[syzbot] [wireless?] [reiserfs?] general protection fault in __iterate_interfaces

syzbot <[email protected]>
Newsgroups gmane.comp.file-systems.reiserfs.general,gmane.linux.file-systems,gmane.linux.kernel,gmane.linux.kernel.wireless.general,gmane.linux.network
Message-ID <[email protected]> 
Hello,

syzbot found the following issue on:

HEAD commit:    715abedee4cd Add linux-next specific files for 20230515
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13c96725280000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6a2745d066dda0ec
dashboard link: https://syzkaller.appspot.com/bug?extid=1c54f0eff457978ad5f9
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1588e999280000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1013cbc1280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d4d1d06b34b8/disk-715abede.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3ef33a86fdc8/vmlinux-715abede.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e0006b413ed1/bzImage-715abede.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0e228936b617/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

general protection fault, probably for non-canonical address 0xdffffc000000839c: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000000041ce0-0x0000000000041ce7]
CPU: 0 PID: 5001 Comm: syz-executor387 Not tainted 6.4.0-rc2-next-20230515-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
RIP: 0010:__iterate_interfaces+0x85/0x570 net/mac80211/util.c:749
Code: 40 1b 00 00 4c 39 f3 0f 84 82 02 00 00 48 bd 00 00 00 00 00 fc ff df e8 f9 d5 ec f7 4c 8d a3 98 1c 00 00 4c 89 e0 48 c1 e8 03 <0f> b6 04 28 84 c0 74 08 3c 03 0f 8e 5d 04 00 00 8b bb 98 1c 00 00
RSP: 0018:ffffc90000007d90 EFLAGS: 00010206
RAX: 000000000000839c RBX: 0000000000040048 RCX: 0000000000000100
RDX: ffff888026db8000 RSI: ffffffff89974db7 RDI: 0000000000000005
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffffc90000007ff8 R12: 0000000000041ce0
R13: 0000000000000000 R14: ffff88802ab22920 R15: 0000000000000002
FS:  00005555565e7300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564e16122000 CR3: 0000000021303000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 ieee80211_iterate_active_interfaces_atomic+0x73/0x1c0 net/mac80211/util.c:802
 mac80211_hwsim_beacon+0x101/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2283
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x599/0xa30 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x17f/0x360 kernel/time/hrtimer.c:1766
 __do_softirq+0x1d4/0x905 kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:memmove+0x28/0x1b0 arch/x86/lib/memmove_64.S:44
Code: c3 90 f3 0f 1e fa 48 89 f8 48 39 fe 7d 0f 49 89 f0 49 01 d0 49 39 f8 0f 8f b5 00 00 00 48 83 fa 20 0f 82 01 01 00 00 48 89 d1 <f3> a4 c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 47 48 83 ea 20 48
RSP: 0018:ffffc900039aefb0 EFLAGS: 00010282
RAX: ffff888073521fb4 RBX: 0000000000000002 RCX: fffffffff2718d78
RDX: ffffffffffffffe1 RSI: ffff888080e0920d RDI: ffff888080e0921d
RBP: 0000000000000020 R08: ffff888073521f85 R09: 0000766972705f73
R10: 667265736965722e R11: 0000766972705f73 R12: 0000000000000001
R13: 0000000000000001 R14: ffff888073521fa4 R15: 0000000000000010
 leaf_paste_entries+0x44d/0x910 fs/reiserfs/lbalance.c:1377
 balance_leaf_finish_node_paste_dirent fs/reiserfs/do_balan.c:1295 [inline]
