syzbot has found a reproducer for the following issue on:
HEAD commit: bf4ad6fa4e53 Linux 6.1.28
git tree: linux-6.1.y
console output:
https://syzkaller.appspot.com/x/log.txt?x=15a42cba280000
kernel config:
https://syzkaller.appspot.com/x/.config?x=ee1a89a0c6a2db67
syz repro:
https://syzkaller.appspot.com/x/repro.syz?x=15e7e152280000
C reproducer:
https://syzkaller.appspot.com/x/repro.c?x=1097c33a280000
Downloadable assets:
disk image:
https://storage.googleapis.com/syzbot-assets/a7b85a636ba8/disk-bf4ad6fa.raw.xz
vmlinux:
https://storage.googleapis.com/syzbot-assets/a626aeb9d231/vmlinux-bf4ad6fa.xz
kernel image:
https://storage.googleapis.com/syzbot-assets/78fbbffb9ee8/Image-bf4ad6fa.gz.xz
mounted in repro:
https://storage.googleapis.com/syzbot-assets/68dc13712df0/mount_0.gz
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
hfs: new node 0 already hashed?
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4224 at fs/hfs/bnode.c:422 hfs_bnode_create+0x428/0x4dc fs/hfs/bnode.c:421
Modules linked in:
CPU: 1 PID: 4224 Comm: syz-executor147 Not tainted 6.1.28-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfs_bnode_create+0x428/0x4dc fs/hfs/bnode.c:421
lr : hfs_bnode_create+0x428/0x4dc fs/hfs/bnode.c:421
sp : ffff80001da36a10
x29: ffff80001da36a20 x28: dfff800000000000 x27: dfff800000000000
x26: 000000000000016c x25: ffff0000c3191688 x24: 0000000000000000
x23: 0000000000000000 x22: ffff0000de4ba0e0 x21: ffff0000de4ba000
x20: 0000000000000000 x19: ffff0000c3191600 x18: 1fffe000368ba776
x17: ffff80001558d000 x16: ffff800008305b94 x15: ffff0001b45d3bbc
x14: 1ffff00002ab20b0 x13: dfff800000000000 x12: 0000000000000003
x11: ff80800008346178 x10: 0000000000000000 x9 : 5103be2ad8d08400
x8 : 5103be2ad8d08400 x7 : ffff80000827ddcc x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000100000000 x0 : 000000000000001f
Call trace:
hfs_bnode_create+0x428/0x4dc fs/hfs/bnode.c:421
hfs_bmap_alloc+0x59c/0x664 fs/hfs/btree.c:291
hfs_btree_inc_height+0xf8/0x9d0 fs/hfs/brec.c:471
hfs_brec_insert+0x580/0x97c fs/hfs/brec.c:148
__hfs_ext_write_extent+0x240/0x468 fs/hfs/extent.c:124
__hfs_ext_cache_extent+0x84/0x754 fs/hfs/extent.c:174
hfs_ext_read_extent fs/hfs/extent.c:202 [inline]
hfs_extend_file+0x29c/0x1130 fs/hfs/extent.c:401
hfs_get_block+0x3b8/0x9e0 fs/hfs/extent.c:353
__block_write_begin_int+0x340/0x13b4 fs/buffer.c:1991
__block_write_begin fs/buffer.c:2041 [inline]
block_write_begin fs/buffer.c:2102 [inline]
cont_write_begin+0x5c0/0x7d8 fs/buffer.c:2456
hfs_write_begin+0x98/0xe4 fs/hfs/inode.c:58
cont_expand_zero fs/buffer.c:2383 [inline]
cont_write_begin+0x2ac/0x7d8 fs/buffer.c:2446
hfs_write_begin+0x98/0xe4 fs/hfs/inode.c:58
generic_perform_write+0x278/0x55c mm/filemap.c:3754
__generic_file_write_iter+0x168/0x388 mm/filemap.c:3882
generic_file_write_iter+0xb8/0x2b4 mm/filemap.c:3914
do_iter_write+0x534/0x964 fs/read_write.c:861
vfs_writev fs/read_write.c:934 [inline]
do_pwritev+0x1ec/0x334 fs/read_write.c:1031
__do_sys_pwritev2 fs/read_write.c:1090 [inline]
__se_sys_pwritev2 fs/read_write.c:1081 [inline]
__arm64_sys_pwritev2+0xd4/0x108 fs/read_write.c:1081
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
irq event stamp: 2274
hardirqs last enabled at (2273): [<ffff80000827de6c>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1367 [inline]
hardirqs last enabled at (2273): [<ffff80000827de6c>] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:5000
hardirqs last disabled at (2274): [<ffff8000120e4a4c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (2214): [<ffff800008020d74>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last enabled at (2214): [<ffff800008020d74>] __do_softirq+0xc14/0xea0 kernel/softirq.c:600
softirqs last disabled at (2103): [<ffff80000802a994>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
kernel BUG at fs/hfs/bnode.c:467!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4224 Comm: syz-executor147 Tainted: G W 6.1.28-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hfs_bnode_put+0x318/0x324 fs/hfs/bnode.c:467
lr : hfs_bnode_put+0x318/0x324 fs/hfs/bnode.c:467
sp : ffff80001da36b30
x29: ffff80001da36b30 x28: dfff800000000000 x27: ffff700003b46d7c
x26: 1fffe0001bc97403 x25: 0000000000000200 x24: 1fffe000186322c0
x23: dfff800000000000 x22: ffff0000de4ba000 x21: ffff0000c3191680
x20: 0000000000000000 x19: ffff0000c3191600 x18: 1fffe000368ba776
x17: ffff80001558d000 x16: ffff8000120e8ec4 x15: ffff0001b45d3bbc
x14: 1ffff00002ab20b0 x13: dfff800000000000 x12: 0000000000000001
x11: ff80800009091c4c x10: 0000000000000000 x9 : ffff800009091c4c
x8 : ffff0000c91b5340 x7 : ffff8000089cb440 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000909198c
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
hfs_bnode_put+0x318/0x324 fs/hfs/bnode.c:467
hfs_btree_inc_height+0x4c0/0x9d0 fs/hfs/brec.c:525
hfs_brec_insert+0x580/0x97c fs/hfs/brec.c:148
__hfs_ext_write_extent+0x240/0x468 fs/hfs/extent.c:124
__hfs_ext_cache_extent+0x84/0x754 fs/hfs/extent.c:174
hfs_ext_read_extent fs/hfs/extent.c:202 [inline]
hfs_extend_file+0x29c/0x1130 fs/hfs/extent.c:401
hfs_get_block+0x3b8/0x9e0 fs/hfs/extent.c:353
__block_write_begin_int+0x340/0x13b4 fs/buffer.c:1991
__block_write_begin fs/buffer.c:2041 [inline]
block_write_begin fs/buffer.c:2102 [inline]
cont_write_begin+0x5c0/0x7d8 fs/buffer.c:2456
hfs_write_begin+0x98/0xe4 fs/hfs/inode.c:58
cont_expand_zero fs/buffer.c:2383 [inline]
cont_write_begin+0x2ac/0x7d8 fs/buffer.c:2446
hfs_write_begin+0x98/0xe4 fs/hfs/inode.c:58
generic_perform_write+0x278/0x55c mm/filemap.c:3754
__generic_file_write_iter+0x168/0x388 mm/filemap.c:3882
generic_file_write_iter+0xb8/0x2b4 mm/filemap.c:3914
do_iter_write+0x534/0x964 fs/read_write.c:861
vfs_writev fs/read_write.c:934 [inline]
do_pwritev+0x1ec/0x334 fs/read_write.c:1031
__do_sys_pwritev2 fs/read_write.c:1090 [inline]
__se_sys_pwritev2 fs/read_write.c:1081 [inline]
__arm64_sys_pwritev2+0xd4/0x108 fs/read_write.c:1081
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: aa1503e0 97e36a6f 17ffffd5 97d1a39e (d4210000)
---[ end trace 0000000000000000 ]---
---