kernel BUG in ext4_writepages
12 views
Skip to first unread message
syzbot
May 9, 2022, 3:22:25 PM5/9/22
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: de64d941a71a Merge 5.10.112 into android12-5.10-lts
git tree: android12-5.10-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1500400ef00000
kernel config: https://syzkaller.appspot.com/x/.config?x=42eb3bb85aaa1fc9
dashboard link: https://syzkaller.appspot.com/bug?extid=bd13648a53ed6933ca49
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=167475faf00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=129da6caf00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bd1364...@syzkaller.appspotmail.com
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
------------[ cut here ]------------
kernel BUG at fs/ext4/inode.c:2753!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 372 Comm: syz-executor373 Not tainted 5.10.112-syzkaller-00287-gde64d941a71a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ext4_writepages+0x36ca/0x36f0 fs/ext4/inode.c:2752
Code: c6 31 ff e8 d8 5d 90 ff 84 db 75 2c e8 bf 5a 90 ff 49 bf 00 00 00 00 00 fc ff df 4c 8b 64 24 48 e9 3f f7 ff ff e8 a6 5a 90 ff <0f> 0b e8 9f 5a 90 ff e8 b9 fd 23 ff eb 9d e8 93 5a 90 ff e8 ad fd
RSP: 0018:ffffc90000ae7300 EFLAGS: 00010293
RAX: ffffffff81dc561a RBX: 0000008000000000 RCX: ffff88810658e2c0
RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000
RBP: ffffc90000ae76f0 R08: ffffffff81dc25e7 R09: ffffed1021c6800b
R10: ffffed1021c6800b R11: 1ffff11021c6800a R12: ffffc90000ae75c0
R13: 0000000000000001 R14: 0000008410000000 R15: ffffc90000ae7860
FS: 00007f030cfb9700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599f528b520 CR3: 000000011e5e5000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_writepages+0x13a/0x280 mm/page-writeback.c:2358
__filemap_fdatawrite_range+0x354/0x420 mm/filemap.c:427
file_write_and_wait_range+0x89/0x120 mm/filemap.c:766
ext4_sync_file+0x19e/0x9d0 fs/ext4/fsync.c:151
vfs_fsync_range+0x17b/0x190 fs/sync.c:200
generic_write_sync include/linux/fs.h:2796 [inline]
ext4_buffered_write_iter+0x565/0x610 fs/ext4/file.c:280
ext4_file_write_iter+0x192/0x1cd0 fs/ext4/file.c:683
call_write_iter include/linux/fs.h:1947 [inline]
new_sync_write fs/read_write.c:518 [inline]
vfs_write+0xc1c/0xf40 fs/read_write.c:605
ksys_write+0x198/0x2c0 fs/read_write.c:658
__do_sys_write fs/read_write.c:670 [inline]
__se_sys_write fs/read_write.c:667 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:667
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f030d00bcc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f030cfb92f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f030d090420 RCX: 00007f030d00bcc9
RDX: 0000000000000016 RSI: 0000000020002580 RDI: 0000000000000007
RBP: 00007f030d05e04c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e
R13: e5d26e84aa4cf3c6 R14: 65732f636f72702f R15: 00007f030d090428
Modules linked in:
---[ end trace 89f6fade01325723 ]---
RIP: 0010:ext4_writepages+0x36ca/0x36f0 fs/ext4/inode.c:2752
Code: c6 31 ff e8 d8 5d 90 ff 84 db 75 2c e8 bf 5a 90 ff 49 bf 00 00 00 00 00 fc ff df 4c 8b 64 24 48 e9 3f f7 ff ff e8 a6 5a 90 ff <0f> 0b e8 9f 5a 90 ff e8 b9 fd 23 ff eb 9d e8 93 5a 90 ff e8 ad fd
RSP: 0018:ffffc90000ae7300 EFLAGS: 00010293
RAX: ffffffff81dc561a RBX: 0000008000000000 RCX: ffff88810658e2c0
RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000
RBP: ffffc90000ae76f0 R08: ffffffff81dc25e7 R09: ffffed1021c6800b
R10: ffffed1021c6800b R11: 1ffff11021c6800a R12: ffffc90000ae75c0
R13: 0000000000000001 R14: 0000008410000000 R15: ffffc90000ae7860
FS: 00007f030cfb9700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599f528b520 CR3: 000000011e5e5000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: de64d941a71a Merge 5.10.112 into android12-5.10-lts
git tree: android12-5.10-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1500400ef00000
kernel config: https://syzkaller.appspot.com/x/.config?x=42eb3bb85aaa1fc9
dashboard link: https://syzkaller.appspot.com/bug?extid=bd13648a53ed6933ca49
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=167475faf00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=129da6caf00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bd1364...@syzkaller.appspotmail.com
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
------------[ cut here ]------------
kernel BUG at fs/ext4/inode.c:2753!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 372 Comm: syz-executor373 Not tainted 5.10.112-syzkaller-00287-gde64d941a71a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ext4_writepages+0x36ca/0x36f0 fs/ext4/inode.c:2752
Code: c6 31 ff e8 d8 5d 90 ff 84 db 75 2c e8 bf 5a 90 ff 49 bf 00 00 00 00 00 fc ff df 4c 8b 64 24 48 e9 3f f7 ff ff e8 a6 5a 90 ff <0f> 0b e8 9f 5a 90 ff e8 b9 fd 23 ff eb 9d e8 93 5a 90 ff e8 ad fd
RSP: 0018:ffffc90000ae7300 EFLAGS: 00010293
RAX: ffffffff81dc561a RBX: 0000008000000000 RCX: ffff88810658e2c0
RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000
RBP: ffffc90000ae76f0 R08: ffffffff81dc25e7 R09: ffffed1021c6800b
R10: ffffed1021c6800b R11: 1ffff11021c6800a R12: ffffc90000ae75c0
R13: 0000000000000001 R14: 0000008410000000 R15: ffffc90000ae7860
FS: 00007f030cfb9700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599f528b520 CR3: 000000011e5e5000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_writepages+0x13a/0x280 mm/page-writeback.c:2358
__filemap_fdatawrite_range+0x354/0x420 mm/filemap.c:427
file_write_and_wait_range+0x89/0x120 mm/filemap.c:766
ext4_sync_file+0x19e/0x9d0 fs/ext4/fsync.c:151
vfs_fsync_range+0x17b/0x190 fs/sync.c:200
generic_write_sync include/linux/fs.h:2796 [inline]
ext4_buffered_write_iter+0x565/0x610 fs/ext4/file.c:280
ext4_file_write_iter+0x192/0x1cd0 fs/ext4/file.c:683
call_write_iter include/linux/fs.h:1947 [inline]
new_sync_write fs/read_write.c:518 [inline]
vfs_write+0xc1c/0xf40 fs/read_write.c:605
ksys_write+0x198/0x2c0 fs/read_write.c:658
__do_sys_write fs/read_write.c:670 [inline]
__se_sys_write fs/read_write.c:667 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:667
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f030d00bcc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f030cfb92f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f030d090420 RCX: 00007f030d00bcc9
RDX: 0000000000000016 RSI: 0000000020002580 RDI: 0000000000000007
RBP: 00007f030d05e04c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e
R13: e5d26e84aa4cf3c6 R14: 65732f636f72702f R15: 00007f030d090428
Modules linked in:
---[ end trace 89f6fade01325723 ]---
RIP: 0010:ext4_writepages+0x36ca/0x36f0 fs/ext4/inode.c:2752
Code: c6 31 ff e8 d8 5d 90 ff 84 db 75 2c e8 bf 5a 90 ff 49 bf 00 00 00 00 00 fc ff df 4c 8b 64 24 48 e9 3f f7 ff ff e8 a6 5a 90 ff <0f> 0b e8 9f 5a 90 ff e8 b9 fd 23 ff eb 9d e8 93 5a 90 ff e8 ad fd
RSP: 0018:ffffc90000ae7300 EFLAGS: 00010293
RAX: ffffffff81dc561a RBX: 0000008000000000 RCX: ffff88810658e2c0
RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000
RBP: ffffc90000ae76f0 R08: ffffffff81dc25e7 R09: ffffed1021c6800b
R10: ffffed1021c6800b R11: 1ffff11021c6800a R12: ffffc90000ae75c0
R13: 0000000000000001 R14: 0000008410000000 R15: ffffc90000ae7860
FS: 00007f030cfb9700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599f528b520 CR3: 000000011e5e5000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Nov 7, 2022, 7:37:30 AM11/7/22
to gre...@linuxfoundation.org, ja...@suse.cz, lcze...@redhat.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, stable-...@vger.kernel.org, sta...@kernel.org, sta...@vger.kernel.org, syzkaller-a...@googlegroups.com, tadeus...@linaro.org, ty...@mit.edu
This bug is marked as fixed by commit:
ext4: Avoid crash when inline data creation follows DIO write
But I can't find it in any tested tree for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and
new crashes with the same signature are ignored.
ext4: Avoid crash when inline data creation follows DIO write
But I can't find it in any tested tree for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and
new crashes with the same signature are ignored.
Jan Kara
Nov 7, 2022, 9:09:02 AM11/7/22
to syzbot, gre...@linuxfoundation.org, ja...@suse.cz, lcze...@redhat.com, linux...@vger.kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, stable-...@vger.kernel.org, sta...@kernel.org, sta...@vger.kernel.org, syzkaller-a...@googlegroups.com, tadeus...@linaro.org, ty...@mit.edu
Honza
--
Jan Kara <ja...@suse.com>
SUSE Labs, CR
Reply all
Reply to author
Forward
0 new messages