[syzbot] WARNING in nilfs_segctor_do_construct

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: aaa11ce2ffc8 Add linux-next specific files for 20220923
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17870cdf080000
kernel config: https://syzkaller.appspot.com/x/.config?x=186d1ff305f10294
dashboard link: https://syzkaller.appspot.com/bug?extid=fbb3e0b24e8dae5a16ee
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fbb3e0...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 3320 at fs/nilfs2/segment.c:879 nilfs_segctor_create_checkpoint fs/nilfs2/segment.c:879 [inline]
WARNING: CPU: 1 PID: 3320 at fs/nilfs2/segment.c:879 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]
WARNING: CPU: 1 PID: 3320 at fs/nilfs2/segment.c:879 nilfs_segctor_collect fs/nilfs2/segment.c:1497 [inline]
WARNING: CPU: 1 PID: 3320 at fs/nilfs2/segment.c:879 nilfs_segctor_do_construct+0x45ac/0x69b0 fs/nilfs2/segment.c:2039
Modules linked in:
CPU: 1 PID: 3320 Comm: segctord Not tainted 6.0.0-rc6-next-20220923-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
RIP: 0010:nilfs_segctor_create_checkpoint fs/nilfs2/segment.c:879 [inline]
RIP: 0010:nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]
RIP: 0010:nilfs_segctor_collect fs/nilfs2/segment.c:1497 [inline]
RIP: 0010:nilfs_segctor_do_construct+0x45ac/0x69b0 fs/nilfs2/segment.c:2039
Code: ff ff e8 27 7b 55 fe 41 83 fc ea 74 18 e8 4c 7e 55 fe 44 89 e6 bf fe ff ff ff e8 0f 7b 55 fe 41 83 fc fe 75 07 e8 34 7e 55 fe <0f> 0b e8 2d 7e 55 fe e9 3c de ff ff e8 23 7e 55 fe 48 8b 44 24 30
RSP: 0018:ffffc9000b897b40 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888030627000 RCX: 0000000000000000
RDX: ffff88802da60000 RSI: ffffffff832715cc RDI: 0000000000000005
RBP: ffff8880306272d0 R08: 0000000000000005 R09: 00000000fffffffe
R10: 00000000fffffffe R11: 0000000000000001 R12: 00000000fffffffe
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888021df8800
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8bbee45fc8 CR3: 0000000032ce7000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 000000000000003b DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
nilfs_segctor_construct+0x8e3/0xb30 fs/nilfs2/segment.c:2373
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2481 [inline]
nilfs_segctor_thread+0x3c3/0xf30 fs/nilfs2/segment.c:2564
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Ryusuke Konishi]

If creation or finalization of a checkpoint fails due to anomalies
in the checkpoint metadata on disk, a kernel warning is generated.

This patch replaces the WARN_ONs by nilfs_error, so that a kernel,
booted with panic_on_warn, does not panic. A nilfs_error is
appropriate here to handle the abnormal filesystem condition.

This also replaces the detected error codes with an I/O error so that
neither of the internal error codes is returned to callers.

Reported-by: syzbot+fbb3e0...@syzkaller.appspotmail.com
Signed-off-by: Ryusuke Konishi <konishi...@gmail.com>
---
fs/nilfs2/segment.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 0afe0832c754..25c56ea779ea 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -875,9 +875,11 @@ static int nilfs_segctor_create_checkpoint(struct nilfs_sc_info *sci)
nilfs_mdt_mark_dirty(nilfs->ns_cpfile);
nilfs_cpfile_put_checkpoint(
nilfs->ns_cpfile, nilfs->ns_cno, bh_cp);
- } else
- WARN_ON(err == -EINVAL || err == -ENOENT);
-
+ } else if (err == -EINVAL || err == -ENOENT) {
+ nilfs_error(sci->sc_super,
+ "checkpoint creation failed due to metadata corruption.");
+ err = -EIO;
+ }
return err;
}

@@ -891,7 +893,11 @@ static int nilfs_segctor_fill_in_checkpoint(struct nilfs_sc_info *sci)
err = nilfs_cpfile_get_checkpoint(nilfs->ns_cpfile, nilfs->ns_cno, 0,
&raw_cp, &bh_cp);
if (unlikely(err)) {
- WARN_ON(err == -EINVAL || err == -ENOENT);
+ if (err == -EINVAL || err == -ENOENT) {
+ nilfs_error(sci->sc_super,
+ "checkpoint finalization failed due to metadata corruption.");
+ err = -EIO;
+ }
goto failed_ibh;
}
raw_cp->cp_snapshot_list.ssl_next = 0;
--
2.34.1

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: a5541c0811a0 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15c56bdb880000
kernel config: https://syzkaller.appspot.com/x/.config?x=cbd4e584773e9397
dashboard link: https://syzkaller.appspot.com/bug?extid=fbb3e0b24e8dae5a16ee
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14caa71d880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1032f2b7880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4b7702208fb9/disk-a5541c08.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9ec0153ec051/vmlinux-a5541c08.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6f8725ad290a/Image-a5541c08.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0911b0ec76cf/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fbb3e0...@syzkaller.appspotmail.com

NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop0): nilfs_sufile_update: invalid segment number: 53
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3149 at fs/nilfs2/segment.c:1482 nilfs_segctor_truncate_segments fs/nilfs2/segment.c:1482 [inline]
WARNING: CPU: 0 PID: 3149 at fs/nilfs2/segment.c:1482 nilfs_segctor_collect fs/nilfs2/segment.c:1534 [inline]
WARNING: CPU: 0 PID: 3149 at fs/nilfs2/segment.c:1482 nilfs_segctor_do_construct+0x6cc/0xefc fs/nilfs2/segment.c:2045
Modules linked in:
CPU: 0 PID: 3149 Comm: segctord Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : nilfs_segctor_truncate_segments fs/nilfs2/segment.c:1482 [inline]
pc : nilfs_segctor_collect fs/nilfs2/segment.c:1534 [inline]
pc : nilfs_segctor_do_construct+0x6cc/0xefc fs/nilfs2/segment.c:2045
lr : nilfs_segctor_truncate_segments fs/nilfs2/segment.c:1482 [inline]
lr : nilfs_segctor_collect fs/nilfs2/segment.c:1534 [inline]
lr : nilfs_segctor_do_construct+0x6cc/0xefc fs/nilfs2/segment.c:2045
sp : ffff800012f6bc80
x29: ffff800012f6bd00 x28: ffff800008f744fc x27: ffff0000c6cf9128
x26: ffff0000c6cf9258 x25: ffff0000c9039138 x24: ffff0000ca797818
x23: ffff0000c90390b8 x22: 00000000ffffffea x21: 0000000000000001
x20: ffff0000cb9a8000 x19: ffff0000c9039000 x18: 000000000000027f
x17: 0000000000000000 x16: ffff80000dbe6158 x15: ffff0000c6508000
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c6508000
x11: ff80800008f68d3c x10: 0000000000000000 x9 : ffff800008f68d3c
x8 : ffff0000c6508000 x7 : ffff80000816678c x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefbecd0 x1 : 00000000ffffffea x0 : 0000000000000000
Call trace:
nilfs_segctor_truncate_segments fs/nilfs2/segment.c:1482 [inline]
nilfs_segctor_collect fs/nilfs2/segment.c:1534 [inline]
nilfs_segctor_do_construct+0x6cc/0xefc fs/nilfs2/segment.c:2045
nilfs_segctor_construct+0xa0/0x380 fs/nilfs2/segment.c:2379
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]
nilfs_segctor_thread+0x180/0x634 fs/nilfs2/segment.c:2570
kthread+0x12c/0x158 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
irq event stamp: 8892
hardirqs last enabled at (8891): [<ffff80000816681c>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1366 [inline]
hardirqs last enabled at (8891): [<ffff80000816681c>] finish_lock_switch+0x94/0xe8 kernel/sched/core.c:4968
hardirqs last disabled at (8892): [<ffff80000c084084>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (8698): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (8677): [<ffff800008017c88>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---

[Ryusuke Konishi]

This is a different issue than the one we fixed earlier.
WARN_ON is caught in another function nilfs_segctor_truncate_segments().
I will look into it and think of a fix.

Ryusuke Konishi