kernel BUG in ext4_da_write_end
7 views
Skip to first unread message
syzbot
Mar 3, 2023, 12:32:44 AM3/3/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 7878a41b6cc1 Linux 4.14.307
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14de7908c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=77c994a24403ce1c
dashboard link: https://syzkaller.appspot.com/bug?extid=d0dda2a71a6a01c87ec3
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123c51c4c80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17658282c80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1fdebf709d79/disk-7878a41b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/88229e373f4d/vmlinux-7878a41b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bf3c4c287a8b/bzImage-7878a41b.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/88c6ce23a8a2/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d0dda2...@syzkaller.appspotmail.com
EXT4-fs error (device loop4): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs error (device loop3): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
------------[ cut here ]------------
EXT4-fs error (device loop5): ext4_mb_generate_buddy:754: group 0,
kernel BUG at fs/ext4/inode.c:3192!
block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs error (device loop2): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop4): This should not happen!! Data will be lost
EXT4-fs (loop0): This should not happen!! Data will be lost
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
Modules linked in:
CPU: 1 PID: 8102 Comm: syz-executor384 Not tainted 4.14.307-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
task: ffff8880aacfe4c0 task.stack: ffff8880a1058000
RIP: 0010:ext4_da_should_update_i_disksize fs/ext4/inode.c:3192 [inline]
RIP: 0010:ext4_da_write_end+0x7b9/0x8e0 fs/ext4/inode.c:3231
RSP: 0018:ffff8880a105f5e0 EFLAGS: 00010297
RAX: ffff8880aacfe4c0 RBX: ffff88808a41f540 RCX: ffff88808a41f330
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffea000228cf08
RBP: ffff88808a41f330 R08: 0000000000000001 R09: ffffea000228cf00
R10: ffff88808a33c07e R11: ffff8880aacfe4c0 R12: 0000000000000001
R13: 000000000000007e R14: 0000000000000001 R15: 0000000000000001
FS: 00007f3f5d07d700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a24acc3cc8 CR3: 00000000a9139000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
generic_perform_write+0x274/0x430 mm/filemap.c:3066
__generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
EXT4-fs (loop4): Total free blocks count 0
ext4_file_write_iter+0x276/0xd20 fs/ext4/file.c:270
EXT4-fs (loop0): Total free blocks count 0
EXT4-fs (loop4): Free/Dirty block details
call_write_iter include/linux/fs.h:1780 [inline]
do_iter_readv_writev+0x4cf/0x5f0 fs/read_write.c:675
EXT4-fs (loop5): This should not happen!! Data will be lost
do_iter_write+0x152/0x550 fs/read_write.c:954
EXT4-fs (loop0): Free/Dirty block details
vfs_iter_write+0x70/0xa0 fs/read_write.c:967
iter_file_splice_write+0x52b/0xa90 fs/splice.c:749
EXT4-fs (loop5): Total free blocks count 0
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1018
splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
EXT4-fs (loop4): free_blocks=2415919104
do_splice_direct+0x164/0x210 fs/splice.c:1061
EXT4-fs (loop0): free_blocks=2415919104
do_sendfile+0x47f/0xb30 fs/read_write.c:1441
SYSC_sendfile64 fs/read_write.c:1502 [inline]
SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f3f5d0d1679
EXT4-fs (loop5): Free/Dirty block details
RSP: 002b:00007f3f5d07d2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f3f5d1567a0 RCX: 00007f3f5d0d1679
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f3f5d12384c R08: 0000000000000000 R09: 0000000000000000
R10: 0001000000201005 R11: 0000000000000246 R12: 00007f3f5d1230e0
EXT4-fs (loop4): dirty_blocks=16
R13: 0000000020000fc0 R14: 0030656c69662f2e R15: 00007f3f5d1567a8
Code: 80 3c 02
EXT4-fs (loop0): dirty_blocks=16
00 0f 85 22 01 00 00 48 8b 85
EXT4-fs (loop5): free_blocks=2415919104
e0 00 00 00 48 85 c0 0f 85 a2 fe ff ff
EXT4-fs (loop0): Block reservation details
e8 33 4d 99 ff 0f 0b e9 96 fe ff ff e8
EXT4-fs (loop4): Block reservation details
27 4d 99 ff <0f> 0b 4c 89 f7 e8 8d 10
EXT4-fs (loop4): i_reserved_data_blocks=1
c3 ff e9 f5 fc ff ff e8 83 10 c3 ff e9
RIP: ext4_da_should_update_i_disksize fs/ext4/inode.c:3192 [inline] RSP: ffff8880a105f5e0
RIP: ext4_da_write_end+0x7b9/0x8e0 fs/ext4/inode.c:3231 RSP: ffff8880a105f5e0
EXT4-fs error (device loop1): ext4_mb_generate_buddy:754: group 0,
EXT4-fs (loop5): dirty_blocks=16
block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs (loop2): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop0): i_reserved_data_blocks=1
EXT4-fs (loop2): This should not happen!! Data will be lost
EXT4-fs (loop5): Block reservation details
EXT4-fs (loop2): Total free blocks count 0
EXT4-fs (loop5): i_reserved_data_blocks=1
EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 3 with error 28
EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2 with error 28
EXT4-fs (loop2): Free/Dirty block details
EXT4-fs (loop0): This should not happen!! Data will be lost
EXT4-fs (loop2): free_blocks=2415919104
EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop2): dirty_blocks=16
EXT4-fs (loop5): This should not happen!! Data will be lost
EXT4-fs (loop2): Block reservation details
EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop2): i_reserved_data_blocks=1
EXT4-fs (loop4): This should not happen!! Data will be lost
---[ end trace c4aef23c239e7373 ]---
EXT4-fs (loop1): This should not happen!! Data will be lost
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 7878a41b6cc1 Linux 4.14.307
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14de7908c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=77c994a24403ce1c
dashboard link: https://syzkaller.appspot.com/bug?extid=d0dda2a71a6a01c87ec3
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123c51c4c80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17658282c80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1fdebf709d79/disk-7878a41b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/88229e373f4d/vmlinux-7878a41b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bf3c4c287a8b/bzImage-7878a41b.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/88c6ce23a8a2/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d0dda2...@syzkaller.appspotmail.com
EXT4-fs error (device loop4): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs error (device loop3): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
------------[ cut here ]------------
EXT4-fs error (device loop5): ext4_mb_generate_buddy:754: group 0,
kernel BUG at fs/ext4/inode.c:3192!
block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs error (device loop2): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop4): This should not happen!! Data will be lost
EXT4-fs (loop0): This should not happen!! Data will be lost
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
Modules linked in:
CPU: 1 PID: 8102 Comm: syz-executor384 Not tainted 4.14.307-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
task: ffff8880aacfe4c0 task.stack: ffff8880a1058000
RIP: 0010:ext4_da_should_update_i_disksize fs/ext4/inode.c:3192 [inline]
RIP: 0010:ext4_da_write_end+0x7b9/0x8e0 fs/ext4/inode.c:3231
RSP: 0018:ffff8880a105f5e0 EFLAGS: 00010297
RAX: ffff8880aacfe4c0 RBX: ffff88808a41f540 RCX: ffff88808a41f330
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffea000228cf08
RBP: ffff88808a41f330 R08: 0000000000000001 R09: ffffea000228cf00
R10: ffff88808a33c07e R11: ffff8880aacfe4c0 R12: 0000000000000001
R13: 000000000000007e R14: 0000000000000001 R15: 0000000000000001
FS: 00007f3f5d07d700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a24acc3cc8 CR3: 00000000a9139000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
generic_perform_write+0x274/0x430 mm/filemap.c:3066
__generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
EXT4-fs (loop4): Total free blocks count 0
ext4_file_write_iter+0x276/0xd20 fs/ext4/file.c:270
EXT4-fs (loop0): Total free blocks count 0
EXT4-fs (loop4): Free/Dirty block details
call_write_iter include/linux/fs.h:1780 [inline]
do_iter_readv_writev+0x4cf/0x5f0 fs/read_write.c:675
EXT4-fs (loop5): This should not happen!! Data will be lost
do_iter_write+0x152/0x550 fs/read_write.c:954
EXT4-fs (loop0): Free/Dirty block details
vfs_iter_write+0x70/0xa0 fs/read_write.c:967
iter_file_splice_write+0x52b/0xa90 fs/splice.c:749
EXT4-fs (loop5): Total free blocks count 0
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1018
splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
EXT4-fs (loop4): free_blocks=2415919104
do_splice_direct+0x164/0x210 fs/splice.c:1061
EXT4-fs (loop0): free_blocks=2415919104
do_sendfile+0x47f/0xb30 fs/read_write.c:1441
SYSC_sendfile64 fs/read_write.c:1502 [inline]
SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f3f5d0d1679
EXT4-fs (loop5): Free/Dirty block details
RSP: 002b:00007f3f5d07d2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f3f5d1567a0 RCX: 00007f3f5d0d1679
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f3f5d12384c R08: 0000000000000000 R09: 0000000000000000
R10: 0001000000201005 R11: 0000000000000246 R12: 00007f3f5d1230e0
EXT4-fs (loop4): dirty_blocks=16
R13: 0000000020000fc0 R14: 0030656c69662f2e R15: 00007f3f5d1567a8
Code: 80 3c 02
EXT4-fs (loop0): dirty_blocks=16
00 0f 85 22 01 00 00 48 8b 85
EXT4-fs (loop5): free_blocks=2415919104
e0 00 00 00 48 85 c0 0f 85 a2 fe ff ff
EXT4-fs (loop0): Block reservation details
e8 33 4d 99 ff 0f 0b e9 96 fe ff ff e8
EXT4-fs (loop4): Block reservation details
27 4d 99 ff <0f> 0b 4c 89 f7 e8 8d 10
EXT4-fs (loop4): i_reserved_data_blocks=1
c3 ff e9 f5 fc ff ff e8 83 10 c3 ff e9
RIP: ext4_da_should_update_i_disksize fs/ext4/inode.c:3192 [inline] RSP: ffff8880a105f5e0
RIP: ext4_da_write_end+0x7b9/0x8e0 fs/ext4/inode.c:3231 RSP: ffff8880a105f5e0
EXT4-fs error (device loop1): ext4_mb_generate_buddy:754: group 0,
EXT4-fs (loop5): dirty_blocks=16
block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs (loop2): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop0): i_reserved_data_blocks=1
EXT4-fs (loop2): This should not happen!! Data will be lost
EXT4-fs (loop5): Block reservation details
EXT4-fs (loop2): Total free blocks count 0
EXT4-fs (loop5): i_reserved_data_blocks=1
EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 3 with error 28
EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2 with error 28
EXT4-fs (loop2): Free/Dirty block details
EXT4-fs (loop0): This should not happen!! Data will be lost
EXT4-fs (loop2): free_blocks=2415919104
EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop2): dirty_blocks=16
EXT4-fs (loop5): This should not happen!! Data will be lost
EXT4-fs (loop2): Block reservation details
EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop2): i_reserved_data_blocks=1
EXT4-fs (loop4): This should not happen!! Data will be lost
---[ end trace c4aef23c239e7373 ]---
EXT4-fs (loop1): This should not happen!! Data will be lost
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Reply all
Reply to author
Forward
0 new messages