general protection fault in create_empty_buffers

[syzbot]

Hello,

syzkaller hit the following crash on
91dfed74eabcdae9378131546c446442c29bf769
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.


CC: [vi...@zeniv.linux.org.uk linux-...@vger.kernel.org
linux-...@vger.kernel.org]

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 16876 Comm: syz-executor5 Not tainted 4.13.0-rc4-next-20170811
#1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8801d9800680 task.stack: ffff8801d4488000
RIP: 0010:create_empty_buffers+0xeb/0x7b0 fs/buffer.c:1581
RSP: 0018:ffff8801d448eea8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90004998000
RDX: 00000000000019cd RSI: ffffffff81b2ce94 RDI: ffffea00067c43f8
RBP: ffff8801d448f0b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00067c43f8
R13: 0000000000000000 R14: ffff8801d448f088 R15: dffffc0000000000
FS: 00007f0e1cb9f700(0000) GS:ffff8801dc100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007eff270a6000 CR3: 00000001c6bae000 CR4: 00000000001406e0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
create_page_buffers+0x1ed/0x290 fs/buffer.c:1695
__block_write_begin_int+0x22c/0x1410 fs/buffer.c:2005
__block_write_begin fs/buffer.c:2076 [inline]
block_write_begin+0xd2/0x2e0 fs/buffer.c:2135
blkdev_write_begin+0x3c/0x50 fs/block_dev.c:596
generic_perform_write+0x28c/0x650 mm/filemap.c:2979
__generic_file_write_iter+0x366/0x5b0 mm/filemap.c:3104
blkdev_write_iter+0x1cf/0x390 fs/block_dev.c:1897
call_write_iter include/linux/fs.h:1742 [inline]
do_iter_readv_writev+0x525/0x7f0 fs/read_write.c:650
do_iter_write+0x154/0x540 fs/read_write.c:929
vfs_iter_write+0x77/0xb0 fs/read_write.c:942
iter_file_splice_write+0x7e9/0xf50 fs/splice.c:765
do_splice_from fs/splice.c:867 [inline]
direct_splice_actor+0x125/0x180 fs/splice.c:1034
splice_direct_to_actor+0x2c1/0x820 fs/splice.c:989
do_splice_direct+0x29b/0x3c0 fs/splice.c:1077
do_sendfile+0x5c9/0xe80 fs/read_write.c:1412
SYSC_sendfile64 fs/read_write.c:1467 [inline]
SyS_sendfile64+0xbd/0x160 fs/read_write.c:1459
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x4512e9
RSP: 002b:00007f0e1cb9ec08 EFLAGS: 00000216 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004512e9
RDX: 00000000200ddff8 RSI: 0000000000000017 RDI: 0000000000000016
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000100000001 R11: 0000000000000216 R12: 00000000004b8500
R13: 00000000ffffffff R14: 0000000000000016 R15: 0000000000004c00
Code: 4c 89 ee ba 01 00 00 00 4c 89 e7 e8 b0 e3 ff ff 48 89 85 18 fe ff ff
49 89 c5 eb 03 49 89 c5 e8 cc 5d ba ff 4c 89 e8 48 c1 e8 03 <42> 80 3c 38
00 0f 85 44 06 00 00 49 8d 7d 08 49 09 5d 00 48 89
RIP: create_empty_buffers+0xeb/0x7b0 fs/buffer.c:1581 RSP: ffff8801d448eea8
---[ end trace de3d4b7a767dc5a5 ]---
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.
Please credit me with: Reported-by: syzbot

syzbot will keep track of this bug report.
Once a fix for this bug is committed, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line.
To upstream this report, please reply with:
#syz upstream

[Dmitry Vyukov]

Last happened on Aug 28, seems to be fixed by something:

#syz invalid

On Tue, Oct 31, 2017 at 1:01 PM, syzbot
<bot+3f22a0da4bbc258434...@syzkaller.appspotmail.com>
wrote:

> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-upstream-m...@googlegroups.com.
> To post to this group, send email to
> syzkaller-upst...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-upstream-moderation/001a113ee9ba261672055cd4d8ac%40google.com.
> For more options, visit https://groups.google.com/d/optout.