From: syzbot <syzbot+c423003741c992ccf56b@syzkaller.appspotmail.com>
To: clm@fb.com, dsterba@suse.com, fdmanana@suse.com,
josef@toxicpanda.com, linux-btrfs@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] general protection fault in btrfs_ioctl_send
Date: Mon, 28 Nov 2022 01:50:49 -0800 [thread overview]
Message-ID: <00000000000060cb5005ee84ce27@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 9e46a7996732 Add linux-next specific files for 20221125
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1518a973880000
kernel config: https://syzkaller.appspot.com/x/.config?x=11e19c740a0b2926
dashboard link: https://syzkaller.appspot.com/bug?extid=c423003741c992ccf56b
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1024ec05880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12bc0973880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/758d818cf966/disk-9e46a799.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f7c8696b40a5/vmlinux-9e46a799.xz
kernel image: https://storage.googleapis.com/syzbot-assets/810f9750b87f/bzImage-9e46a799.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/9b34ff4df466/mount_0.gz
The issue was bisected to:
commit d14cd51f13589142902687cfacd09e373251ac6e
Author: Filipe Manana <fdmanana@suse.com>
Date: Tue Nov 1 16:15:50 2022 +0000
btrfs: send: cache leaf to roots mapping during backref walking
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17d92353880000
final oops: https://syzkaller.appspot.com/x/report.txt?x=14392353880000
console output: https://syzkaller.appspot.com/x/log.txt?x=10392353880000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c423003741c992ccf56b@syzkaller.appspotmail.com
Fixes: d14cd51f1358 ("btrfs: send: cache leaf to roots mapping during backref walking")
BTRFS info (device loop0): enabling ssd optimizations
BTRFS info (device loop0): auto enabling async discard
BTRFS info (device loop0): checking UUID tree
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 5294 Comm: syz-executor236 Not tainted 6.1.0-rc6-next-20221125-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:empty_backref_cache fs/btrfs/send.c:1396 [inline]
RIP: 0010:btrfs_ioctl_send+0x13ab/0x65a0 fs/btrfs/send.c:8365
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 49 1c 00 00 4d 8b ae c0 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 34 1c 00 00 4c 39 ed 49 8b 5d 00 49 bc 00 00 00
RSP: 0018:ffffc90003bbf8c8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88807735f140 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8380b588 RDI: ffff88807735f000
RBP: ffff88807735f1c0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffed100ee6be28
R13: 0000000000000000 R14: ffff88807735f000 R15: 0000000000000000
FS: 00005555556b3300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff4af8bff8 CR3: 000000007dbc9000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
_btrfs_ioctl_send+0x231/0x2e0 fs/btrfs/ioctl.c:4343
btrfs_ioctl+0x4058/0x5870 fs/btrfs/ioctl.c:4634
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5d8166ab09
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff55cc13f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5d8166ab09
RDX: 0000000020000040 RSI: 0000000040489426 RDI: 0000000000000003
RBP: 00007f5d8162a3d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5d8162a460
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:empty_backref_cache fs/btrfs/send.c:1396 [inline]
RIP: 0010:btrfs_ioctl_send+0x13ab/0x65a0 fs/btrfs/send.c:8365
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 49 1c 00 00 4d 8b ae c0 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 34 1c 00 00 4c 39 ed 49 8b 5d 00 49 bc 00 00 00
RSP: 0018:ffffc90003bbf8c8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88807735f140 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8380b588 RDI: ffff88807735f000
RBP: ffff88807735f1c0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffed100ee6be28
R13: 0000000000000000 R14: ffff88807735f000 R15: 0000000000000000
FS: 00005555556b3300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff4af8bff8 CR3: 000000007dbc9000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 4 bytes skipped:
0: 48 c1 ea 03 shr $0x3,%rdx
4: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
8: 0f 85 49 1c 00 00 jne 0x1c57
e: 4d 8b ae c0 01 00 00 mov 0x1c0(%r14),%r13
15: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1c: fc ff df
1f: 4c 89 ea mov %r13,%rdx
22: 48 c1 ea 03 shr $0x3,%rdx
* 26: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2a: 0f 85 34 1c 00 00 jne 0x1c64
30: 4c 39 ed cmp %r13,%rbp
33: 49 8b 5d 00 mov 0x0(%r13),%rbx
37: 49 rex.WB
38: bc .byte 0xbc
39: 00 00 add %al,(%rax)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
reply other threads:[~2022-11-28 9:50 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=00000000000060cb5005ee84ce27@google.com \
--to=syzbot+c423003741c992ccf56b@syzkaller.appspotmail.com \
--cc=clm@fb.com \
--cc=dsterba@suse.com \
--cc=fdmanana@suse.com \
--cc=josef@toxicpanda.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.