[v5.15] WARNING in nilfs_btree_assign

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d86dfc4d95cd Linux 5.15.106
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17a53c8dc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=639d55ab480652c5
dashboard link: https://syzkaller.appspot.com/bug?extid=f4b1c5d06555002d6949
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b2a94107dd69/disk-d86dfc4d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/398f8d288cb9/vmlinux-d86dfc4d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9b790c7e7c8c/Image-d86dfc4d.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f4b1c5...@syzkaller.appspotmail.com

NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8639 at fs/nilfs2/btree.c:2284 nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
Modules linked in:
CPU: 0 PID: 8639 Comm: segctord Not tainted 5.15.106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
lr : nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
sp : ffff80001ea673e0
x29: ffff80001ea674d0 x28: 00000000fffffffe x27: ffff0001231f2cf0
x26: ffff80001ea67940 x25: 0000000000000001 x24: dfff800000000000
x23: 1ffff00003d4cf28 x22: 0000000000000000 x21: 000000000004001b
x20: 0000000000000000 x19: ffff0000c7ecbc00 x18: 0000000000000000
x17: ff80800009cac87c x16: 0000000000000000 x15: ffff800009cac87c
x14: 00000000ffffffef x13: ffffffffffffffff x12: 0000000000000000
x11: ff80800009ca9894 x10: 0000000000000000 x9 : ffff800009ca9894
x8 : ffff000129ffd040 x7 : ffff8000086dd508 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800009c9e028
x2 : 0000000000000001 x1 : 00000000fffffffe x0 : 00000000fffffffe
Call trace:
nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
nilfs_bmap_assign+0x90/0x148 fs/nilfs2/bmap.c:382
nilfs_segctor_update_payload_blocknr fs/nilfs2/segment.c:1595 [inline]
nilfs_segctor_assign fs/nilfs2/segment.c:1629 [inline]
nilfs_segctor_do_construct+0x3134/0x6980 fs/nilfs2/segment.c:2056
nilfs_segctor_construct+0x110/0x768 fs/nilfs2/segment.c:2381
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2489 [inline]
nilfs_segctor_thread+0x3c8/0xe98 fs/nilfs2/segment.c:2572
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
irq event stamp: 1282
hardirqs last enabled at (1281): [<ffff8000088c48d4>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (1282): [<ffff80001193bfc8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (0): [<ffff800008191140>] copy_process+0x12c4/0x3750 kernel/fork.c:2143
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 4c93c6993f6b4e4b ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=135c914c280000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e93d602da27af41

dashboard link: https://syzkaller.appspot.com/bug?extid=f4b1c5d06555002d6949
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1634e57a280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/16bea75b636d/disk-8a7f2a5c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b169e33dcf2/vmlinux-8a7f2a5c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/190d08a00950/Image-8a7f2a5c.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6be5a9ea8c4d/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f4b1c5...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 4983 at fs/nilfs2/btree.c:2284 nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
Modules linked in:
CPU: 1 PID: 4983 Comm: segctord Not tainted 5.15.110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
lr : nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284

sp : ffff8000208473e0
x29: ffff8000208474d0 x28: 00000000fffffffe x27: ffff0000e609acf0
x26: ffff800020847940 x25: 0000000000000001 x24: dfff800000000000
x23: 1ffff00004108f28 x22: 0000000000000000 x21: 0000000000000013
x20: 0000000000000042 x19: ffff0000e774da00 x18: 0000000000000000
x17: ff80800009cb14fc x16: 0000000000000000 x15: ffff800009cb14fc

x14: 00000000ffffffef x13: ffffffffffffffff x12: 0000000000000000

x11: ff80800009cae514 x10: 0000000000000000 x9 : ffff800009cae514
x8 : ffff0000c67eb580 x7 : ffff8000086df870 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800009ca2ca8

x2 : 0000000000000001 x1 : 00000000fffffffe x0 : 00000000fffffffe
Call trace:
nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
nilfs_bmap_assign+0x90/0x148 fs/nilfs2/bmap.c:382

nilfs_segctor_update_payload_blocknr fs/nilfs2/segment.c:1615 [inline]
nilfs_segctor_assign fs/nilfs2/segment.c:1649 [inline]
nilfs_segctor_do_construct+0x2f68/0x67cc fs/nilfs2/segment.c:2076
nilfs_segctor_construct+0x110/0x768 fs/nilfs2/segment.c:2401
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2509 [inline]
nilfs_segctor_thread+0x3c8/0xe94 fs/nilfs2/segment.c:2592

kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

irq event stamp: 15100
hardirqs last enabled at (15099): [<ffff8000088c6d88>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (15100): [<ffff80001193d130>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (13434): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (13434): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (13389): [<ffff8000081b573c>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (13389): [<ffff8000081b573c>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (13389): [<ffff8000081b573c>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 6f427577b675c004 ]---


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: b0ece631f84a Linux 5.15.111
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=145dc90a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=db3750b003ff805e

dashboard link: https://syzkaller.appspot.com/bug?extid=f4b1c5d06555002d6949
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10216556280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13fd3e46280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eded75b6c3f9/disk-b0ece631.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/20e5ae802010/vmlinux-b0ece631.xz
kernel image: https://storage.googleapis.com/syzbot-assets/05d665c869f3/Image-b0ece631.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/51dd8d5340ea/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f4b1c5...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 23653 at fs/nilfs2/btree.c:2284 nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
Modules linked in:
CPU: 1 PID: 23653 Comm: segctord Not tainted 5.15.111-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284
lr : nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284

sp : ffff80001dcd73e0
x29: ffff80001dcd74d0 x28: 00000000fffffffe x27: ffff0000e2578018
x26: ffff80001dcd7940 x25: 0000000000000001 x24: dfff800000000000
x23: 1ffff00003b9af28 x22: 0000000000000000 x21: 0000000000040013
x20: 0000000000000082 x19: ffff0000dce5f800 x18: 0000000000000000
x17: ff80800009cb1bc0 x16: 0000000000000000 x15: ffff800009cb1bc0

x14: 00000000ffffffef x13: ffffffffffffffff x12: 0000000000000000

x11: ff80800009caebd8 x10: 0000000000000000 x9 : ffff800009caebd8
x8 : ffff0000d9fb1b40 x7 : ffff8000086e0af8 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800009ca3344

x2 : 0000000000000001 x1 : 00000000fffffffe x0 : 00000000fffffffe
Call trace:
nilfs_btree_assign+0xbc0/0xdc8 fs/nilfs2/btree.c:2284

nilfs_bmap_assign+0x90/0x148 fs/nilfs2/bmap.c:390

nilfs_segctor_update_payload_blocknr fs/nilfs2/segment.c:1615 [inline]
nilfs_segctor_assign fs/nilfs2/segment.c:1649 [inline]

nilfs_segctor_do_construct+0x2fa4/0x6804 fs/nilfs2/segment.c:2079
nilfs_segctor_construct+0x110/0x768 fs/nilfs2/segment.c:2404
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2512 [inline]
nilfs_segctor_thread+0x3c8/0xe94 fs/nilfs2/segment.c:2595

kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

irq event stamp: 2614
hardirqs last enabled at (2613): [<ffff8000088b91b4>] ___slab_alloc+0xc48/0xdbc mm/slub.c:2963
hardirqs last disabled at (2614): [<ffff800011943708>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (982): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (982): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (963): [<ffff8000081b573c>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (963): [<ffff8000081b573c>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (963): [<ffff8000081b573c>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 600b3fba902896a4 ]---

[syzbot]

syzbot suspects this issue was fixed by commit:

commit b12011cea56bd80d52e2d9a6a320ee6ce89034c8
Author: Ryusuke Konishi <konishi...@gmail.com>
Date: Fri Jun 9 03:57:32 2023 +0000

nilfs2: fix buffer corruption due to concurrent device reads

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=108d4ddda80000
start commit: 471e639e59d1 Linux 5.15.117
git tree: linux-5.15.y
kernel config: https://syzkaller.appspot.com/x/.config?x=6390289bcc1381aa
dashboard link: https://syzkaller.appspot.com/bug?extid=f4b1c5d06555002d6949
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12e1f39b280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11b55b27280000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: nilfs2: fix buffer corruption due to concurrent device reads

For information about bisection process see: https://goo.gl/tpsmEJ#bisection