[syzbot] [btrfs?] general protection fault in getname_kernel (2)

26 views
Skip to first unread message

syzbot

unread,
Oct 9, 2024, 9:48:26 AM10/9/24
to c...@fb.com, dst...@suse.com, jo...@toxicpanda.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 33ce24234fca Add linux-next specific files for 20241008
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10df97d0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4750ca93740b938d
dashboard link: https://syzkaller.appspot.com/bug?extid=cee29f5a48caf10cd475
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=160ce327980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15ea7707980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ee8dc2df0c57/disk-33ce2423.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dc473c0fa06e/vmlinux-33ce2423.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4671f1ca2e61/bzImage-33ce2423.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cee29f...@syzkaller.appspotmail.com

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5235 Comm: syz-executor338 Not tainted 6.12.0-rc2-next-20241008-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:strlen+0x2c/0x70 lib/string.c:402
Code: 1e fa 41 57 41 56 41 54 53 49 89 fe 48 c7 c0 ff ff ff ff 49 bf 00 00 00 00 00 fc ff df 48 89 fb 49 89 c4 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 12 48 ff c3 49 8d 44 24 01 43 80 7c 26 01
RSP: 0018:ffffc90003b7f8a8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802c5cda00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff901d3f2f R09: 1ffffffff203a7e5
R10: dffffc0000000000 R11: fffffbfff203a7e6 R12: ffffffffffffffff
R13: ffff888028a7e000 R14: 0000000000000000 R15: dffffc0000000000
FS: 000055557da91380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200000c0 CR3: 000000004fdaa000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
getname_kernel+0x1d/0x2f0 fs/namei.c:232
kern_path+0x1d/0x50 fs/namei.c:2716
is_good_dev_path fs/btrfs/volumes.c:760 [inline]
btrfs_scan_one_device+0x19e/0xd90 fs/btrfs/volumes.c:1484
btrfs_get_tree_super fs/btrfs/super.c:1841 [inline]
btrfs_get_tree+0x30e/0x1920 fs/btrfs/super.c:2114
vfs_get_tree+0x90/0x2b0 fs/super.c:1800
fc_mount+0x1b/0xb0 fs/namespace.c:1231
btrfs_get_tree_subvol fs/btrfs/super.c:2077 [inline]
btrfs_get_tree+0x652/0x1920 fs/btrfs/super.c:2115
vfs_get_tree+0x90/0x2b0 fs/super.c:1800
vfs_cmd_create+0xa0/0x1f0 fs/fsopen.c:225
__do_sys_fsconfig fs/fsopen.c:472 [inline]
__se_sys_fsconfig+0xa1f/0xf70 fs/fsopen.c:344
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe8c78542a9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd2c4992f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
RAX: ffffffffffffffda RBX: 00007ffd2c4994c8 RCX: 00007fe8c78542a9
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
RBP: 00007fe8c78c7610 R08: 0000000000000000 R09: 00007ffd2c4994c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd2c4994b8 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:strlen+0x2c/0x70 lib/string.c:402
Code: 1e fa 41 57 41 56 41 54 53 49 89 fe 48 c7 c0 ff ff ff ff 49 bf 00 00 00 00 00 fc ff df 48 89 fb 49 89 c4 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 12 48 ff c3 49 8d 44 24 01 43 80 7c 26 01
RSP: 0018:ffffc90003b7f8a8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802c5cda00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff901d3f2f R09: 1ffffffff203a7e5
R10: dffffc0000000000 R11: fffffbfff203a7e6 R12: ffffffffffffffff
R13: ffff888028a7e000 R14: 0000000000000000 R15: dffffc0000000000
FS: 000055557da91380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005606b6327058 CR3: 000000004fdaa000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: fa cli
1: 41 57 push %r15
3: 41 56 push %r14
5: 41 54 push %r12
7: 53 push %rbx
8: 49 89 fe mov %rdi,%r14
b: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
12: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
19: fc ff df
1c: 48 89 fb mov %rdi,%rbx
1f: 49 89 c4 mov %rax,%r12
22: 48 89 d8 mov %rbx,%rax
25: 48 c1 e8 03 shr $0x3,%rax
* 29: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 75 12 jne 0x44
32: 48 ff c3 inc %rbx
35: 49 8d 44 24 01 lea 0x1(%r12),%rax
3a: 43 rex.XB
3b: 80 .byte 0x80
3c: 7c 26 jl 0x64
3e: 01 .byte 0x1


