general protection fault in update_sit_entry

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e911713e40ca Linux 4.14.299
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=140adaae880000
kernel config: https://syzkaller.appspot.com/x/.config?x=1d7ed9728cc57838
dashboard link: https://syzkaller.appspot.com/bug?extid=04a357a6933e5765086d
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c8588259d654/disk-e911713e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/700d08072e5e/vmlinux-e911713e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/844ad5da2ed5/bzImage-e911713e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+04a357...@syzkaller.appspotmail.com

audit: type=1800 audit(1668219398.478:16): pid=10275 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.0" name="bus" dev="loop0" ino=10 res=0
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 10275 Comm: syz-executor.0 Not tainted 4.14.299-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff8880455ca500 task.stack: ffff8880454c8000
RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline]
RIP: 0010:update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682
RSP: 0018:ffff8880454cf5a8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880a9c26a80 RCX: ffffc90005bda000
RDX: 0000000000000000 RSI: ffffffff82cc620d RDI: ffff88809a340350
RBP: ffff88809a340330 R08: ffff8880aa134b80 R09: ffffed1008aef026
R10: ffff888045778130 R11: ffff8880455ca500 R12: 0000000000000000
R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000001
FS: 00007fe92580a700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbee3f69028 CR3: 00000000a9947000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
refresh_sit_entry+0x2c/0x730 fs/f2fs/segment.c:1728
allocate_data_block+0x47d/0xf60 fs/f2fs/segment.c:2372
do_write_page+0x222/0x7f0 fs/f2fs/segment.c:2402
write_node_page+0x6f/0x230 fs/f2fs/segment.c:2442
__write_node_page+0x483/0xc20 fs/f2fs/node.c:1414
fsync_node_pages+0x90e/0x1420 fs/f2fs/node.c:1532
f2fs_do_sync_file+0xd51/0x1920 fs/f2fs/file.c:266
vfs_fsync_range+0x103/0x260 fs/sync.c:196
generic_write_sync include/linux/fs.h:2684 [inline]
f2fs_file_write_iter+0x4a6/0x600 fs/f2fs/file.c:2753
call_write_iter include/linux/fs.h:1780 [inline]
new_sync_write fs/read_write.c:469 [inline]
__vfs_write+0x44c/0x630 fs/read_write.c:482
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 6c 0e 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 75 20 4d 01 e6 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 57 0e 00
RIP: f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline] RSP: ffff8880454cf5a8
RIP: update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682 RSP: ffff8880454cf5a8
---[ end trace e3b08447466a76dc ]---
----------------
Code disassembly (best guess), 1 bytes skipped:
0: df 48 89 fisttps -0x77(%rax)
3: fa cli
4: 48 c1 ea 03 shr $0x3,%rdx
8: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
c: 0f 85 6c 0e 00 00 jne 0xe7e
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 4c 8b 75 20 mov 0x20(%rbp),%r14
20: 4d 01 e6 add %r12,%r14
23: 4c 89 f2 mov %r14,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 4c 89 f2 mov %r14,%rdx
31: 83 e2 07 and $0x7,%edx
34: 38 d0 cmp %dl,%al
36: 7f 08 jg 0x40
38: 84 c0 test %al,%al
3a: 0f .byte 0xf
3b: 85 57 0e test %edx,0xe(%rdi)


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: e911713e40ca Linux 4.14.299
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=150fe115880000

kernel config: https://syzkaller.appspot.com/x/.config?x=1d7ed9728cc57838
dashboard link: https://syzkaller.appspot.com/bug?extid=04a357a6933e5765086d
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17828766880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1131ef89880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c8588259d654/disk-e911713e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/700d08072e5e/vmlinux-e911713e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/844ad5da2ed5/bzImage-e911713e.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/b861b7afe726/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+04a357...@syzkaller.appspotmail.com

F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): Found nat_bits in checkpoint
F2FS-fs (loop0): Mounted with checkpoint version = 3e17dab1

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:

CPU: 0 PID: 22 Comm: kworker/u4:1 Not tainted 4.14.299-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Workqueue: writeback wb_workfn (flush-7:0)
task: ffff8880b55ee5c0 task.stack: ffff8880b55f8000

RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline]
RIP: 0010:update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682

RSP: 0018:ffff8880b55ff1b8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880b336e5c0 RCX: 000000000000007c
RDX: 0000000000000000 RSI: 1ffff110145be4c4 RDI: ffff8880b3121730
RBP: ffff8880b3121710 R08: ffff8880b3048780 R09: ffffed1012b40535
R10: ffff888095a029a9 R11: ffff8880b55ee5c0 R12: 0000000000000000
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f0a28ad2fb0 CR3: 000000009a7c1000 CR4: 00000000003406f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
refresh_sit_entry+0x2c/0x730 fs/f2fs/segment.c:1728
allocate_data_block+0x47d/0xf60 fs/f2fs/segment.c:2372
do_write_page+0x222/0x7f0 fs/f2fs/segment.c:2402

write_data_page+0x15d/0x3a0 fs/f2fs/segment.c:2456
do_write_data_page+0xc63/0x2ca0 fs/f2fs/data.c:1493
__write_data_page+0x115a/0x1480 fs/f2fs/data.c:1567
f2fs_write_cache_pages+0x40d/0xe50 fs/f2fs/data.c:1744
__f2fs_write_data_pages+0x2e2/0xb90 fs/f2fs/data.c:1838
do_writepages+0xc3/0x240 mm/page-writeback.c:2361
__writeback_single_inode+0xda/0x1010 fs/fs-writeback.c:1382
writeback_sb_inodes+0x48b/0xd30 fs/fs-writeback.c:1645
wb_writeback+0x243/0xb80 fs/fs-writeback.c:1820
wb_do_writeback fs/fs-writeback.c:1952 [inline]
wb_workfn+0x2bd/0xf50 fs/fs-writeback.c:1988
process_one_work+0x793/0x14a0 kernel/workqueue.c:2117
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406

Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 6c 0e 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 75 20 4d 01 e6 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 57 0e 00

RIP: f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline] RSP: ffff8880b55ff1b8
RIP: update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682 RSP: ffff8880b55ff1b8
---[ end trace eec8cf03e5f7b5aa ]---