general protection fault in errseq_set
12 views
Skip to first unread message
syzbot
Dec 15, 2022, 7:36:41 PM12/15/22
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13d49100480000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=bc6a15d39abc902b058e
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc6a15...@syzkaller.appspotmail.com
XFS (loop3): Torn write (CRC failure) detected at log block 0x10. Truncating head block from 0x20.
XFS (loop1): First 128 bytes of corrupted metadata buffer:
XFS (loop3): Ending clean mount
kasan: GPF could be caused by NULL-ptr deref or user memory access
XFS (loop0): Please umount the filesystem and rectify the problem(s)
general protection fault: 0000 [#1] PREEMPT SMP KASAN
XFS (loop3): Metadata corruption detected at xfs_allocbt_verify+0x327/0x4a0 fs/xfs/libxfs/xfs_alloc_btree.c:329, xfs_allocbt block 0x4
CPU: 1 PID: 19175 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
XFS (loop3): Unmount and run xfs_repair
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
XFS (loop3): First 128 bytes of corrupted metadata buffer:
RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline]
RIP: 0010:errseq_set+0x26/0x150 lib/errseq.c:71
Code: 1f 44 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb e8 3b 6a ec fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f4
RSP: 0018:ffff888096ffef40 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: ffffc90006e7f000
000000007d9c4160: 07 42 54 42 00 00 00 01 ff ff ff ff ff ff ff ff .BTB............
RDX: 000000000000002d RSI: ffffffff83761b35 RDI: 0000000000000168
RBP: 00000000ffffff8b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffff8b R15: ffff888096fff280
FS: 00007ff0da1af700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
0000000089286b73: 00 00 00 42 00 00 7f be 00 00 00 42 00 00 7f be ...B.......B....
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
00000000e63cf96f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CR2: 0000001b2e131000 CR3: 00000000af4ff000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__filemap_set_wb_err+0x21/0x280 mm/filemap.c:700
filemap_set_wb_err include/linux/fs.h:2707 [inline]
mapping_set_error include/linux/pagemap.h:54 [inline]
xfs_writepage_map fs/xfs/xfs_aops.c:796 [inline]
xfs_do_writepage+0xb87/0xfa0 fs/xfs/xfs_aops.c:908
00000000ea44e816: 07 42 54 42 00 00 00 01 ff ff ff ff ff ff ff ff .BTB............
write_cache_pages+0x802/0x12d0 mm/page-writeback.c:2240
0000000054132e93: 00 00 00 42 00 00 7f be 00 00 00 42 00 00 7f be ...B.......B....
xfs_vm_writepages+0xe9/0x170 fs/xfs/xfs_aops.c:943
00000000354d4107: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
audit: type=1800 audit(1671150981.051:347): pid=19264 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="bus" dev="loop3" ino=41 res=0
do_writepages+0xe5/0x290 mm/page-writeback.c:2344
0000000021f59129: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000063d590c8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
__filemap_fdatawrite_range+0x27d/0x350 mm/filemap.c:446
000000007e1d15e1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
file_write_and_wait_range+0x93/0x100 mm/filemap.c:776
00000000e320211f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
xfs_file_fsync+0x161/0xa40 fs/xfs/xfs_file.c:118
00000000ed849804: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
vfs_fsync_range+0x13a/0x220 fs/sync.c:197
generic_write_sync include/linux/fs.h:2750 [inline]
xfs_file_buffered_aio_write+0xa0f/0xbf0 fs/xfs/xfs_file.c:686
00000000192b5c29: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000085799994: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000000a5be0275: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000033999a62: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
XFS (loop3): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x4 len 1 error 117
xfs_file_write_iter+0x346/0x450 fs/xfs/xfs_file.c:726
00000000d76f2f02: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
call_write_iter include/linux/fs.h:1821 [inline]
do_iter_readv_writev+0x668/0x790 fs/read_write.c:681
XFS (loop1): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x4 len 1 error 117
do_iter_write+0x182/0x5d0 fs/read_write.c:960
vfs_iter_write+0x70/0xa0 fs/read_write.c:973
XFS (loop1): xfs_do_force_shutdown(0x8) called from line 439 of file fs/xfs/libxfs/xfs_defer.c. Return address = 00000000916256f9
