* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
[not found] <20260109080649.582553-1-kartikey406@gmail.com>
@ 2026-01-09 8:25 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-01-09 8:25 UTC (permalink / raw)
To: kartikey406, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __filemap_add_folio
kernel_clone+0xfc/0x910 kernel/fork.c:2651
__do_sys_clone+0xce/0x120 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at mm/filemap.c:858!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 6603 Comm: syz.0.90 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__filemap_add_folio+0xf29/0x11b0 mm/filemap.c:858
Code: 96 c6 ff 48 c7 c6 80 ed 99 8b 4c 89 ef e8 bf 72 11 00 90 0f 0b e8 77 96 c6 ff 48 c7 c6 e0 ed 99 8b 4c 89 ef e8 a8 72 11 00 90 <0f> 0b e8 60 96 c6 ff 90 0f 0b 90 e9 1c fc ff ff e8 52 96 c6 ff 48
RSP: 0018:ffffc900040af808 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88802b89c980 RSI: ffffffff81f85248 RDI: ffff88802b89ce04
RBP: 0000000000000c40 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9088b8d7 R11: 0000000000000001 R12: 0000000000000002
R13: ffffea0000936400 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f83919c36c0(0000) GS:ffff8880d6af5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f83919c2f98 CR3: 000000002db08000 CR4: 0000000000352ef0
Call Trace:
<TASK>
filemap_add_folio+0x19a/0x610 mm/filemap.c:966
do_read_cache_folio+0x23c/0x5c0 mm/filemap.c:4063
do_read_cache_page mm/filemap.c:4162 [inline]
read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195
btrfs_read_disk_super+0x192/0x500 fs/btrfs/volumes.c:1367
btrfs_scan_one_device+0x109/0x820 fs/btrfs/volumes.c:1475
btrfs_get_tree_super fs/btrfs/super.c:1860 [inline]
btrfs_get_tree_subvol fs/btrfs/super.c:2089 [inline]
btrfs_get_tree+0x5b3/0x2710 fs/btrfs/super.c:2123
vfs_get_tree+0x8e/0x330 fs/super.c:1751
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3636 [inline]
do_new_mount fs/namespace.c:3712 [inline]
path_mount+0x7bf/0x23a0 fs/namespace.c:4022
do_mount fs/namespace.c:4035 [inline]
__do_sys_mount fs/namespace.c:4224 [inline]
__se_sys_mount fs/namespace.c:4201 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:4201
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8390b8f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f83919c3038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f8390de6090 RCX: 00007f8390b8f7c9
RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00002000000001c0
RBP: 00007f8390c13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004418 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8390de6128 R14: 00007f8390de6090 R15: 00007ffc2a9b3b58
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__filemap_add_folio+0xf29/0x11b0 mm/filemap.c:858
Code: 96 c6 ff 48 c7 c6 80 ed 99 8b 4c 89 ef e8 bf 72 11 00 90 0f 0b e8 77 96 c6 ff 48 c7 c6 e0 ed 99 8b 4c 89 ef e8 a8 72 11 00 90 <0f> 0b e8 60 96 c6 ff 90 0f 0b 90 e9 1c fc ff ff e8 52 96 c6 ff 48
RSP: 0018:ffffc900040af808 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88802b89c980 RSI: ffffffff81f85248 RDI: ffff88802b89ce04
RBP: 0000000000000c40 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9088b8d7 R11: 0000000000000001 R12: 0000000000000002
R13: ffffea0000936400 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f83919c36c0(0000) GS:ffff8880d6af5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f83919c2f98 CR3: 000000002db08000 CR4: 0000000000352ef0
Tested on:
commit: 623fb991 Merge tag 'pinctrl-v6.19-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15105074580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10205074580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
2026-01-09 11:14 ` Edward Adam Davis
@ 2026-01-09 11:36 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-01-09 11:36 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+b4a2af3000eaa84d95d5@syzkaller.appspotmail.com
Tested-by: syzbot+b4a2af3000eaa84d95d5@syzkaller.appspotmail.com
Tested on:
commit: 623fb991 Merge tag 'pinctrl-v6.19-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1667e922580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11c2a19a580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
2026-01-08 13:00 syzbot
2026-01-09 4:30 ` Edward Adam Davis
