mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
       [not found] <20250609052925.971-1-hdanton@sina.com>
@ 2025-06-09  6:01 ` syzbot
  0 siblings, 0 replies; 9+ messages in thread
From: syzbot @ 2025-06-09  6:01 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
Tested-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com

Tested on:

commit:         19272b37 Linux 6.16-rc1
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17e2ca82580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=713d218acd33d94
dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
compiler:       Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1398f570580000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
  2025-06-12  9:37           ` Uladzislau Rezki
@ 2025-06-12 17:20             ` Boqun Feng
  0 siblings, 0 replies; 9+ messages in thread
From: Boqun Feng @ 2025-06-12 17:20 UTC (permalink / raw)
  To: Uladzislau Rezki (Sony), Aleksandr Nogikh
  Cc: syzbot, Andrew Morton, Josh Triplett, kent.overstreet,
	linux-bcachefs, linux-kernel, linux-mm, Paul E. McKenney, rcu,
	syzkaller-bugs



On Thu, Jun 12, 2025, at 2:37 AM, Uladzislau Rezki wrote:
> On Thu, Jun 12, 2025 at 09:42:32AM +0200, Aleksandr Nogikh wrote:
>> On Wed, Jun 11, 2025 at 10:58 PM Boqun Feng <boqun.feng@gmail.com> wrote:
>> >
>> > On Wed, Jun 11, 2025 at 12:57:04PM -0700, syzbot wrote:
>> > > Hello,
>> > >
>> > > syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>> > >
>> > > Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
>> > > Tested-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
>> > >
>> > > Tested on:
>> > >
>> > > commit:         488ef356 KEYS: Invert FINAL_PUT bit
>> > > git tree:       upstream
>> > > console output: https://syzkaller.appspot.com/x/log.txt?x=129a660c580000
>> >
>> > Is there a way to see the whole console output? If Ulad's patch fixes
>> > the exact issue, we should be able to see a WARN_ON_ONCE() triggered.
>> 
>> If WARN_ON_ONCE() were triggered, the associated kernel panic output
>> would have been at the end of this log.
>> 
>> >
>> > Regards,
>> > Boqun
>> >
>> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=713d218acd33d94
>> > > dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
>> 
>> FWIW the last time the bug was observed on syzbot was 100 days ago, so
>> it has likely been fixed since then or has become much harder to
>> reproduce.
>> 
> That is even worse, if it is last for 100 days already.
>

My understanding is that the evidence shows that the
issue that directly caused null-ptr-derek the has been
fixed 100 days ago.

Regards,
Boqun

> --
> Uladzislau Rezki

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
  2025-06-12  7:42         ` Aleksandr Nogikh
@ 2025-06-12  9:37           ` Uladzislau Rezki
  2025-06-12 17:20             ` Boqun Feng
  0 siblings, 1 reply; 9+ messages in thread
From: Uladzislau Rezki @ 2025-06-12  9:37 UTC (permalink / raw)
  To: Aleksandr Nogikh
  Cc: Boqun Feng, syzbot, akpm, josh, kent.overstreet, linux-bcachefs,
	linux-kernel, linux-mm, paulmck, rcu, syzkaller-bugs, urezki

On Thu, Jun 12, 2025 at 09:42:32AM +0200, Aleksandr Nogikh wrote:
> On Wed, Jun 11, 2025 at 10:58 PM Boqun Feng <boqun.feng@gmail.com> wrote:
> >
> > On Wed, Jun 11, 2025 at 12:57:04PM -0700, syzbot wrote:
> > > Hello,
> > >
> > > syzbot has tested the proposed patch and the reproducer did not trigger any issue:
> > >
> > > Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
> > > Tested-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
> > >
> > > Tested on:
> > >
> > > commit:         488ef356 KEYS: Invert FINAL_PUT bit
> > > git tree:       upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=129a660c580000
> >
> > Is there a way to see the whole console output? If Ulad's patch fixes
> > the exact issue, we should be able to see a WARN_ON_ONCE() triggered.
> 
> If WARN_ON_ONCE() were triggered, the associated kernel panic output
> would have been at the end of this log.
> 
> >
> > Regards,
> > Boqun
> >
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=713d218acd33d94
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
> 
> FWIW the last time the bug was observed on syzbot was 100 days ago, so
> it has likely been fixed since then or has become much harder to
> reproduce.
> 
That is even worse, if it is last for 100 days already.

--
Uladzislau Rezki

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
  2025-06-11 20:58       ` Boqun Feng
@ 2025-06-12  7:42         ` Aleksandr Nogikh
  2025-06-12  9:37           ` Uladzislau Rezki
  0 siblings, 1 reply; 9+ messages in thread
From: Aleksandr Nogikh @ 2025-06-12  7:42 UTC (permalink / raw)
  To: Boqun Feng
  Cc: syzbot, akpm, josh, kent.overstreet, linux-bcachefs,
	linux-kernel, linux-mm, paulmck, rcu, syzkaller-bugs, urezki

On Wed, Jun 11, 2025 at 10:58 PM Boqun Feng <boqun.feng@gmail.com> wrote:
>
> On Wed, Jun 11, 2025 at 12:57:04PM -0700, syzbot wrote:
> > Hello,
> >
> > syzbot has tested the proposed patch and the reproducer did not trigger any issue:
> >
> > Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
> > Tested-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
> >
> > Tested on:
> >
> > commit:         488ef356 KEYS: Invert FINAL_PUT bit
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=129a660c580000
>
> Is there a way to see the whole console output? If Ulad's patch fixes
> the exact issue, we should be able to see a WARN_ON_ONCE() triggered.

If WARN_ON_ONCE() were triggered, the associated kernel panic output
would have been at the end of this log.

>
> Regards,
> Boqun
>
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=713d218acd33d94
> > dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a

FWIW the last time the bug was observed on syzbot was 100 days ago, so
it has likely been fixed since then or has become much harder to
reproduce.

> > compiler:       Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> > patch:          https://syzkaller.appspot.com/x/patch.diff?x=170e460c580000
> >
> > Note: testing is done by a robot and is best-effort only.
> >
>

-- 
Aleksandr

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
  2025-06-11 19:57     ` syzbot
@ 2025-06-11 20:58       ` Boqun Feng
  2025-06-12  7:42         ` Aleksandr Nogikh
  0 siblings, 1 reply; 9+ messages in thread
From: Boqun Feng @ 2025-06-11 20:58 UTC (permalink / raw)
  To: syzbot
  Cc: akpm, josh, kent.overstreet, linux-bcachefs, linux-kernel,
	linux-mm, paulmck, rcu, syzkaller-bugs, urezki

On Wed, Jun 11, 2025 at 12:57:04PM -0700, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
> 
> Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
> Tested-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
> 
> Tested on:
> 
> commit:         488ef356 KEYS: Invert FINAL_PUT bit
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=129a660c580000

Is there a way to see the whole console output? If Ulad's patch fixes
the exact issue, we should be able to see a WARN_ON_ONCE() triggered.

Regards,
Boqun

> kernel config:  https://syzkaller.appspot.com/x/.config?x=713d218acd33d94
> dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
> compiler:       Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=170e460c580000
> 
> Note: testing is done by a robot and is best-effort only.
> 

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
  2025-06-11 19:15   ` Uladzislau Rezki
@ 2025-06-11 19:57     ` syzbot
  2025-06-11 20:58       ` Boqun Feng
  0 siblings, 1 reply; 9+ messages in thread
From: syzbot @ 2025-06-11 19:57 UTC (permalink / raw)
  To: akpm, josh, kent.overstreet, linux-bcachefs, linux-kernel,
	linux-mm, paulmck, rcu, syzkaller-bugs, urezki

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
Tested-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com

Tested on:

commit:         488ef356 KEYS: Invert FINAL_PUT bit
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=129a660c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=713d218acd33d94
dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
compiler:       Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch:          https://syzkaller.appspot.com/x/patch.diff?x=170e460c580000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
  2025-06-11 18:02 ` [syzbot] [bcachefs?] [rcu?] " syzbot
@ 2025-06-11 19:15   ` Uladzislau Rezki
  2025-06-11 19:57     ` syzbot
  0 siblings, 1 reply; 9+ messages in thread
From: Uladzislau Rezki @ 2025-06-11 19:15 UTC (permalink / raw)
  To: syzbot
  Cc: akpm, josh, kent.overstreet, linux-bcachefs, linux-kernel,
	linux-mm, paulmck, rcu, syzkaller-bugs, urezki