iter_file_splice_write+0x60d/0xbb0 fs/splice.c:750
XFS (loop3): xfs_do_force_shutdown(0x8) called from line 439 of file fs/xfs/libxfs/xfs_defer.c. Return address = 00000000916256f9
XFS (loop1): Corruption of in-memory data detected. Shutting down filesystem
XFS (loop3): Corruption of in-memory data detected. Shutting down filesystem
do_splice_from fs/splice.c:852 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1025
splice_direct_to_actor+0x33f/0x8d0 fs/splice.c:980
XFS (loop1): Please umount the filesystem and rectify the problem(s)
do_splice_direct+0x1a7/0x270 fs/splice.c:1068
XFS (loop3): Please umount the filesystem and rectify the problem(s)
do_sendfile+0x550/0xc30 fs/read_write.c:1447
__do_sys_sendfile64 fs/read_write.c:1508 [inline]
__se_sys_sendfile64+0x147/0x160 fs/read_write.c:1494
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ff0dbc3d0d9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff0da1af168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007ff0dbd5cf80 RCX: 00007ff0dbc3d0d9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007ff0dbc98ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 000100000020100f R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcb9f880af R14: 00007ff0da1af300 R15: 0000000000022000
Modules linked in:
XFS (loop0): Unmounting Filesystem
---[ end trace bf0f7efb4f9d87d8 ]---
XFS (loop3): Unmounting Filesystem
RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline]
RIP: 0010:errseq_set+0x26/0x150 lib/errseq.c:71
Code: 1f 44 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb e8 3b 6a ec fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f4
RSP: 0018:ffff888096ffef40 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: ffffc90006e7f000
RDX: 000000000000002d RSI: ffffffff83761b35 RDI: 0000000000000168
RBP: 00000000ffffff8b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffff8b R15: ffff888096fff280
FS: 00007ff0da1af700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e1d67b008 CR3: 00000000af4ff000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 44 00 00 add %r8b,(%rax)
3: 41 57 push %r15
5: 41 56 push %r14
7: 41 89 f6 mov %esi,%r14d
a: 41 55 push %r13
c: 41 54 push %r12
e: 55 push %rbp
f: 53 push %rbx
10: 48 89 fb mov %rdi,%rbx
13: e8 3b 6a ec fd callq 0xfdec6a53
18: 48 89 da mov %rbx,%rdx
1b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
22: fc ff df
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2d: 48 89 d8 mov %rbx,%rax
30: 83 e0 07 and $0x7,%eax
33: 83 c0 03 add $0x3,%eax
36: 38 d0 cmp %dl,%al
38: 7c 08 jl 0x42
3a: 84 d2 test %dl,%dl
3c: 0f .byte 0xf
3d: 85 f4 test %esi,%esp
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13d49100480000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=bc6a15d39abc902b058e
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc6a15...@syzkaller.appspotmail.com
XFS (loop3): Torn write (CRC failure) detected at log block 0x10. Truncating head block from 0x20.
XFS (loop1): First 128 bytes of corrupted metadata buffer:
XFS (loop3): Ending clean mount
kasan: GPF could be caused by NULL-ptr deref or user memory access
XFS (loop0): Please umount the filesystem and rectify the problem(s)
general protection fault: 0000 [#1] PREEMPT SMP KASAN
XFS (loop3): Metadata corruption detected at xfs_allocbt_verify+0x327/0x4a0 fs/xfs/libxfs/xfs_alloc_btree.c:329, xfs_allocbt block 0x4
CPU: 1 PID: 19175 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
XFS (loop3): Unmount and run xfs_repair
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
XFS (loop3): First 128 bytes of corrupted metadata buffer:
RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline]
RIP: 0010:errseq_set+0x26/0x150 lib/errseq.c:71
Code: 1f 44 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb e8 3b 6a ec fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f4
RSP: 0018:ffff888096ffef40 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: ffffc90006e7f000
000000007d9c4160: 07 42 54 42 00 00 00 01 ff ff ff ff ff ff ff ff .BTB............
RDX: 000000000000002d RSI: ffffffff83761b35 RDI: 0000000000000168
RBP: 00000000ffffff8b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffff8b R15: ffff888096fff280
FS: 00007ff0da1af700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
0000000089286b73: 00 00 00 42 00 00 7f be 00 00 00 42 00 00 7f be ...B.......B....
