syzbot
divide error in flush_commit_list
Status:
auto-obsoleted due to no activity on 2024/04/06 13:39
Subsystems:
fs
[Documentation on labels]
Reported-by: syzbot+32134c00ff57e0343b6b@syzkaller.appspotmail.com
First crash: 1336d, last: 957d
Sample crash report:
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 24508 Comm: kworker/0:1 Not tainted 6.7.0-rc7-syzkaller-00016-gf5837722ffec #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: reiserfs/loop0 flush_async_commits
RIP: 0010:flush_commit_list+0x954/0x1c50 fs/reiserfs/journal.c:1050
Code: fc ff df 0f b6 04 18 84 c0 0f 85 c6 01 00 00 4c 89 f0 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 d3 01 00 00 41 8b 0f 48 89 e8 31 d2 <48> f7 f1 48 89 d5 49 83 c4 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74
RSP: 0018:ffffc90004c6f9e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc9000ad79408
RBP: 0000000000000000 R08: ffffc9000ad7940b R09: 1ffff920015af281
R10: dffffc0000000000 R11: fffff520015af282 R12: ffff88802a0fd000
R13: 0000000000000000 R14: ffff88806dd4f017 R15: ffff88806dd4f014
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa59af9d988 CR3: 0000000019734000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
flush_older_commits fs/reiserfs/journal.c:918 [inline]
flush_commit_list+0x3d1/0x1c50 fs/reiserfs/journal.c:996
flush_async_commits+0xa4/0xc0 fs/reiserfs/journal.c:3553
process_one_work kernel/workqueue.c:2627 [inline]
process_scheduled_works+0x90f/0x1420 kernel/workqueue.c:2700
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2781
kthread+0x2d3/0x370 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:flush_commit_list+0x954/0x1c50 fs/reiserfs/journal.c:1050
Code: fc ff df 0f b6 04 18 84 c0 0f 85 c6 01 00 00 4c 89 f0 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 d3 01 00 00 41 8b 0f 48 89 e8 31 d2 <48> f7 f1 48 89 d5 49 83 c4 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74
RSP: 0018:ffffc90004c6f9e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc9000ad79408
RBP: 0000000000000000 R08: ffffc9000ad7940b R09: 1ffff920015af281
R10: dffffc0000000000 R11: fffff520015af282 R12: ffff88802a0fd000
R13: 0000000000000000 R14: ffff88806dd4f017 R15: ffff88806dd4f014
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0a4e1d000 CR3: 000000000d731000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 2 bytes skipped:
0: df 0f fisttps (%rdi)
2: b6 04 mov $0x4,%dh
4: 18 84 c0 0f 85 c6 01 sbb %al,0x1c6850f(%rax,%rax,8)
b: 00 00 add %al,(%rax)
d: 4c 89 f0 mov %r14,%rax
10: 48 c1 e8 03 shr $0x3,%rax
14: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax
18: 84 c0 test %al,%al
1a: 0f 85 d3 01 00 00 jne 0x1f3
20: 41 8b 0f mov (%r15),%ecx
23: 48 89 e8 mov %rbp,%rax
26: 31 d2 xor %edx,%edx
* 28: 48 f7 f1 div %rcx <-- trapping instruction
2b: 48 89 d5 mov %rdx,%rbp
2e: 49 83 c4 18 add $0x18,%r12
32: 4c 89 e0 mov %r12,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
3d: 74 .byte 0x74
* Struck through repros no longer work on HEAD.