[syzbot] [f2fs?] WARNING: lock held when returning to user space in f2fs_write_single_data_page

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=136e6ef8280000
kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bbb03c280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140d36f8280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d7f0cdd29b71/vmlinux-58390c8c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/de415ad52ae4/bzImage-58390c8c.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/dc89d01cd6e9/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eb6201...@syzkaller.appspotmail.com

syz-executor768: attempt to access beyond end of device
loop0: rw=2049, sector=77824, nr_sectors = 2048 limit=63271
syz-executor768: attempt to access beyond end of device
loop0: rw=2049, sector=79872, nr_sectors = 2048 limit=63271
================================================
WARNING: lock held when returning to user space!
6.3.0-syzkaller-12049-g58390c8ce1bd #0 Not tainted
------------------------------------------------
syz-executor768/4998 is leaving the kernel with locks still held!
1 lock held by syz-executor768/4998:
#0: ffff88807e800448 (&sbi->node_write){++++}-{3:3}, at: f2fs_down_read fs/f2fs/f2fs.h:2087 [inline]
#0: ffff88807e800448 (&sbi->node_write){++++}-{3:3}, at: f2fs_write_single_data_page+0xa10/0x1d50 fs/f2fs/data.c:2842


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Hillf Danton]

On 1 May 2023 10:05:05 -0700

> HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140d36f8280000

Pair down with up.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 58390c8ce1bd

--- x/fs/f2fs/data.c
+++ y/fs/f2fs/data.c
@@ -2833,18 +2833,21 @@ write:

/* Dentry/quota blocks are controlled by checkpoint */
if (S_ISDIR(inode->i_mode) || IS_NOQUOTA(inode)) {
+ int locked = 0;
/*
* We need to wait for node_write to avoid block allocation during
* checkpoint. This can only happen to quota writes which can cause
* the below discard race condition.
*/
- if (IS_NOQUOTA(inode))
+ if (IS_NOQUOTA(inode)) {
f2fs_down_read(&sbi->node_write);
+ locked = 1;
+ }

fio.need_lock = LOCK_DONE;
err = f2fs_do_write_data_page(&fio);

- if (IS_NOQUOTA(inode))
+ if (locked)
f2fs_up_read(&sbi->node_write);

goto done;
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
no output from test machine



Tested on:

commit: 58390c8c Merge tag 'iommu-updates-v6.4' of git://git.k..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17fe6ef8280000

kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=141e43c2280000

[Chao Yu]

On 2023/5/2 1:05, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=136e6ef8280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
> dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bbb03c280000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140d36f8280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/d7f0cdd29b71/vmlinux-58390c8c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/de415ad52ae4/bzImage-58390c8c.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/dc89d01cd6e9/mount_0.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+eb6201...@syzkaller.appspotmail.com