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
00000000e63cf96f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CR2: 0000001b2e131000 CR3: 00000000af4ff000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__filemap_set_wb_err+0x21/0x280 mm/filemap.c:700
filemap_set_wb_err include/linux/fs.h:2707 [inline]
mapping_set_error include/linux/pagemap.h:54 [inline]
xfs_writepage_map fs/xfs/xfs_aops.c:796 [inline]
xfs_do_writepage+0xb87/0xfa0 fs/xfs/xfs_aops.c:908
00000000ea44e816: 07 42 54 42 00 00 00 01 ff ff ff ff ff ff ff ff .BTB............
write_cache_pages+0x802/0x12d0 mm/page-writeback.c:2240
0000000054132e93: 00 00 00 42 00 00 7f be 00 00 00 42 00 00 7f be ...B.......B....
xfs_vm_writepages+0xe9/0x170 fs/xfs/xfs_aops.c:943
00000000354d4107: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
audit: type=1800 audit(1671150981.051:347): pid=19264 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="bus" dev="loop3" ino=41 res=0
do_writepages+0xe5/0x290 mm/page-writeback.c:2344
0000000021f59129: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000063d590c8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
__filemap_fdatawrite_range+0x27d/0x350 mm/filemap.c:446
000000007e1d15e1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
file_write_and_wait_range+0x93/0x100 mm/filemap.c:776
00000000e320211f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
xfs_file_fsync+0x161/0xa40 fs/xfs/xfs_file.c:118
00000000ed849804: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
vfs_fsync_range+0x13a/0x220 fs/sync.c:197
generic_write_sync include/linux/fs.h:2750 [inline]
xfs_file_buffered_aio_write+0xa0f/0xbf0 fs/xfs/xfs_file.c:686
00000000192b5c29: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000085799994: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000000a5be0275: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000033999a62: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
XFS (loop3): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x4 len 1 error 117
xfs_file_write_iter+0x346/0x450 fs/xfs/xfs_file.c:726
00000000d76f2f02: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
call_write_iter include/linux/fs.h:1821 [inline]
do_iter_readv_writev+0x668/0x790 fs/read_write.c:681
XFS (loop1): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x4 len 1 error 117
do_iter_write+0x182/0x5d0 fs/read_write.c:960
vfs_iter_write+0x70/0xa0 fs/read_write.c:973
XFS (loop1): xfs_do_force_shutdown(0x8) called from line 439 of file fs/xfs/libxfs/xfs_defer.c. Return address = 00000000916256f9
iter_file_splice_write+0x60d/0xbb0 fs/splice.c:750
XFS (loop3): xfs_do_force_shutdown(0x8) called from line 439 of file fs/xfs/libxfs/xfs_defer.c. Return address = 00000000916256f9
XFS (loop1): Corruption of in-memory data detected. Shutting down filesystem
XFS (loop3): Corruption of in-memory data detected. Shutting down filesystem
do_splice_from fs/splice.c:852 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1025
splice_direct_to_actor+0x33f/0x8d0 fs/splice.c:980
XFS (loop1): Please umount the filesystem and rectify the problem(s)
do_splice_direct+0x1a7/0x270 fs/splice.c:1068
XFS (loop3): Please umount the filesystem and rectify the problem(s)
do_sendfile+0x550/0xc30 fs/read_write.c:1447
__do_sys_sendfile64 fs/read_write.c:1508 [inline]
__se_sys_sendfile64+0x147/0x160 fs/read_write.c:1494
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ff0dbc3d0d9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff0da1af168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007ff0dbd5cf80 RCX: 00007ff0dbc3d0d9
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007ff0dbc98ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 000100000020100f R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcb9f880af R14: 00007ff0da1af300 R15: 0000000000022000
Modules linked in:
XFS (loop0): Unmounting Filesystem
---[ end trace bf0f7efb4f9d87d8 ]---
XFS (loop3): Unmounting Filesystem
RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline]
RIP: 0010:errseq_set+0x26/0x150 lib/errseq.c:71
Code: 1f 44 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb e8 3b 6a ec fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f4
RSP: 0018:ffff888096ffef40 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: ffffc90006e7f000
RDX: 000000000000002d RSI: ffffffff83761b35 RDI: 0000000000000168
RBP: 00000000ffffff8b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffff8b R15: ffff888096fff280
FS: 00007ff0da1af700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e1d67b008 CR3: 00000000af4ff000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 44 00 00 add %r8b,(%rax)
3: 41 57 push %r15
5: 41 56 push %r14
7: 41 89 f6 mov %esi,%r14d
a: 41 55 push %r13
c: 41 54 push %r12
e: 55 push %rbp
f: 53 push %rbx
10: 48 89 fb mov %rdi,%rbx
13: e8 3b 6a ec fd callq 0xfdec6a53
18: 48 89 da mov %rbx,%rdx
1b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
22: fc ff df
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2d: 48 89 d8 mov %rbx,%rax
30: 83 e0 07 and $0x7,%eax
33: 83 c0 03 add $0x3,%eax
36: 38 d0 cmp %dl,%al
38: 7c 08 jl 0x42
3a: 84 d2 test %dl,%dl
3c: 0f .byte 0xf
3d: 85 f4 test %esi,%esp
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Dec 20, 2022, 4:52:34 AM12/20/22
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14daf21b880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1170d477880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/4175419cffec/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc6a15...@syzkaller.appspotmail.com
00000000839f475b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
XFS (loop0): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x4 len 1 error 117
XFS (loop0): page discard on page 00000000f9b999c7, inode 0x29, offset 0.