2026-01-09 10:49 ` Edward Adam Davis
@ 2026-01-09 11:14 ` Edward Adam Davis
2026-01-09 11:36 ` syzbot
2 siblings, 1 reply; 11+ messages in thread
From: Edward Adam Davis @ 2026-01-09 11:14 UTC (permalink / raw)
To: syzbot+b4a2af3000eaa84d95d5; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 13c514684cfb..eee7471a3e03 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1339,6 +1339,7 @@ struct btrfs_super_block *btrfs_read_disk_super(struct block_device *bdev,
struct page *page;
u64 bytenr, bytenr_orig;
struct address_space *mapping = bdev->bd_mapping;
+ struct inode *inode = mapping->host;
int ret;
bytenr_orig = btrfs_sb_offset(copy_num);
@@ -1364,7 +1365,9 @@ struct btrfs_super_block *btrfs_read_disk_super(struct block_device *bdev,
(bytenr + BTRFS_SUPER_INFO_SIZE) >> PAGE_SHIFT);
}
+ inode_lock(inode);
page = read_cache_page_gfp(mapping, bytenr >> PAGE_SHIFT, GFP_NOFS);
+ inode_unlock(inode);
if (IS_ERR(page))
return ERR_CAST(page);
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
2026-01-09 10:49 ` Edward Adam Davis
@ 2026-01-09 11:04 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-01-09 11:04 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
possible deadlock in do_read_cache_folio
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz-executor/5943 is trying to acquire lock:
ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: do_read_cache_folio+0x71/0x630 mm/filemap.c:4057
but task is already holding lock:
ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: __do_sys_swapon+0x8c5/0x3b30 mm/swapfile.c:3447
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&sb->s_type->i_mutex_key#9);
lock(&sb->s_type->i_mutex_key#9);
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by syz-executor/5943:
#0: ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: __do_sys_swapon+0x8c5/0x3b30 mm/swapfile.c:3447
stack backtrace:
CPU: 2 UID: 0 PID: 5943 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_deadlock_bug+0x225/0x2f0 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x1497/0x2890 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x179/0x330 kernel/locking/lockdep.c:5825
down_write+0x92/0x200 kernel/locking/rwsem.c:1590
inode_lock include/linux/fs.h:1027 [inline]
do_read_cache_folio+0x71/0x630 mm/filemap.c:4057
read_mapping_folio include/linux/pagemap.h:1017 [inline]
__do_sys_swapon+0xa3c/0x3b30 mm/swapfile.c:3473
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6eec78f687
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a7 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdb225a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a7
RAX: ffffffffffffffda RBX: 00007ffdb225a030 RCX: 00007f6eec78f687
RDX: 0000000000000000 RSI: 0000000000008000 RDI: 00007f6eec814bc1
RBP: 00007f6eec814bc1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00007f6eec9b4270
R13: 0000000000000000 R14: 00007f6eec830975 R15: 00007f6eec8309b1
</TASK>
[ 53.084811][ T40] audit: type=1400 audit(1767956586.888:60): avc: denied { rlimitinh } for pid=5908 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 53.096835][ T40] audit: type=1400 audit(1767956586.888:61): avc: denied { siginh } for pid=5908 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '[localhost]:9988' (ED25519) to the list of known hosts.
[ 60.278181][ T40] audit: type=1400 audit(1767956594.098:62): avc: denied { execute } for pid=5933 comm="sh" name="syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1
[ 60.287411][ T40] audit: type=1400 audit(1767956594.098:63): avc: denied { execute_no_trans } for pid=5933 comm="sh" path="/syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1
2026/01/09 11:03:15 parsed 1 programs
[ 61.777835][ T40] audit: type=1400 audit(1767956595.598:64): avc: denied { node_bind } for pid=5933 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 64.448665][ T40] audit: type=1400 audit(1767956598.268:65): avc: denied { mounton } for pid=5943 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 64.458449][ T40] audit: type=1400 audit(1767956598.278:66): avc: denied { mount } for pid=5943 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 64.460855][ T5943] cgroup: Unknown subsys name 'net'