On Wed, Jun 11, 2025 at 11:02:03AM -0700, syzbot wrote:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:
> 
> failed to apply patch:
> checking file kernel/rcu/tree.c
> patch: **** unexpected end of file in patch
> 
> 
> 
> Tested on:
> 
> commit:         aef17cb3 Revert "mm/damon/Kconfig: enable CONFIG_DAMON..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=523d3ff8e053340a
> dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
> compiler:       
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=17de99d4580000
> 
#syz test

diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index e8a4b720d7d2..14d4499c6fc3 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -3072,6 +3072,10 @@ __call_rcu_common(struct rcu_head *head, rcu_callback_t func, bool lazy_in)
 	/* Misaligned rcu_head! */
 	WARN_ON_ONCE((unsigned long)head & (sizeof(void *) - 1));
 
+	/* Avoid NULL dereference if callback is NULL. */
+	if (WARN_ON_ONCE(!func))
+		return;
+
 	if (debug_rcu_head_queue(head)) {
 		/*
 		 * Probable double call_rcu(), so leak the callback.

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
  2025-06-11 15:58 [syzbot] [rcu?] [bcachefs?] " Uladzislau Rezki
@ 2025-06-11 18:02 ` syzbot
  2025-06-11 19:15   ` Uladzislau Rezki
  0 siblings, 1 reply; 9+ messages in thread
From: syzbot @ 2025-06-11 18:02 UTC (permalink / raw)
  To: akpm, josh, kent.overstreet, linux-bcachefs, linux-kernel,
	linux-mm, paulmck, rcu, syzkaller-bugs, urezki

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file kernel/rcu/tree.c
patch: **** unexpected end of file in patch



Tested on:

commit:         aef17cb3 Revert "mm/damon/Kconfig: enable CONFIG_DAMON..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=523d3ff8e053340a
dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17de99d4580000


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3)
  2025-02-05  0:34 [syzbot] [rcu?] [bcachefs?] " syzbot
@ 2025-06-08  6:58 ` syzbot
  0 siblings, 0 replies; 9+ messages in thread
From: syzbot @ 2025-06-08  6:58 UTC (permalink / raw)
  To: akpm, ayaanmirza.788, ayaanmirzabaig85, josh, kent.overstreet,
	linux-bcachefs, linux-kernel, linux-mm, luto, paulmck, peterz,
	rcu, syzkaller-bugs, tglx

syzbot has bisected this issue to:

commit 14152654805256d760315ec24e414363bfa19a06
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date:   Mon Nov 25 05:21:27 2024 +0000

    bcachefs: Bad btree roots are now autofix

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=12fa0a82580000
start commit:   99fa936e8e4f Merge tag 'affs-6.14-rc5-tag' of git://git.ke..
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=11fa0a82580000
console output: https://syzkaller.appspot.com/x/log.txt?x=16fa0a82580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=523d3ff8e053340a
dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=119d35a8580000

Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
Fixes: 141526548052 ("bcachefs: Bad btree roots are now autofix")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2025-06-12 17:20 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <20250609052925.971-1-hdanton@sina.com>
2025-06-09  6:01 ` [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu_core (3) syzbot
2025-06-11 15:58 [syzbot] [rcu?] [bcachefs?] " Uladzislau Rezki
2025-06-11 18:02 ` [syzbot] [bcachefs?] [rcu?] " syzbot
2025-06-11 19:15   ` Uladzislau Rezki
2025-06-11 19:57     ` syzbot
2025-06-11 20:58       ` Boqun Feng
2025-06-12  7:42         ` Aleksandr Nogikh
2025-06-12  9:37           ` Uladzislau Rezki
2025-06-12 17:20             ` Boqun Feng
  -- strict thread matches above, loose matches on Subject: below --
2025-02-05  0:34 [syzbot] [rcu?] [bcachefs?] " syzbot
2025-06-08  6:58 ` [syzbot] [bcachefs?] [rcu?] " syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®