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Edward Adam Davis

unread,
Oct 9, 2024, 10:33:18 AM10/9/24
to syzbot+cee29f...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
The origin fc's source is NULL

#syz test

diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 692f81f1e23e..06bdf0cf7b88 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2148,6 +2148,8 @@ static int btrfs_dup_fs_context(struct fs_context *fc, struct fs_context *src_fc
* mounting, and then once we free the dup it'll free ->source, so we
* need to make sure we're only pointing to it in one fc.
*/
+ if (!src_fc->source)
+ return -EINVAL;
refcount_inc(&ctx->refs);
fc->fs_private = ctx;
fc->source = src_fc->source;

syzbot

unread,
Oct 9, 2024, 2:51:04 PM10/9/24
to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot tried to test the proposed patch but the build/boot failed:

s2_ap_driver
[ 10.319275][ T1] comedi: version 0.7.76 - http://www.comedi.org
[ 10.322568][ T1] usbcore: registered new interface driver dt9812
[ 10.325416][ T1] usbcore: registered new interface driver ni6501
[ 10.327201][ T1] usbcore: registered new interface driver usbdux
[ 10.329379][ T1] usbcore: registered new interface driver usbduxfast
[ 10.332121][ T1] usbcore: registered new interface driver usbduxsigma
[ 10.334088][ T1] usbcore: registered new interface driver vmk80xx
[ 10.337211][ T1] usbcore: registered new interface driver r8712u
[ 10.338343][ T1] greybus: registered new driver hid
[ 10.340298][ T1] greybus: registered new driver gbphy
[ 10.341827][ T1] gb_gbphy: registered new driver usb
[ 10.349219][ T1] asus_wmi: ASUS WMI generic driver loaded
[ 10.361679][ T1] gnss: GNSS driver registered with major 493
[ 10.368815][ T1] usbcore: registered new interface driver gnss-usb
[ 10.370709][ T1] usbcore: registered new interface driver hdm_usb
[ 10.444816][ T1] usbcore: registered new interface driver snd-usb-audio
[ 10.448305][ T1] usbcore: registered new interface driver snd-ua101
[ 10.450555][ T1] usbcore: registered new interface driver snd-usb-usx2y
[ 10.452954][ T1] usbcore: registered new interface driver snd-usb-us122l
[ 10.454894][ T1] usbcore: registered new interface driver snd-usb-caiaq
[ 10.456790][ T1] usbcore: registered new interface driver snd-usb-6fire
[ 10.458789][ T1] usbcore: registered new interface driver snd-usb-hiface
[ 10.460996][ T1] usbcore: registered new interface driver snd-bcd2000
[ 10.463111][ T1] usbcore: registered new interface driver snd_usb_pod
[ 10.466398][ T1] usbcore: registered new interface driver snd_usb_podhd
[ 10.468273][ T1] usbcore: registered new interface driver snd_usb_toneport
[ 10.469725][ T1] usbcore: registered new interface driver snd_usb_variax
[ 10.474004][ T1] drop_monitor: Initializing network drop monitor service
[ 10.476401][ T1] NET: Registered PF_LLC protocol family
[ 10.477481][ T1] GACT probability on
[ 10.478257][ T1] Mirror/redirect action on
[ 10.479172][ T1] Simple TC action Loaded
[ 10.482782][ T1] netem: version 1.3
[ 10.483673][ T1] u32 classifier
[ 10.484180][ T1] Performance counters on
[ 10.484834][ T1] input device check on
[ 10.486023][ T1] Actions configured
[ 10.489157][ T1] nf_conntrack_irc: failed to register helpers
[ 10.490084][ T1] nf_conntrack_sane: failed to register helpers
[ 10.598437][ T1] nf_conntrack_sip: failed to register helpers
[ 10.604205][ T2709] kworker/u8:5 (2709) used greatest stack depth: 24784 bytes left
[ 10.604399][ T1] xt_time: kernel timezone is -0000
[ 10.606687][ T1] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 10.607753][ T1] IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
[ 10.609718][ T1] IPVS: ipvs loaded.
[ 10.610454][ T1] IPVS: [rr] scheduler registered.
[ 10.611224][ T1] IPVS: [wrr] scheduler registered.
[ 10.612068][ T1] IPVS: [lc] scheduler registered.
[ 10.612780][ T1] IPVS: [wlc] scheduler registered.
[ 10.613556][ T1] IPVS: [fo] scheduler registered.
[ 10.614304][ T1] IPVS: [ovf] scheduler registered.
[ 10.615149][ T1] IPVS: [lblc] scheduler registered.
[ 10.615886][ T1] IPVS: [lblcr] scheduler registered.
[ 10.616665][ T1] IPVS: [dh] scheduler registered.
[ 10.617614][ T1] IPVS: [sh] scheduler registered.