[ 64.471699][ T40] audit: type=1400 audit(1767956598.288:67): avc: denied { unmount } for pid=5943 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 64.617962][ T5943] cgroup: Unknown subsys name 'cpuset'
[ 64.625187][ T5943] cgroup: Unknown subsys name 'rlimit'
[ 64.814304][ T40] audit: type=1400 audit(1767956598.638:68): avc: denied { setattr } for pid=5943 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=849 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 64.822507][ T40] audit: type=1400 audit(1767956598.638:69): avc: denied { create } for pid=5943 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 64.830130][ T40] audit: type=1400 audit(1767956598.638:70): avc: denied { write } for pid=5943 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 64.837309][ T40] audit: type=1400 audit(1767956598.638:71): avc: denied { read } for pid=5943 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 64.898978][ T5946] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[ 65.699886][ T5943]
[ 65.701037][ T5943] ============================================
[ 65.703700][ T5943] WARNING: possible recursive locking detected
[ 65.706218][ T5943] syzkaller #0 Not tainted
[ 65.708005][ T5943] --------------------------------------------
[ 65.710557][ T5943] syz-executor/5943 is trying to acquire lock:
[ 65.713078][ T5943] ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: do_read_cache_folio+0x71/0x630
[ 65.717231][ T5943]
[ 65.717231][ T5943] but task is already holding lock:
[ 65.720205][ T5943] ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: __do_sys_swapon+0x8c5/0x3b30
[ 65.724343][ T5943]
[ 65.724343][ T5943] other info that might help us debug this:
[ 65.727468][ T5943] Possible unsafe locking scenario:
[ 65.727468][ T5943]
[ 65.730398][ T5943] CPU0
[ 65.731745][ T5943] ----
[ 65.733146][ T5943] lock(&sb->s_type->i_mutex_key#9);
[ 65.735015][ T5943] lock(&sb->s_type->i_mutex_key#9);
[ 65.737050][ T5943]
[ 65.737050][ T5943] *** DEADLOCK ***
[ 65.737050][ T5943]
[ 65.740266][ T5943] May be due to missing lock nesting notation
[ 65.740266][ T5943]
[ 65.743600][ T5943] 1 lock held by syz-executor/5943:
[ 65.745702][ T5943] #0: ffff88803d88bda0 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: __do_sys_swapon+0x8c5/0x3b30
[ 65.749925][ T5943]
[ 65.749925][ T5943] stack backtrace:
[ 65.752320][ T5943] CPU: 2 UID: 0 PID: 5943 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
[ 65.752343][ T5943] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 65.752354][ T5943] Call Trace:
[ 65.752363][ T5943] <TASK>
[ 65.752370][ T5943] dump_stack_lvl+0x116/0x1f0
[ 65.752397][ T5943] print_deadlock_bug+0x225/0x2f0
[ 65.752418][ T5943] __lock_acquire+0x1497/0x2890
[ 65.752442][ T5943] lock_acquire+0x179/0x330
[ 65.752461][ T5943] ? do_read_cache_folio+0x71/0x630
[ 65.752480][ T5943] ? __pfx___might_resched+0x10/0x10
[ 65.752498][ T5943] down_write+0x92/0x200
[ 65.752522][ T5943] ? do_read_cache_folio+0x71/0x630
[ 65.752539][ T5943] ? __pfx_down_write+0x10/0x10
[ 65.752564][ T5943] ? down_write+0x14d/0x200
[ 65.752587][ T5943] do_read_cache_folio+0x71/0x630
[ 65.752604][ T5943] ? __pfx_ext4_read_folio+0x10/0x10
[ 65.752622][ T5943] __do_sys_swapon+0xa3c/0x3b30
[ 65.752644][ T5943] ? __pfx_restore_altstack+0x10/0x10
[ 65.752663][ T5943] ? lockdep_hardirqs_on+0x7c/0x110
[ 65.752686][ T5943] ? restore_signal_shadow_stack+0x63/0x460
[ 65.752713][ T5943] ? __do_sys_rt_sigreturn+0x1da/0x2c0
[ 65.752739][ T5943] ? __pfx___do_sys_swapon+0x10/0x10
[ 65.752759][ T5943] ? rcu_is_watching+0x12/0xc0
[ 65.752778][ T5943] do_syscall_64+0xcd/0xf80
[ 65.752799][ T5943] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 65.752817][ T5943] RIP: 0033:0x7f6eec78f687
[ 65.752830][ T5943] Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a7 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 65.752847][ T5943] RSP: 002b:00007ffdb225a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a7
[ 65.752863][ T5943] RAX: ffffffffffffffda RBX: 00007ffdb225a030 RCX: 00007f6eec78f687
[ 65.752875][ T5943] RDX: 0000000000000000 RSI: 0000000000008000 RDI: 00007f6eec814bc1
[ 65.752885][ T5943] RBP: 00007f6eec814bc1 R08: 0000000000000000 R09: 0000000000000000
[ 65.752896][ T5943] R10: 0000000000000008 R11: 0000000000000246 R12: 00007f6eec9b4270
