UBSAN: shift-out-of-bounds in ext4_fill_super

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 15ac8fdb Add linux-next specific files for 20201207
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1125c923500000
kernel config: https://syzkaller.appspot.com/x/.config?x=3696b8138207d24d
dashboard link: https://syzkaller.appspot.com/bug?extid=345b75652b1d24227443
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=151bf86b500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=139212cb500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+345b75...@syzkaller.appspotmail.com

loop0: detected capacity change from 4 to 0
================================================================================
UBSAN: shift-out-of-bounds in fs/ext4/super.c:4190:25
shift exponent 589825 is too large for 32-bit type 'int'
CPU: 1 PID: 8498 Comm: syz-executor023 Not tainted 5.10.0-rc6-next-20201207-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
ext4_fill_super.cold+0x154/0x3ce fs/ext4/super.c:4190
mount_bdev+0x34d/0x410 fs/super.c:1366
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1496
do_new_mount fs/namespace.c:2896 [inline]
path_mount+0x12ae/0x1e70 fs/namespace.c:3227
do_mount fs/namespace.c:3240 [inline]
__do_sys_mount fs/namespace.c:3448 [inline]
__se_sys_mount fs/namespace.c:3425 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3425
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446d6a
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc2d215018 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc2d215070 RCX: 0000000000446d6a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc2d215030
RBP: 00007ffc2d215030 R08: 00007ffc2d215070 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001
R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003
================================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Theodore Y. Ts'o]

On Tue, Dec 08, 2020 at 11:33:11PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 15ac8fdb Add linux-next specific files for 20201207
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1125c923500000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3696b8138207d24d
> dashboard link: https://syzkaller.appspot.com/bug?extid=345b75652b1d24227443
> compiler: gcc (GCC) 10.1.0-syz 20200507
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=151bf86b500000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=139212cb500000

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git e360ba58d067a30a4e3e7d55ebdd919885a058d6

From 3d3bc303a8a8f7123cf486f49fa9060116fa1465 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <ty...@mit.edu>
Date: Wed, 9 Dec 2020 15:59:11 -0500
Subject: [PATCH] ext4: check for invalid block size early when mounting a file
system

Check for valid block size directly by validating s_log_block_size; we
were doing this in two places. First, by calculating blocksize via
BLOCK_SIZE << s_log_block_size, and then checking that the blocksize
was valid. And then secondly, by checking s_log_block_size directly.

The first check is not reliable, and can trigger an UBSAN warning if
s_log_block_size on a maliciously corrupted superblock is greater than
22. This is harmless, since the second test will correctly reject the
maliciously fuzzed file system, but to make syzbot shut up, and
because the two checks are duplicative in any case, delete the
blocksize check, and move the s_log_block_size earlier in
ext4_fill_super().

Signed-off-by: Theodore Ts'o <ty...@mit.edu>
Reported-by: syzbot+345b75...@syzkaller.appspotmail.com
---
fs/ext4/super.c | 40 ++++++++++++++++------------------------
1 file changed, 16 insertions(+), 24 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index f86220a8df50..4a16bbf0432c 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4202,18 +4202,25 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
*/
sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT;

- blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
-
- if (blocksize == PAGE_SIZE)
- set_opt(sb, DIOREAD_NOLOCK);
-
- if (blocksize < EXT4_MIN_BLOCK_SIZE ||
- blocksize > EXT4_MAX_BLOCK_SIZE) {
+ if (le32_to_cpu(es->s_log_block_size) >
+ (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
ext4_msg(sb, KERN_ERR,
- "Unsupported filesystem blocksize %d (%d log_block_size)",
- blocksize, le32_to_cpu(es->s_log_block_size));
+ "Invalid log block size: %u",
+ le32_to_cpu(es->s_log_block_size));
goto failed_mount;
}
+ if (le32_to_cpu(es->s_log_cluster_size) >
+ (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
+ ext4_msg(sb, KERN_ERR,
+ "Invalid log cluster size: %u",
+ le32_to_cpu(es->s_log_cluster_size));
+ goto failed_mount;
+ }
+
+ blocksize = EXT4_MIN_BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
+
+ if (blocksize == PAGE_SIZE)
+ set_opt(sb, DIOREAD_NOLOCK);

if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) {
sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE;
@@ -4432,21 +4439,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
if (!ext4_feature_set_ok(sb, (sb_rdonly(sb))))
goto failed_mount;

