Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <000000000000c11ed40600e994b1@google.com> <000000000000d96eec0600fbea8f@google.com>
In-Reply-To: <000000000000d96eec0600fbea8f@google.com>
From:   Aleksandr Nogikh <nogikh@google.com>
Date:   Fri, 21 Jul 2023 11:47:20 +0200
Message-ID: <CANp29Y7Sgbfa5u-wSe1rTJiyKQb7d1GWcnTm+GZBvTcYdjvx-g@mail.gmail.com>
Subject: Re: [syzbot] [ext4?] general protection fault in ep_poll_callback
To:     syzbot <syzbot+c2b68bdf76e442836443@syzkaller.appspotmail.com>
Cc:     adilger.kernel@dilger.ca, brauner@kernel.org, bvanassche@acm.org,
        linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org, mingo@kernel.org,
        peterz@infradead.org, syzkaller-bugs@googlegroups.com,
        tytso@mit.edu, viro@zeniv.linux.org.uk,
        Dmitry Vyukov <dvyukov@google.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Fri, Jul 21, 2023 at 11:30=E2=80=AFAM syzbot
<syzbot+c2b68bdf76e442836443@syzkaller.appspotmail.com> wrote:
>
> syzbot has bisected this issue to:
>
> commit a0b0fd53e1e67639b303b15939b9c653dbe7a8c4
> Author: Bart Van Assche <bvanassche@acm.org>
> Date:   Thu Feb 14 23:00:46 2019 +0000
>
>     locking/lockdep: Free lock classes that are no longer in use

No, that doesn't seem like a real cause commit.

>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=3D16c0c84ea8=
0000

The reproducer actually causes a lot of different crashes, which
apparently confused the bisector.

run #0: crashed: general protection fault in ext4_finish_bio
run #1: crashed: general protection fault in ext4_finish_bio
run #2: crashed: KASAN: wild-memory-access Read in force_sig_info_to_task
run #3: crashed: KASAN: wild-memory-access Read in force_sig_info_to_task
run #4: crashed: BUG: unable to handle kernel paging request in __run_timer=
s
run #5: crashed: BUG: unable to handle kernel paging request in __run_timer=
s
run #6: crashed: general protection fault in mac80211_hwsim_netlink_notify
run #7: crashed: general protection fault in mac80211_hwsim_netlink_notify
run #8: crashed: general protection fault in __run_timers
run #9: crashed: general protection fault in __run_timers
run #10: crashed: KASAN: wild-memory-access Read in process_one_work
run #11: crashed: KASAN: wild-memory-access Read in process_one_work
run #12: crashed: general protection fault in timerqueue_del
run #13: crashed: general protection fault in timerqueue_del
run #14: crashed: kernel BUG in corrupted
run #15: crashed: kernel BUG in corrupted
run #16: crashed: general protection fault in mm_update_next_owner
run #17: crashed: general protection fault in mm_update_next_owner

Isn't it a sign of a severe memory corruption caused by the reproducer?


> start commit:   bfa3037d8280 Merge tag 'fuse-update-6.5' of git://git.ker=
n..
> git tree:       upstream
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=3D15c0c84ea8=
0000
> console output: https://syzkaller.appspot.com/x/log.txt?x=3D11c0c84ea8000=
0
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3D27e33fd2346a5=
4b
> dashboard link: https://syzkaller.appspot.com/bug?extid=3Dc2b68bdf76e4428=
36443
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D111c904ea80=
000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D116b0faaa8000=
0
>
> Reported-by: syzbot+c2b68bdf76e442836443@syzkaller.appspotmail.com
> Fixes: a0b0fd53e1e6 ("locking/lockdep: Free lock classes that are no long=
er in use")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisect=
ion
>