kasan: CONFIG_KASAN_INLINE enabled
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: 0000000000000000
FS: 00007fbe3f060700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
xfs_vm_writepages+0xe9/0x170 fs/xfs/xfs_aops.c:943
do_writepages+0xe5/0x290 mm/page-writeback.c:2344
__filemap_fdatawrite_range+0x27d/0x350 mm/filemap.c:446
file_write_and_wait_range+0x93/0x100 mm/filemap.c:776
xfs_file_fsync+0x161/0xa40 fs/xfs/xfs_file.c:118
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbe3f060208 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007fbe3f1477a8 RCX: 00007fbe3f0b7d29
R10: 000100000020100f R11: 0000000000000246 R12: 00007fbe3f1477ac
R13: 00007ffe48fa215f R14: 00007fbe3f060300 R15: 0000000000022000
Modules linked in:
---[ end trace e5b9f5d266de5e3f ]---
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: 0000000000000000
FS: 00007fbe3f060700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=bc6a15d39abc902b058e
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12678810480000
dashboard link: https://syzkaller.appspot.com/bug?extid=bc6a15d39abc902b058e
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1170d477880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc6a15...@syzkaller.appspotmail.com
XFS (loop0): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x4 len 1 error 117
XFS (loop0): page discard on page 00000000f9b999c7, inode 0x29, offset 0.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8332 Comm: syz-executor129 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline]
RIP: 0010:errseq_set+0x26/0x150 lib/errseq.c:71
Code: 1f 44 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb e8 3b 6a ec fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f4
RSP: 0018:ffff8880aea96f40 EFLAGS: 00010206
RIP: 0010:errseq_set+0x26/0x150 lib/errseq.c:71
Code: 1f 44 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb e8 3b 6a ec fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f4
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: 0000000000000000
RDX: 000000000000002d RSI: ffffffff83761b35 RDI: 0000000000000168
RBP: 00000000ffffff8b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffff8b R15: ffff8880aea97280
RBP: 00000000ffffff8b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
FS: 00007fbe3f060700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe38c1e718 CR3: 00000000abdf0000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__filemap_set_wb_err+0x21/0x280 mm/filemap.c:700
filemap_set_wb_err include/linux/fs.h:2707 [inline]
mapping_set_error include/linux/pagemap.h:54 [inline]
xfs_writepage_map fs/xfs/xfs_aops.c:796 [inline]
xfs_do_writepage+0xb87/0xfa0 fs/xfs/xfs_aops.c:908
write_cache_pages+0x802/0x12d0 mm/page-writeback.c:2240
__filemap_set_wb_err+0x21/0x280 mm/filemap.c:700
filemap_set_wb_err include/linux/fs.h:2707 [inline]
mapping_set_error include/linux/pagemap.h:54 [inline]
xfs_writepage_map fs/xfs/xfs_aops.c:796 [inline]
xfs_do_writepage+0xb87/0xfa0 fs/xfs/xfs_aops.c:908
xfs_vm_writepages+0xe9/0x170 fs/xfs/xfs_aops.c:943
do_writepages+0xe5/0x290 mm/page-writeback.c:2344
__filemap_fdatawrite_range+0x27d/0x350 mm/filemap.c:446
file_write_and_wait_range+0x93/0x100 mm/filemap.c:776
xfs_file_fsync+0x161/0xa40 fs/xfs/xfs_file.c:118
vfs_fsync_range+0x13a/0x220 fs/sync.c:197
generic_write_sync include/linux/fs.h:2750 [inline]
xfs_file_buffered_aio_write+0xa0f/0xbf0 fs/xfs/xfs_file.c:686