- if (le32_to_cpu(es->s_log_block_size) >
- (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
- ext4_msg(sb, KERN_ERR,
- "Invalid log block size: %u",
- le32_to_cpu(es->s_log_block_size));
- goto failed_mount;
- }
- if (le32_to_cpu(es->s_log_cluster_size) >
- (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
- ext4_msg(sb, KERN_ERR,
- "Invalid log cluster size: %u",
- le32_to_cpu(es->s_log_cluster_size));
- goto failed_mount;
- }
-
if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) {
ext4_msg(sb, KERN_ERR,
"Number of reserved GDT blocks insanely large: %d",
--
2.28.0

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

ered new interface driver usbdux
[ 11.580522][ T1] usbcore: registered new interface driver usbduxfast
[ 11.581798][ T1] usbcore: registered new interface driver usbduxsigma
[ 11.583064][ T1] usbcore: registered new interface driver vmk80xx
[ 11.584633][ T1] usbcore: registered new interface driver r8712u
[ 11.587101][ T1] ashmem: initialized
[ 11.588027][ T1] greybus: registered new driver hid
[ 11.589178][ T1] greybus: registered new driver gbphy
[ 11.590272][ T1] gb_gbphy: registered new driver usb
[ 11.591182][ T1] asus_wmi: ASUS WMI generic driver loaded
[ 11.681496][ T1] usbcore: registered new interface driver snd-usb-audio
[ 11.682997][ T1] usbcore: registered new interface driver snd-ua101
[ 11.684383][ T1] usbcore: registered new interface driver snd-usb-usx2y
[ 11.685832][ T1] usbcore: registered new interface driver snd-usb-us122l
[ 11.688035][ T1] usbcore: registered new interface driver snd-usb-caiaq
[ 11.689539][ T1] usbcore: registered new interface driver snd-usb-6fire
[ 11.690927][ T1] usbcore: registered new interface driver snd-usb-hiface
[ 11.692248][ T1] usbcore: registered new interface driver snd-bcd2000
[ 11.693529][ T1] usbcore: registered new interface driver snd_usb_pod
[ 11.694814][ T1] usbcore: registered new interface driver snd_usb_podhd
[ 11.696561][ T1] usbcore: registered new interface driver snd_usb_toneport
[ 11.697861][ T1] usbcore: registered new interface driver snd_usb_variax
[ 11.699358][ T1] drop_monitor: Initializing network drop monitor service
[ 11.700824][ T1] NET: Registered protocol family 26
[ 11.701670][ T1] GACT probability on
[ 11.702347][ T1] Mirror/redirect action on
[ 11.703311][ T1] Simple TC action Loaded
[ 11.706197][ T1] netem: version 1.3
[ 11.707471][ T1] u32 classifier
[ 11.708003][ T1] Performance counters on
[ 11.708637][ T1] input device check on
[ 11.709286][ T1] Actions configured
[ 11.712027][ T1] nf_conntrack_irc: failed to register helpers
[ 11.713099][ T1] nf_conntrack_sane: failed to register helpers
[ 11.762391][ T1] nf_conntrack_sip: failed to register helpers
[ 11.768433][ T1] xt_time: kernel timezone is -0000
[ 11.769637][ T1] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 11.771058][ T1] IPVS: Connection hash table configured (size=4096, memory=64Kbytes)
[ 11.772801][ T1] IPVS: ipvs loaded.
