[syzbot] kernel BUG in lbmIODone

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a763d5a5abd6 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14556c83b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=5247c9e141823545
dashboard link: https://syzkaller.appspot.com/bug?extid=52ddb6c83a04ca55f975
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+52ddb6...@syzkaller.appspotmail.com

BUG at fs/jfs/jfs_logmgr.c:2313 assert(bp->l_flag & lbmRELEASE)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_logmgr.c:2313!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:lbmIODone.cold+0xc9/0x116 fs/jfs/jfs_logmgr.c:2313
Code: 68 c3 b3 f8 eb d3 e8 31 89 6d f8 48 c7 c1 e0 8a e6 89 ba 09 09 00 00 48 c7 c6 20 89 e6 89 48 c7 c7 60 89 e6 89 e8 ec 12 f8 ff <0f> 0b e8 0b 89 6d f8 48 c7 c1 20 8b e6 89 ba 0a 09 00 00 48 c7 c6
RSP: 0018:ffffc90000f3fc88 EFLAGS: 00010082
RAX: 000000000000003f RBX: ffff8880208bf100 RCX: 0000000000000000
RDX: ffff888011c86040 RSI: ffffffff815e52a8 RDI: fffff520001e7f83
RBP: 0000000000000020 R08: 000000000000003f R09: 0000000000000000
R10: ffffffff815df04e R11: 0000000000000000 R12: 0000000000000246
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3fa25ed000 CR3: 00000000412c7000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bio_endio+0x5ec/0x770 block/bio.c:1489
req_bio_endio block/blk-mq.c:674 [inline]
blk_update_request+0x46a/0x1400 block/blk-mq.c:742
blk_mq_end_request+0x4b/0x80 block/blk-mq.c:821
lo_complete_rq+0x1c2/0x280 drivers/block/loop.c:369
blk_complete_reqs+0xad/0xe0 block/blk-mq.c:892
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
run_ksoftirqd kernel/softirq.c:921 [inline]
run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 7200a80d946f066f ]---
RIP: 0010:lbmIODone.cold+0xc9/0x116 fs/jfs/jfs_logmgr.c:2313
Code: 68 c3 b3 f8 eb d3 e8 31 89 6d f8 48 c7 c1 e0 8a e6 89 ba 09 09 00 00 48 c7 c6 20 89 e6 89 48 c7 c7 60 89 e6 89 e8 ec 12 f8 ff <0f> 0b e8 0b 89 6d f8 48 c7 c1 20 8b e6 89 ba 0a 09 00 00 48 c7 c6
RSP: 0018:ffffc90000f3fc88 EFLAGS: 00010082
RAX: 000000000000003f RBX: ffff8880208bf100 RCX: 0000000000000000
RDX: ffff888011c86040 RSI: ffffffff815e52a8 RDI: fffff520001e7f83
RBP: 0000000000000020 R08: 000000000000003f R09: 0000000000000000
R10: ffffffff815df04e R11: 0000000000000000 R12: 0000000000000246
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3fa25ed000 CR3: 00000000412c7000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: bbed346d5a96 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=17935e48880000
kernel config: https://syzkaller.appspot.com/x/.config?x=aae2d21e7dd80684
dashboard link: https://syzkaller.appspot.com/bug?extid=52ddb6c83a04ca55f975
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111ad268880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/11078f50b80b/disk-bbed346d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/398e5f1e6c84/vmlinux-bbed346d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+52ddb6...@syzkaller.appspotmail.com