[ 65.752906][ T5943] R13: 0000000000000000 R14: 00007f6eec830975 R15: 00007f6eec8309b1
[ 65.752922][ T5943] </TASK>
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1604046123=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at d1b870e1003
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d1b870e1003b52891d2196c1e2ee42fe905010ba -X github.com/google/syzkaller/prog.gitRevisionDate=20251128-125159" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d1b870e1003b52891d2196c1e2ee42fe905010ba -X github.com/google/syzkaller/prog.gitRevisionDate=20251128-125159" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d1b870e1003b52891d2196c1e2ee42fe905010ba -X github.com/google/syzkaller/prog.gitRevisionDate=20251128-125159" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d1b870e1003b52891d2196c1e2ee42fe905010ba\"
/usr/bin/ld: /tmp/cc8lgRxb.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: 623fb991 Merge tag 'pinctrl-v6.19-2' of git://git.kern..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1271919a580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
2026-01-08 13:00 syzbot
2026-01-09 4:30 ` Edward Adam Davis
@ 2026-01-09 10:49 ` Edward Adam Davis
2026-01-09 11:04 ` syzbot
2026-01-09 11:14 ` Edward Adam Davis
2 siblings, 1 reply; 11+ messages in thread
From: Edward Adam Davis @ 2026-01-09 10:49 UTC (permalink / raw)
To: syzbot+b4a2af3000eaa84d95d5; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/mm/filemap.c b/mm/filemap.c
index ebd75684cb0a..9044a4087ce5 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -4048,17 +4048,22 @@ EXPORT_SYMBOL(generic_file_readonly_mmap_prepare);
static struct folio *do_read_cache_folio(struct address_space *mapping,
pgoff_t index, filler_t filler, struct file *file, gfp_t gfp)
{
+ struct inode *inode = mapping->host;
struct folio *folio;
int err;
if (!filler)
filler = mapping->a_ops->read_folio;
+ inode_lock(inode);
repeat:
folio = filemap_get_folio(mapping, index);
if (IS_ERR(folio)) {
folio = filemap_alloc_folio(gfp, mapping_min_folio_order(mapping), NULL);
- if (!folio)
+ if (!folio) {
+ inode_unlock(inode);
return ERR_PTR(-ENOMEM);
+ }
+
index = mapping_align_index(mapping, index);
err = filemap_add_folio(mapping, folio, index, gfp);
if (unlikely(err)) {
@@ -4066,13 +4071,16 @@ static struct folio *do_read_cache_folio(struct address_space *mapping,
if (err == -EEXIST)
goto repeat;
/* Presumably ENOMEM for xarray node */
+ inode_unlock(inode);
return ERR_PTR(err);
}
goto filler;
}
- if (folio_test_uptodate(folio))
+ if (folio_test_uptodate(folio)) {
+ inode_unlock(inode);
goto out;
+ }
if (!folio_trylock(folio)) {
folio_put_wait_locked(folio, TASK_UNINTERRUPTIBLE);
@@ -4089,11 +4097,13 @@ static struct folio *do_read_cache_folio(struct address_space *mapping,
/* Someone else locked and filled the page in a very small window */
if (folio_test_uptodate(folio)) {
folio_unlock(folio);
+ inode_unlock(inode);
goto out;
}
filler:
err = filemap_read_folio(file, filler, folio);
+ inode_unlock(inode);
if (err) {
folio_put(folio);
if (err == AOP_TRUNCATED_PAGE)
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
[not found] <20260109090943.585561-1-kartikey406@gmail.com>
@ 2026-01-09 9:31 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-01-09 9:31 UTC (permalink / raw)
To: kartikey406, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+b4a2af3000eaa84d95d5@syzkaller.appspotmail.com
Tested-by: syzbot+b4a2af3000eaa84d95d5@syzkaller.appspotmail.com
Tested on:
commit: 623fb991 Merge tag 'pinctrl-v6.19-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10e6b1fc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1513583a580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
[not found] <20260109084313.584239-1-kartikey406@gmail.com>
@ 2026-01-09 9:00 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-01-09 9:00 UTC (permalink / raw)
To: kartikey406, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in create_empty_buffers
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 6871 Comm: syz.0.175 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694
Code: ea 6d ff 48 89 de ba 40 8c 40 00 4c 89 ef e8 0a f6 ff ff 49 89 c6 48 89 c3 eb 03 48 89 c3 e8 1a ea 6d ff 48 89 d8 48 c1 e8 03 <80> 3c 28 00 0f 85 81 03 00 00 48 8d 7b 08 4c 09 23 48 89 f8 48 c1
