00007fc6672e69c0 R15: 000000000118cf4c
Code: 8d b3 18 01 00 00 49 c1 ed 03 41 83 e4 07 49 01 ed 41 83 c4 03 e8 a4 82 70 01 e8 7f 82 b7 ff 48 c7 c7 00 28 c1 87 e8 13 78 b1 04 <41> 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 cf 04 00 00 8b 83 f8
RIP: __read_once_size include/linux/compiler.h:183 [inline] RSP: ffff8880342ef870
RIP: atomic_read arch/x86/include/asm/atomic.h:27 [inline] RSP: ffff8880342ef870
RIP: dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761 RSP: ffff8880342ef870
CR2: fffffbfff000014f
---[ end trace e8c00baf9edb1478 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1164ecbb900000
kernel config: https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link: https://syzkaller.appspot.com/bug?extid=b261701f02d8a7b36733
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b26170...@syzkaller.appspotmail.com
EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs error (device loop4): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 32768 vs 25 free clusters
BUG: unable to handle kernel paging request at fffffbfff000014f
IP: __read_once_size include/linux/compiler.h:183 [inline]
IP: atomic_read arch/x86/include/asm/atomic.h:27 [inline]
IP: dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761
PGD 21ffec067 P4D 21ffec067 PUD 21ffeb067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 20275 Comm: syz-executor.4 Not tainted 4.14.198-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880519b2300 task.stack: ffff8880342e8000
RIP: 0010:__read_once_size include/linux/compiler.h:183 [inline]
RIP: 0010:atomic_read arch/x86/include/asm/atomic.h:27 [inline]
RIP: 0010:dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761
RSP: 0018:ffff8880342ef870 EFLAGS: 00010286
RAX: dffffc0000000000 RBX: ffffffff80000980 RCX: 0000000000003a3c
RDX: 1ffffffff0f82502 RSI: 0000000000000001 RDI: ffffffff87c12804
RBP: dffffc0000000000 R08: ffffffff8a099b60 R09: 00000000000401ca
R10: ffff8880519b2bd8 R11: ffff8880519b2300 R12: 0000000000000003
R13: fffffbfff000014f R14: ffffffff80000a98 R15: ffffffff80000a78
FS: 00007fc6672e6700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff000014f CR3: 00000000a4462000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dqput fs/quota/dquot.c:748 [inline]
dqput_all fs/quota/dquot.c:391 [inline]
__dquot_initialize+0x47c/0xa70 fs/quota/dquot.c:1517
ext4_xattr_set+0xaa/0x230 fs/ext4/xattr.c:2494
__vfs_setxattr+0xdc/0x130 fs/xattr.c:150
__vfs_setxattr_noperm+0xfd/0x3d0 fs/xattr.c:181
__vfs_setxattr_locked+0x14d/0x250 fs/xattr.c:239
vfs_setxattr+0xcf/0x230 fs/xattr.c:256
setxattr+0x1a9/0x300 fs/xattr.c:523
path_setxattr+0x118/0x130 fs/xattr.c:542
SYSC_setxattr fs/xattr.c:557 [inline]
SyS_setxattr+0x36/0x50 fs/xattr.c:553
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45e179
RSP: 002b:00007fc6672e5c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 0000000000032580 RCX: 000000000045e179
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000020000040
RBP: 000000000118cf90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffcb95519cf R14: 00007fc6672e69c0 R15: 000000000118cf4c
Code: 8d b3 18 01 00 00 49 c1 ed 03 41 83 e4 07 49 01 ed 41 83 c4 03 e8 a4 82 70 01 e8 7f 82 b7 ff 48 c7 c7 00 28 c1 87 e8 13 78 b1 04 <41> 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 cf 04 00 00 8b 83 f8
RIP: __read_once_size include/linux/compiler.h:183 [inline] RSP: ffff8880342ef870
RIP: atomic_read arch/x86/include/asm/atomic.h:27 [inline] RSP: ffff8880342ef870
RIP: dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761 RSP: ffff8880342ef870
CR2: fffffbfff000014f
---[ end trace e8c00baf9edb1478 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Sep 23, 2020, 2:12:16 PM9/23/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11a24b07900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=112d8f8b900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b26170...@syzkaller.appspotmail.com
audit: type=1400 audit(1600884575.761:8): avc: denied { execmem } for pid=6360 comm="syz-executor985" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
IPVS: ftp: loaded support on port[0] = 21
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
Quota error (device loop0): qtree_write_dquot: Error -2147481216 occurred while creating quota
RAX: dffffc0000000000 RBX: ffffffff80000980 RCX: 0000000000005ad2
R10: ffff88808bf1acb0 R11: ffff88808bf1a400 R12: 0000000000000003
dquot_drop fs/quota/dquot.c:1589 [inline]
dquot_drop+0x13e/0x190 fs/quota/dquot.c:1567
ext4_clear_inode+0x31/0x1d0 fs/ext4/super.c:1110
ext4_evict_inode+0x1f1/0x1500 fs/ext4/inode.c:347
evict+0x2c8/0x700 fs/inode.c:555
dispose_list+0x109/0x1e0 fs/inode.c:590
evict_inodes+0x2cd/0x3a0 fs/inode.c:640
generic_shutdown_super+0xb3/0x370 fs/super.c:438
kill_block_super+0x95/0xe0 fs/super.c:1161
deactivate_locked_super+0x6c/0xd0 fs/super.c:319
deactivate_super+0x7f/0xa0 fs/super.c:350
cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183
task_work_run+0x11f/0x190 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa08/0x27f0 kernel/exit.c:865
do_group_exit+0x100/0x2e0 kernel/exit.c:962
SYSC_exit_group kernel/exit.c:973 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:971
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x443918
RSP: 002b:00007ffd42a6a6e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000443918
RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
RBP: 00000000004c3e30 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d6180 R14: 0000000000000000 R15: 0000000000000000
RIP: atomic_read arch/x86/include/asm/atomic.h:27 [inline] RSP: ffff88808c7c7980
