linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Matthew Wilcox <willy@infradead.org>
To: syzbot <syzbot+6324a37c93030377021f@syzkaller.appspotmail.com>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk
Subject: Re: WARNING in delete_node (2)
Date: Sun, 26 Jul 2020 04:21:15 +0100	[thread overview]
Message-ID: <20200726032115.GE23808@casper.infradead.org> (raw)
In-Reply-To: <00000000000051a79d05ab471440@google.com>

On Sat, Jul 25, 2020 at 10:04:15AM -0700, syzbot wrote:
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 17410 at lib/radix-tree.c:571 delete_node+0x1e7/0x8a0 lib/radix-tree.c:571

Umm.  Interesting.  That's
                WARN_ON_ONCE(!list_empty(&node->private_list));
That list_head is only used by the page cache, and this node is part of
the radix tree of mounts.  So it should have been initialised to empty
and remained empty the entire time it was in use.  It'd be interesting
to get the object file that syzbot ran (at least lib/radix-tree.o) so I
could see from the register dump below what was in node->private_list.
The 'Code' snippet below is, alas, not very interesting because it's
the ud2 instruction, which gcc has correctly shuffled off to the end of
the function.

Or it's a random scribble, or it's bad ram.

> RIP: 0010:delete_node+0x1e7/0x8a0 lib/radix-tree.c:571
> Code: e2 48 c7 43 48 00 00 00 00 48 c1 ea 03 42 80 3c 2a 00 0f 85 bb 05 00 00 48 8b 55 18 49 39 d4 0f 84 8b 03 00 00 e8 e9 6c c3 fd <0f> 0b 48 c7 c6 d0 a6 b0 83 4c 89 e7 e8 b8 d7 b0 fd 4d 85 f6 0f 85
> RSP: 0018:ffffc900078afd08 EFLAGS: 00010246
> RAX: 0000000000040000 RBX: ffffffff89d2df00 RCX: ffffc90013fcd000
> RDX: 0000000000040000 RSI: ffffffff83b0d377 RDI: ffff8880a9c90842
> RBP: ffff88808a91ab40 R08: 0000000000000000 R09: ffff8880a9c90a6f
> R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808a91ab58
> R13: dffffc0000000000 R14: ffff8880a9c90840 R15: 000000000000000a
>  __radix_tree_delete+0x190/0x370 lib/radix-tree.c:1378
>  radix_tree_delete_item+0xe7/0x230 lib/radix-tree.c:1429
>  mnt_free_id fs/namespace.c:131 [inline]

      reply	other threads:[~2020-07-26  3:21 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-25 17:04 WARNING in delete_node (2) syzbot
2020-07-26  3:21 ` Matthew Wilcox [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200726032115.GE23808@casper.infradead.org \
    --to=willy@infradead.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+6324a37c93030377021f@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).