xfs_file_write_iter+0x346/0x450 fs/xfs/xfs_file.c:726
generic_write_sync include/linux/fs.h:2750 [inline]
xfs_file_buffered_aio_write+0xa0f/0xbf0 fs/xfs/xfs_file.c:686
call_write_iter include/linux/fs.h:1821 [inline]
do_iter_readv_writev+0x668/0x790 fs/read_write.c:681
do_iter_readv_writev+0x668/0x790 fs/read_write.c:681
do_iter_write+0x182/0x5d0 fs/read_write.c:960
vfs_iter_write+0x70/0xa0 fs/read_write.c:973
iter_file_splice_write+0x60d/0xbb0 fs/splice.c:750
vfs_iter_write+0x70/0xa0 fs/read_write.c:973
do_splice_from fs/splice.c:852 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1025
splice_direct_to_actor+0x33f/0x8d0 fs/splice.c:980
do_splice_direct+0x1a7/0x270 fs/splice.c:1068
direct_splice_actor+0x115/0x160 fs/splice.c:1025
splice_direct_to_actor+0x33f/0x8d0 fs/splice.c:980
do_sendfile+0x550/0xc30 fs/read_write.c:1447
__do_sys_sendfile64 fs/read_write.c:1508 [inline]
__se_sys_sendfile64+0x147/0x160 fs/read_write.c:1494
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fbe3f0b7d29
__do_sys_sendfile64 fs/read_write.c:1508 [inline]
__se_sys_sendfile64+0x147/0x160 fs/read_write.c:1494
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbe3f060208 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007fbe3f1477a8 RCX: 00007fbe3f0b7d29
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007fbe3f1477a0 R08: 0000000000000000 R09: 0000000000000000
R10: 000100000020100f R11: 0000000000000246 R12: 00007fbe3f1477ac
R13: 00007ffe48fa215f R14: 00007fbe3f060300 R15: 0000000000022000
Modules linked in:
---[ end trace e5b9f5d266de5e3f ]---
RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline]
RIP: 0010:errseq_set+0x26/0x150 lib/errseq.c:71
Code: 1f 44 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb e8 3b 6a ec fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f4
RSP: 0018:ffff8880aea96f40 EFLAGS: 00010206
RIP: 0010:errseq_set+0x26/0x150 lib/errseq.c:71
Code: 1f 44 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb e8 3b 6a ec fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f4
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: 0000000000000000
RDX: 000000000000002d RSI: ffffffff83761b35 RDI: 0000000000000168
RBP: 00000000ffffff8b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000ffffff8b R15: ffff8880aea97280
RBP: 00000000ffffff8b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
FS: 00007fbe3f060700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe38c1e718 CR3: 00000000abdf0000 CR4: 00000000003406f0
syzbot
Dec 24, 2022, 10:39:46 AM12/24/22
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c4215ee4771b Linux 4.14.302
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=136a4d28480000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a9988fe055c9527
dashboard link: https://syzkaller.appspot.com/bug?extid=53e63375cb1fd33f1b6b
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=134a6e40480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c93ba055d204/disk-c4215ee4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfbc929a33c1/vmlinux-c4215ee4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/444658051770/bzImage-c4215ee4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c898a2cc4041/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+53e633...@syzkaller.appspotmail.com
XFS (loop0): metadata I/O error: block 0x4 ("xfs_trans_read_buf_map") error 117 numblks 1
XFS (loop0): page discard on page ffffea00022ceb80, inode 0x29, offset 0.