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

general protection fault in f2fs_quota_on

general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737]
CPU: 0 PID: 5450 Comm: syz-executor.0 Not tainted 6.3.0-syzkaller-05651-gfd78b242ba1b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:__lock_acquire+0x69/0x2000 kernel/locking/lockdep.c:4942
Code: df 0f b6 04 30 84 c0 0f 85 5a 16 00 00 83 3d c1 51 e9 0c 00 0f 84 02 11 00 00 83 3d f0 89 74 0b 00 74 2b 4c 89 f0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 f7 e8 c9 54 76 00 48 be 00 00 00 00 00 fc
RSP: 0018:ffffc90005a1faf8 EFLAGS: 00010002
RAX: 00000000000000e6 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000730
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000730 R15: ffff888077f13b80
FS: 00007fc1c2b17700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055800180a000 CR3: 00000000706b1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5691
down_write+0x3a/0x50 kernel/locking/rwsem.c:1573
f2fs_down_write fs/f2fs/f2fs.h:2125 [inline]
f2fs_quota_on+0x120/0x320 fs/f2fs/super.c:2916
__do_sys_quotactl fs/quota/quota.c:960 [inline]
__se_sys_quotactl+0x2b5/0x810 fs/quota/quota.c:916
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc1c1e8c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc1c2b17168 EFLAGS: 00000246 ORIG_RAX: 00000000000000b3
RAX: ffffffffffffffda RBX: 00007fc1c1fac050 RCX: 00007fc1c1e8c169
RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffff80000202
RBP: 00007fc1c1ee7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020008040 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd3e2e112f R14: 00007fc1c2b17300 R15: 0000000000022000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0x69/0x2000 kernel/locking/lockdep.c:4942
Code: df 0f b6 04 30 84 c0 0f 85 5a 16 00 00 83 3d c1 51 e9 0c 00 0f 84 02 11 00 00 83 3d f0 89 74 0b 00 74 2b 4c 89 f0 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 f7 e8 c9 54 76 00 48 be 00 00 00 00 00 fc
RSP: 0018:ffffc90005a1faf8 EFLAGS: 00010002
RAX: 00000000000000e6 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000730
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000730 R15: ffff888077f13b80
FS: 00007fc1c2b17700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055800180a000 CR3: 00000000706b1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: df 0f fisttps (%rdi)
2: b6 04 mov $0x4,%dh
4: 30 84 c0 0f 85 5a 16 xor %al,0x165a850f(%rax,%rax,8)
b: 00 00 add %al,(%rax)
d: 83 3d c1 51 e9 0c 00 cmpl $0x0,0xce951c1(%rip) # 0xce951d5
14: 0f 84 02 11 00 00 je 0x111c
1a: 83 3d f0 89 74 0b 00 cmpl $0x0,0xb7489f0(%rip) # 0xb748a11
21: 74 2b je 0x4e
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 30 00 cmpb $0x0,(%rax,%rsi,1) <-- trapping instruction
2e: 74 12 je 0x42
30: 4c 89 f7 mov %r14,%rdi
33: e8 c9 54 76 00 callq 0x765501
38: 48 rex.W
39: be 00 00 00 00 mov $0x0,%esi
3e: 00 fc add %bh,%ah


Tested on:

commit: fd78b242 f2fs: fix potential deadlock due to unpaired ..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test
console output: https://syzkaller.appspot.com/x/log.txt?x=11d46838280000
kernel config: https://syzkaller.appspot.com/x/.config?x=86e4eb913e90d4b2

dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

[Chao Yu]

On 2023/5/2 1:05, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=136e6ef8280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
> dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bbb03c280000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140d36f8280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/d7f0cdd29b71/vmlinux-58390c8c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/de415ad52ae4/bzImage-58390c8c.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/dc89d01cd6e9/mount_0.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+eb6201...@syzkaller.appspotmail.com

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test

>

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

no output from test machine



Tested on:

commit: 2adb872d f2fs: fix potential deadlock due to unpaired ..

git tree: https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test

console output: https://syzkaller.appspot.com/x/log.txt?x=114b5338280000
kernel config: https://syzkaller.appspot.com/x/.config?x=86e4eb913e90d4b2

dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

[Chao Yu]

Hi,

On 2023/5/4 21:31, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:

It said the reproducer is still triggering an issue, however, there is
no error output from the test.

Could you please help to check whether such status is normal or not, or
am I missing something?

Thanks,

[Aleksandr Nogikh]

On Thu, May 4, 2023 at 3:48 PM Chao Yu <ch...@kernel.org> wrote:
>
> Hi,
>
> On 2023/5/4 21:31, syzbot wrote:
> > Hello,
> >
> > syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>
> It said the reproducer is still triggering an issue, however, there is
> no error output from the test.
>
> Could you please help to check whether such status is normal or not, or
> am I missing something?

The status means that syzbot has not received a single byte from the
VM for 5 minutes in a row, i.e. the kernel likely just hung.

