All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+4bbd040ddada1c7801f4@syzkaller.appspotmail.com>
To: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	mingo@kernel.org, mingo@redhat.com, peterz@infradead.org,
	rostedt@goodmis.org, syzkaller-bugs@googlegroups.com,
	viro@zeniv.linux.org.uk, will@kernel.org
Subject: general protection fault in __fget_files
Date: Tue, 03 Nov 2020 09:43:26 -0800	[thread overview]
Message-ID: <000000000000664beb05b33766bd@google.com> (raw)

Hello,

syzbot found the following issue on:

HEAD commit:    b49976d8 Add linux-next specific files for 20201102
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=158bbb82500000
kernel config:  https://syzkaller.appspot.com/x/.config?x=fe87d079ac78e2be
dashboard link: https://syzkaller.appspot.com/bug?extid=4bbd040ddada1c7801f4
compiler:       gcc (GCC) 10.1.0-syz 20200507
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1559ef32500000

The issue was bisected to:

commit 4d004099a668c41522242aa146a38cc4eb59cb1e
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Fri Oct 2 09:04:21 2020 +0000

    lockdep: Fix lockdep recursion

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=14fb9c3a500000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=16fb9c3a500000
console output: https://syzkaller.appspot.com/x/log.txt?x=12fb9c3a500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4bbd040ddada1c7801f4@syzkaller.appspotmail.com
Fixes: 4d004099a668 ("lockdep: Fix lockdep recursion")

general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 1 PID: 8824 Comm: io_uring-sq Not tainted 5.10.0-rc1-next-20201102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:fcheck_files include/linux/fdtable.h:99 [inline]
RIP: 0010:__fget_files+0xef/0x400 fs/file.c:829
Code: db 74 1d e8 43 0d ac ff 0f b6 1d c1 82 14 0b 31 ff 89 de e8 43 05 ac ff 84 db 0f 84 d0 01 00 00 e8 26 0d ac ff 48 8b 44 24 10 <80> 38 00 0f 85 c3 02 00 00 48 8b 44 24 08 48 8b 68 58 48 89 e8 48
RSP: 0018:ffffc900023dfb28 EFLAGS: 00010293
RAX: dffffc000000000b RBX: 0000000000000001 RCX: ffffffff81c4157a
RDX: ffff88814193b500 RSI: ffffffff81c4139a RDI: 0000000000000005
RBP: ffffc900023dfd20 R08: 0000000000000001 R09: ffffffff8ebb4667
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000003 R15: ffffc900023dfd30
FS:  0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f42329d7db8 CR3: 000000001b67b000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __io_file_get fs/io_uring.c:2770 [inline]
 io_file_get+0x454/0x8b0 fs/io_uring.c:6295
 io_req_set_file fs/io_uring.c:6304 [inline]
 io_init_req fs/io_uring.c:6724 [inline]
 io_submit_sqes+0xf1c/0x25f0 fs/io_uring.c:6774
 __io_sq_thread fs/io_uring.c:6921 [inline]
 io_sq_thread+0x4d2/0x1700 fs/io_uring.c:6990
 kthread+0x3af/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Modules linked in:
---[ end trace 71851a1d0e522d2e ]---
RIP: 0010:fcheck_files include/linux/fdtable.h:99 [inline]
RIP: 0010:__fget_files+0xef/0x400 fs/file.c:829
Code: db 74 1d e8 43 0d ac ff 0f b6 1d c1 82 14 0b 31 ff 89 de e8 43 05 ac ff 84 db 0f 84 d0 01 00 00 e8 26 0d ac ff 48 8b 44 24 10 <80> 38 00 0f 85 c3 02 00 00 48 8b 44 24 08 48 8b 68 58 48 89 e8 48
RSP: 0018:ffffc900023dfb28 EFLAGS: 00010293
RAX: dffffc000000000b RBX: 0000000000000001 RCX: ffffffff81c4157a
RDX: ffff88814193b500 RSI: ffffffff81c4139a RDI: 0000000000000005
RBP: ffffc900023dfd20 R08: 0000000000000001 R09: ffffffff8ebb4667
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000003 R15: ffffc900023dfd30
FS:  0000000000000000(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdc225dc7c CR3: 000000000b08e000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

                 reply	other threads:[~2020-11-03 17:43 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=000000000000664beb05b33766bd@google.com \
    --to=syzbot+4bbd040ddada1c7801f4@syzkaller.appspotmail.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=mingo@redhat.com \
    --cc=peterz@infradead.org \
    --cc=rostedt@goodmis.org \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.