[ 11.773386][ T1] IPVS: [rr] scheduler registered.
[ 11.774142][ T1] IPVS: [wrr] scheduler registered.
[ 11.774842][ T1] IPVS: [lc] scheduler registered.
[ 11.775630][ T1] IPVS: [wlc] scheduler registered.
[ 11.776605][ T1] IPVS: [fo] scheduler registered.
[ 11.777429][ T1] IPVS: [ovf] scheduler registered.
[ 11.778315][ T1] IPVS: [lblc] scheduler registered.
[ 11.779271][ T1] IPVS: [lblcr] scheduler registered.
[ 11.780060][ T1] IPVS: [dh] scheduler registered.
[ 11.780787][ T1] IPVS: [sh] scheduler registered.
[ 11.781548][ T1] IPVS: [mh] scheduler registered.
[ 11.782361][ T1] IPVS: [sed] scheduler registered.
[ 11.783128][ T1] IPVS: [nq] scheduler registered.
[ 11.783947][ T1] IPVS: ftp: loaded support on port[0] = 21
[ 11.784903][ T1] IPVS: [sip] pe registered.
[ 11.785694][ T1] ipip: IPv4 and MPLS over IPv4 tunneling driver
[ 11.788710][ T1] gre: GRE over IPv4 demultiplexor driver
[ 11.789693][ T1] ip_gre: GRE over IPv4 tunneling driver
[ 11.797345][ T1] IPv4 over IPsec tunneling driver
[ 11.801668][ T1] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
[ 11.802961][ T1] Initializing XFRM netlink socket
[ 11.803799][ T1] IPsec XFRM device driver
[ 11.806887][ T1] NET: Registered protocol family 10
[ 11.819302][ T1] Segment Routing with IPv6
[ 11.820100][ T1] RPL Segment Routing with IPv6
[ 11.821507][ T1] mip6: Mobile IPv6
[ 11.826326][ T1] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[ 11.832162][ T1] ip6_gre: GRE over IPv6 tunneling driver
[ 11.835300][ T1] NET: Registered protocol family 17
[ 11.836417][ T1] NET: Registered protocol family 15
[ 11.837814][ T1] Bridge firewalling registered
[ 11.839492][ T1] NET: Registered protocol family 9
[ 11.840394][ T1] X25: Linux Version 0.2
[ 11.878547][ T1] NET: Registered protocol family 6
[ 11.917228][ T1] NET: Registered protocol family 11
[ 11.918541][ T1] NET: Registered protocol family 3
[ 11.919389][ T1] can: controller area network core
[ 11.920529][ T1] NET: Registered protocol family 29
[ 11.921435][ T1] can: raw protocol
[ 11.922222][ T1] can: broadcast manager protocol
[ 11.922956][ T1] can: netlink gateway - max_hops=1
[ 11.924003][ T1] can: SAE J1939
[ 11.924592][ T1] can: isotp protocol
[ 11.926204][ T1] Bluetooth: RFCOMM TTY layer initialized
[ 11.927195][ T1] Bluetooth: RFCOMM socket layer initialized
[ 11.928061][ T1] Bluetooth: RFCOMM ver 1.11
[ 11.928717][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 11.929584][ T1] Bluetooth: BNEP filters: protocol multicast
[ 11.930556][ T1] Bluetooth: BNEP socket layer initialized
[ 11.931465][ T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[ 11.932346][ T1] Bluetooth: CMTP socket layer initialized
[ 11.933149][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 11.934180][ T1] Bluetooth: HIDP socket layer initialized
[ 11.939058][ T1] NET: Registered protocol family 33
[ 11.939983][ T1] Key type rxrpc registered
[ 11.940615][ T1] Key type rxrpc_s registered