--
Aleksandr

>
> Thanks,
>
> > no output from test machine
> >
> >
> >
> > Tested on:
> >
> > commit: 2adb872d f2fs: fix potential deadlock due to unpaired ..
> > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test
> > console output: https://syzkaller.appspot.com/x/log.txt?x=114b5338280000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=86e4eb913e90d4b2
> > dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
> > compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> >
> > Note: no patches were applied.
>

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/d6a26ad8-3c90-d932-d966-85414e0ae42a%40kernel.org.

[Chao Yu]

On 2023/5/2 1:05, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=136e6ef8280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
> dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bbb03c280000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140d36f8280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/d7f0cdd29b71/vmlinux-58390c8c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/de415ad52ae4/bzImage-58390c8c.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/dc89d01cd6e9/mount_0.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+eb6201...@syzkaller.appspotmail.com

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test

>

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

no output from test machine



Tested on:

commit: d3aff4a1 f2fs: fix potential deadlock due to unpaired ..

git tree: https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test

console output: https://syzkaller.appspot.com/x/log.txt?x=12a82cba280000
kernel config: https://syzkaller.appspot.com/x/.config?x=86e4eb913e90d4b2

dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

[Chao Yu]

On 2023/5/2 1:05, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=136e6ef8280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
> dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bbb03c280000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140d36f8280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/d7f0cdd29b71/vmlinux-58390c8c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/de415ad52ae4/bzImage-58390c8c.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/dc89d01cd6e9/mount_0.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+eb6201...@syzkaller.appspotmail.com

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test

>

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
no output from test machine



Tested on:

commit: 25faad5b f2fs: fix potential deadlock due to unpaired ..

git tree: https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git dev-test

console output: https://syzkaller.appspot.com/x/log.txt?x=17041f8a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=38526bf24c8d961b

dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

[Chao Yu]

On 2023/5/2 1:05, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=136e6ef8280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
> dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bbb03c280000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140d36f8280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/d7f0cdd29b71/vmlinux-58390c8c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/de415ad52ae4/bzImage-58390c8c.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/dc89d01cd6e9/mount_0.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+eb6201...@syzkaller.appspotmail.com

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git master

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING: lock held when returning to user space in f2fs_write_single_data_page

syz-executor.0: attempt to access beyond end of device
loop0: rw=2049, sector=77824, nr_sectors = 3208 limit=63271
syz-executor.0: attempt to access beyond end of device
loop0: rw=2049, sector=81032, nr_sectors = 888 limit=63271

================================================
WARNING: lock held when returning to user space!

6.4.0-rc1-syzkaller-00177-gbb7c241fae62 #0 Not tainted
------------------------------------------------
syz-executor.0/5561 is leaving the kernel with locks still held!
1 lock held by syz-executor.0/5561:
#0: ffff88807cb4c448 (&sbi->node_write){++++}-{3:3}, at: f2fs_down_read fs/f2fs/f2fs.h:2087 [inline]
#0: ffff88807cb4c448 (&sbi->node_write){++++}-{3:3}, at: f2fs_write_single_data_page+0xa10/0x1d50 fs/f2fs/data.c:2842


Tested on:

commit: bb7c241f Merge tag 'ext4_for_linus_stable' of git://gi..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1269271a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=38526bf24c8d961b

dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

[Chao Yu]

On 2023/5/2 1:05, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 58390c8ce1bd Merge tag 'iommu-updates-v6.4' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=136e6ef8280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
> dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bbb03c280000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140d36f8280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/d7f0cdd29b71/vmlinux-58390c8c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/de415ad52ae4/bzImage-58390c8c.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/dc89d01cd6e9/mount_0.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+eb6201...@syzkaller.appspotmail.com

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git bugfix/syzbot

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

no output from test machine



Tested on:

commit: 7d9ee30e f2fs: fix potential deadlock due to unpaired ..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git bugfix/syzbot
console output: https://syzkaller.appspot.com/x/log.txt?x=1648d8fc280000
kernel config: https://syzkaller.appspot.com/x/.config?x=38526bf24c8d961b

dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

[Chao Yu]