 balance_leaf_finish_node_paste fs/reiserfs/do_balan.c:1321 [inline]
 balance_leaf_finish_node fs/reiserfs/do_balan.c:1364 [inline]
 balance_leaf+0x9853/0xddc0 fs/reiserfs/do_balan.c:1452
 do_balance+0x319/0x810 fs/reiserfs/do_balan.c:1888
 reiserfs_paste_into_item+0x74b/0x8d0 fs/reiserfs/stree.c:2157
 reiserfs_add_entry+0x8cb/0xcf0 fs/reiserfs/namei.c:565
 reiserfs_mkdir+0x683/0x990 fs/reiserfs/namei.c:860
 xattr_mkdir fs/reiserfs/xattr.c:77 [inline]
 create_privroot fs/reiserfs/xattr.c:890 [inline]
 reiserfs_xattr_init+0x57e/0xbc0 fs/reiserfs/xattr.c:1006
 reiserfs_fill_super+0x2129/0x2eb0 fs/reiserfs/super.c:2175
 mount_bdev+0x357/0x420 fs/super.c:1380
 legacy_get_tree+0x109/0x220 fs/fs_context.c:610
 vfs_get_tree+0x8d/0x350 fs/super.c:1510
 do_new_mount fs/namespace.c:3039 [inline]
 path_mount+0x134b/0x1e40 fs/namespace.c:3369
 do_mount fs/namespace.c:3382 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __x64_sys_mount+0x283/0x300 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fdf5f19069a
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5001 at arch/x86/mm/tlb.c:1295 nmi_uaccess_okay+0x99/0xb0 arch/x86/mm/tlb.c:1295
Modules linked in:
CPU: 0 PID: 5001 Comm: syz-executor387 Not tainted 6.4.0-rc2-next-20230515-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
RIP: 0010:nmi_uaccess_okay+0x99/0xb0 arch/x86/mm/tlb.c:1295
Code: d8 48 ba 00 f0 ff ff ff ff 0f 00 41 b8 01 00 00 00 48 21 d0 48 ba 00 00 00 00 80 88 ff ff 48 01 d0 48 39 85 80 00 00 00 74 b0 <0f> 0b eb ac 0f 0b eb a0 e8 5a 59 9d 00 eb 8d e8 53 59 9d 00 eb be
RSP: 0018:ffffc90000007a18 EFLAGS: 00010007
RAX: ffff888021303000 RBX: ffff8880780c8000 RCX: 0000000000000100
RDX: ffff888000000000 RSI: ffffffff8a063b4d RDI: ffff8880780c8080
RBP: ffff8880780c8000 R08: 0000000000000001 R09: 00007fdf5f190670
R10: 00007fdf5f1906b0 R11: 0000000000000001 R12: 00007fdf5f190670
R13: 00007fdf5f1906b0 R14: 0000000000000000 R15: ffffc90000007b88
FS:  00005555565e7300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564e16122000 CR3: 0000000021303000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 copy_from_user_nmi+0x62/0x150 arch/x86/lib/usercopy.c:39
 copy_code arch/x86/kernel/dumpstack.c:91 [inline]
 show_opcodes+0x5d/0xd0 arch/x86/kernel/dumpstack.c:121
 show_ip arch/x86/kernel/dumpstack.c:144 [inline]
 show_iret_regs+0x30/0x60 arch/x86/kernel/dumpstack.c:149
 __show_regs+0x22/0x680 arch/x86/kernel/process_64.c:75
 show_trace_log_lvl+0x256/0x390 arch/x86/kernel/dumpstack.c:298
 __die_body arch/x86/kernel/dumpstack.c:417 [inline]
 die_addr+0x3c/0xa0 arch/x86/kernel/dumpstack.c:457
 __exc_general_protection arch/x86/kernel/traps.c:783 [inline]
 exc_general_protection+0x129/0x230 arch/x86/kernel/traps.c:728
 asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:564
RIP: 0010:__iterate_interfaces+0x85/0x570 net/mac80211/util.c:749
Code: 40 1b 00 00 4c 39 f3 0f 84 82 02 00 00 48 bd 00 00 00 00 00 fc ff df e8 f9 d5 ec f7 4c 8d a3 98 1c 00 00 4c 89 e0 48 c1 e8 03 <0f> b6 04 28 84 c0 74 08 3c 03 0f 8e 5d 04 00 00 8b bb 98 1c 00 00
RSP: 0018:ffffc90000007d90 EFLAGS: 00010206
RAX: 000000000000839c RBX: 0000000000040048 RCX: 0000000000000100
RDX: ffff888026db8000 RSI: ffffffff89974db7 RDI: 0000000000000005
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffffc90000007ff8 R12: 0000000000041ce0
R13: 0000000000000000 R14: ffff88802ab22920 R15: 0000000000000002
