[syzbot] [bpf?] [reiserfs?] WARNING: locking bug in corrupted (2)

[syzbot] [bpf?] [reiserfs?] WARNING: locking bug in corrupted (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    c17414a273b8 Merge tag 'sh-for-v6.5-tag1' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13cc4baca80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=7ad417033279f15a
dashboard link: https://syzkaller.appspot.com/bug?extid=3779764ddb7a3e19437f
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12bbd544a80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13fd50b0a80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ea495e93586c/disk-c17414a2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bdb03e817e47/vmlinux-c17414a2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/20ba23616f1f/bzImage-c17414a2.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/98d086ce1a87/mount_0.gz

The issue was bisected to:

commit 2acf15b94d5b8ea8392c4b6753a6ffac3135cd78
Author: Yu Kuai <yukuai3@huawei.com>
Date:   Fri Jul 2 04:07:43 2021 +0000

    reiserfs: add check for root_inode in reiserfs_fill_super

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=143b663ca80000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=163b663ca80000
console output: https://syzkaller.appspot.com/x/log.txt?x=123b663ca80000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3779764ddb7a3e19437f@syzkaller.appspotmail.com
Fixes: 2acf15b94d5b ("reiserfs: add check for root_inode in reiserfs_fill_super")

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(depth >= MAX_LOCK_DEPTH)
WARNING: CPU: 0 PID: 0 at kernel/locking/lockdep.c:5045 __lock_acquire+0x164b/0x5e20 kernel/locking/lockdep.c:5045
Modules linked in:
CPU: 0 PID: 0 Comm:  Not tainted 6.4.0-syzkaller-12069-gc17414a273b8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
RIP: 0010:__lock_acquire+0x164b/0x5e20 kernel/locking/lockdep.c:5045
Code: d2 0f 85 be 47 00 00 44 8b 3d 0d b3 44 0d 45 85 ff 0f 85 40 f8 ff ff 48 c7 c6 40 9f 6c 8a 48 c7 c7 e0 6e 6c 8a e8 b5 46 e6 ff <0f> 0b e9 29 f8 ff ff 48 8d 7d f8 48 b8 00 00 00 00 00 fc ff df 48
RSP: 0018:ffffc90000007ca8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 1ffff92000000fc7 RCX: 0000000000000000
RDX: ffff8880779d5940 RSI: ffffffff814c34f7 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880779d5940
R13: ffff8880b982b898 R14: 0000000000000000 R15: 0000000000000000
FS:  00005555573b8300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffde3197000 CR3: 00000000173e2000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at kernel/rcu/tree_plugin.h:431 arch_local_irq_enable arch/x86/include/asm/irqflags.h:78 [inline]
WARNING: CPU: 0 PID: 0 at kernel/rcu/tree_plugin.h:431 arch_local_irq_restore arch/x86/include/asm/irqflags.h:135 [inline]
WARNING: CPU: 0 PID: 0 at kernel/rcu/tree_plugin.h:431 rcu_read_unlock_special kernel/rcu/tree_plugin.h:678 [inline]
WARNING: CPU: 0 PID: 0 at kernel/rcu/tree_plugin.h:431 __rcu_read_unlock+0x24b/0x570 kernel/rcu/tree_plugin.h:426
Modules linked in:
CPU: 0 PID: 0 Comm:  Not tainted 6.4.0-syzkaller-12069-gc17414a273b8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
RIP: 0010:__rcu_read_unlock+0x24b/0x570 kernel/rcu/tree_plugin.h:431
Code: 00 e8 49 4f df ff 4d 85 f6 74 05 e8 cf c3 1c 00 9c 58 f6 c4 02 0f 85 78 02 00 00 4d 85 f6 0f 84 83 fe ff ff fb e9 7d fe ff ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e c3 e8 25 50 69 00 e9 2a fe ff ff e8
RSP: 0018:ffffc900000079d8 EFLAGS: 00010096
RAX: 00000000ffff8880 RBX: ffff8880779d5940 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8192bb90 RDI: ffff8880779d5d7c
RBP: ffff8880779d5940 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880779d5940
R13: ffffc90000007bf8 R14: 0000000000000000 R15: ffffc90000007a98
FS:  00005555573b8300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffde3197000 CR3: 00000000173e2000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 rcu_read_unlock include/linux/rcupdate.h:781 [inline]
 is_bpf_text_address+0x85/0x1b0 kernel/bpf/core.c:721
 kernel_text_address kernel/extable.c:125 [inline]
 kernel_text_address+0x3d/0x80 kernel/extable.c:94
 __kernel_text_address+0xd/0x30 kernel/extable.c:79
 show_trace_log_lvl+0x1c7/0x390 arch/x86/kernel/dumpstack.c:259
 __warn+0xe6/0x390 kernel/panic.c:671
 __report_bug lib/bug.c:199 [inline]
 report_bug+0x2da/0x500 lib/bug.c:219
 handle_bug+0x3c/0x70 arch/x86/kernel/traps.c:324
 exc_invalid_op+0x18/0x50 arch/x86/kernel/traps.c:345
 asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:568
RIP: 0010:__lock_acquire+0x164b/0x5e20 kernel/locking/lockdep.c:5045
Code: d2 0f 85 be 47 00 00 44 8b 3d 0d b3 44 0d 45 85 ff 0f 85 40 f8 ff ff 48 c7 c6 40 9f 6c 8a 48 c7 c7 e0 6e 6c 8a e8 b5 46 e6 ff <0f> 0b e9 29 f8 ff ff 48 8d 7d f8 48 b8 00 00 00 00 00 fc ff df 48
RSP: 0018:ffffc90000007ca8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 1ffff92000000fc7 RCX: 0000000000000000
RDX: ffff8880779d5940 RSI: ffffffff814c34f7 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880779d5940
R13: ffff8880b982b898 R14: 0000000000000000 R15: 0000000000000000
 lock_acquire kernel/locking/lockdep.c:5761 [inline]
 lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5726
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
 hrtimer_interrupt+0x107/0x7b0 kernel/time/hrtimer.c:1795
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1098 [inline]
 __sysvec_apic_timer_interrupt+0x14a/0x430 arch/x86/kernel/apic/apic.c:1115
 sysvec_apic_timer_interrupt+0x92/0xc0 arch/x86/kernel/apic/apic.c:1109
 </IRQ>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] Test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Test
Author: tintinm2017@gmail.com

