From: syzbot <syzbot+392ac209604cc18792e5@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, reiserfs-devel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING in reiserfs_lookup
Date: Fri, 09 Sep 2022 14:35:26 -0700 [thread overview]
Message-ID: <00000000000003c78505e845532e@google.com> (raw)
In-Reply-To: <0000000000006c2bbc05e714ec79@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 92221e2af10d Merge branch 'for-next/core', remote-tracking..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15b18f43080000
kernel config: https://syzkaller.appspot.com/x/.config?x=e79d82586727c5df
dashboard link: https://syzkaller.appspot.com/bug?extid=392ac209604cc18792e5
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172e6877080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12cad8af080000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8ea7850f2fc1/disk-92221e2a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8b514f934717/vmlinux-92221e2a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+392ac209604cc18792e5@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 64
BFS-fs: bfs_fill_super(): loop0 is unclean, continuing
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 0 PID: 3079 at kernel/locking/mutex.c:582 __mutex_lock_common+0x4c4/0xca8 kernel/locking/mutex.c:582
Modules linked in:
CPU: 0 PID: 3079 Comm: syz-executor275 Not tainted 6.0.0-rc4-syzkaller-17255-g92221e2af10d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mutex_lock_common+0x4c4/0xca8 kernel/locking/mutex.c:582
lr : __mutex_lock_common+0x4c4/0xca8 kernel/locking/mutex.c:582
sp : ffff8000127938e0
x29: ffff800012793950 x28: ffff80000ee5a000 x27: ffff0000caad0618
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000002
x23: ffff80000878cbbc x22: 0000000000000000 x21: 0000000000000000
x20: 0000000000000000 x19: ffff0000c8f03e28 x18: 00000000000000c0
x17: ffff80000dd3a698 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000012 x12: ffff80000d61f820
x11: ff808000081c1fa0 x10: 0000000000000000 x9 : 1d38989ac5d23000
x8 : 1d38989ac5d23000 x7 : 4e5241575f534b43 x6 : ffff8000081965e0
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000028
Call trace:
__mutex_lock_common+0x4c4/0xca8 kernel/locking/mutex.c:582
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
reiserfs_write_lock+0x3c/0x64 fs/reiserfs/lock.c:27
reiserfs_lookup+0xa4/0x1c4 fs/reiserfs/namei.c:364
lookup_open fs/namei.c:3391 [inline]
open_last_lookups fs/namei.c:3481 [inline]
path_openat+0x738/0x11c4 fs/namei.c:3688
do_filp_open+0xdc/0x1b8 fs/namei.c:3718
do_sys_openat2+0xb8/0x22c fs/open.c:1311
do_sys_open fs/open.c:1327 [inline]
__do_sys_openat fs/open.c:1343 [inline]
__se_sys_openat fs/open.c:1338 [inline]
__arm64_sys_openat+0xb0/0xe0 fs/open.c:1338
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:624
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:642
el0t_64_sync+0x18c/0x190
irq event stamp: 1073
hardirqs last enabled at (1073): [<ffff80000bfd8fbc>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (1073): [<ffff80000bfd8fbc>] _raw_spin_unlock_irqrestore+0x48/0x8c kernel/locking/spinlock.c:194
hardirqs last disabled at (1072): [<ffff80000bfd8df8>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (1072): [<ffff80000bfd8df8>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last enabled at (982): [<ffff80000801c370>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (980): [<ffff80000801c33c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
Unable to handle kernel execute from non-executable memory at virtual address ffff80000ef5d0a8
Mem abort info:
ESR = 0x000000008600000e
EC = 0x21: IABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x0e: level 2 permission fault
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001c56f6000
[ffff80000ef5d0a8] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=00680001c7400701
Internal error: Oops: 8600000e [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3079 Comm: syz-executor275 Tainted: G W 6.0.0-rc4-syzkaller-17255-g92221e2af10d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : bfs_fill_super.__key+0x0/0x10
lr : get_third_component fs/reiserfs/namei.c:196 [inline]
lr : reiserfs_find_entry+0x130/0x298 fs/reiserfs/namei.c:317
sp : ffff800012793960
x29: ffff800012793990 x28: 0000000000000040 x27: ffff0000caad0618
x26: ffff0000c057e750 x25: ffff0000c70db000 x24: 0000000010000000
x23: ffff0000c057e7c0 x22: 000000000000000e x21: ffff8000127939e0
x20: ffff800012793a48 x19: ffff0000cabd87b8 x18: 00000000000000c0
x17: ffff80000dd3a698 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000002 x12: ffff80000d4b94d8
x11: ff80800008754e24 x10: 0000000000000000 x9 : ffff800008754e24
x8 : ffff80000ef5d0a8 x7 : 4e5241575f534b43 x6 : ffff80000878cbbc
x5 : 0000000000000000 x4 : ffff8000127939e0 x3 : ffff800012793a48
x2 : 000000000000000e x1 : 000000000000000e x0 : ffff0000c057e7c0
Call trace:
bfs_fill_super.__key+0x0/0x10
reiserfs_lookup+0xc4/0x1c4 fs/reiserfs/namei.c:368
lookup_open fs/namei.c:3391 [inline]
open_last_lookups fs/namei.c:3481 [inline]
path_openat+0x738/0x11c4 fs/namei.c:3688
do_filp_open+0xdc/0x1b8 fs/namei.c:3718
do_sys_openat2+0xb8/0x22c fs/open.c:1311
do_sys_open fs/open.c:1327 [inline]
__do_sys_openat fs/open.c:1343 [inline]
__se_sys_openat fs/open.c:1338 [inline]
__arm64_sys_openat+0xb0/0xe0 fs/open.c:1338
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:624
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:642
el0t_64_sync+0x18c/0x190
Code: 00000000 00000000 00000000 00000000 (00000000)
---[ end trace 0000000000000000 ]---
next prev parent reply other threads:[~2022-09-09 21:35 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-25 18:25 [syzbot] WARNING in reiserfs_lookup syzbot
2022-09-09 21:35 ` syzbot [this message]
2024-03-08 21:27 ` [syzbot] [reiserfs?] " syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=00000000000003c78505e845532e@google.com \
--to=syzbot+392ac209604cc18792e5@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=reiserfs-devel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.