[ 11.942623][ T1] NET: Registered protocol family 41
[ 11.943993][ T1] lec:lane_module_init: lec.c: initialized
[ 11.944815][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 11.945771][ T1] l2tp_core: L2TP core driver, V2.0
[ 11.947612][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 11.948492][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 11.949881][ T1] l2tp_netlink: L2TP netlink interface
[ 11.950813][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 11.951793][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 11.953223][ T1] NET: Registered protocol family 35
[ 11.954644][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 11.968296][ T1] DCCP: Activated CCID 2 (TCP-like)
[ 11.969765][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[ 11.973286][ T1] sctp: Hash tables configured (bind 32/56)
[ 11.976659][ T1] NET: Registered protocol family 21
[ 11.978553][ T1] Registered RDS/infiniband transport
[ 11.980791][ T1] Registered RDS/tcp transport
[ 11.981481][ T1] tipc: Activated (version 2.0.0)
[ 11.983155][ T1] NET: Registered protocol family 30
[ 11.984620][ T1] tipc: Started in single node mode
[ 11.986491][ T1] NET: Registered protocol family 43
[ 11.987761][ T1] 9pnet: Installing 9P2000 support
[ 11.988985][ T1] NET: Registered protocol family 37
[ 11.994611][ T1] NET: Registered protocol family 36
[ 11.996628][ T1] Key type dns_resolver registered
[ 11.997444][ T1] Key type ceph registered
[ 11.999019][ T1] libceph: loaded (mon/osd proto 15/24)
[ 12.002268][ T1] batman_adv: B.A.T.M.A.N. advanced 2020.4 (compatibility version 15) loaded
[ 12.003755][ T1] openvswitch: Open vSwitch switching datapath
[ 12.007658][ T1] NET: Registered protocol family 40
[ 12.009484][ T1] mpls_gso: MPLS GSO support
[ 12.025431][ T1] IPI shorthand broadcast: enabled
[ 12.030814][ T1] AVX2 version of gcm_enc/dec engaged.
[ 12.036943][ T1] AES CTR mode by8 optimization enabled
[ 12.048765][ T1] sched_clock: Marking stable (12014908938, 33807447)->(12066289806, -17573421)
[ 12.059676][ T1] registered taskstats version 1
[ 12.064655][ T1] Loading compiled-in X.509 certificates
[ 12.072462][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: f850c787ad998c396ae089c083b940ff0a9abb77'
[ 12.084726][ T1] zswap: loaded using pool lzo/zbud
[ 12.091373][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 12.102233][ T1] Key type ._fscrypt registered
[ 12.107118][ T1] Key type .fscrypt registered
[ 12.111871][ T1] Key type fscrypt-provisioning registered
[ 12.121095][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 12.127844][ T1] FS-Cache: Netfs 'afs' registered for caching
[ 12.144698][ T1] Btrfs loaded, crc32c=crc32c-intel
[ 12.150774][ T1] Key type big_key registered
[ 12.158124][ T1] Key type encrypted registered
[ 12.163026][ T1] AppArmor: AppArmor sha1 policy hashing enabled
[ 12.169501][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 12.175925][ T1] ima: Allocated hash algorithm: sha256
[ 12.181705][ T1] ima: No architecture policies found
[ 12.187379][ T1] evm: Initialising EVM extended attributes:
[ 12.193335][ T1] evm: security.apparmor
[ 12.197637][ T1] evm: security.ima
[ 12.201430][ T1] evm: security.capability
[ 12.205820][ T1] evm: HMAC attrs: 0x1
[ 12.211962][ T1] PM: Magic number: 0:237:664
[ 12.218467][ T1] platform vkms: hash matches
[ 12.223270][ T1] tty ptyef: hash matches
[ 12.229413][ T1] printk: console [netcon0] enabled
[ 12.234603][ T1] netconsole: network logging started
[ 12.240856][ T1] gtp: GTP module loaded (pdp ctx size 104 bytes)
[ 12.249108][ T1] rdma_rxe: loaded
[ 12.253286][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 12.264229][ T1] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 12.273502][ T3159] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 12.276158][ T1] ALSA device list:
[ 12.283218][ T3159] cfg80211: failed to load regulatory.db
[ 12.286917][ T1] #0: Dummy 1
[ 12.295969][ T1] #1: Loopback 1
[ 12.299689][ T1] #2: Virtual MIDI Card 1
[ 12.306825][ T1] md: Waiting for all devices to be available before autodetect
[ 12.314432][ T1] md: If you don't use raid, use raid=noautodetect
[ 12.321078][ T1] md: Autodetecting RAID arrays.
[ 12.326149][ T1] md: autorun ...
[ 12.329774][ T1] md: ... autorun DONE.
[ 12.343653][ T1] EXT4-fs (sda1): Unsupported filesystem log block size (2 log_block_size)
[ 12.354336][ T1] EXT4-fs (sda1): Unsupported filesystem log block size (2 log_block_size)
[ 12.365108][ T1] EXT4-fs (sda1): Unsupported filesystem log block size (2 log_block_size)
[ 12.444573][ T1] exFAT-fs (sda1): invalid boot record signature
[ 12.451031][ T1] exFAT-fs (sda1): failed to read boot sector
[ 12.457097][ T1] exFAT-fs (sda1): failed to recognize exfat type
[ 12.536522][ T1] VFS: could not find a valid V7 on sda1.
[ 12.559692][ T1] qnx6: unable to read the first superblock
[ 12.592544][ T1] NILFS (sda1): couldn't find nilfs on the device
[ 12.602103][ T1] befs: (sda1): invalid magic header
[ 12.612329][ T1] (swapper/0,1,0):ocfs2_fill_super:1003 ERROR: superblock probe failed!
[ 12.620854][ T1] (swapper/0,1,0):ocfs2_fill_super:1190 ERROR: status = -22
[ 12.630921][ T1] gfs2: gfs2 mount does not exist
[ 12.637983][ T1] F2FS-fs (sda1): Magic Mismatch, valid(0xf2f52010) - read(0x20000)
[ 12.646135][ T1] F2FS-fs (sda1): Can't find valid F2FS filesystem in 1th superblock
[ 12.655153][ T1] F2FS-fs (sda1): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 12.662911][ T1] F2FS-fs (sda1): Can't find valid F2FS filesystem in 2th superblock
[ 12.673258][ T1] erofs: (device sda1): erofs_read_superblock: cannot find valid erofs superblock
[ 12.683454][ T1] zonefs (sda1) ERROR: Not a zoned block device
[ 12.693449][ T1] List of all partitions:
[ 12.697857][ T1] 0100 4096 ram0
[ 12.697866][ T1] (driver?)
[ 12.705626][ T1] 0101 4096 ram1
[ 12.705632][ T1] (driver?)
[ 12.713521][ T1] 0102 4096 ram2
[ 12.713526][ T1] (driver?)
[ 12.721349][ T1] 0103 4096 ram3
[ 12.721355][ T1] (driver?)
[ 12.729265][ T1] 0104 4096 ram4
[ 12.729271][ T1] (driver?)
[ 12.737055][ T1] 0105 4096 ram5
[ 12.737060][ T1] (driver?)
[ 12.744823][ T1] 0106 4096 ram6
[ 12.744828][ T1] (driver?)
[ 12.752612][ T1] 0107 4096 ram7
[ 12.752618][ T1] (driver?)
[ 12.760384][ T1] 0108 4096 ram8
[ 12.760389][ T1] (driver?)
[ 12.769115][ T1] 0109 4096 ram9
[ 12.769121][ T1] (driver?)
[ 12.776907][ T1] 010a 4096 ram10
[ 12.776912][ T1] (driver?)
[ 12.784756][ T1] 010b 4096 ram11
[ 12.784761][ T1] (driver?)
[ 12.792922][ T1] 010c 4096 ram12
[ 12.792927][ T1] (driver?)
[ 12.800795][ T1] 010d 4096 ram13
[ 12.800800][ T1] (driver?)
[ 12.808654][ T1] 010e 4096 ram14
[ 12.808659][ T1] (driver?)
[ 12.816533][ T1] 010f 4096 ram15
[ 12.816541][ T1] (driver?)
[ 12.824417][ T1] 1f00 128 mtdblock0
[ 12.824423][ T1] (driver?)
[ 12.832619][ T1] 0800 2097152 sda
[ 12.832626][ T1] driver: sd
[ 12.840408][ T1] 0801 2096128 sda1 58c336d5-01
[ 12.840418][ T1]
[ 12.848455][ T1] No filesystem could mount root, tried:
[ 12.848461][ T1] reiserfs
[ 12.854151][ T1] ext3
[ 12.857287][ T1] ext2
[ 12.860026][ T1] ext4
[ 12.862767][ T1] cramfs
[ 12.865506][ T1] squashfs
[ 12.868443][ T1] minix
[ 12.871532][ T1] vfat
[ 12.874357][ T1] msdos
[ 12.877145][ T1] exfat
[ 12.879970][ T1] bfs
[ 12.882802][ T1] iso9660
[ 12.885451][ T1] hfsplus
[ 12.888486][ T1] hfs
[ 12.891486][ T1] vxfs
[ 12.894142][ T1] sysv
[ 12.896912][ T1] v7
[ 12.899648][ T1] hpfs
[ 12.902210][ T1] ntfs
[ 12.904958][ T1] ufs
[ 12.907714][ T1] efs
[ 12.910363][ T1] affs
[ 12.913011][ T1] romfs
[ 12.915745][ T1] qnx4
[ 12.918628][ T1] qnx6
[ 12.921375][ T1] adfs
[ 12.924111][ T1] fuseblk
[ 12.926908][ T1] udf
[ 12.929918][ T1] omfs
[ 12.932567][ T1] jfs
[ 12.935303][ T1] xfs
[ 12.937991][ T1] nilfs2
[ 12.940643][ T1] befs
[ 12.943554][ T1] ocfs2
[ 12.946307][ T1] gfs2
[ 12.949132][ T1] gfs2meta
[ 12.951881][ T1] f2fs
[ 12.954988][ T1] erofs
[ 12.957760][ T1] zonefs
[ 12.960584][ T1] btrfs
[ 12.963494][ T1]
[ 12.968668][ T1] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,1)
[ 12.977758][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.10.0-rc7-syzkaller #0
[ 12.985712][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 12.995740][ T1] Call Trace:
[ 12.999033][ T1] dump_stack+0x107/0x163
[ 13.003352][ T1] panic+0x393/0x7d3
[ 13.007309][ T1] ? __warn_printk+0xf3/0xf3
[ 13.011885][ T1] mount_block_root+0x4cb/0x4dd
[ 13.016713][ T1] ? init_rootfs+0x59/0x59
[ 13.021120][ T1] ? memcpy+0x39/0x60
[ 13.025085][ T1] mount_root+0x1af/0x1f5
[ 13.029389][ T1] ? mount_block_root+0x4dd/0x4dd
[ 13.034390][ T1] ? memcpy+0x39/0x60
[ 13.038354][ T1] prepare_namespace+0x1ff/0x234
[ 13.043280][ T1] kernel_init_freeable+0x707/0x71f
[ 13.048456][ T1] ? rest_init+0x460/0x460
[ 13.052861][ T1] kernel_init+0xe/0x1e0
[ 13.057077][ T1] ? rest_init+0x460/0x460
[ 13.061479][ T1] ret_from_fork+0x1f/0x30
[ 13.066732][ T1] Kernel Offset: disabled
[ 13.071098][ T1] Rebooting in 86400 seconds..