#syz test:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Re: [syzbot] [bpf?] [reiserfs?] WARNING: locking bug in corrupted (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in __hrtimer_run_queues

BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5476 Comm: dhcpcd-run-hook Not tainted 6.7.0-rc1-syzkaller-00139-g6bc40e44f1dd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90000007e38 EFLAGS: 00010046
RAX: 0000000080010000 RBX: ffff8880b982b9c0 RCX: ffffffff81767893
RDX: ffff888079589dc0 RSI: ffffffff817678a1 RDI: ffffc90004bcfd90
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000081 R11: ffffc90000007ff8 R12: ffff8880b982b940
R13: 0000000000000081 R14: ffffc90004bcfd90 R15: 0000000000000000
FS:  00007f0750eb5380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007b29c000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1688 [inline]
 __hrtimer_run_queues+0x647/0xc10 kernel/time/hrtimer.c:1752
 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline]
 __sysvec_apic_timer_interrupt+0x105/0x3f0 arch/x86/kernel/apic/apic.c:1082
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1076
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__init_rwsem+0x13/0x1b0 kernel/locking/rwsem.c:312
Code: 18 4c 89 e7 31 ed e8 1c 49 de 08 eb e8 48 89 df e8 52 86 77 00 eb 9e f3 0f 1e fa 41 54 49 89 d4 55 48 89 f5 be 98 00 00 00 53 <48> 89 fb e8 45 c9 00 00 48 8d 7b 70 45 31 c9 31 c9 6a 00 4c 89 e2
RSP: 0018:ffffc900053f7980 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff8880152a1800 RCX: 0000000000000001
RDX: ffffffff90667540 RSI: 0000000000000098 RDI: ffff88802767eaf8
RBP: ffffffff8a8b0a60 R08: ffffc900053f7950 R09: 0000000000000000
R10: ffff88802767eaf8 R11: 0000000000000000 R12: ffffffff90667540
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
 vma_lock_alloc kernel/fork.c:463 [inline]
 vm_area_dup+0x9d/0x2f0 kernel/fork.c:512
 dup_mmap+0x93c/0x1d80 kernel/fork.c:710
 dup_mm kernel/fork.c:1691 [inline]
 copy_mm kernel/fork.c:1740 [inline]
 copy_process+0x6cab/0x7490 kernel/fork.c:2502
 kernel_clone+0xe9/0x920 kernel/fork.c:2907
 __do_sys_clone+0xba/0x100 kernel/fork.c:3050
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f0750fefa12
Code: 41 5d 41 5e 41 5f c3 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 e7 43 0f 00 f7 d8 64 89 02 48 83
RSP: 002b:00007fffadeb0d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 000055a881dc2901 RCX: 00007f0750fefa12
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 000055a881dc3b70 R08: 0000000000000000 R09: 3c00000000001001
R10: 00007f0750eb5650 R11: 0000000000000246 R12: 000055a881dd0640
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90000007e38 EFLAGS: 00010046