CPU: 0 PID: 7986 Comm: syz-executor302 Not tainted 4.14.302-syzkaller #0
RIP: 0010:__read_once_size include/linux/compiler.h:185 [inline]
RIP: 0010:errseq_set+0x27/0xf0 lib/errseq.c:71
RSP: 0018:ffff8880b33df180 EFLAGS: 00010206
RBP: 00000000ffffff8b R08: ffff8880ba434d30 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffff8b
R13: ffff8880b33df4f0 R14: 00000000ffffff8b R15: ffff88808cb7b340
FS: 00007f90b1552700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
filemap_set_wb_err include/linux/fs.h:2641 [inline]
mapping_set_error include/linux/pagemap.h:52 [inline]
xfs_writepage_map fs/xfs/xfs_aops.c:1034 [inline]
xfs_do_writepage+0xcf0/0x13d0 fs/xfs/xfs_aops.c:1149
write_cache_pages+0x505/0xd20 mm/page-writeback.c:2257
xfs_vm_writepages+0x258/0x340 fs/xfs/xfs_aops.c:1188
do_writepages+0xc3/0x240 mm/page-writeback.c:2361
__filemap_fdatawrite_range+0x236/0x310 mm/filemap.c:346
file_write_and_wait_range+0x86/0xd0 mm/filemap.c:678
xfs_file_fsync+0x123/0x960 fs/xfs/xfs_file.c:143
vfs_fsync_range+0x103/0x260 fs/sync.c:196
generic_write_sync include/linux/fs.h:2684 [inline]
xfs_file_write_iter+0x4df/0x680 fs/xfs/xfs_file.c:749
call_write_iter include/linux/fs.h:1780 [inline]
do_iter_readv_writev+0x4cf/0x5f0 fs/read_write.c:675
do_iter_write+0x152/0x550 fs/read_write.c:954
vfs_iter_write+0x70/0xa0 fs/read_write.c:967
iter_file_splice_write+0x52b/0xa90 fs/splice.c:749
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1018
splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
do_splice_direct+0x164/0x210 fs/splice.c:1061
do_sendfile+0x47f/0xb30 fs/read_write.c:1441
SYSC_sendfile64 fs/read_write.c:1502 [inline]
SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f90b15a6569
RSP: 002b:00007f90b15522f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f90b16367a0 RCX: 00007f90b15a6569
R10: 000100000020100f R11: 0000000000000246 R12: 00007f90b15f80c0
R13: 0000000020000500 R14: 0030656c69662f2e R15: 00007f90b16367a8
Code: 0f 1f 40 00 41 56 41 55 41 54 55 89 f5 53 48 89 fb 48 83 ec 08 e8 5a a0 3b fe 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP: __read_once_size include/linux/compiler.h:185 [inline] RSP: ffff8880b33df180
RIP: errseq_set+0x27/0xf0 lib/errseq.c:71 RSP: ffff8880b33df180
---[ end trace a2a768122a726c4c ]---
----------------
Code disassembly (best guess):
0: 0f 1f 40 00 nopl 0x0(%rax)
4: 41 56 push %r14
6: 41 55 push %r13
8: 41 54 push %r12
a: 55 push %rbp
b: 89 f5 mov %esi,%ebp
d: 53 push %rbx
e: 48 89 fb mov %rdi,%rbx
11: 48 83 ec 08 sub $0x8,%rsp
15: e8 5a a0 3b fe callq 0xfe3ba074
1a: 48 89 da mov %rbx,%rdx
1d: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
24: fc ff df
27: 48 c1 ea 03 shr $0x3,%rdx
* 2b: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2f: 48 89 d8 mov %rbx,%rax
32: 83 e0 07 and $0x7,%eax
35: 83 c0 03 add $0x3,%eax
38: 38 d0 cmp %dl,%al
3a: 7c 08 jl 0x44
3c: 84 d2 test %dl,%dl
3e: 0f .byte 0xf
3f: 85 .byte 0x85
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: c4215ee4771b Linux 4.14.302
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=136a4d28480000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a9988fe055c9527
dashboard link: https://syzkaller.appspot.com/bug?extid=53e63375cb1fd33f1b6b
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1229fd08480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=134a6e40480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c93ba055d204/disk-c4215ee4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfbc929a33c1/vmlinux-c4215ee4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/444658051770/bzImage-c4215ee4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c898a2cc4041/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
