WARNING in inc_nlink (2)

syzbot

unread,

Nov 1, 2020, 10:25:21 AM11/1/20

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: f5d8eef0 Linux 4.19.154
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1251702c500000
kernel config: https://syzkaller.appspot.com/x/.config?x=be9b9357b4680aa1
dashboard link: https://syzkaller.appspot.com/bug?extid=3fbbd90094e3d827144b
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3fbbd9...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 4262 at fs/inode.c:343 inc_nlink.cold+0x11/0x18 fs/inode.c:343
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 4262 Comm: syz-executor.2 Not tainted 4.19.154-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186
__warn.cold+0x20/0x61 kernel/panic.c:541
report_bug+0x262/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:inc_nlink.cold+0x11/0x18 fs/inode.c:343
Code: c0 74 04 3c 03 7e 08 8b 5d 48 e9 65 7e ff ff 4c 89 e7 e8 18 96 ee ff eb ee e8 51 6d b8 ff 48 c7 c7 80 a6 74 88 e8 54 67 a3 ff <0f> 0b e9 a7 7f ff ff e8 39 6d b8 ff 48 8d 7b 40 b8 ff ff 37 00 48
RSP: 0018:ffff88804185fdf0 EFLAGS: 00010282
RAX: 0000000000000024 RBX: ffff88808b301948 RCX: 0000000000000000
RDX: 00000000000093d8 RSI: ffffffff814fdb21 RDI: ffffed100830bfb0
RBP: 0000000000000000 R08: 0000000000000024 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff88808b301990
R13: ffff88804914e160 R14: 000000000000007e R15: 0000000000000021
inode_inc_link_count include/linux/fs.h:2102 [inline]
sysv_mkdir+0x21/0x150 fs/sysv/namei.c:131
vfs_mkdir+0x508/0x7a0 fs/namei.c:3819
do_mkdirat+0x262/0x2d0 fs/namei.c:3842
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45deb9
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd1edf3ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000021000 RCX: 000000000045deb9
RDX: 0000000000000000 RSI: 0000000000000023 RDI: 0000000020000080
RBP: 000000000118c000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bfd4
R13: 00007ffe6d9e9b4f R14: 00007fd1edf3f9c0 R15: 000000000118bfd4
Kernel Offset: disabled
Rebooting in 86400 seconds..

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Nov 1, 2020, 10:39:14 AM11/1/20

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: f5d8eef0 Linux 4.19.154
git tree: linux-4.19.y

console output: https://syzkaller.appspot.com/x/log.txt?x=1414ffda500000

kernel config: https://syzkaller.appspot.com/x/.config?x=be9b9357b4680aa1
dashboard link: https://syzkaller.appspot.com/bug?extid=3fbbd90094e3d827144b
compiler: gcc (GCC) 10.1.0-syz 20200507

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1756fa1a500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16225fda500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3fbbd9...@syzkaller.appspotmail.com

VFS: Found a V7 FS (block size = 512) on device loop0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 8114 at fs/inode.c:343 inc_nlink.cold+0x11/0x18 fs/inode.c:343

Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 8114 Comm: syz-executor923 Not tainted 4.19.154-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186
__warn.cold+0x20/0x61 kernel/panic.c:541
report_bug+0x262/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:inc_nlink.cold+0x11/0x18 fs/inode.c:343
Code: c0 74 04 3c 03 7e 08 8b 5d 48 e9 65 7e ff ff 4c 89 e7 e8 18 96 ee ff eb ee e8 51 6d b8 ff 48 c7 c7 80 a6 74 88 e8 54 67 a3 ff <0f> 0b e9 a7 7f ff ff e8 39 6d b8 ff 48 8d 7b 40 b8 ff ff 37 00 48

RSP: 0018:ffff8880b139fdf0 EFLAGS: 00010282
RAX: 0000000000000024 RBX: ffff88808b01c948 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff814fdb21 RDI: ffffed1016273fb0

RBP: 0000000000000000 R08: 0000000000000024 R09: 0000000000000000

R10: 0000000000000005 R11: 0000000000000000 R12: ffff88808b01c990
R13: ffff88808e61a9e0 R14: 000000000000007e R15: 0000000000000021

inode_inc_link_count include/linux/fs.h:2102 [inline]
sysv_mkdir+0x21/0x150 fs/sysv/namei.c:131
vfs_mkdir+0x508/0x7a0 fs/namei.c:3819
do_mkdirat+0x262/0x2d0 fs/namei.c:3842
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