BUG at fs/jfs/jfs_logmgr.c:2298 assert(bp->l_flag & lbmRELEASE)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_logmgr.c:2298!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : lbmIODone+0x2ec/0x340 fs/jfs/jfs_logmgr.c:2298
lr : lbmIODone+0x2ec/0x340 fs/jfs/jfs_logmgr.c:2298
sp : ffff80000f22bc20
x29: ffff80000f22bc20 x28: ffff80000d2609e0 x27: 000000000000000a
x26: 0000000000000001 x25: 0000000000000000 x24: 0000000000000020
x23: 0000000000000000 x22: ffff0000d0968c00 x21: 0000000000000020
x20: 0000000000000000 x19: ffff0000d0b7d600 x18: 00000000000000c0
x17: ffff80000dd0b198 x16: ffff80000db49158 x15: ffff0000c02d9a80
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c02d9a80
x11: ff808000081c0d5c x10: 0000000000000000 x9 : f6a2b00d81307a00
x8 : f6a2b00d81307a00 x7 : ffff80000819545c x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefbecd0 x1 : 0000000100000101 x0 : 000000000000003f
Call trace:
lbmIODone+0x2ec/0x340 fs/jfs/jfs_logmgr.c:2298
bio_endio+0x28c/0x2d8 block/bio.c:1564
req_bio_endio block/blk-mq.c:695 [inline]
blk_update_request+0x25c/0x570 block/blk-mq.c:825
blk_mq_end_request+0x2c/0x58 block/blk-mq.c:951
lo_complete_rq+0xb8/0x138 drivers/block/loop.c:370
blk_complete_reqs block/blk-mq.c:1022 [inline]
blk_done_softirq+0x70/0xa0 block/blk-mq.c:1027
_stext+0x168/0x37c
run_ksoftirqd+0x4c/0x21c kernel/softirq.c:934
smpboot_thread_fn+0x248/0x3e4 kernel/smpboot.c:164
kthread+0x12c/0x158 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Code: 9137e821 91101063 52811f42 94c93ef6 (d4210000)
---[ end trace 0000000000000000 ]---

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 715abedee4cd Add linux-next specific files for 20230515
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16769f33280000
kernel config: https://syzkaller.appspot.com/x/.config?x=6a2745d066dda0ec

dashboard link: https://syzkaller.appspot.com/bug?extid=52ddb6c83a04ca55f975
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1262d159280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14e3b42d280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d4d1d06b34b8/disk-715abede.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3ef33a86fdc8/vmlinux-715abede.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e0006b413ed1/bzImage-715abede.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/e03edfdf992b/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+52ddb6...@syzkaller.appspotmail.com

BUG at fs/jfs/jfs_logmgr.c:2298 assert(bp->l_flag & lbmRELEASE)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_logmgr.c:2298!

invalid opcode: 0000 [#1] PREEMPT SMP KASAN

CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.4.0-rc2-next-20230515-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
RIP: 0010:lbmIODone+0x111a/0x11d0 fs/jfs/jfs_logmgr.c:2298
Code: fe e9 97 f3 ff ff e8 25 70 95 fe 48 c7 c1 80 ac 89 8a ba fa 08 00 00 48 c7 c6 c0 aa 89 8a 48 c7 c7 00 ab 89 8a e8 26 58 79 fe <0f> 0b e8 df 70 e8 fe e9 09 f2 ff ff e8 f5 6f 95 fe 48 c7 c1 c0 ac
RSP: 0018:ffffc90000147c70 EFLAGS: 00010086
RAX: 000000000000003f RBX: ffff88814aa95200 RCX: 0000000000000100
RDX: 0000000000000000 RSI: ffffffff81689ddc RDI: 0000000000000005
RBP: 0000000000000020 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000101 R11: 0000000000000001 R12: 0000000000000246

R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f5731f31000 CR3: 00000000219b5000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

bio_endio+0x5af/0x6c0 block/bio.c:1608
req_bio_endio block/blk-mq.c:761 [inline]
blk_update_request+0x56a/0x14f0 block/blk-mq.c:906
blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023
lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370
blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101
__do_softirq+0x1d4/0x905 kernel/softirq.c:553
run_ksoftirqd kernel/softirq.c:921 [inline]
run_ksoftirqd+0x31/0x60 kernel/softirq.c:913
smpboot_thread_fn+0x659/0x9f0 kernel/smpboot.c:164
kthread+0x344/0x440 kernel/kthread.c:379
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:lbmIODone+0x111a/0x11d0 fs/jfs/jfs_logmgr.c:2298
Code: fe e9 97 f3 ff ff e8 25 70 95 fe 48 c7 c1 80 ac 89 8a ba fa 08 00 00 48 c7 c6 c0 aa 89 8a 48 c7 c7 00 ab 89 8a e8 26 58 79 fe <0f> 0b e8 df 70 e8 fe e9 09 f2 ff ff e8 f5 6f 95 fe 48 c7 c1 c0 ac
RSP: 0018:ffffc90000147c70 EFLAGS: 00010086
RAX: 000000000000003f RBX: ffff88814aa95200 RCX: 0000000000000100
RDX: 0000000000000000 RSI: ffffffff81689ddc RDI: 0000000000000005
RBP: 0000000000000020 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000101 R11: 0000000000000001 R12: 0000000000000246

R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f5731f31000 CR3: 00000000219b5000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.