[ 10.618521][ T1] IPVS: [mh] scheduler registered.
[ 10.619321][ T1] IPVS: [sed] scheduler registered.
[ 10.620373][ T1] IPVS: [nq] scheduler registered.
[ 10.621182][ T1] IPVS: [twos] scheduler registered.
[ 10.622179][ T1] IPVS: [sip] pe registered.
[ 10.623331][ T1] ipip: IPv4 and MPLS over IPv4 tunneling driver
[ 10.627241][ T1] gre: GRE over IPv4 demultiplexor driver
[ 10.628252][ T1] ip_gre: GRE over IPv4 tunneling driver
[ 10.637645][ T1] IPv4 over IPsec tunneling driver
[ 10.641661][ T1] Initializing XFRM netlink socket
[ 10.642642][ T1] IPsec XFRM device driver
[ 10.643733][ T1] NET: Registered PF_INET6 protocol family
[ 10.656555][ T1] Segment Routing with IPv6
[ 10.657375][ T1] RPL Segment Routing with IPv6
[ 10.658370][ T1] In-situ OAM (IOAM) with IPv6
[ 10.659392][ T1] mip6: Mobile IPv6
[ 10.663271][ T1] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[ 10.670008][ T1] ip6_gre: GRE over IPv6 tunneling driver
[ 10.674292][ T1] NET: Registered PF_PACKET protocol family
[ 10.676334][ T1] NET: Registered PF_KEY protocol family
[ 10.677683][ T1] Bridge firewalling registered
[ 10.679324][ T1] NET: Registered PF_X25 protocol family
[ 10.680368][ T1] X25: Linux Version 0.2
[ 10.716733][ T1] NET: Registered PF_NETROM protocol family
[ 10.753122][ T1] NET: Registered PF_ROSE protocol family
[ 10.754387][ T1] NET: Registered PF_AX25 protocol family
[ 10.757938][ T1] can: controller area network core
[ 10.758970][ T1] NET: Registered PF_CAN protocol family
[ 10.759924][ T1] can: raw protocol
[ 10.760534][ T1] can: broadcast manager protocol
[ 10.761312][ T1] can: netlink gateway - max_hops=1
[ 10.762339][ T1] can: SAE J1939
[ 10.762919][ T1] can: isotp protocol (max_pdu_size 8300)
[ 10.764278][ T1] Bluetooth: RFCOMM TTY layer initialized
[ 10.767642][ T1] Bluetooth: RFCOMM socket layer initialized
[ 10.768787][ T1] Bluetooth: RFCOMM ver 1.11
[ 10.769560][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 10.770537][ T1] Bluetooth: BNEP filters: protocol multicast
[ 10.771518][ T1] Bluetooth: BNEP socket layer initialized
[ 10.772349][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 10.773324][ T1] Bluetooth: HIDP socket layer initialized
[ 10.778406][ T1] NET: Registered PF_RXRPC protocol family
[ 10.779406][ T1] Key type rxrpc registered
[ 10.780204][ T1] Key type rxrpc_s registered
[ 10.781608][ T1] NET: Registered PF_KCM protocol family
[ 10.783775][ T1] lec:lane_module_init: lec.c: initialized
[ 10.784692][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 10.785946][ T1] l2tp_core: L2TP core driver, V2.0
[ 10.786934][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 10.787969][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 10.789031][ T1] l2tp_netlink: L2TP netlink interface
[ 10.789899][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 10.790827][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 10.792073][ T1] NET: Registered PF_PHONET protocol family
[ 10.793120][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 10.808908][ T1] DCCP: Activated CCID 2 (TCP-like)
[ 10.814230][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[ 10.821673][ T1] DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 10.832766][ T1] sctp: Hash tables configured (bind 32/56)
[ 10.840557][ T1] NET: Registered PF_RDS protocol family
[ 10.847237][ T1] Registered RDS/infiniband transport
[ 10.853730][ T1] Registered RDS/tcp transport
[ 10.858656][ T1] tipc: Activated (version 2.0.0)
[ 10.864431][ T1] NET: Registered PF_TIPC protocol family
[ 10.871052][ T1] tipc: Started in single node mode
[ 10.877071][ T1] NET: Registered PF_SMC protocol family
[ 10.883181][ T1] 9pnet: Installing 9P2000 support
[ 10.888922][ T1] NET: Registered PF_CAIF protocol family
[ 10.898506][ T1] NET: Registered PF_IEEE802154 protocol family
[ 10.905068][ T1] Key type dns_resolver registered
[ 10.910312][ T1] Key type ceph registered
[ 10.915415][ T1] libceph: loaded (mon/osd proto 15/24)
[ 10.922141][ T1] batman_adv: B.A.T.M.A.N. advanced 2024.2 (compatibility version 15) loaded
[ 10.931398][ T1] openvswitch: Open vSwitch switching datapath
[ 10.939441][ T1] NET: Registered PF_VSOCK protocol family
[ 10.945999][ T1] mpls_gso: MPLS GSO support
[ 10.967691][ T1] IPI shorthand broadcast: enabled
[ 10.973087][ T1] AES CTR mode by8 optimization enabled
[ 12.104613][ T1] sched_clock: Marking stable (12060025057, 34932274)->(12093279688, 1677643)
[ 12.119544][ T1] registered taskstats version 1
[ 12.141500][ T1] Loading compiled-in X.509 certificates
[ 12.199712][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 34511b135d2758a08a46bc4f061ab8667a62b201'
[ 12.396949][ T1] zswap: loaded using pool 842/z3fold
[ 12.404836][ T1] Demotion targets for Node 0: null
[ 12.410189][ T1] Demotion targets for Node 1: null
[ 12.415469][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 14.168414][ T1] Key type .fscrypt registered
[ 14.173201][ T1] Key type fscrypt-provisioning registered
[ 14.184392][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 14.207263][ T1] Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
[ 14.215931][ T1] Key type big_key registered
[ 14.229036][ T1] Key type encrypted registered
[ 14.233923][ T1] AppArmor: AppArmor sha256 policy hashing enabled
[ 14.240771][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 14.247197][ T1] Loading compiled-in module X.509 certificates
[ 14.271408][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 34511b135d2758a08a46bc4f061ab8667a62b201'
[ 14.282261][ T1] ima: Allocated hash algorithm: sha256
[ 14.288286][ T1] ima: No architecture policies found
[ 14.294068][ T1] evm: Initialising EVM extended attributes:
[ 14.300089][ T1] evm: security.selinux (disabled)
[ 14.305769][ T1] evm: security.SMACK64 (disabled)
[ 14.310887][ T1] evm: security.SMACK64EXEC (disabled)
[ 14.316468][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 14.322337][ T1] evm: security.SMACK64MMAP (disabled)
[ 14.327813][ T1] evm: security.apparmor
[ 14.332050][ T1] evm: security.ima
[ 14.335873][ T1] evm: security.capability
[ 14.340547][ T1] evm: HMAC attrs: 0x1
[ 14.347257][ T1] PM: Magic number: 12:295:746
[ 14.353400][ T1] printk: legacy console [netcon0] enabled
[ 14.359315][ T1] netconsole: network logging started
[ 14.365308][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 14.375941][ T1] rdma_rxe: loaded
[ 14.380278][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 14.391416][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 14.399964][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 14.409267][ T939] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 14.418937][ T1] clk: Disabling unused clocks
[ 14.419013][ T939] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 14.423899][ T1] ALSA device list:
[ 14.436380][ T1] #0: Dummy 1
[ 14.439870][ T1] #1: Loopback 1
[ 14.443576][ T1] #2: Virtual MIDI Card 1
[ 14.451100][ T1] md: Waiting for all devices to be available before autodetect
[ 14.458822][ T1] md: If you don't use raid, use raid=noautodetect
[ 14.465370][ T1] md: Autodetecting RAID arrays.
[ 14.470381][ T1] md: autorun ...
[ 14.474008][ T1] md: ... autorun DONE.
[ 14.538322][ T1] EXT4-fs (sda1): mounted filesystem b4773fba-1738-4da0-8a90-0fe043d0a496 ro with ordered data mode. Quota mode: none.
[ 14.551126][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 14.578998][ T1] devtmpfs: mounted
[ 14.631301][ T1] Freeing unused kernel image (initmem) memory: 26736K
[ 14.641332][ T1] Write protecting the kernel read-only data: 219136k
[ 14.656226][ T1] Freeing unused kernel image (rodata/data gap) memory: 1100K
[ 14.763403][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 14.771313][ T1] x86/mm: Checking user space page tables
[ 14.864011][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 14.877068][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 14.886913][ T1] Run /sbin/init as init process
[ 15.655177][ T4652] mount (4652) used greatest stack depth: 23104 bytes left
[ 15.709114][ T4653] EXT4-fs (sda1): re-mounted b4773fba-1738-4da0-8a90-0fe043d0a496 r/w. Quota mode: none.
mount: mounting devtmpfs on /dev failed: Device or resource busy
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 15.856092][ T4657] mount (4657) used greatest stack depth: 20608 bytes left
Starting syslogd: OK
Starting acpid: [ 76.826513][ T939] cfg80211: failed to load regulatory.db


