syzbot


general protection fault in do_move_mount (3)

Status: upstream: reported C repro on 2025/05/14 17:39
Subsystems: xfs
[Documentation on labels]
Reported-by: syzbot+799d4cf78a7476483ba2@syzkaller.appspotmail.com
First crash: 35d, last: 3d20h
Cause bisection: introduced by (bisect log) :
commit 267fc3a06a37bec30cc5b4d97fb8409102bc7a9d
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Tue Apr 29 01:43:23 2025 +0000

  do_move_mount(): don't leak MNTNS_PROPAGATING on failures

Crash: BUG: unable to handle kernel NULL pointer dereference in do_move_mount (log)
Repro: C syz .config
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [xfs?] general protection fault in do_move_mount (3) 3 (7) 2025/05/14 19:49
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in do_move_mount (2) fs syz done 7 2180d 2188d 12/28 fixed on 2019/07/29 13:39
upstream general protection fault in do_move_mount fs 3 2229d 2228d 12/28 fixed on 2019/06/14 18:22
Last patch testing requests (3)
Created Duration User Patch Repo Result
2025/05/14 18:46 26m viro@zeniv.linux.org.uk git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git cfaefc95bfa7eb92dd837ea9fb38bc84e62d79b5 OK log
2025/05/14 18:21 2m viro@zeniv.linux.org.uk git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git 8a6d8037a5deb2a9d5184f299f9adb60b0c0ae04 error
2025/05/14 18:05 0m viro@zeniv.linux.org.uk git://git.kernel.org//pub/scm/linux/kernel/git/viro/vfs.git fixes error

Sample crash report:
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
XFS (loop0): Quotacheck: Done.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 UID: 0 PID: 5821 Comm: syz-executor358 Not tainted 6.15.0-rc5-syzkaller-00275-gbec6f00f120e #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:is_anon_ns fs/mount.h:165 [inline]
RIP: 0010:do_move_mount+0x27d/0xb10 fs/namespace.c:3725
Code: e8 98 53 85 ff 41 be ea ff ff ff 49 bd 00 00 00 00 00 fc ff df 48 8b 6c 24 18 4c 8b 7c 24 08 48 8d 5d 48 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 54 22 e5 ff 48 8b 1b 31 ff 48 89
RSP: 0018:ffffc90004197d50 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000032 RCX: ffff888034268000
RDX: 0000000000000000 RSI: ffffffff8d9214e1 RDI: ffff88801b2d77b8
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8238eb99 R12: ffffffff8dde9718
R13: dffffc0000000000 R14: 00000000ffffffea R15: ffff88803401e480
FS:  0000555582a39380(0000) GS:ffff888126200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000066c7e0 CR3: 000000003414c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __do_sys_move_mount fs/namespace.c:4678 [inline]
 __se_sys_move_mount+0x41e/0x580 fs/namespace.c:4616
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7effb3efc739
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcb2b585e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001ad
RAX: ffffffffffffffda RBX: 00007ffcb2b587b8 RCX: 00007effb3efc739
RDX: 00000000ffffff9c RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007effb3f78610 R08: 0000000000000224 R09: 00007ffcb2b587b8
R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffcb2b587a8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:is_anon_ns fs/mount.h:165 [inline]
RIP: 0010:do_move_mount+0x27d/0xb10 fs/namespace.c:3725
Code: e8 98 53 85 ff 41 be ea ff ff ff 49 bd 00 00 00 00 00 fc ff df 48 8b 6c 24 18 4c 8b 7c 24 08 48 8d 5d 48 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 54 22 e5 ff 48 8b 1b 31 ff 48 89
RSP: 0018:ffffc90004197d50 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000032 RCX: ffff888034268000
RDX: 0000000000000000 RSI: ffffffff8d9214e1 RDI: ffff88801b2d77b8
RBP: ffffffffffffffea R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8238eb99 R12: ffffffff8dde9718
R13: dffffc0000000000 R14: 00000000ffffffea R15: ffff88803401e480
FS:  0000555582a39380(0000) GS:ffff888126200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000066c7e0 CR3: 000000003414c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	e8 98 53 85 ff       	call   0xff85539d
   5:	41 be ea ff ff ff    	mov    $0xffffffea,%r14d
   b:	49 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%r13
  12:	fc ff df
  15:	48 8b 6c 24 18       	mov    0x18(%rsp),%rbp
  1a:	4c 8b 7c 24 08       	mov    0x8(%rsp),%r15
  1f:	48 8d 5d 48          	lea    0x48(%rbp),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 54 22 e5 ff       	call   0xffe5228d
  39:	48 8b 1b             	mov    (%rbx),%rbx
  3c:	31 ff                	xor    %edi,%edi
  3e:	48                   	rex.W
  3f:	89                   	.byte 0x89

