From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30B11CD1288 for ; Thu, 4 Apr 2024 01:33:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5D4796B0089; Wed, 3 Apr 2024 21:33:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5845C6B008A; Wed, 3 Apr 2024 21:33:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 44BD36B008C; Wed, 3 Apr 2024 21:33:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 267F96B0089 for ; Wed, 3 Apr 2024 21:33:47 -0400 (EDT) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 92E95C0E2B for ; Thu, 4 Apr 2024 01:33:46 +0000 (UTC) X-FDA: 81970127652.15.B4201FB Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf26.hostedemail.com (Postfix) with ESMTP id 55DEC14000A for ; Thu, 4 Apr 2024 01:33:43 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=JligCp8x; dmarc=none; spf=pass (imf26.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712194425; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=2jAoeD89+8fiRM4uxUYs5ACVWeeqvpRGvvobscBCABA=; b=4d4mX7V/Drpf62xyZl6OKNMHKtssv2+cg+rtO6BJZqrCrFoooc8gjGlcKY5i+i/dkvQrgp +aDfeXkazzNHQU8HGB0P8S1/z+TAGRLPilDUe5MfFV2hTOP7v2PM3Q6zPt9tfBcknxcIvL jwCoSQlWvJYQxbqabNQeR4xubXVmYKM= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=JligCp8x; dmarc=none; spf=pass (imf26.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712194425; a=rsa-sha256; cv=none; b=DLkfzY5nhLDEtMdwvJEEVw6XDciMyKa4IPXsYH9n3K1UNkl3tTErCvqeF3VsU9fXttP+ws FCzJWVnMydWHYR5ZYIQFrXjdHmV/RII+LcJ/czNUW42Sz9v3u1dbjqmkJv2kpITrlCj/5e PNRnT/IYfxVyRwX6AsOS7kVIHGF+x2w= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 9E519CE2E12; Thu, 4 Apr 2024 01:33:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7C73C433C7; Thu, 4 Apr 2024 01:33:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1712194419; bh=D1HLpi3FU8IDGF/aXJYP38qaxr1OoZI8SUSL6g8MQNY=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=JligCp8xPNXLKgSPMMFZMvT3PsSXbVEAhq8o/zM9JKE74WlTimOXRPCMyu5IgAZRD 4vrADQ0RNNGynJtRFuMwGgs26y2BkE+XlihZd0ZayEu5jBgucYTCMXUTtZnL/aMaQA qWWEHdk6BlghS4BE9Iwy3T4G24LMd8sPGLmotfP8= Date: Wed, 3 Apr 2024 18:33:39 -0700 From: Andrew Morton To: syzbot Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com, Carlos Maiolino , Christian Brauner Subject: Re: [syzbot] [mm?] general protection fault in shmem_get_next_id Message-Id: <20240403183339.7a257066e79ac04a7d6e33fd@linux-foundation.org> In-Reply-To: <000000000000a1ff78061517a148@google.com> References: <000000000000a1ff78061517a148@google.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Rspam-User: X-Stat-Signature: 63m4dn9n8jznux18jssmdiz8dffe7fs3 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 55DEC14000A X-HE-Tag: 1712194423-646767 X-HE-Meta: U2FsdGVkX19O8iYnsay03z7SoMcpz3Tf6uU1dbnFYuozarLTYUvV+XrESQTxzLHD84SvjyyaIYLp1LpT/1t1dS2qjds3Y0aBgWOQXpJWDokpN4c6E8MhF80TmusZAv+luSwXFwjFS8ujKxFcQWffSfWLmk7Onm5KuqB4dORPh9/BHLygVhyu9b44nPZ//p2zsOrrmqtCHltOqTBVBSbbi2JP9ZQcgrCZRVyiffhSCgB2jJ0cZ9sJIQ4GOkkgFX3HQeD0n4lkWmxznPUhoaRU46rqpir5PIO+FXAJ9ZRGzQZNFkQuJu7H+NH3hZHODaT/qwhvM1UHNFfA9C5jX/9ytXVjcA6H/jJUx9NXdV/ZEKCDDQ1kR5pLreSjcH8cEj1vzMcn0dQSCUlgxNN00vC1gSoACxiSD4eVNgSBrLe/0Mhd6Pk66GXSz/Rw6wQNUtUyo7hi9GBuHK5mZSDy5hUYqO5Jeo2w1sUmJfJSPvmhMe3Gmy+ji8JQb1lriklJ58Kc/Wt5VM8ormx3+BcDtzJu8ZSfzhvKy2z3VpSW8yRxij9QKO3HQ5eE8T52IX6i8WPW0t7rluTrJr13uP9Ersy8KPBcZ11PbaeRcoW9HliRVhJzqjMOipRY6QmDkkG8sp5YasHVvad7eeuZ6tCbYQllL5e3+d1gmQ1QZL16PLmC6K6r6rUCoK6tSzCIMJPx8Ls/+B6A+1HCINgS0/mogQO49gsbQpWUIOR0uwiaIW65mXjP/OIsGWeZhdFFivfbBhijK9UaihcUIwkR3gJAtq80F0ApWDKSyKFQcBKtam5GiSKlTrpwvphKe7HqsIRKCmXy9z+IspqokFmds0Bh8QnnjwiFMhIiQJqoI7jm7+oukV2N676rH//MAxC/ljUQic5BkEnm/7k+ywn5QgI59FRlVz6ySM5zQvik5Kca7xknvDueBn5tWnXK9DpUtz7tsMcfMe+7wljq0gFKv4l/ZGK l6nLTmRz tKcluRnJNDALlUPVWk8GGmnRKUjDX1UT39qXHZJVnxC0Q14gvhfGAiea00GARsmydVqZwELNYX7SPQ8rqk5KcwtXquvS/wCs4XXi/wlvMts66dGfnSZKDEZhtWg13UWFD2e/WjCNA2EYHVDRX9XTqG/V38xPq1mrDYjYBcRSnvD4EmM8JdBaMlX8aer7ZqeU4R7AfzDg0MtPrr3VnugTzsoC1DgbVbbBL9AKBv1p+BFP9HdpDtk3rgPQhlJX9WblLfrhJGDG5CNBBPcgt9BmBq3VALPWBXTVsKl2ber0rpkB9Ja3F1U/N238a9c9/YDyVDvZK5jYpxUZSp8E= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, 01 Apr 2024 23:58:20 -0700 syzbot wrote: > Hello, Hello. Seems that the new TMPFS_QUOTA code has blown up. Cc's added, thanks for the report and the reproducer! > syzbot found the following issue on: > > HEAD commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel.. > git tree: upstream > console+strace: https://syzkaller.appspot.com/x/log.txt?x=10c90795180000 > kernel config: https://syzkaller.appspot.com/x/.config?x=fe78468a74fdc3b7 > dashboard link: https://syzkaller.appspot.com/bug?extid=05e63c0981a31f35f3fa > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17f51129180000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150d3cee180000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/0f7abe4afac7/disk-fe46a7dd.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/82598d09246c/vmlinux-fe46a7dd.xz > kernel image: https://storage.googleapis.com/syzbot-assets/efa23788c875/bzImage-fe46a7dd.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+05e63c0981a31f35f3fa@syzkaller.appspotmail.com > > general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] > CPU: 0 PID: 5070 Comm: syz-executor253 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 > RIP: 0010:shmem_get_next_id+0x92/0x5c0 mm/shmem_quota.c:119 > Code: 04 db 49 8d 9c c6 90 02 00 00 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 f8 66 1b 00 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 df 66 1b 00 4c 8b 23 48 8d 5d 07 > RSP: 0018:ffffc900043a7be0 EFLAGS: 00010256 > RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880266c8000 > RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000004 > RBP: ffffc900043a7d00 R08: ffffffff81dcdd47 R09: ffffffff822e7d5a > R10: 0000000000000003 R11: ffffffff81dcdcf0 R12: 1ffff92000874fa0 > R13: ffff888022110000 R14: ffff888022110000 R15: dffffc0000000000 > FS: 0000555578677380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020001000 CR3: 000000007a384000 CR4: 0000000000350ef0 > Call Trace: > > dquot_get_next_dqblk+0x75/0x3a0 fs/quota/dquot.c:2705 > quota_getnextquota+0x2c7/0x6c0 fs/quota/quota.c:250 > __do_sys_quotactl_fd fs/quota/quota.c:1002 [inline] > __se_sys_quotactl_fd+0x2a1/0x440 fs/quota/quota.c:973 > do_syscall_64+0xfd/0x240 > entry_SYSCALL_64_after_hwframe+0x6d/0x75 > RIP: 0033:0x7f5c0349b329 > Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007ffc39d71138 EFLAGS: 00000246 ORIG_RAX: 00000000000001bb > RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007f5c0349b329 > RDX: 0000000000000000 RSI: ffffffff80000901 RDI: 0000000000000003 > RBP: 00007f5c0350e610 R08: 0000000000000000 R09: 00007ffc39d71308 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 > R13: 00007ffc39d712f8 R14: 0000000000000001 R15: 0000000000000001 > > Modules linked in: > ---[ end trace 0000000000000000 ]--- > RIP: 0010:shmem_get_next_id+0x92/0x5c0 mm/shmem_quota.c:119 > Code: 04 db 49 8d 9c c6 90 02 00 00 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 f8 66 1b 00 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 df 66 1b 00 4c 8b 23 48 8d 5d 07 > RSP: 0018:ffffc900043a7be0 EFLAGS: 00010256 > RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880266c8000 > RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000004 > RBP: ffffc900043a7d00 R08: ffffffff81dcdd47 R09: ffffffff822e7d5a > R10: 0000000000000003 R11: ffffffff81dcdcf0 R12: 1ffff92000874fa0 > R13: ffff888022110000 R14: ffff888022110000 R15: dffffc0000000000 > FS: 0000555578677380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020001000 CR3: 000000007a384000 CR4: 0000000000350ef0 > ---------------- > Code disassembly (best guess): > 0: 04 db add $0xdb,%al > 2: 49 8d 9c c6 90 02 00 lea 0x290(%r14,%rax,8),%rbx > 9: 00 > a: 48 89 d8 mov %rbx,%rax > d: 48 c1 e8 03 shr $0x3,%rax > 11: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) > 16: 74 08 je 0x20 > 18: 48 89 df mov %rbx,%rdi > 1b: e8 f8 66 1b 00 call 0x1b6718 > 20: 48 8b 1b mov (%rbx),%rbx > 23: 48 89 d8 mov %rbx,%rax > 26: 48 c1 e8 03 shr $0x3,%rax > * 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction > 2f: 74 08 je 0x39 > 31: 48 89 df mov %rbx,%rdi > 34: e8 df 66 1b 00 call 0x1b6718 > 39: 4c 8b 23 mov (%rbx),%r12 > 3c: 48 8d 5d 07 lea 0x7(%rbp),%rbx > > > --- > This report is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this issue. See: > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > If the report is already addressed, let syzbot know by replying with: > #syz fix: exact-commit-title > > If you want syzbot to run the reproducer, reply with: > #syz test: git://repo/address.git branch-or-commit-hash > If you attach or paste a git patch, syzbot will apply it before testing. > > If you want to overwrite report's subsystems, reply with: > #syz set subsystems: new-subsystem > (See the list of subsystem names on the web dashboard) > > If the report is a duplicate of another one, reply with: > #syz dup: exact-subject-of-another-report > > If you want to undo deduplication, reply with: > #syz undup