From: syzbot <syzbot+baa30b3f0af34d3b3832@syzkaller.appspotmail.com>
To: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk
Subject: [syzbot] BUG: unable to handle kernel paging request in sb_end_write
Date: Mon, 07 Nov 2022 13:36:42 -0800 [thread overview]
Message-ID: <0000000000002b449505ece8385e@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: f0c4d9fc9cc9 Linux 6.1-rc4
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1325f951880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ff27f0c8b406726e
dashboard link: https://syzkaller.appspot.com/bug?extid=baa30b3f0af34d3b3832
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12c3890e880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15d5fede880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/92c7e839ac32/disk-f0c4d9fc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b7bedbc08fb4/vmlinux-f0c4d9fc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3fe25e2dfdb7/Image-f0c4d9fc.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/e08ff430eaf4/mount_3.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+baa30b3f0af34d3b3832@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 79
Unable to handle kernel paging request at virtual address ffff8001f1dad000
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005
CM = 0, WnR = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001c5630000
[ffff8001f1dad000] pgd=100000023ffff003, p4d=100000023ffff003, pud=0000000000000000
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3024 Comm: syz-executor176 Not tainted 6.1.0-rc4-syzkaller-31833-gf0c4d9fc9cc9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __percpu_add_case_32 arch/arm64/include/asm/percpu.h:127 [inline]
pc : percpu_up_read include/linux/percpu-rwsem.h:106 [inline]
pc : __sb_end_write include/linux/fs.h:1821 [inline]
pc : sb_end_write+0xac/0x22c include/linux/fs.h:1853
lr : rcu_sync_is_idle include/linux/rcu_sync.h:36 [inline]
lr : percpu_up_read include/linux/percpu-rwsem.h:105 [inline]
lr : __sb_end_write include/linux/fs.h:1821 [inline]
lr : sb_end_write+0x84/0x22c include/linux/fs.h:1853
sp : ffff800012b9bc00
x29: ffff800012b9bc00 x28: ffff0000cb107888 x27: ffff80000d3182f0
x26: 00000000fffffffb x25: 0000000000000021 x24: 0000000000000001
x23: 0000000020000080 x22: 0000000020000180 x21: ffff0000c6540000
x20: 0000000000000000 x19: ffff0000c97e7000 x18: 00000000000000c0
x17: ffff80000dcec198 x16: ffff80000db2a158 x15: ffff0000c6540000
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c6540000
x11: ff808000085ff1b0 x10: 0000000000000000 x9 : 00000000ffffffff
x8 : ffff8001f1dad000 x7 : ffff8000095f3074 x6 : 0000000000000000
x5 : 0000000000000080 x4 : ffff0001feff2950 x3 : 0000000000002bb9
x2 : ffff0000c9558000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
__sb_end_write include/linux/fs.h:1821 [inline]
sb_end_write+0xac/0x22c include/linux/fs.h:1853
mnt_drop_write+0x28/0x38 fs/namespace.c:471
path_setxattr+0x36c/0x414 fs/xattr.c:638
__do_sys_setxattr fs/xattr.c:652 [inline]
__se_sys_setxattr fs/xattr.c:648 [inline]
__arm64_sys_setxattr+0x2c/0x40 fs/xattr.c:648
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: f941fe68 d538d089 8b080128 12800009 (b829011f)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: f941fe68 ldr x8, [x19, #1016]
4: d538d089 mrs x9, tpidr_el1
8: 8b080128 add x8, x9, x8
c: 12800009 mov w9, #0xffffffff // #-1
* 10: b829011f stadd w9, [x8] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
reply other threads:[~2022-11-07 21:38 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000002b449505ece8385e@google.com \
--to=syzbot+baa30b3f0af34d3b3832@syzkaller.appspotmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.