From: syzbot <syzbot+09ddb593eea76a158f42@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [block?] general protection fault in bio_alloc_bioset
Date: Fri, 20 Mar 2026 23:46:02 -0700 [thread overview]
Message-ID: <69be3eaa.050a0220.3bf4de.0043.GAE@google.com> (raw)
In-Reply-To: <tencent_924968A3B12440B76F377706C8D374036A05@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in bio_alloc_bioset
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5172 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:bio_init block/bio.c:214 [inline]
RIP: 0010:bio_init_inline include/linux/bio.h:435 [inline]
RIP: 0010:bio_alloc_bioset+0x67e/0xc30 block/bio.c:597
Code: 04 24 00 00 00 00 41 8d 46 ff 0f b7 d8 bf 04 00 00 00 89 de e8 33 6c 3c fd 66 83 fb 04 0f 83 db 00 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 ff e8 c4 cf a5 fd 49 c7 07 00 00 00 00 49
RSP: 0018:ffffc9000e6ef7e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88803778bd00 RSI: 0000000000000000 RDI: 0000000000000004
RBP: dffffc0000000000 R08: ffffffff903445f7 R09: 1ffffffff20688be
R10: dffffc0000000000 R11: fffffbfff20688bf R12: 0000000000092800
R13: ffffffff9a6ca840 R14: 0000000000000001 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888124ff3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2f6b59c76f CR3: 000000007cd28000 CR4: 00000000003526f0
Call Trace:
<TASK>
bio_alloc include/linux/bio.h:373 [inline]
submit_bh_wbc+0x22d/0x650 fs/buffer.c:2816
jbd2_journal_commit_transaction+0x2186/0x5ad0 fs/jbd2/commit.c:726
kjournald2+0x3e0/0x760 fs/jbd2/journal.c:201
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bio_init block/bio.c:214 [inline]
RIP: 0010:bio_init_inline include/linux/bio.h:435 [inline]
RIP: 0010:bio_alloc_bioset+0x67e/0xc30 block/bio.c:597
Code: 04 24 00 00 00 00 41 8d 46 ff 0f b7 d8 bf 04 00 00 00 89 de e8 33 6c 3c fd 66 83 fb 04 0f 83 db 00 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 ff e8 c4 cf a5 fd 49 c7 07 00 00 00 00 49
RSP: 0018:ffffc9000e6ef7e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88803778bd00 RSI: 0000000000000000 RDI: 0000000000000004
RBP: dffffc0000000000 R08: ffffffff903445f7 R09: 1ffffffff20688be
R10: dffffc0000000000 R11: fffffbfff20688bf R12: 0000000000092800
R13: ffffffff9a6ca840 R14: 0000000000000001 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888124ff3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2f6b59c76f CR3: 000000007cd28000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 04 24 add $0x24,%al
2: 00 00 add %al,(%rax)
4: 00 00 add %al,(%rax)
6: 41 8d 46 ff lea -0x1(%r14),%eax
a: 0f b7 d8 movzwl %ax,%ebx
d: bf 04 00 00 00 mov $0x4,%edi
12: 89 de mov %ebx,%esi
14: e8 33 6c 3c fd call 0xfd3c6c4c
19: 66 83 fb 04 cmp $0x4,%bx
1d: 0f 83 db 00 00 00 jae 0xfe
23: 4c 89 f8 mov %r15,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 ff mov %r15,%rdi
33: e8 c4 cf a5 fd call 0xfda5cffc
38: 49 c7 07 00 00 00 00 movq $0x0,(%r15)
3f: 49 rex.WB
Tested on:
commit: 785f0eb2 Add linux-next specific files for 20260320
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1646d0ca580000
kernel config: https://syzkaller.appspot.com/x/.config?x=22bf3527036b9be1
dashboard link: https://syzkaller.appspot.com/bug?extid=09ddb593eea76a158f42
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1177a2f6580000
next prev parent reply other threads:[~2026-03-21 6:46 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-20 22:44 [syzbot] [block?] general protection fault in bio_alloc_bioset syzbot
2026-03-21 6:09 ` Edward Adam Davis
2026-03-21 6:46 ` syzbot [this message]
2026-03-21 7:24 ` Edward Adam Davis
2026-03-21 7:55 ` syzbot
2026-03-21 8:36 ` [PATCH next] block: mempool alloc fail due to insufficient memory Edward Adam Davis
2026-03-21 14:17 ` Jens Axboe
2026-03-21 22:52 ` [syzbot] [block?] general protection fault in bio_alloc_bioset Vasily Gorbik
2026-03-22 0:18 ` syzbot
2026-03-22 2:23 ` Vasily Gorbik
2026-03-22 2:35 ` [PATCH] block: fix bio_alloc_bioset slowpath GFP handling Vasily Gorbik
2026-03-23 6:44 ` Christoph Hellwig
2026-03-23 13:58 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69be3eaa.050a0220.3bf4de.0043.GAE@google.com \
--to=syzbot+09ddb593eea76a158f42@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.