 ieee80211_iterate_active_interfaces_atomic+0x73/0x1c0 net/mac80211/util.c:802
 mac80211_hwsim_beacon+0x101/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2283
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x599/0xa30 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x17f/0x360 kernel/time/hrtimer.c:1766
 __do_softirq+0x1d4/0x905 kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:memmove+0x28/0x1b0 arch/x86/lib/memmove_64.S:44
Code: c3 90 f3 0f 1e fa 48 89 f8 48 39 fe 7d 0f 49 89 f0 49 01 d0 49 39 f8 0f 8f b5 00 00 00 48 83 fa 20 0f 82 01 01 00 00 48 89 d1 <f3> a4 c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 47 48 83 ea 20 48
RSP: 0018:ffffc900039aefb0 EFLAGS: 00010282
RAX: ffff888073521fb4 RBX: 0000000000000002 RCX: fffffffff2718d78
RDX: ffffffffffffffe1 RSI: ffff888080e0920d RDI: ffff888080e0921d
RBP: 0000000000000020 R08: ffff888073521f85 R09: 0000766972705f73
R10: 667265736965722e R11: 0000766972705f73 R12: 0000000000000001
R13: 0000000000000001 R14: ffff888073521fa4 R15: 0000000000000010
 leaf_paste_entries+0x44d/0x910 fs/reiserfs/lbalance.c:1377
 balance_leaf_finish_node_paste_dirent fs/reiserfs/do_balan.c:1295 [inline]
 balance_leaf_finish_node_paste fs/reiserfs/do_balan.c:1321 [inline]
 balance_leaf_finish_node fs/reiserfs/do_balan.c:1364 [inline]
 balance_leaf+0x9853/0xddc0 fs/reiserfs/do_balan.c:1452
 do_balance+0x319/0x810 fs/reiserfs/do_balan.c:1888
 reiserfs_paste_into_item+0x74b/0x8d0 fs/reiserfs/stree.c:2157
 reiserfs_add_entry+0x8cb/0xcf0 fs/reiserfs/namei.c:565
 reiserfs_mkdir+0x683/0x990 fs/reiserfs/namei.c:860
 xattr_mkdir fs/reiserfs/xattr.c:77 [inline]
 create_privroot fs/reiserfs/xattr.c:890 [inline]
 reiserfs_xattr_init+0x57e/0xbc0 fs/reiserfs/xattr.c:1006
 reiserfs_fill_super+0x2129/0x2eb0 fs/reiserfs/super.c:2175
 mount_bdev+0x357/0x420 fs/super.c:1380
 legacy_get_tree+0x109/0x220 fs/fs_context.c:610
 vfs_get_tree+0x8d/0x350 fs/super.c:1510
 do_new_mount fs/namespace.c:3039 [inline]
 path_mount+0x134b/0x1e40 fs/namespace.c:3369
 do_mount fs/namespace.c:3382 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __x64_sys_mount+0x283/0x300 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fdf5f19069a
Code: Unable to access opcode bytes at 0x7fdf5f190670.
RSP: 002b:00007fffd1387398 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdf5f19069a
RDX: 0000000020001100 RSI: 0000000020000180 RDI: 00007fffd13873b0
RBP: 00007fffd13873b0 R08: 00007fffd13873f0 R09: 00000000000010de
R10: 0000000000000080 R11: 0000000000000286 R12: 0000000000000004
R13: 00005555565e72b8 R14: 0000000000000080 R15: 00007fffd13873f0
 </TASK>
----------------
Code disassembly (best guess):
   0:	40 1b 00             	rex sbb (%rax),%eax
   3:	00 4c 39 f3          	add    %cl,-0xd(%rcx,%rdi,1)
   7:	0f 84 82 02 00 00    	je     0x28f
   d:	48 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbp
  14:	fc ff df
  17:	e8 f9 d5 ec f7       	callq  0xf7ecd615
  1c:	4c 8d a3 98 1c 00 00 	lea    0x1c98(%rbx),%r12
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	0f b6 04 28          	movzbl (%rax,%rbp,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	74 08                	je     0x3a
  32:	3c 03                	cmp    $0x3,%al
  34:	0f 8e 5d 04 00 00    	jle    0x497
  3a:	8b bb 98 1c 00 00    	mov    0x1c98(%rbx),%edi


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.