RIP: dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761 RSP: ffff88808c7c7980
CR2: fffffbfff000014f
---[ end trace 05838537344d2dac ]---
HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link: https://syzkaller.appspot.com/bug?extid=b261701f02d8a7b36733
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1289929b900000
dashboard link: https://syzkaller.appspot.com/bug?extid=b261701f02d8a7b36733
compiler: gcc (GCC) 10.1.0-syz 20200507
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=112d8f8b900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b26170...@syzkaller.appspotmail.com
IPVS: ftp: loaded support on port[0] = 21
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
Quota error (device loop0): qtree_write_dquot: Error -2147481216 occurred while creating quota
BUG: unable to handle kernel paging request at fffffbfff000014f
IP: __read_once_size include/linux/compiler.h:183 [inline]
IP: atomic_read arch/x86/include/asm/atomic.h:27 [inline]
IP: dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761
PGD 21ffec067 P4D 21ffec067 PUD 21ffeb067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 6361 Comm: syz-executor985 Not tainted 4.14.198-syzkaller #0
IP: __read_once_size include/linux/compiler.h:183 [inline]
IP: atomic_read arch/x86/include/asm/atomic.h:27 [inline]
IP: dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761
PGD 21ffec067 P4D 21ffec067 PUD 21ffeb067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88808bf1a400 task.stack: ffff88808c7c0000
RIP: 0010:__read_once_size include/linux/compiler.h:183 [inline]
RIP: 0010:atomic_read arch/x86/include/asm/atomic.h:27 [inline]
RIP: 0010:dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761
RSP: 0018:ffff88808c7c7980 EFLAGS: 00010282
RIP: 0010:atomic_read arch/x86/include/asm/atomic.h:27 [inline]
RIP: 0010:dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761
RAX: dffffc0000000000 RBX: ffffffff80000980 RCX: 0000000000005ad2
RDX: 1ffffffff0f82502 RSI: 0000000000000001 RDI: ffffffff87c12804
RBP: dffffc0000000000 R08: ffffffff8a0aa010 R09: 00000000000401c9
R10: ffff88808bf1acb0 R11: ffff88808bf1a400 R12: 0000000000000003
R13: fffffbfff000014f R14: ffffffff80000a98 R15: ffffffff80000a78
FS: 0000000001448880(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff000014f CR3: 0000000007c6a000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dqput fs/quota/dquot.c:748 [inline]
dqput_all fs/quota/dquot.c:391 [inline]
__dquot_drop+0x193/0x250 fs/quota/dquot.c:1564
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dqput fs/quota/dquot.c:748 [inline]
dqput_all fs/quota/dquot.c:391 [inline]
dquot_drop fs/quota/dquot.c:1589 [inline]
dquot_drop+0x13e/0x190 fs/quota/dquot.c:1567
ext4_clear_inode+0x31/0x1d0 fs/ext4/super.c:1110
ext4_evict_inode+0x1f1/0x1500 fs/ext4/inode.c:347
evict+0x2c8/0x700 fs/inode.c:555
dispose_list+0x109/0x1e0 fs/inode.c:590
evict_inodes+0x2cd/0x3a0 fs/inode.c:640
generic_shutdown_super+0xb3/0x370 fs/super.c:438
kill_block_super+0x95/0xe0 fs/super.c:1161
deactivate_locked_super+0x6c/0xd0 fs/super.c:319
deactivate_super+0x7f/0xa0 fs/super.c:350
cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183
task_work_run+0x11f/0x190 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa08/0x27f0 kernel/exit.c:865
do_group_exit+0x100/0x2e0 kernel/exit.c:962
SYSC_exit_group kernel/exit.c:973 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:971
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x443918
RSP: 002b:00007ffd42a6a6e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000443918
RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
RBP: 00000000004c3e30 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d6180 R14: 0000000000000000 R15: 0000000000000000
Code: 8d b3 18 01 00 00 49 c1 ed 03 41 83 e4 07 49 01 ed 41 83 c4 03 e8 a4 82 70 01 e8 7f 82 b7 ff 48 c7 c7 00 28 c1 87 e8 13 78 b1 04 <41> 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 cf 04 00 00 8b 83 f8
RIP: __read_once_size include/linux/compiler.h:183 [inline] RSP: ffff88808c7c7980
RIP: atomic_read arch/x86/include/asm/atomic.h:27 [inline] RSP: ffff88808c7c7980
RIP: dqput.part.0+0x9d/0x750 fs/quota/dquot.c:761 RSP: ffff88808c7c7980
CR2: fffffbfff000014f
---[ end trace 05838537344d2dac ]---
syzbot
Jan 21, 2021, 8:20:15 AM1/21/21
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit a9c625fcddc078624e1e7a673443b29c71be3431
Author: Jan Kara <ja...@suse.cz>
Date: Mon Nov 2 15:16:29 2020 +0000
quota: Sanity-check quota file headers on load
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13f1d7e7500000
start commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10bb1deb900000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: quota: Sanity-check quota file headers on load
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit a9c625fcddc078624e1e7a673443b29c71be3431
Author: Jan Kara <ja...@suse.cz>
Date: Mon Nov 2 15:16:29 2020 +0000
quota: Sanity-check quota file headers on load
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13f1d7e7500000
start commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link: https://syzkaller.appspot.com/bug?extid=b261701f02d8a7b36733
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15ec55eb900000
dashboard link: https://syzkaller.appspot.com/bug?extid=b261701f02d8a7b36733
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10bb1deb900000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: quota: Sanity-check quota file headers on load
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages