kernel BUG in f2fs_new_node_page

3 views
Skip to first unread message

syzbot

unread,
Oct 19, 2022, 2:56:49 PM10/19/22
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=155a7dd6880000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=c0decd6e12fa1a6433c4
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c0decd...@syzkaller.appspotmail.com

F2FS-fs (loop5): invalid crc value
F2FS-fs (loop5): Found nat_bits in checkpoint
EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue
F2FS-fs (loop5): Mounted with checkpoint version = 3e17dab1
------------[ cut here ]------------
kernel BUG at fs/f2fs/node.c:1235!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 17303 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
RIP: 0010:f2fs_new_node_page+0x1942/0x1f40 fs/f2fs/node.c:1235
Code: 8f f8 ff ff 4c 89 ef e8 4c 1f 7d fe e9 77 f7 ff ff e8 42 1f 7d fe e9 48 f3 ff ff e8 38 1f 7d fe e9 21 f7 ff ff e8 ce 42 47 fe <0f> 0b e8 c7 42 47 fe 4d 8d 75 ff e9 e8 f0 ff ff e8 b9 42 47 fe 48
RSP: 0018:ffff8880458a7390 EFLAGS: 00010293
RAX: ffff8880b2eea1c0 RBX: ffff88804af88400 RCX: ffffffff831b30ec
RDX: 0000000000000000 RSI: ffffffff831b42a2 RDI: 0000000000000005
RBP: ffffffff8b271190 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffea00026e6e00
R13: 0000000000001002 R14: ffff8880458a73f0 R15: 0000000000000000
FS: 00007f5ac77e0700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2ec803b058 CR3: 0000000097eab000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
f2fs_new_inode_page+0xc2/0x110 fs/f2fs/node.c:1209
f2fs_init_inode_metadata+0xcd/0x1430 fs/f2fs/dir.c:366
f2fs_add_regular_entry+0x925/0x1560 fs/f2fs/dir.c:558
f2fs_add_dentry+0x147/0x2f0 fs/f2fs/dir.c:604
f2fs_do_add_link+0x307/0x4f0 fs/f2fs/dir.c:644
f2fs_add_link fs/f2fs/f2fs.h:2862 [inline]
f2fs_create+0x336/0x930 fs/f2fs/namei.c:295
lookup_open+0x893/0x1a20 fs/namei.c:3235
do_last fs/namei.c:3327 [inline]
path_openat+0x1094/0x2df0 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5ac8e6d5a9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5ac77e0168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f5ac8f8df80 RCX: 00007f5ac8e6d5a9
RDX: 000000000000275a RSI: 0000000020000280 RDI: ffffffffffffff9c
RBP: 00007f5ac8ec8580 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe3a4e635f R14: 00007f5ac77e0300 R15: 0000000000022000
Modules linked in:
---[ end trace 30ea83716b102c34 ]---
RIP: 0010:f2fs_new_node_page+0x1942/0x1f40 fs/f2fs/node.c:1235
Code: 8f f8 ff ff 4c 89 ef e8 4c 1f 7d fe e9 77 f7 ff ff e8 42 1f 7d fe e9 48 f3 ff ff e8 38 1f 7d fe e9 21 f7 ff ff e8 ce 42 47 fe <0f> 0b e8 c7 42 47 fe 4d 8d 75 ff e9 e8 f0 ff ff e8 b9 42 47 fe 48
RSP: 0018:ffff8880458a7390 EFLAGS: 00010293
RAX: ffff8880b2eea1c0 RBX: ffff88804af88400 RCX: ffffffff831b30ec
RDX: 0000000000000000 RSI: ffffffff831b42a2 RDI: 0000000000000005
RBP: ffffffff8b271190 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffea00026e6e00
R13: 0000000000001002 R14: ffff8880458a73f0 R15: 0000000000000000
FS: 00007f5ac77e0700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5ac779e718 CR3: 0000000097eab000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Oct 19, 2022, 3:27:51 PM10/19/22
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1253b706880000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=c0decd6e12fa1a6433c4
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16954fe6880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15ee66ba880000
mounted in repro: https://storage.googleapis.com/syzbot-assets/e8bb85dec3b6/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c0decd...@syzkaller.appspotmail.com

F2FS-fs (loop0): Mounted with checkpoint version = 3e17dab1
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix.
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix.
------------[ cut here ]------------
kernel BUG at fs/f2fs/node.c:1235!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8097 Comm: syz-executor388 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
RIP: 0010:f2fs_new_node_page+0x1942/0x1f40 fs/f2fs/node.c:1235
Code: 8f f8 ff ff 4c 89 ef e8 4c 1f 7d fe e9 77 f7 ff ff e8 42 1f 7d fe e9 48 f3 ff ff e8 38 1f 7d fe e9 21 f7 ff ff e8 ce 42 47 fe <0f> 0b e8 c7 42 47 fe 4d 8d 75 ff e9 e8 f0 ff ff e8 b9 42 47 fe 48
RSP: 0018:ffff88808c8ef390 EFLAGS: 00010293
RAX: ffff888093d161c0 RBX: ffff88809b6f9dc0 RCX: ffffffff831b30ec
RDX: 0000000000000000 RSI: ffffffff831b42a2 RDI: 0000000000000005
RBP: ffffffff8b271190 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffea00028be940
R13: 0000000000001002 R14: ffff88808c8ef3f0 R15: 0000000000000000
FS: 0000555556fed300(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056234b2c10d0 CR3: 00000000a955b000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
f2fs_new_inode_page+0xc2/0x110 fs/f2fs/node.c:1209
f2fs_init_inode_metadata+0xcd/0x1430 fs/f2fs/dir.c:366
f2fs_add_regular_entry+0x925/0x1560 fs/f2fs/dir.c:558
f2fs_add_dentry+0x147/0x2f0 fs/f2fs/dir.c:604
f2fs_do_add_link+0x307/0x4f0 fs/f2fs/dir.c:644
f2fs_add_link fs/f2fs/f2fs.h:2862 [inline]
f2fs_create+0x336/0x930 fs/f2fs/namei.c:295
lookup_open+0x893/0x1a20 fs/namei.c:3235
do_last fs/namei.c:3327 [inline]
path_openat+0x1094/0x2df0 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f74af780979
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe1c51e98 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f74af780979
RDX: 000000000000275a RSI: 0000000020000280 RDI: 00000000ffffff9c
RBP: 00007f74af7401e0 R08: 0000555556fed2c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f74af740270
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 16b601b4a6180c6e ]---
RIP: 0010:f2fs_new_node_page+0x1942/0x1f40 fs/f2fs/node.c:1235
Code: 8f f8 ff ff 4c 89 ef e8 4c 1f 7d fe e9 77 f7 ff ff e8 42 1f 7d fe e9 48 f3 ff ff e8 38 1f 7d fe e9 21 f7 ff ff e8 ce 42 47 fe <0f> 0b e8 c7 42 47 fe 4d 8d 75 ff e9 e8 f0 ff ff e8 b9 42 47 fe 48
RSP: 0018:ffff88808c8ef390 EFLAGS: 00010293
RAX: ffff888093d161c0 RBX: ffff88809b6f9dc0 RCX: ffffffff831b30ec
RDX: 0000000000000000 RSI: ffffffff831b42a2 RDI: 0000000000000005
RBP: ffffffff8b271190 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffea00028be940
R13: 0000000000001002 R14: ffff88808c8ef3f0 R15: 0000000000000000
FS: 0000555556fed300(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056234b2c10d0 CR3: 00000000a955b000 CR4: 00000000003406f0
Reply all
Reply to author
Forward
0 new messages