RSP: 0018:ffffc90003967870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8250f9bc
RDX: ffff888025ef8000 RSI: ffffffff8250fe96 RDI: ffff888025ef9680
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888025ef8b30 R12: 0000000000000000
R13: ffffea0000a94200 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007fe24bca76c0(0000) GS:ffff8880d68f5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe24bca6f98 CR3: 0000000035a6c000 CR4: 0000000000352ef0
Call Trace:
<TASK>
folio_create_buffers+0x109/0x150 fs/buffer.c:1802
block_read_full_folio+0x14c/0x850 fs/buffer.c:2403
filemap_read_folio+0xc8/0x2a0 mm/filemap.c:2496
do_read_cache_folio+0x266/0x5c0 mm/filemap.c:4096
do_read_cache_page mm/filemap.c:4162 [inline]
read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195
btrfs_read_disk_super+0x201/0x580 fs/btrfs/volumes.c:1371
btrfs_scan_one_device+0x109/0x820 fs/btrfs/volumes.c:1479
btrfs_get_tree_super fs/btrfs/super.c:1860 [inline]
btrfs_get_tree_subvol fs/btrfs/super.c:2089 [inline]
btrfs_get_tree+0x5b3/0x2710 fs/btrfs/super.c:2123
vfs_get_tree+0x8e/0x330 fs/super.c:1751
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3636 [inline]
do_new_mount fs/namespace.c:3712 [inline]
path_mount+0x7bf/0x23a0 fs/namespace.c:4022
do_mount fs/namespace.c:4035 [inline]
__do_sys_mount fs/namespace.c:4224 [inline]
__se_sys_mount fs/namespace.c:4201 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:4201
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe24ad8f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe24bca7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fe24afe6090 RCX: 00007fe24ad8f7c9
RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00002000000001c0
RBP: 00007fe24ae13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004418 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe24afe6128 R14: 00007fe24afe6090 R15: 00007ffe2f937158
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694
Code: ea 6d ff 48 89 de ba 40 8c 40 00 4c 89 ef e8 0a f6 ff ff 49 89 c6 48 89 c3 eb 03 48 89 c3 e8 1a ea 6d ff 48 89 d8 48 c1 e8 03 <80> 3c 28 00 0f 85 81 03 00 00 48 8d 7b 08 4c 09 23 48 89 f8 48 c1
RSP: 0018:ffffc90003967870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8250f9bc
RDX: ffff888025ef8000 RSI: ffffffff8250fe96 RDI: ffff888025ef9680
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888025ef8b30 R12: 0000000000000000
R13: ffffea0000a94200 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007fe24bca76c0(0000) GS:ffff8880d68f5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe24bca6f98 CR3: 0000000035a6c000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 6d insl (%dx),%es:(%rdi)
1: ff 48 89 decl -0x77(%rax)
4: de ba 40 8c 40 00 fidivrs 0x408c40(%rdx)
a: 4c 89 ef mov %r13,%rdi
d: e8 0a f6 ff ff call 0xfffff61c
12: 49 89 c6 mov %rax,%r14
15: 48 89 c3 mov %rax,%rbx
18: eb 03 jmp 0x1d
1a: 48 89 c3 mov %rax,%rbx
1d: e8 1a ea 6d ff call 0xff6dea3c
22: 48 89 d8 mov %rbx,%rax
25: 48 c1 e8 03 shr $0x3,%rax
* 29: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2d: 0f 85 81 03 00 00 jne 0x3b4
33: 48 8d 7b 08 lea 0x8(%rbx),%rdi
37: 4c 09 23 or %r12,(%rbx)
3a: 48 89 f8 mov %rdi,%rax
3d: 48 rex.W
3e: c1 .byte 0xc1
Tested on:
commit: 623fb991 Merge tag 'pinctrl-v6.19-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=137de922580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1778a19a580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
[not found] <20260109054404.349244-1-kartikey406@gmail.com>
@ 2026-01-09 6:43 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-01-09 6:43 UTC (permalink / raw)
To: kartikey406, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in create_empty_buffers
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 2 UID: 0 PID: 6551 Comm: syz.0.69 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694
Code: ea 6d ff 48 89 de ba 40 8c 40 00 4c 89 ef e8 0a f6 ff ff 49 89 c6 48 89 c3 eb 03 48 89 c3 e8 1a ea 6d ff 48 89 d8 48 c1 e8 03 <80> 3c 28 00 0f 85 81 03 00 00 48 8d 7b 08 4c 09 23 48 89 f8 48 c1
RSP: 0018:ffffc900041ff870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8250f9bc
RDX: ffff8880375dc980 RSI: ffffffff8250fe96 RDI: ffff8880375de000
