MIME-Version: 1.0
In-Reply-To: <CAPAsAGzD1tk-zi+Khu-e3=8=vQL8e4huZmd1pRKVJ7gm0n6ajA@mail.gmail.com>
References: <CACT4Y+YAjq8mcfiVxR075didJKCyOCVrqxdbfKdgUxabstbfmA@mail.gmail.com>
 <20160420211456.GE4775@htj.duckdns.org> <CACT4Y+arruy73K7kATxByuGqJKr=vfmOGqxiQAVgLaJ3DZsV9g@mail.gmail.com>
 <CAPAsAGzD1tk-zi+Khu-e3=8=vQL8e4huZmd1pRKVJ7gm0n6ajA@mail.gmail.com>
From: Dmitry Vyukov <dvyukov@google.com>
Date: Thu, 21 Apr 2016 12:00:38 +0200
Message-ID: <CACT4Y+YSRq=BzA+rCNRX10=GBQZC84hc4gc6GjoGwCgoRz9HPQ@mail.gmail.com>
Subject: Re: fs: GPF in locked_inode_to_wb_and_lock_list
To: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Tejun Heo <tj@kernel.org>, Alexander Viro <viro@zeniv.linux.org.uk>,
        "linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        syzkaller <syzkaller@googlegroups.com>,
        Kostya Serebryany <kcc@google.com>,
        Alexander Potapenko <glider@google.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 695
Lines: 19

On Thu, Apr 21, 2016 at 11:45 AM, Andrey Ryabinin
<ryabinin.a.a@gmail.com> wrote:
> 2016-04-21 11:35 GMT+03:00 Dmitry Vyukov <dvyukov@google.com>:
>>
>> ffffffff818884dd:       48 8b 03                mov    (%rbx),%rax
>>
>> So whatever load "&wb->bdi->wb" produces is a NULL deref. (is it wb
>> that is NULL?)
>
> Yes it's NULL wb, because there is only one load:
>     mov    (%rbx),%rax        =>       rax = wb->bdi
>     add    $0x50,%rax         =>       rax = &bdi->wb


I bet that wb becomes NULL on the second iteration of the loop. The
loop loops in case of a race with another thread, so it would also
explain why it is difficult to reproduce.

Tejun, does it make any sense to you?