From: syzbot <syzbot+5b1e53987f858500ec00@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING in mntput_no_expire (3)
Date: Sun, 15 May 2022 02:59:07 -0700 [thread overview]
Message-ID: <0000000000005e542d05df09f5cb@google.com> (raw)
In-Reply-To: <20220515094719.1786-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in dst_dev_put
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 5.18.0-rc6-syzkaller-00009-gfeb9c5e19e91-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dst_dev_put+0x22/0x320 net/core/dst.c:154
Code: 00 00 00 00 00 0f 1f 00 41 57 41 56 49 89 fe 41 55 41 54 55 e8 5f 7b 2b fa 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 dc 02 00 00 49 8d 7e 3a 4d 8b 26 48 b8 00 00 00
RSP: 0018:ffffc90000147c88 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000100
RDX: 0000000000000000 RSI: ffffffff874dc581 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: ffffe8ffffd801e7
R10: fffff91ffffb003c R11: 0000000000000000 R12: 0000000000000003
R13: ffff888069c1a8a8 R14: 0000000000000001 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f729a014ff8 CR3: 0000000023035000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
fib6_nh_release_dsts.part.0+0xf8/0x160 net/ipv6/route.c:3672
fib6_nh_release_dsts net/ipv6/route.c:3663 [inline]
fib6_nh_release+0x11a/0x240 net/ipv6/route.c:3653
fib6_info_destroy_rcu+0x187/0x210 net/ipv6/ip6_fib.c:176
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0x7b1/0x1880 kernel/rcu/tree.c:2786
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
run_ksoftirqd kernel/softirq.c:921 [inline]
run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dst_dev_put+0x22/0x320 net/core/dst.c:154
Code: 00 00 00 00 00 0f 1f 00 41 57 41 56 49 89 fe 41 55 41 54 55 e8 5f 7b 2b fa 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 dc 02 00 00 49 8d 7e 3a 4d 8b 26 48 b8 00 00 00
RSP: 0018:ffffc90000147c88 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000100
RDX: 0000000000000000 RSI: ffffffff874dc581 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: ffffe8ffffd801e7
R10: fffff91ffffb003c R11: 0000000000000000 R12: 0000000000000003
R13: ffff888069c1a8a8 R14: 0000000000000001 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f729a014ff8 CR3: 0000000023035000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 0f 1f 00 nopl (%rax)
7: 41 57 push %r15
9: 41 56 push %r14
b: 49 89 fe mov %rdi,%r14
e: 41 55 push %r13
10: 41 54 push %r12
12: 55 push %rbp
13: e8 5f 7b 2b fa callq 0xfa2b7b77
18: 4c 89 f2 mov %r14,%rdx
1b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
22: fc ff df
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 0f 85 dc 02 00 00 jne 0x30f
33: 49 8d 7e 3a lea 0x3a(%r14),%rdi
37: 4d 8b 26 mov (%r14),%r12
3a: 48 rex.W
3b: b8 .byte 0xb8
3c: 00 00 add %al,(%rax)
Tested on:
commit: feb9c5e1 Merge tag 'for_linus' of git://git.kernel.org..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
console output: https://syzkaller.appspot.com/x/log.txt?x=16848769f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=79caa0035f59d385
dashboard link: https://syzkaller.appspot.com/bug?extid=5b1e53987f858500ec00
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=15cc4e85f00000
next parent reply other threads:[~2022-05-15 9:59 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220515094719.1786-1-hdanton@sina.com>
2022-05-15 9:59 ` syzbot [this message]
[not found] <20220518104052.2373-1-hdanton@sina.com>
2022-05-18 11:00 ` [syzbot] WARNING in mntput_no_expire (3) syzbot
[not found] <20220517223806.2299-1-hdanton@sina.com>
2022-05-17 22:49 ` syzbot
2022-05-17 22:58 ` Al Viro
2022-05-18 0:59 ` Al Viro
2022-05-18 1:10 ` Al Viro
2022-05-18 1:58 ` Al Viro
2022-05-18 4:38 ` Al Viro
2022-05-18 4:57 ` Al Viro
2022-05-18 5:37 ` Al Viro
2022-05-18 6:25 ` Al Viro
2022-05-18 6:45 ` syzbot
[not found] <20220517111247.2103-1-hdanton@sina.com>
2022-05-17 11:35 ` syzbot
[not found] <20220516233918.2046-1-hdanton@sina.com>
2022-05-17 2:57 ` syzbot
[not found] <20220516122225.1986-1-hdanton@sina.com>
2022-05-16 12:33 ` syzbot
[not found] <20220515133111.1864-1-hdanton@sina.com>
2022-05-15 13:42 ` syzbot
[not found] <20220515050556.1646-1-hdanton@sina.com>
2022-05-15 7:52 ` syzbot
[not found] <20220515012731.1529-1-hdanton@sina.com>
2022-05-15 7:23 ` syzbot
[not found] <20220514233453.1426-1-hdanton@sina.com>
2022-05-15 0:22 ` syzbot
[not found] <20220514132858.1322-1-hdanton@sina.com>
2022-05-14 13:40 ` syzbot
[not found] <20220514114718.1254-1-hdanton@sina.com>
2022-05-14 11:59 ` syzbot
[not found] <20220514084129.1104-1-hdanton@sina.com>
2022-05-14 9:20 ` syzbot
[not found] <20220514073117.965-1-hdanton@sina.com>
2022-05-14 7:42 ` syzbot
[not found] <20220514062752.900-1-hdanton@sina.com>
2022-05-14 6:38 ` syzbot
[not found] <20220514005032.346-1-hdanton@sina.com>
2022-05-14 1:30 ` syzbot
[not found] <20220513144536.279-1-hdanton@sina.com>
2022-05-13 15:14 ` syzbot
[not found] <20220513134852.6446-1-hdanton@sina.com>
2022-05-13 14:12 ` syzbot
[not found] <20220513123641.6379-1-hdanton@sina.com>
2022-05-13 12:48 ` syzbot
[not found] <20220512133426.6300-1-hdanton@sina.com>
2022-05-12 14:05 ` syzbot
[not found] <20220512120234.6088-1-hdanton@sina.com>
2022-05-12 12:20 ` syzbot
[not found] <20220511135117.5993-1-hdanton@sina.com>
2022-05-11 14:03 ` syzbot
2021-11-15 22:27 syzbot
2022-05-11 5:34 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000005e542d05df09f5cb@google.com \
--to=syzbot+5b1e53987f858500ec00@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.