RIP: 0033:0x444439
Code: 8d d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc0983ab18 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444439
RDX: 0000000000400fe0 RSI: 0000000000000023 RDI: 0000000020000080
RBP: 00000000006cf018 R08: 00007ffc00000015 R09: 0000000000000000
R10: 00007ffc0983a9d0 R11: 0000000000000246 R12: 0000000000402020
R13: 00000000004020b0 R14: 0000000000000000 R15: 0000000000000000

syzbot

unread,

Nov 6, 2020, 4:55:17 AM11/6/20

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 6b6446ef Linux 4.14.204
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17283746500000
kernel config: https://syzkaller.appspot.com/x/.config?x=3b2e3745f25cbc4e
dashboard link: https://syzkaller.appspot.com/bug?extid=7ea4ab8fb125ccf3dacf

compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+7ea4ab...@syzkaller.appspotmail.com

VFS: Found a V7 FS (block size = 512) on device loop2
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3669 at fs/inode.c:342 inc_nlink+0x113/0x130 fs/inode.c:342

Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 3669 Comm: syz-executor.2 Not tainted 4.14.204-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x4b kernel/panic.c:547
report_bug+0x208/0x249 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:inc_nlink+0x113/0x130 fs/inode.c:342
RSP: 0018:ffff8880589c7df0 EFLAGS: 00010212
RAX: 0000000000040000 RBX: ffff88802a519238 RCX: ffffc90006cfc000
RDX: 0000000000000968 RSI: ffffffff818eb893 RDI: ffff88802a519310
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88802a519280
R13: ffff88808e1868c0 R14: ffffffff87aa2dc0 R15: 0000000000000000
inode_inc_link_count include/linux/fs.h:2039 [inline]
sysv_mkdir+0x21/0x120 fs/sysv/namei.c:136
vfs_mkdir+0x463/0x6e0 fs/namei.c:3849
SYSC_mkdirat fs/namei.c:3872 [inline]
SyS_mkdirat+0x1fd/0x270 fs/namei.c:3856
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45deb9
RSP: 002b:00007f9f80524c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 0000000000021040 RCX: 000000000045deb9
RDX: 00000000000000b8 RSI: 0000000020000040 RDI: 0000000000000005
RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c
R13: 00007ffc7c36c13f R14: 00007f9f805259c0 R15: 000000000118bf2c

Kernel Offset: disabled
Rebooting in 86400 seconds..

syzbot

unread,

Nov 6, 2020, 5:09:18 AM11/6/20

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 6b6446ef Linux 4.14.204
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=13b1438e500000

kernel config: https://syzkaller.appspot.com/x/.config?x=3b2e3745f25cbc4e
dashboard link: https://syzkaller.appspot.com/bug?extid=7ea4ab8fb125ccf3dacf
compiler: gcc (GCC) 10.1.0-syz 20200507

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16b3c094500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12e77f14500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7ea4ab...@syzkaller.appspotmail.com

VFS: Found a V7 FS (block size = 512) on device loop0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 7977 at fs/inode.c:342 inc_nlink+0x113/0x130 fs/inode.c:342

Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 7977 Comm: syz-executor877 Not tainted 4.14.204-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x4b kernel/panic.c:547
report_bug+0x208/0x249 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:inc_nlink+0x113/0x130 fs/inode.c:342

RSP: 0018:ffff8880b3737df0 EFLAGS: 00010297
RAX: ffff8880b482c640 RBX: ffff88808e308958 RCX: 1ffffffff0f545c1
RDX: 0000000000000000 RSI: ffff8880b1d97840 RDI: ffff88808e308a30

RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808e3089a0
R13: ffff8880b1d97840 R14: ffffffff87aa2dc0 R15: 0000000000000000

inode_inc_link_count include/linux/fs.h:2039 [inline]
sysv_mkdir+0x21/0x120 fs/sysv/namei.c:136
vfs_mkdir+0x463/0x6e0 fs/namei.c:3849
SYSC_mkdirat fs/namei.c:3872 [inline]
SyS_mkdirat+0x1fd/0x270 fs/namei.c:3856
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb

RIP: 0033:0x444439
RSP: 002b:00007ffe7a4fbc58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444439

RDX: 00000000000000b8 RSI: 0000000020000040 RDI: 0000000000000005

RBP: 00000000006cf018 R08: 00007ffe00000015 R09: 00000000004002e0
R10: 00007ffe7a4fbb00 R11: 0000000000000246 R12: 0000000000402020

R13: 00000000004020b0 R14: 0000000000000000 R15: 0000000000000000

Reply all

Reply to author

Forward