On 2023/5/4 21:53, Aleksandr Nogikh wrote:
> On Thu, May 4, 2023 at 3:48 PM Chao Yu <ch...@kernel.org> wrote:
>>
>> Hi,
>>
>> On 2023/5/4 21:31, syzbot wrote:
>>> Hello,
>>>
>>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>>
>> It said the reproducer is still triggering an issue, however, there is
>> no error output from the test.
>>
>> Could you please help to check whether such status is normal or not, or
>> am I missing something?
>
> The status means that syzbot has not received a single byte from the
> VM for 5 minutes in a row, i.e. the kernel likely just hung.
>

Hi,

Can we use echo w > /proc/sysrq-trigger to check where kernel hung at
in such status? Or the shell doesn't response as well? :(

Thanks,

[Aleksandr Nogikh]

Hi!

At least in this particular case it seems that the VM was not hanging
completely -- there were some messages in the serial output, but it's
hard to say if ssh was working fine.

Have you tried to run the reproducer under qemu? FWIW syzbot provided
a bootable disk image in its bug report:

disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz

Something like this should work:

qemu-system-x86_64 -smp 2,sockets=2,cores=1 -m 4G -drive
file=disk-58390c8c.raw,format=raw -snapshot -nographic -enable-kvm

You'd need to build the C repro program and upload the executable to
the qemu instance (it's not in the disk image by default).

If it doesn't trigger the problem, I can try to reproduce it on GCE
and trigger sysrq.

--
Aleksandr

[Chao Yu]

On 2023/5/19 6:06, Aleksandr Nogikh wrote:
> On Sun, May 14, 2023 at 9:22 AM Chao Yu <ch...@kernel.org> wrote:
>>
>> On 2023/5/4 21:53, Aleksandr Nogikh wrote:
>>
>> Hi,
>>
>> Can we use echo w > /proc/sysrq-trigger to check where kernel hung at
>> in such status? Or the shell doesn't response as well? :(
>>
>> Thanks,
>
> Hi!
>
> At least in this particular case it seems that the VM was not hanging
> completely -- there were some messages in the serial output, but it's
> hard to say if ssh was working fine.
>
> Have you tried to run the reproducer under qemu? FWIW syzbot provided
> a bootable disk image in its bug report:
>
> disk image: https://storage.googleapis.com/syzbot-assets/60130779f509/disk-58390c8c.raw.xz
>
> Something like this should work:
>
> qemu-system-x86_64 -smp 2,sockets=2,cores=1 -m 4G -drive
> file=disk-58390c8c.raw,format=raw -snapshot -nographic -enable-kvm

Thanks for providing more information about the test environment, I'm trying
to do the test w/ constructed rootfs and kernel image, and it looks that
the C repro program will exit due to initialize_wifi_devices() fails, after
removing initialize_wifi_devices(), I can run the repro program now.

However, I can't reproduce this bug... even w/ original disk-58390c8c.raw image.

>
> You'd need to build the C repro program and upload the executable to
> the qemu instance (it's not in the disk image by default).
>
> If it doesn't trigger the problem, I can try to reproduce it on GCE
> and trigger sysrq.

So, could you please help to reproduce the bug, and trigger sysrq to dump
debug information? thanks in advance! :)

Thanks,

>

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 5079e1c0c879311668b77075de3e701869804adf
Author: Chao Yu <ch...@kernel.org>
Date: Fri Jun 2 08:36:05 2023 +0000

f2fs: avoid dead loop in f2fs_issue_checkpoint()

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15aae552680000
start commit: c8c655c34e33 Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=5eadbf0d3c2ece89
dashboard link: https://syzkaller.appspot.com/bug?extid=eb6201248f684e99b9f8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13130a1c280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d919f8280000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: f2fs: avoid dead loop in f2fs_issue_checkpoint()

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.