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=108c240f500000


Tested on:

commit: a2f5ea9e Merge tag 'arm-soc-fixes-v5.10-4b' of git://git.k..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=3cbe20eb8d8072fd

dashboard link: https://syzkaller.appspot.com/bug?extid=345b75652b1d24227443
compiler: gcc (GCC) 10.1.0-syz 20200507

patch: https://syzkaller.appspot.com/x/patch.diff?x=119c1b4b500000

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to checkout kernel repo git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git on commit e360ba58d067a30a4e3e7d55ebdd919885a058d6: failed to run ["git" "fetch" "--tags" "d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8"]: exit status 1
From git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
* [new branch] bisect-test-ext4-035 -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/bisect-test-ext4-035
* [new branch] bisect-test-generic-307 -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/bisect-test-generic-307
* [new branch] dev -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/dev
* [new branch] ext4-3.18 -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/ext4-3.18
* [new branch] ext4-4.1 -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/ext4-4.1
* [new branch] ext4-4.4 -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/ext4-4.4
* [new branch] ext4-4.9 -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/ext4-4.9
* [new branch] ext4-dax -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/ext4-dax
* [new branch] ext4-tools -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/ext4-tools
* [new branch] fix-bz-206443 -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/fix-bz-206443
* [new branch] for-stable -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/for-stable
* [new branch] fsverity -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/fsverity
* [new branch] lazy_journal -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/lazy_journal
* [new branch] master -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/master
* [new branch] origin -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/origin
* [new branch] pu -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/pu
* [new branch] test -> d06f7b29746c7f0a52f349ff7fbf2a3f22d27cf8/test
* [new tag] ext4-for-linus-5.8-rc1-2 -> ext4-for-linus-5.8-rc1-2
! [rejected] ext4_for_linus -> ext4_for_linus (would clobber existing tag)
* [new tag] ext4_for_linus_bugfixes -> ext4_for_linus_bugfixes
* [new tag] ext4_for_linus_cleanups -> ext4_for_linus_cleanups
* [new tag] ext4_for_linus_fixes -> ext4_for_linus_fixes
* [new tag] ext4_for_linus_fixes2 -> ext4_for_linus_fixes2



Tested on:

commit: [unknown
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git e360ba58d067a30a4e3e7d55ebdd919885a058d6

dashboard link: https://syzkaller.appspot.com/bug?extid=345b75652b1d24227443
compiler: gcc (GCC) 10.1.0-syz 20200507

patch: https://syzkaller.appspot.com/x/patch.diff?x=1499c287500000

[Dmitry Vyukov]

Interesting. First time I see this. Should syzkaller use 'git fetch
--tags --force"?...
StackOverflow suggests it should help:
https://stackoverflow.com/questions/58031165/how-to-get-rid-of-would-clobber-existing-tag

[Dmitry Vyukov]

I've added --force to fetches:
https://github.com/google/syzkaller/commit/9a72bc3440b65a01187ba4277b49d6bd821079cd
and it should be deployed by now. Let's try again:

[Theodore Y. Ts'o]

On Thu, Dec 10, 2020 at 09:09:51AM +0100, Dmitry Vyukov wrote:
> > * [new tag] ext4-for-linus-5.8-rc1-2 -> ext4-for-linus-5.8-rc1-2
> > ! [rejected] ext4_for_linus -> ext4_for_linus (would clobber existing tag)
>
> Interesting. First time I see this. Should syzkaller use 'git fetch
> --tags --force"?...
> StackOverflow suggests it should help:
> https://stackoverflow.com/questions/58031165/how-to-get-rid-of-would-clobber-existing-tag

Yeah, sorry, ext4_for_linus is a signed tag which is only used to
authenticate my pull request to Linus. After Linus accepts the pull,
the digital signature is going to be upstream, and so I end up
deleting and the reusing that tag for the next merge window.

I guess I could just start always using ext4_for_linus-<VERSION> and
just delete the tags once they have been accepted, to keep my list of
tags clean.

It's going to make everyone else's tags who pull from ext4.git messy,
though, with gobs of tags that probably won't be of use to them. It
does avoid the need to use git fetch --tags --force, and I guess
people are used to the need to GC tags with the linux-repo. So maybe
that's the right thing to do going forward.


- Ted

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+345b75...@syzkaller.appspotmail.com

Tested on:

commit: e360ba58 ext4: fix a memory leak of ext4_free_data
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git
kernel config: https://syzkaller.appspot.com/x/.config?x=fe9725f8845d9fe6

dashboard link: https://syzkaller.appspot.com/bug?extid=345b75652b1d24227443
compiler: gcc (GCC) 10.1.0-syz 20200507

patch: https://syzkaller.appspot.com/x/patch.diff?x=1166cf17500000

Note: testing is done by a robot and is best-effort only.

[Dmitry Vyukov]

Hi Ted,

syzbot is now prepared and won't fail next time, nor on other similar
trees. Which is good.
So it's really up to you.

Thanks