XFS (loop0): metadata I/O error: block 0x4 ("xfs_trans_read_buf_map") error 117 numblks 1
XFS (loop0): page discard on page ffffea00022ceb80, inode 0x29, offset 0.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7986 Comm: syz-executor302 Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff8880b1a525c0 task.stack: ffff8880b33d8000
RIP: 0010:__read_once_size include/linux/compiler.h:185 [inline]
RIP: 0010:errseq_set+0x27/0xf0 lib/errseq.c:71
RSP: 0018:ffff8880b33df180 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000168 RCX: 0000000000000000
RDX: 000000000000002d RSI: 00000000ffffff8b RDI: 0000000000000168
RBP: 00000000ffffff8b R08: ffff8880ba434d30 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffff8b
R13: ffff8880b33df4f0 R14: 00000000ffffff8b R15: ffff88808cb7b340
FS: 00007f90b1552700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f48c3af1000 CR3: 0000000099179000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__filemap_set_wb_err+0x22/0x260 mm/filemap.c:602
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
filemap_set_wb_err include/linux/fs.h:2641 [inline]
mapping_set_error include/linux/pagemap.h:52 [inline]
xfs_writepage_map fs/xfs/xfs_aops.c:1034 [inline]
xfs_do_writepage+0xcf0/0x13d0 fs/xfs/xfs_aops.c:1149
write_cache_pages+0x505/0xd20 mm/page-writeback.c:2257
xfs_vm_writepages+0x258/0x340 fs/xfs/xfs_aops.c:1188
do_writepages+0xc3/0x240 mm/page-writeback.c:2361
__filemap_fdatawrite_range+0x236/0x310 mm/filemap.c:346
file_write_and_wait_range+0x86/0xd0 mm/filemap.c:678
xfs_file_fsync+0x123/0x960 fs/xfs/xfs_file.c:143
vfs_fsync_range+0x103/0x260 fs/sync.c:196
generic_write_sync include/linux/fs.h:2684 [inline]
xfs_file_write_iter+0x4df/0x680 fs/xfs/xfs_file.c:749
call_write_iter include/linux/fs.h:1780 [inline]
do_iter_readv_writev+0x4cf/0x5f0 fs/read_write.c:675
do_iter_write+0x152/0x550 fs/read_write.c:954
vfs_iter_write+0x70/0xa0 fs/read_write.c:967
iter_file_splice_write+0x52b/0xa90 fs/splice.c:749
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1018
splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
do_splice_direct+0x164/0x210 fs/splice.c:1061
do_sendfile+0x47f/0xb30 fs/read_write.c:1441
SYSC_sendfile64 fs/read_write.c:1502 [inline]
SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f90b15a6569
RSP: 002b:00007f90b15522f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f90b16367a0 RCX: 00007f90b15a6569
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f90b16031e4 R08: 0000000000000000 R09: 0000000000000000
R10: 000100000020100f R11: 0000000000000246 R12: 00007f90b15f80c0
R13: 0000000020000500 R14: 0030656c69662f2e R15: 00007f90b16367a8
Code: 0f 1f 40 00 41 56 41 55 41 54 55 89 f5 53 48 89 fb 48 83 ec 08 e8 5a a0 3b fe 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP: __read_once_size include/linux/compiler.h:185 [inline] RSP: ffff8880b33df180
RIP: errseq_set+0x27/0xf0 lib/errseq.c:71 RSP: ffff8880b33df180
---[ end trace a2a768122a726c4c ]---
----------------
Code disassembly (best guess):
0: 0f 1f 40 00 nopl 0x0(%rax)
4: 41 56 push %r14
6: 41 55 push %r13
8: 41 54 push %r12
a: 55 push %rbp
b: 89 f5 mov %esi,%ebp
d: 53 push %rbx
e: 48 89 fb mov %rdi,%rbx
11: 48 83 ec 08 sub $0x8,%rsp
15: e8 5a a0 3b fe callq 0xfe3ba074
1a: 48 89 da mov %rbx,%rdx
1d: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
24: fc ff df
27: 48 c1 ea 03 shr $0x3,%rdx
* 2b: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2f: 48 89 d8 mov %rbx,%rax
32: 83 e0 07 and $0x7,%eax
35: 83 c0 03 add $0x3,%eax
38: 38 d0 cmp %dl,%al
3a: 7c 08 jl 0x44
3c: 84 d2 test %dl,%dl
3e: 0f .byte 0xf
3f: 85 .byte 0x85
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
https://goo.gl/tpsmEJ#testing-patches
Reply all
Reply to author
Forward
0 new messages