Crashes (570):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/10 19:08 upstream bec6f00f120e 77908e5f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs general protection fault in do_move_mount
2025/05/10 18:47 upstream bec6f00f120e 77908e5f .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs general protection fault in do_move_mount
2025/05/30 20:55 upstream f66bc387efbe 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/30 15:07 upstream f66bc387efbe 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/30 11:43 upstream f66bc387efbe 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/30 04:27 upstream e0797d3b91de 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in do_move_mount
2025/05/29 18:14 upstream 90b83efa6701 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/29 11:57 upstream 90b83efa6701 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/29 09:26 upstream 90b83efa6701 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/29 05:57 upstream feacb1774bd5 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in do_move_mount
2025/05/29 04:27 upstream 3d413f0cfd7e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in do_move_mount
2025/05/29 02:08 upstream feacb1774bd5 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/29 00:10 upstream feacb1774bd5 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto general protection fault in do_move_mount
2025/05/28 18:48 upstream feacb1774bd5 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/28 15:09 upstream feacb1774bd5 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/28 08:10 upstream 015a99fa7665 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/28 06:16 upstream 015a99fa7665 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/28 05:03 upstream 015a99fa7665 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in do_move_mount
2025/05/23 00:37 upstream d608703fcdd9 0919b50b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in do_move_mount
2025/05/22 00:04 upstream 4a95bc121ccd 0919b50b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in do_move_mount
2025/05/18 20:57 upstream 5723cc3450bc f41472b0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in do_move_mount
2025/05/31 02:29 upstream 8477ab143069 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in do_move_mount
2025/05/30 18:47 upstream f66bc387efbe 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in do_move_mount
2025/05/30 01:01 upstream 90b83efa6701 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in do_move_mount
2025/05/31 06:05 upstream 8477ab143069 3d2f584d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in do_move_mount
2025/05/31 03:46 upstream 8477ab143069 3d2f584d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in do_move_mount
2025/05/30 06:46 upstream e0797d3b91de 3d2f584d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in do_move_mount
2025/05/29 08:13 upstream 90b83efa6701 3d2f584d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in do_move_mount
2025/05/28 21:08 upstream feacb1774bd5 3d2f584d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in do_move_mount
2025/05/28 18:22 upstream feacb1774bd5 3d2f584d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in do_move_mount
2025/05/28 13:47 upstream c89756bcf406 874a1386 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in do_move_mount
2025/05/28 11:28 upstream c89756bcf406 874a1386 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in do_move_mount
2025/05/28 00:11 upstream 914873bc7df9 874a1386 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in do_move_mount
2025/05/24 15:32 upstream 4856ebd99715 ed351ea7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in do_move_mount
2025/05/26 09:38 upstream 0f8c0258bf04 2d4582d0 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte BUG: unable to handle kernel NULL pointer dereference in do_move_mount
2025/05/24 12:51 upstream 94305e83eccb ed351ea7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-compat BUG: unable to handle kernel paging request in do_move_mount
2025/05/20 01:23 upstream a5806cd506af 8f9cf946 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte BUG: unable to handle kernel NULL pointer dereference in do_move_mount
2025/05/13 18:40 upstream e9565e23cd89 9497799b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/13 14:26 upstream e9565e23cd89 9497799b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel NULL pointer dereference in do_move_mount
2025/06/11 02:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 5d7e17ca .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/10 18:46 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 5d7e17ca .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/10 17:21 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 5d7e17ca .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/10 09:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/10 02:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/10 00:24 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/09 21:22 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/09 10:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/09 07:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/08 20:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/08 11:06 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/08 08:03 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/07 19:21 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/06 22:57 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e f61267d4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/06 20:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e f61267d4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/06 04:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 6b6b5f21 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/04 09:20 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e a30356b7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/04 03:07 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e a30356b7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/03 06:19 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e b396b4bf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/02 07:16 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/02 05:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/06/01 02:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/30 05:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/29 23:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/29 19:49 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/29 14:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
2025/05/28 01:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci d7fa1af5b33e 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in do_move_mount
* Struck through repros no longer work on HEAD.