From: syzbot <syzbot+cfed5b56649bddf80d6e@syzkaller.appspotmail.com>
To: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk
Subject: Re: kernel BUG at fs/buffer.c:LINE!
Date: Wed, 18 Dec 2019 03:36:08 -0800 [thread overview]
Message-ID: <000000000000d1dc120599f8d953@google.com> (raw)
In-Reply-To: <0000000000002df264056a35b16b@google.com>
syzbot has found a reproducer for the following crash on:
HEAD commit: 2187f215 Merge tag 'for-5.5-rc2-tag' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=154f72fee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=dcf10bf83926432a
dashboard link: https://syzkaller.appspot.com/bug?extid=cfed5b56649bddf80d6e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1171ba8ee00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=107440aee00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+cfed5b56649bddf80d6e@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/buffer.c:3094!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 10075 Comm: syz-executor292 Not tainted 5.5.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:submit_bh_wbc+0x71c/0x900 fs/buffer.c:3094
Code: 14 e5 ff f0 80 63 01 f7 e9 ab fa ff ff e8 bc a5 a7 ff 41 81 cd 00 10
00 00 e9 4d fe ff ff e8 ab a5 a7 ff 0f 0b e8 a4 a5 a7 ff <0f> 0b e8 9d a5
a7 ff 0f 0b e8 96 a5 a7 ff 0f 0b e8 8f a5 a7 ff 0f
RSP: 0018:ffffc90001f37bf8 EFLAGS: 00010293
RAX: ffff888097cd6540 RBX: ffff88808c089888 RCX: ffffffff81cd7f8d
RDX: 0000000000000000 RSI: ffffffff81cd85fc RDI: 0000000000000001
RBP: ffffc90001f37c40 R08: ffff888097cd6540 R09: ffffed1011811312
R10: ffffed1011811311 R11: ffff88808c08988f R12: 0000000000000000
R13: 0000000000000800 R14: 0000000000000001 R15: 0000000000000000
FS: 0000000001f36940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f41849f0ef0 CR3: 0000000095d70000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
submit_bh fs/buffer.c:3141 [inline]
__sync_dirty_buffer+0x12b/0x350 fs/buffer.c:3227
sync_dirty_buffer+0x1b/0x20 fs/buffer.c:3240
fat_set_state+0x242/0x330 fs/fat/inode.c:708
fat_put_super+0x46/0xd0 fs/fat/inode.c:734
generic_shutdown_super+0x14c/0x370 fs/super.c:462
kill_block_super+0xa0/0x100 fs/super.c:1442
deactivate_locked_super+0x95/0x100 fs/super.c:335
deactivate_super fs/super.c:366 [inline]
deactivate_super+0x1b2/0x1d0 fs/super.c:362
cleanup_mnt+0x351/0x4c0 fs/namespace.c:1102
__cleanup_mnt+0x16/0x20 fs/namespace.c:1109
task_work_run+0x145/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x316/0x380 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
do_syscall_64+0x676/0x790 arch/x86/entry/common.c:304
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x448c07
Code: 00 00 00 b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 5d a2 fb ff c3
66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 0f 83 3d a2 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc40282788 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 000000000002675b RCX: 0000000000448c07
RDX: 0000000000400dc7 RSI: 0000000000000002 RDI: 00007ffc40282830
RBP: 0000000000002abe R08: 0000000000000000 R09: 000000000000000a
R10: 0000000000000005 R11: 0000000000000206 R12: 00007ffc40283890
R13: 0000000001f37940 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace c010b278a98f0232 ]---
RIP: 0010:submit_bh_wbc+0x71c/0x900 fs/buffer.c:3094
Code: 14 e5 ff f0 80 63 01 f7 e9 ab fa ff ff e8 bc a5 a7 ff 41 81 cd 00 10
00 00 e9 4d fe ff ff e8 ab a5 a7 ff 0f 0b e8 a4 a5 a7 ff <0f> 0b e8 9d a5
a7 ff 0f 0b e8 96 a5 a7 ff 0f 0b e8 8f a5 a7 ff 0f
RSP: 0018:ffffc90001f37bf8 EFLAGS: 00010293
RAX: ffff888097cd6540 RBX: ffff88808c089888 RCX: ffffffff81cd7f8d
RDX: 0000000000000000 RSI: ffffffff81cd85fc RDI: 0000000000000001
RBP: ffffc90001f37c40 R08: ffff888097cd6540 R09: ffffed1011811312
R10: ffffed1011811311 R11: ffff88808c08988f R12: 0000000000000000
R13: 0000000000000800 R14: 0000000000000001 R15: 0000000000000000
FS: 0000000001f36940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000152d458 CR3: 0000000095d70000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
next prev parent reply other threads:[~2019-12-18 11:36 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-19 16:02 kernel BUG at fs/buffer.c:LINE! syzbot
2019-12-18 11:36 ` syzbot [this message]
2019-12-18 16:21 ` syzbot
2019-12-19 5:00 ` Bart Van Assche
2019-12-19 19:15 ` Jaegeuk Kim
2019-12-19 23:30 ` Jaegeuk Kim
2024-03-13 10:58 ` [PATCH 0/2] nilfs2: fix kernel bug at submit_bh_wbc() Ryusuke Konishi
2024-03-13 10:58 ` [PATCH 1/2] nilfs2: fix failure to detect DAT corruption in btree and direct mappings Ryusuke Konishi
2024-03-13 10:58 ` [PATCH 2/2] nilfs2: prevent kernel bug at submit_bh_wbc() Ryusuke Konishi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000d1dc120599f8d953@google.com \
--to=syzbot+cfed5b56649bddf80d6e@syzkaller.appspotmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.