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffea0000d84a80 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007f3509bdd6c0(0000) GS:ffff8880d6af5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3509bdcf98 CR3: 000000002babe000 CR4: 0000000000352ef0
Call Trace:
<TASK>
folio_create_buffers+0x109/0x150 fs/buffer.c:1802
block_read_full_folio+0x14c/0x850 fs/buffer.c:2403
filemap_read_folio+0xc8/0x2a0 mm/filemap.c:2496
do_read_cache_folio+0x266/0x5c0 mm/filemap.c:4096
do_read_cache_page mm/filemap.c:4162 [inline]
read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195
btrfs_read_disk_super+0x23a/0x5c0 fs/btrfs/volumes.c:1370
btrfs_scan_one_device+0x109/0x820 fs/btrfs/volumes.c:1478
btrfs_get_tree_super fs/btrfs/super.c:1860 [inline]
btrfs_get_tree_subvol fs/btrfs/super.c:2089 [inline]
btrfs_get_tree+0x5b3/0x2710 fs/btrfs/super.c:2123
vfs_get_tree+0x8e/0x330 fs/super.c:1751
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3636 [inline]
do_new_mount fs/namespace.c:3712 [inline]
path_mount+0x7bf/0x23a0 fs/namespace.c:4022
do_mount fs/namespace.c:4035 [inline]
__do_sys_mount fs/namespace.c:4224 [inline]
__se_sys_mount fs/namespace.c:4201 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:4201
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f350a58f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3509bdd038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f350a7e6090 RCX: 00007f350a58f7c9
RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00002000000001c0
RBP: 00007f350a613f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004418 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f350a7e6128 R14: 00007f350a7e6090 R15: 00007ffc45633788
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694
Code: ea 6d ff 48 89 de ba 40 8c 40 00 4c 89 ef e8 0a f6 ff ff 49 89 c6 48 89 c3 eb 03 48 89 c3 e8 1a ea 6d ff 48 89 d8 48 c1 e8 03 <80> 3c 28 00 0f 85 81 03 00 00 48 8d 7b 08 4c 09 23 48 89 f8 48 c1
RSP: 0018:ffffc900041ff870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8250f9bc
RDX: ffff8880375dc980 RSI: ffffffff8250fe96 RDI: ffff8880375de000
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffea0000d84a80 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007f3509bdd6c0(0000) GS:ffff8880d6af5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3509bdcf98 CR3: 000000002babe000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 6d insl (%dx),%es:(%rdi)
1: ff 48 89 decl -0x77(%rax)
4: de ba 40 8c 40 00 fidivrs 0x408c40(%rdx)
a: 4c 89 ef mov %r13,%rdi
d: e8 0a f6 ff ff call 0xfffff61c
12: 49 89 c6 mov %rax,%r14
15: 48 89 c3 mov %rax,%rbx
18: eb 03 jmp 0x1d
1a: 48 89 c3 mov %rax,%rbx
1d: e8 1a ea 6d ff call 0xff6dea3c
22: 48 89 d8 mov %rbx,%rax
25: 48 c1 e8 03 shr $0x3,%rax
* 29: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2d: 0f 85 81 03 00 00 jne 0x3b4
33: 48 8d 7b 08 lea 0x8(%rbx),%rdi
37: 4c 09 23 or %r12,(%rbx)
3a: 48 89 f8 mov %rdi,%rax
3d: 48 rex.W
3e: c1 .byte 0xc1
Tested on:
commit: 623fb991 Merge tag 'pinctrl-v6.19-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15ed319a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16e55f92580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
2026-01-09 4:30 ` Edward Adam Davis
@ 2026-01-09 4:50 ` syzbot
0 siblings, 0 replies; 11+ messages in thread
From: syzbot @ 2026-01-09 4:50 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __filemap_add_folio
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
------------[ cut here ]------------
kernel BUG at mm/filemap.c:858!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 8695 Comm: syz.0.781 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__filemap_add_folio+0xf29/0x11b0 mm/filemap.c:858
Code: 96 c6 ff 48 c7 c6 80 ed 99 8b 4c 89 ef e8 bf 72 11 00 90 0f 0b e8 77 96 c6 ff 48 c7 c6 e0 ed 99 8b 4c 89 ef e8 a8 72 11 00 90 <0f> 0b e8 60 96 c6 ff 90 0f 0b 90 e9 1c fc ff ff e8 52 96 c6 ff 48
RSP: 0018:ffffc9000c72f808 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888026b024c0 RSI: ffffffff81f85248 RDI: ffff888026b02944
RBP: 0000000000000c40 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9088bbd7 R11: 0000000000000001 R12: 0000000000000002
R13: ffffea0000ce5bc0 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f7a297d56c0(0000) GS:ffff8880d6af5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7a297d4f98 CR3: 0000000035522000 CR4: 0000000000352ef0
Call Trace:
<TASK>
filemap_add_folio+0x19a/0x610 mm/filemap.c:966
do_read_cache_folio+0x23c/0x5c0 mm/filemap.c:4063
do_read_cache_page mm/filemap.c:4162 [inline]
read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195
btrfs_read_disk_super+0x192/0x500 fs/btrfs/volumes.c:1367
btrfs_scan_one_device+0x109/0x820 fs/btrfs/volumes.c:1475
btrfs_get_tree_super fs/btrfs/super.c:1860 [inline]
btrfs_get_tree_subvol fs/btrfs/super.c:2089 [inline]
btrfs_get_tree+0x5b3/0x2710 fs/btrfs/super.c:2123
vfs_get_tree+0x8e/0x330 fs/super.c:1751
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3636 [inline]
do_new_mount fs/namespace.c:3712 [inline]
path_mount+0x7bf/0x23a0 fs/namespace.c:4022
do_mount fs/namespace.c:4035 [inline]
__do_sys_mount fs/namespace.c:4224 [inline]
__se_sys_mount fs/namespace.c:4201 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:4201
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a2898f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7a297d5038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f7a28be6090 RCX: 00007f7a2898f7c9
RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00002000000001c0
RBP: 00007f7a28a13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004418 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7a28be6128 R14: 00007f7a28be6090 R15: 00007fff39c82018
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__filemap_add_folio+0xf29/0x11b0 mm/filemap.c:858
Code: 96 c6 ff 48 c7 c6 80 ed 99 8b 4c 89 ef e8 bf 72 11 00 90 0f 0b e8 77 96 c6 ff 48 c7 c6 e0 ed 99 8b 4c 89 ef e8 a8 72 11 00 90 <0f> 0b e8 60 96 c6 ff 90 0f 0b 90 e9 1c fc ff ff e8 52 96 c6 ff 48
RSP: 0018:ffffc9000c72f808 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888026b024c0 RSI: ffffffff81f85248 RDI: ffff888026b02944
RBP: 0000000000000c40 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9088bbd7 R11: 0000000000000001 R12: 0000000000000002
R13: ffffea0000ce5bc0 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f7a297d56c0(0000) GS:ffff8880d6af5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7a297d4f98 CR3: 0000000035522000 CR4: 0000000000352ef0
Tested on:
commit: 623fb991 Merge tag 'pinctrl-v6.19-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1689319a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=14bd9074580000
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
2026-01-08 13:00 syzbot
@ 2026-01-09 4:30 ` Edward Adam Davis
2026-01-09 4:50 ` syzbot
2026-01-09 10:49 ` Edward Adam Davis
2026-01-09 11:14 ` Edward Adam Davis
2 siblings, 1 reply; 11+ messages in thread
From: Edward Adam Davis @ 2026-01-09 4:30 UTC (permalink / raw)
To: syzbot+b4a2af3000eaa84d95d5; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/block/fops.c b/block/fops.c
index 4d32785b31d9..c0cdc950d94c 100644
--- a/block/fops.c
+++ b/block/fops.c
@@ -492,6 +492,9 @@ static int blkdev_writepages(struct address_space *mapping,
static int blkdev_read_folio(struct file *file, struct folio *folio)
{
+ if (1 << READ_ONCE(folio->mapping->host->i_blkbits) > folio_size(folio))
+ return -EIO;
+
return block_read_full_folio(folio, blkdev_get_block);
}
^ permalink raw reply [flat|nested] 11+ messages in thread
* [syzbot] [btrfs?] general protection fault in create_empty_buffers (5)
@ 2026-01-08 13:00 syzbot
2026-01-09 4:30 ` Edward Adam Davis
` (2 more replies)
0 siblings, 3 replies; 11+ messages in thread
From: syzbot @ 2026-01-08 13:00 UTC (permalink / raw)
To: clm, dsterba, josef, linux-btrfs, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: f0b9d8eb98df Merge tag 'nfsd-6.19-3' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1311ef92580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10663e9a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14936074580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f0b9d8eb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d6eefae97e89/vmlinux-f0b9d8eb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a16fafcc4238/bzImage-f0b9d8eb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b4a2af3000eaa84d95d5@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 2 UID: 0 PID: 6261 Comm: syz.0.73 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694
