All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+b90b43fd4c6589e96a39@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, hughd@google.com,
	linux-kernel@vger.kernel.org, linux-mm@kvack.org,
	syzkaller-bugs@googlegroups.com
Subject: [syzbot] BUG: unable to handle kernel NULL pointer dereference in shmem_evict_inode
Date: Wed, 16 Nov 2022 06:54:43 -0800	[thread overview]
Message-ID: <0000000000001e68ff05ed97a712@google.com> (raw)

Hello,

syzbot found the following issue on:

HEAD commit:    1621b6eaebf7 Merge branch 'for-next/fixes' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=14016169880000
kernel config:  https://syzkaller.appspot.com/x/.config?x=606e57fd25c5c6cc
dashboard link: https://syzkaller.appspot.com/bug?extid=b90b43fd4c6589e96a39
compiler:       Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1112f7a9880000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17c33e69880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/82aa7741098d/disk-1621b6ea.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f6be08c4e4c2/vmlinux-1621b6ea.xz
kernel image: https://storage.googleapis.com/syzbot-assets/296b6946258a/Image-1621b6ea.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b90b43fd4c6589e96a39@syzkaller.appspotmail.com

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010bfaa000
[0000000000000010] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 PID: 3059 Comm: udevd Not tainted 6.1.0-rc4-syzkaller-31872-g1621b6eaebf7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : simple_xattrs_free include/linux/xattr.h:111 [inline]
pc : shmem_evict_inode+0x2d0/0x3d8 mm/shmem.c:1164
lr : simple_xattrs_free include/linux/xattr.h:110 [inline]
lr : shmem_evict_inode+0x2f0/0x3d8 mm/shmem.c:1164
sp : ffff800012c0ba40
x29: ffff800012c0ba90
 x28: ffff80000d890000
 x27: ffff0000ccf252a0

x26: 00000000000800e0
 x25: 0000000000000001 x24: 0000000000000001
x23: ffff0000ccf254c8 x22: ffff0000c0cb6e00 x21: 0000000000000000
x20: 0000000000000000 x19: ffff0000ccf25310 x18: 0000000000000000
x17: 0000000000000000 x16: ffff80000db1a158 x15: ffff0000c64dcec0
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c64dcec0
x11: ff8080000842e558 x10: 0000000000000000 x9 : ffff80000842e558
x8 : ffff0000c64dcec0 x7 : ffff8000085252dc x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff80000cdfe6d9 x0 : ffff8001f1dbd000
Call trace:
 simple_xattrs_free include/linux/xattr.h:110 [inline]
 shmem_evict_inode+0x2d0/0x3d8 mm/shmem.c:1164
 evict+0xec/0x334 fs/inode.c:664
 iput_final fs/inode.c:1747 [inline]
 iput+0x2c4/0x324 fs/inode.c:1773
 dentry_unlink_inode+0x204/0x21c fs/dcache.c:401
 __dentry_kill+0x15c/0x37c fs/dcache.c:607
 dentry_kill+0x8c/0x194
 dput+0x194/0x2e0 fs/dcache.c:913
 do_renameat2+0x49c/0x758 fs/namei.c:4931
 __do_sys_renameat fs/namei.c:4969 [inline]
 __se_sys_renameat fs/namei.c:4966 [inline]
 __arm64_sys_renameat+0x64/0x7c fs/namei.c:4966
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
Code: 97f9cd15 f84d0f74 eb1b029f 540001a0 (f9400a80) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	97f9cd15 	bl	0xffffffffffe73454
   4:	f84d0f74 	ldr	x20, [x27, #208]!
   8:	eb1b029f 	cmp	x20, x27
   c:	540001a0 	b.eq	0x40  // b.none
* 10:	f9400a80 	ldr	x0, [x20, #16] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

             reply	other threads:[~2022-11-16 14:54 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-11-16 14:54 syzbot [this message]
     [not found] <20221117015628.3543-1-hdanton@sina.com>
2022-11-17  2:11 ` [syzbot] BUG: unable to handle kernel NULL pointer dereference in shmem_evict_inode syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0000000000001e68ff05ed97a712@google.com \
    --to=syzbot+b90b43fd4c6589e96a39@syzkaller.appspotmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=hughd@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.