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1417808173=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 402f1df054
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=402f1df054ddb07ed5bb299d08c781354eb06607 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20241007-221845'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"402f1df054ddb07ed5bb299d08c781354eb06607\"
/usr/bin/ld: /tmp/ccIZFOUJ.o: in function `test_cover_filter()':
executor.cc:(.text+0x1424b): warning: the use of `tempnam' is dangerous, better use `mkstemp'
/usr/bin/ld: /tmp/ccIZFOUJ.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=143537d0580000


Tested on:

commit: b6270c3b Add linux-next specific files for 20241009
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=aa19e8f0089d2704
dashboard link: https://syzkaller.appspot.com/bug?extid=cee29f5a48caf10cd475
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=169837d0580000

Qu Wenruo

unread,
Oct 9, 2024, 7:21:29 PM10/9/24
to syzbot, c...@fb.com, dst...@suse.com, jo...@toxicpanda.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
#syz test: https://github.com/adam900710/linux.git subpage_read

syzbot

unread,
Oct 9, 2024, 8:29:05 PM10/9/24
to c...@fb.com, dst...@suse.com, jo...@toxicpanda.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, quwenru...@gmx.com, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in getname_kernel

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 6008 Comm: syz.0.15 Not tainted 6.12.0-rc2-syzkaller-00045-g964c2da72390 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:strlen+0x2c/0x70 lib/string.c:402
Code: 1e fa 41 57 41 56 41 54 53 49 89 fe 48 c7 c0 ff ff ff ff 49 bf 00 00 00 00 00 fc ff df 48 89 fb 49 89 c4 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 12 48 ff c3 49 8d 44 24 01 43 80 7c 26 01
RSP: 0018:ffffc900035af8a8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802d46bc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff942c58f7 R09: 1ffffffff2858b1e
R10: dffffc0000000000 R11: fffffbfff2858b1f R12: ffffffffffffffff
R13: ffff8880727f8000 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007f01495d76c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f75ffff CR3: 000000002cffe000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
getname_kernel+0x1d/0x2f0 fs/namei.c:232
kern_path+0x1d/0x50 fs/namei.c:2716
is_good_dev_path fs/btrfs/volumes.c:760 [inline]
btrfs_scan_one_device+0x19e/0xd90 fs/btrfs/volumes.c:1492
btrfs_get_tree_super fs/btrfs/super.c:1841 [inline]
btrfs_get_tree+0x30e/0x1920 fs/btrfs/super.c:2114
vfs_get_tree+0x90/0x2b0 fs/super.c:1800
fc_mount+0x1b/0xb0 fs/namespace.c:1231
btrfs_get_tree_subvol fs/btrfs/super.c:2077 [inline]
btrfs_get_tree+0x652/0x1920 fs/btrfs/super.c:2115
vfs_get_tree+0x90/0x2b0 fs/super.c:1800
vfs_cmd_create+0xa0/0x1f0 fs/fsopen.c:225
__do_sys_fsconfig fs/fsopen.c:472 [inline]
__se_sys_fsconfig+0xa1f/0xf70 fs/fsopen.c:344
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f014877dff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f01495d7038 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
RAX: ffffffffffffffda RBX: 00007f0148935f80 RCX: 00007f014877dff9
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
RBP: 00007f01487f0296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f0148935f80 R15: 00007ffe7a9c13b8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:strlen+0x2c/0x70 lib/string.c:402
Code: 1e fa 41 57 41 56 41 54 53 49 89 fe 48 c7 c0 ff ff ff ff 49 bf 00 00 00 00 00 fc ff df 48 89 fb 49 89 c4 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 12 48 ff c3 49 8d 44 24 01 43 80 7c 26 01
RSP: 0018:ffffc900035af8a8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802d46bc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff942c58f7 R09: 1ffffffff2858b1e
R10: dffffc0000000000 R11: fffffbfff2858b1f R12: ffffffffffffffff
R13: ffff8880727f8000 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007f01495d76c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f75ffff CR3: 000000002cffe000 CR4: 00000000003526f0
Tested on:

commit: 964c2da7 btrfs: make buffered write to copy one page a..
git tree: https://github.com/adam900710/linux.git subpage_read
console output: https://syzkaller.appspot.com/x/log.txt?x=1296b7d0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3ec5955a0d4f6ede
dashboard link: https://syzkaller.appspot.com/bug?extid=cee29f5a48caf10cd475
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.

Qu Wenruo

unread,
Oct 9, 2024, 10:26:54 PM10/9/24
to syzbot, c...@fb.com, dst...@suse.com, jo...@toxicpanda.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com

syzbot

unread,
Oct 9, 2024, 11:02:05 PM10/9/24
to c...@fb.com, dst...@suse.com, jo...@toxicpanda.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, quwenru...@gmx.com, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine



Tested on:

commit: 330f0214 btrfs: handle NULL as device path for btrfs_s..
console output: https://syzkaller.appspot.com/x/log.txt?x=122384bb980000

syzbot

unread,
Oct 10, 2024, 12:30:05 AM10/10/24
to c...@fb.com, dst...@suse.com, ead...@qq.com, fdma...@suse.com, jo...@toxicpanda.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, quwenru...@gmx.com, syzkall...@googlegroups.com, w...@suse.com
syzbot has bisected this issue to:

commit b4b3fb6c00f37a9da91022adcd83555bc339e044
Author: Qu Wenruo <w...@suse.com>
Date: Tue Sep 24 04:57:07 2024 +0000

btrfs: canonicalize the device path before adding it

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15744f07980000
start commit: 33ce24234fca Add linux-next specific files for 20241008
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=17744f07980000
console output: https://syzkaller.appspot.com/x/log.txt?x=13744f07980000
Reported-by: syzbot+cee29f...@syzkaller.appspotmail.com
Fixes: b4b3fb6c00f3 ("btrfs: canonicalize the device path before adding it")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Qu Wenruo

unread,
Oct 10, 2024, 12:55:05 AM10/10/24
to syzbot, c...@fb.com, dst...@suse.com, ead...@qq.com, fdma...@suse.com, jo...@toxicpanda.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com, w...@suse.com

syzbot

unread,
Oct 10, 2024, 1:37:07 AM10/10/24
to c...@fb.com, dst...@suse.com, ead...@qq.com, fdma...@suse.com, jo...@toxicpanda.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, quwenru...@gmx.com, syzkall...@googlegroups.com, w...@suse.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+cee29f...@syzkaller.appspotmail.com
Tested-by: syzbot+cee29f...@syzkaller.appspotmail.com

Tested on:

commit: 5e61ad52 btrfs: convert btrfs_buffered_write() to use ..
console output: https://syzkaller.appspot.com/x/log.txt?x=17f24b27980000
kernel config: https://syzkaller.appspot.com/x/.config?x=3ec5955a0d4f6ede
dashboard link: https://syzkaller.appspot.com/bug?extid=cee29f5a48caf10cd475
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

syzbot

unread,
Nov 22, 2024, 10:11:19 AM11/22/24
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages