kernel BUG in new_node_page

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9d5c0b3a8e1a Linux 4.14.295
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1061ab84880000
kernel config: https://syzkaller.appspot.com/x/.config?x=746c079015a92425
dashboard link: https://syzkaller.appspot.com/bug?extid=40de2c3c89bc726d56dc
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ed6fcf5895a2/disk-9d5c0b3a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/341aa3534116/vmlinux-9d5c0b3a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+40de2c...@syzkaller.appspotmail.com

F2FS-fs (loop1): Mounted with checkpoint version = 3651456e
F2FS-fs (loop1): invalid crc value
F2FS-fs (loop1): Found nat_bits in checkpoint
F2FS-fs (loop1): Mounted with checkpoint version = 3651456e
------------[ cut here ]------------
kernel BUG at fs/f2fs/node.c:1069!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 10629 Comm: syz-executor.1 Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
task: ffff888092db8600 task.stack: ffff8880468d0000
RIP: 0010:new_node_page+0xd1d/0x1180 fs/f2fs/node.c:1069
RSP: 0018:ffff8880468d78b0 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffff8880468d7a00 RCX: ffffc900085c7000
RDX: 0000000000040000 RSI: ffffffff82cb06ad RDI: ffff88809fee5b98
RBP: ffff8880961b6800 R08: 0000000000000001 R09: 0000000000000005
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea000265eac0
R13: 000000001fffffff R14: ffff8880468d78f8 R15: 0000000000000001
FS: 00007f0a4387f700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0a4502e0b0 CR3: 00000000af8c2000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
write_all_xattrs fs/f2fs/xattr.c:455 [inline]
__f2fs_setxattr+0xb77/0x1550 fs/f2fs/xattr.c:700
f2fs_setxattr+0x11b/0x1c0 fs/f2fs/xattr.c:737
f2fs_xattr_generic_set+0xe0/0x1c0 fs/f2fs/xattr.c:73
__vfs_setxattr+0xdc/0x130 fs/xattr.c:150
__vfs_setxattr_noperm+0xfd/0x3d0 fs/xattr.c:181
__vfs_setxattr_locked+0x14d/0x250 fs/xattr.c:239
vfs_setxattr+0xcf/0x230 fs/xattr.c:256
setxattr+0x1a9/0x300 fs/xattr.c:523
SYSC_fsetxattr fs/xattr.c:578 [inline]
SyS_fsetxattr+0x123/0x190 fs/xattr.c:567
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f0a44f0c5a9
RSP: 002b:00007f0a4387f168 EFLAGS: 00000246 ORIG_RAX: 00000000000000be
RAX: ffffffffffffffda RBX: 00007f0a4502cf80 RCX: 00007f0a44f0c5a9
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 00007f0a44f67580 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffe457b96f R14: 00007f0a4387f300 R15: 0000000000022000
Code: 00 44 89 ad 78 04 00 00 be 01 00 00 00 48 89 ef e8 99 a3 f7 ff e9 ea fc ff ff 49 c7 c4 ff ff ff ff e9 de fc ff ff e8 13 41 8a fe <0f> 0b 48 89 44 24 10 e8 07 41 8a fe 48 8b 44 24 10 4c 8d 70 ff
RIP: new_node_page+0xd1d/0x1180 fs/f2fs/node.c:1069 RSP: ffff8880468d78b0
---[ end trace ad54058b583cd53e ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 9d5c0b3a8e1a Linux 4.14.295
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=138ec09a880000

kernel config: https://syzkaller.appspot.com/x/.config?x=746c079015a92425
dashboard link: https://syzkaller.appspot.com/bug?extid=40de2c3c89bc726d56dc
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15bdf294880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117ea734880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ed6fcf5895a2/disk-9d5c0b3a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/341aa3534116/vmlinux-9d5c0b3a.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/11f533d15aad/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+40de2c...@syzkaller.appspotmail.com

F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): Found nat_bits in checkpoint
F2FS-fs (loop0): Mounted with checkpoint version = 3651456e

------------[ cut here ]------------
kernel BUG at fs/f2fs/node.c:1069!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:

CPU: 0 PID: 7963 Comm: syz-executor331 Not tainted 4.14.295-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022

task: ffff8880b4f10100 task.stack: ffff88809e020000

RIP: 0010:new_node_page+0xd1d/0x1180 fs/f2fs/node.c:1069

RSP: 0018:ffff88809e0278b0 EFLAGS: 00010297
RAX: ffff8880b4f10100 RBX: ffff88809e027a00 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff88809587b2d8
RBP: ffff888095e62700 R08: 0000000000000001 R09: 0000000000000005
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea0002bc3cc0
R13: 000000001fffffff R14: ffff88809e0278f8 R15: 0000000000000001
FS: 000055555634c300(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000557755407c40 CR3: 00000000ab4d8000 CR4: 00000000003406f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
write_all_xattrs fs/f2fs/xattr.c:455 [inline]
__f2fs_setxattr+0xb77/0x1550 fs/f2fs/xattr.c:700
f2fs_setxattr+0x11b/0x1c0 fs/f2fs/xattr.c:737
f2fs_xattr_generic_set+0xe0/0x1c0 fs/f2fs/xattr.c:73
__vfs_setxattr+0xdc/0x130 fs/xattr.c:150
__vfs_setxattr_noperm+0xfd/0x3d0 fs/xattr.c:181
__vfs_setxattr_locked+0x14d/0x250 fs/xattr.c:239
vfs_setxattr+0xcf/0x230 fs/xattr.c:256
setxattr+0x1a9/0x300 fs/xattr.c:523
SYSC_fsetxattr fs/xattr.c:578 [inline]
SyS_fsetxattr+0x123/0x190 fs/xattr.c:567
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb

RIP: 0033:0x7f52340ccbd9
RSP: 002b:00007ffd504f1268 EFLAGS: 00000246 ORIG_RAX: 00000000000000be
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f52340ccbd9

RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000005

RBP: 00007f523408c470 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f523408c500
R13: 0000000000000000 R14: 00000ffc00000040 R15: 0000000000000000

Code: 00 44 89 ad 78 04 00 00 be 01 00 00 00 48 89 ef e8 99 a3 f7 ff e9 ea fc ff ff 49 c7 c4 ff ff ff ff e9 de fc ff ff e8 13 41 8a fe <0f> 0b 48 89 44 24 10 e8 07 41 8a fe 48 8b 44 24 10 4c 8d 70 ff

RIP: new_node_page+0xd1d/0x1180 fs/f2fs/node.c:1069 RSP: ffff88809e0278b0
---[ end trace 0de149c9126026b3 ]---