Code: ec 6d ff 48 89 de ba 40 8c 40 00 4c 89 ef e8 0a f6 ff ff 49 89 c6 48 89 c3 eb 03 48 89 c3 e8 ea eb 6d ff 48 89 d8 48 c1 e8 03 <80> 3c 28 00 0f 85 81 03 00 00 48 8d 7b 08 4c 09 23 48 89 f8 48 c1
RSP: 0018:ffffc9000408f870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8250f7ec
RDX: ffff88802a4d8000 RSI: ffffffff8250fcc6 RDI: ffff88802a4d9680
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88802a4d8b30 R12: 0000000000000000
R13: ffffea0000a9e5c0 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007f1ac84a46c0(0000) GS:ffff8880d6af5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1ac84a3f98 CR3: 000000002b14f000 CR4: 0000000000352ef0
Call Trace:
<TASK>
folio_create_buffers+0x109/0x150 fs/buffer.c:1802
block_read_full_folio+0x14c/0x850 fs/buffer.c:2403
filemap_read_folio+0xc8/0x2a0 mm/filemap.c:2496
do_read_cache_folio+0x266/0x5c0 mm/filemap.c:4096
do_read_cache_page mm/filemap.c:4162 [inline]
read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195
btrfs_read_disk_super+0x192/0x500 fs/btrfs/volumes.c:1367
btrfs_scan_one_device+0x109/0x820 fs/btrfs/volumes.c:1475
btrfs_get_tree_super fs/btrfs/super.c:1860 [inline]
btrfs_get_tree_subvol fs/btrfs/super.c:2089 [inline]
btrfs_get_tree+0x5b3/0x2710 fs/btrfs/super.c:2123
vfs_get_tree+0x8e/0x330 fs/super.c:1751
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3636 [inline]
do_new_mount fs/namespace.c:3712 [inline]
path_mount+0x7bf/0x23a0 fs/namespace.c:4022
do_mount fs/namespace.c:4035 [inline]
__do_sys_mount fs/namespace.c:4224 [inline]
__se_sys_mount fs/namespace.c:4201 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:4201
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1ac758f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1ac84a4038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f1ac77e6090 RCX: 00007f1ac758f7c9
RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00002000000001c0
RBP: 00007f1ac7613f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004418 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1ac77e6128 R14: 00007f1ac77e6090 R15: 00007ffe5d1bb9d8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694
Code: ec 6d ff 48 89 de ba 40 8c 40 00 4c 89 ef e8 0a f6 ff ff 49 89 c6 48 89 c3 eb 03 48 89 c3 e8 ea eb 6d ff 48 89 d8 48 c1 e8 03 <80> 3c 28 00 0f 85 81 03 00 00 48 8d 7b 08 4c 09 23 48 89 f8 48 c1
RSP: 0018:ffffc9000408f870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8250f7ec
RDX: ffff88802a4d8000 RSI: ffffffff8250fcc6 RDI: ffff88802a4d9680
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88802a4d8b30 R12: 0000000000000000
R13: ffffea0000a9e5c0 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007f1ac84a46c0(0000) GS:ffff8880d6af5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1ac84a3f98 CR3: 000000002b14f000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: ec in (%dx),%al
1: 6d insl (%dx),%es:(%rdi)
2: ff 48 89 decl -0x77(%rax)
5: de ba 40 8c 40 00 fidivrs 0x408c40(%rdx)
b: 4c 89 ef mov %r13,%rdi
e: e8 0a f6 ff ff call 0xfffff61d
13: 49 89 c6 mov %rax,%r14
16: 48 89 c3 mov %rax,%rbx
19: eb 03 jmp 0x1e
1b: 48 89 c3 mov %rax,%rbx
1e: e8 ea eb 6d ff call 0xff6dec0d
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 0f 85 81 03 00 00 jne 0x3b5
34: 48 8d 7b 08 lea 0x8(%rbx),%rdi
38: 4c 09 23 or %r12,(%rbx)
3b: 48 89 f8 mov %rdi,%rax
3e: 48 rex.W
3f: c1 .byte 0xc1
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2026-01-09 11:36 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20260109080649.582553-1-kartikey406@gmail.com>
2026-01-09 8:25 ` [syzbot] [btrfs?] general protection fault in create_empty_buffers (5) syzbot
[not found] <20260109090943.585561-1-kartikey406@gmail.com>
2026-01-09 9:31 ` syzbot
[not found] <20260109084313.584239-1-kartikey406@gmail.com>
2026-01-09 9:00 ` syzbot
[not found] <20260109054404.349244-1-kartikey406@gmail.com>
2026-01-09 6:43 ` syzbot
2026-01-08 13:00 syzbot
2026-01-09 4:30 ` Edward Adam Davis
2026-01-09 4:50 ` syzbot
2026-01-09 10:49 ` Edward Adam Davis
2026-01-09 11:04 ` syzbot
2026-01-09 11:14 ` Edward Adam Davis
2026-01-09 11:36 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome