Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 26 Jun 2020 12:47:27 -0400
From:   "J. Bruce Fields" <bfields@fieldses.org>
To:     Dmitry Vyukov <dvyukov@google.com>
Cc:     Hillf Danton <hdanton@sina.com>,
        syzbot <syzbot+0e37e9d19bded16b8ab9@syzkaller.appspotmail.com>,
        chuck.lever@oracle.com, LKML <linux-kernel@vger.kernel.org>,
        linux-nfs@vger.kernel.org,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: BUG: unable to handle kernel paging request in rb_erase
Message-ID: <20200626164727.GB3565@fieldses.org>
References: <0000000000005016dd05a5e6b308@google.com>
 <20200603043435.13820-1-hdanton@sina.com>
 <20200603144326.GA2035@fieldses.org>
 <20200604035359.2516-1-hdanton@sina.com>
 <20200604215812.GC3458@fieldses.org>
 <20200625210229.GE6605@fieldses.org>
 <CACT4Y+b_byN4xT+-42M6XtHv=QKRrgD2aSH+Hd0CDJ=v+OYWPA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CACT4Y+b_byN4xT+-42M6XtHv=QKRrgD2aSH+Hd0CDJ=v+OYWPA@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Jun 26, 2020 at 12:32:42PM +0200, Dmitry Vyukov wrote:
> So far this crash happened only once:
> https://syzkaller.appspot.com/bug?extid=0e37e9d19bded16b8ab9
> 
> For continuous fuzzing on syzbot it usually means either (1) it's a
> super narrow race or (2) it's a previous unnoticed memory corruption.
> 
> Simpler bugs usually have much higher hit counts:
> https://syzkaller.appspot.com/upstream
> https://syzkaller.appspot.com/upstream/fixed
> 
> If you did a reasonable looking for any obvious bugs in the code that
> would lead to such failure, it can make sense to postpone any
> additional actions until we have more info.
> If no info comes, at some point syzbot will auto-obsolete it, and then
> then we can assume it was (2).

OK, thanks.

It's a big heavily used data structure, if there was random memory
corruption then I guess this wouldn't be a surprising way for it to show
up.

--b.