kernel BUG in __get_meta_page

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e548869f356f Linux 4.14.291
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1646d8f5080000
kernel config: https://syzkaller.appspot.com/x/.config?x=14f65e3c6215eb84
dashboard link: https://syzkaller.appspot.com/bug?extid=e05b5e5dd41374e8af68
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/edb4b0800592/disk-e548869f.raw.xz
vmlinux: https://storage.googleapis.com/1e0119ec09aa/vmlinux-e548869f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e05b5e...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/f2fs/checkpoint.c:91!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
PM: Marking nosave pages: [mem 0x00000000-0x00000fff]
Modules linked in:
CPU: 0 PID: 13185 Comm: syz-executor.0 Not tainted 4.14.291-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
task: ffff8880abb50600 task.stack: ffff88805be20000
PM: Marking nosave pages: [mem 0x0009f000-0x000fffff]
RIP: 0010:__get_meta_page+0x860/0x940 fs/f2fs/checkpoint.c:91
RSP: 0018:ffff88805be277f8 EFLAGS: 00010212
RAX: 0000000000040000 RBX: dffffc0000000000 RCX: ffffc90005c0a000
RDX: 0000000000026695 RSI: ffffffff82c6af00 RDI: ffff8880b328e340
PM: Marking nosave pages: [mem 0xbfffd000-0xffffffff]
RBP: 00000000000003ff R08: ffffffff8b9c4b48 R09: 0000000000000001
R10: 0000000000000000 R11: ffff8880abb50600 R12: ffffea0002577340
R13: ffff88805d3dca00 R14: ffff8880abb38600 R15: ffffea0002577360
FS: 00007f38c04e4700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8fb0ad3130 CR3: 00000000a1e5a000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
get_meta_page fs/f2fs/checkpoint.c:114 [inline]
get_checkpoint_version+0x65/0xa10 fs/f2fs/checkpoint.c:725
validate_checkpoint+0x184/0x970 fs/f2fs/checkpoint.c:770
PM: Basic memory bitmaps created
PM: Basic memory bitmaps freed
get_valid_checkpoint+0x1df/0x13e0 fs/f2fs/checkpoint.c:808
f2fs_fill_super+0x23d9/0x56a0 fs/f2fs/super.c:2548
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2572 [inline]
do_mount+0xe65/0x2a30 fs/namespace.c:2905
SYSC_mount fs/namespace.c:3121 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3098
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f38c1b707aa
RSP: 002b:00007f38c04e3f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f38c1b707aa
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f38c04e3fe0
RBP: 00007f38c04e4020 R08: 00007f38c04e4020 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f38c04e3fe0 R15: 0000000020014900
Code: f6 48 c1 e7 29 48 c1 e0 27 ba 00 10 00 00 4c 01 e7 48 c1 ff 06 48 c1 e7 0c 48 01 c7 e8 9a 41 b8 fe 31 f6 4c 89 f7 e8 50 f6 ff ff <0f> 0b 48 89 df e8 86 4e b8 fe e9 32 fa ff ff e8 7c 4e b8 fe e9
RIP: __get_meta_page+0x860/0x940 fs/f2fs/checkpoint.c:91 RSP: ffff88805be277f8
---[ end trace be05dee673cf4dda ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: e548869f356f Linux 4.14.291
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=1722c6c7080000

kernel config: https://syzkaller.appspot.com/x/.config?x=14f65e3c6215eb84
dashboard link: https://syzkaller.appspot.com/bug?extid=e05b5e5dd41374e8af68
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1540163b080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=109f67ab080000

Downloadable assets:
disk image: https://storage.googleapis.com/edb4b0800592/disk-e548869f.raw.xz
vmlinux: https://storage.googleapis.com/1e0119ec09aa/vmlinux-e548869f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e05b5e...@syzkaller.appspotmail.com

F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock

------------[ cut here ]------------
kernel BUG at fs/f2fs/checkpoint.c:91!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN

Modules linked in:
CPU: 0 PID: 7971 Comm: syz-executor168 Not tainted 4.14.291-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022

task: ffff88809a14c680 task.stack: ffff888091550000

RIP: 0010:__get_meta_page+0x860/0x940 fs/f2fs/checkpoint.c:91

RSP: 0018:ffff8880915577f8 EFLAGS: 00010297
RAX: ffff88809a14c680 RBX: dffffc0000000000 RCX: 1ffff110134299e6
RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8880ab8af180
RBP: 00000000000003ff R08: ffffffff8b9acdb0 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88809a14c680 R12: ffffea0002c15840
R13: ffff88808df2ea00 R14: ffff8880b3392500 R15: ffffea0002c15860
FS: 0000555555fe6300(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007ffe070ee000 CR3: 00000000afdf9000 CR4: 00000000003406f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
get_meta_page fs/f2fs/checkpoint.c:114 [inline]
get_checkpoint_version+0x65/0xa10 fs/f2fs/checkpoint.c:725
validate_checkpoint+0x184/0x970 fs/f2fs/checkpoint.c:770

get_valid_checkpoint+0x1df/0x13e0 fs/f2fs/checkpoint.c:808
f2fs_fill_super+0x23d9/0x56a0 fs/f2fs/super.c:2548
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2572 [inline]
do_mount+0xe65/0x2a30 fs/namespace.c:2905
SYSC_mount fs/namespace.c:3121 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3098
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb

RIP: 0033:0x7fb0df81d18a
RSP: 002b:00007ffe070ed298 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe070ed2f0 RCX: 00007fb0df81d18a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffe070ed2b0
RBP: 00007ffe070ed2b0 R08: 00007ffe070ed2f0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000230
R13: 0000000000000003 R14: 0000000000000004 R15: 0000000000000002

Code: f6 48 c1 e7 29 48 c1 e0 27 ba 00 10 00 00 4c 01 e7 48 c1 ff 06 48 c1 e7 0c 48 01 c7 e8 9a 41 b8 fe 31 f6 4c 89 f7 e8 50 f6 ff ff <0f> 0b 48 89 df e8 86 4e b8 fe e9 32 fa ff ff e8 7c 4e b8 fe e9

RIP: __get_meta_page+0x860/0x940 fs/f2fs/checkpoint.c:91 RSP: ffff8880915577f8
---[ end trace 4786c5d5a65028f1 ]---