RAX: 0000000080010000 RBX: ffff8880b982b9c0 RCX: ffffffff81767893
RDX: ffff888079589dc0 RSI: ffffffff817678a1 RDI: ffffc90004bcfd90
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000081 R11: ffffc90000007ff8 R12: ffff8880b982b940
R13: 0000000000000081 R14: ffffc90004bcfd90 R15: 0000000000000000
FS:  00007f0750eb5380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007b29c000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	18 4c 89 e7          	sbb    %cl,-0x19(%rcx,%rcx,4)
   4:	31 ed                	xor    %ebp,%ebp
   6:	e8 1c 49 de 08       	call   0x8de4927
   b:	eb e8                	jmp    0xfffffff5
   d:	48 89 df             	mov    %rbx,%rdi
  10:	e8 52 86 77 00       	call   0x778667
  15:	eb 9e                	jmp    0xffffffb5
  17:	f3 0f 1e fa          	endbr64
  1b:	41 54                	push   %r12
  1d:	49 89 d4             	mov    %rdx,%r12
  20:	55                   	push   %rbp
  21:	48 89 f5             	mov    %rsi,%rbp
  24:	be 98 00 00 00       	mov    $0x98,%esi
  29:	53                   	push   %rbx
* 2a:	48 89 fb             	mov    %rdi,%rbx <-- trapping instruction
  2d:	e8 45 c9 00 00       	call   0xc977
  32:	48 8d 7b 70          	lea    0x70(%rbx),%rdi
  36:	45 31 c9             	xor    %r9d,%r9d
  39:	31 c9                	xor    %ecx,%ecx
  3b:	6a 00                	push   $0x0
  3d:	4c 89 e2             	mov    %r12,%rdx


Tested on:

commit:         6bc40e44 Merge tag 'ovl-fixes-6.7-rc2' of git://git.ke..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=12241877680000
kernel config:  https://syzkaller.appspot.com/x/.config?x=50e80fa8ba9f1bd4
dashboard link: https://syzkaller.appspot.com/bug?extid=3779764ddb7a3e19437f
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.

Re: [syzbot] [bpf?] [reiserfs?] WARNING: locking bug in corrupted (2)

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 6f861765464f43a71462d52026fbddfc858239a5
Author: Jan Kara <jack@suse.cz>
Date:   Wed Nov 1 17:43:10 2023 +0000

    fs: Block writes to mounted block devices

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=120430a5e80000
start commit:   c17414a273b8 Merge tag 'sh-for-v6.5-tag1' of git://git.ker..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=7ad417033279f15a
dashboard link: https://syzkaller.appspot.com/bug?extid=3779764ddb7a3e19437f
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12bbd544a80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13fd50b0a80000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: fs: Block writes to mounted block devices

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [bpf?] [reiserfs?] WARNING: locking bug in corrupted (2)

[Jan Kara]

On Thu 11-01-24 08:35:04, syzbot wrote:
> syzbot suspects this issue was fixed by commit:
> 
> commit 6f861765464f43a71462d52026fbddfc858239a5
> Author: Jan Kara <jack@suse.cz>
> Date:   Wed Nov 1 17:43:10 2023 +0000
> 
>     fs: Block writes to mounted block devices
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=120430a5e80000
> start commit:   c17414a273b8 Merge tag 'sh-for-v6.5-tag1' of git://git.ker..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=7ad417033279f15a
> dashboard link: https://syzkaller.appspot.com/bug?extid=3779764ddb7a3e19437f
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12bbd544a80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13fd50b0a80000
> 
> If the result looks correct, please mark the issue as fixed by replying with:

Looks plausible.
 
#syz fix: fs: Block writes to mounted block devices

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR