From: syzbot <syzbot+f195123a45ad487ca66c@syzkaller.appspotmail.com>
To: chao@kernel.org, jaegeuk@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [f2fs-dev] [syzbot] [f2fs?] kernel BUG in f2fs_vm_page_mkwrite
Date: Thu, 06 Jun 2024 15:22:28 -0700 [thread overview]
Message-ID: <0000000000004d2e4d061a401e51@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 83814698cf48 Merge tag 'powerpc-6.10-2' of git://git.kerne..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15cb1a16980000
kernel config: https://syzkaller.appspot.com/x/.config?x=238430243a58f702
dashboard link: https://syzkaller.appspot.com/bug?extid=f195123a45ad487ca66c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1129d362980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d4ce06980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/49e438bd237c/disk-83814698.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cc25a0ccc6f6/vmlinux-83814698.xz
kernel image: https://storage.googleapis.com/syzbot-assets/85871c08ab8f/bzImage-83814698.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/cc6db24192e2/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f195123a45ad487ca66c@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/f2fs/file.c:105!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 5092 Comm: syz-executor296 Not tainted 6.10.0-rc1-syzkaller-00304-g83814698cf48 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:f2fs_vm_page_mkwrite+0x1679/0x1bb0 fs/f2fs/file.c:105
Code: e7 41 83 e7 01 4c 89 fe e8 84 39 c8 fd 4d 85 ff 0f 84 f6 f8 ff ff e8 46 3e c8 fd 49 83 ec 01 e9 eb f8 ff ff e8 38 3e c8 fd 90 <0f> 0b e8 30 3e c8 fd e8 5b 0a 3b fd e9 f0 f1 ff ff 48 89 4c 24 08
RSP: 0018:ffffc9000316f828 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807aa48000 RCX: ffffffff83c58900
RDX: ffff8880123a0000 RSI: ffffffff83c596b8 RDI: 0000000000000007
RBP: ffffc9000316fb68 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff9393ffd0 R12: ffffc9000316f8a8
R13: 0000000000000001 R14: ffffea00013dfbc0 R15: ffff88807aa484a8
FS: 0000555581924380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000280 CR3: 00000000791d4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_page_mkwrite+0x17d/0x390 mm/memory.c:3099
wp_page_shared mm/memory.c:3501 [inline]
do_wp_page+0xc89/0x3380 mm/memory.c:3651
handle_pte_fault mm/memory.c:5396 [inline]
__handle_mm_fault+0x2311/0x53f0 mm/memory.c:5523
handle_mm_fault+0x476/0xa00 mm/memory.c:5688
do_user_addr_fault+0x2e5/0xe50 arch/x86/mm/fault.c:1389
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58
Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb
RSP: 0018:ffffc9000316fdd8 EFLAGS: 00050212
RAX: 00000000665cff9a RBX: 0000000000000010 RCX: 0000000000000010
RDX: fffff5200062dfc8 RSI: ffffc9000316fe30 RDI: 0000000020000280
RBP: 0000000020000280 R08: 0000000000000000 R09: fffff5200062dfc7
R10: ffffc9000316fe3f R11: 0000000000000000 R12: ffffc9000316fe30
R13: 0000000020000290 R14: 0000000000000000 R15: 0000000000000000
copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline]
_copy_to_user lib/usercopy.c:46 [inline]
_copy_to_user+0xac/0xc0 lib/usercopy.c:39
copy_to_user include/linux/uaccess.h:191 [inline]
put_timespec64+0xb6/0x120 kernel/time/time.c:910
__do_sys_clock_gettime kernel/time/posix-timers.c:1144 [inline]
__se_sys_clock_gettime kernel/time/posix-timers.c:1132 [inline]
__x64_sys_clock_gettime+0x1d5/0x270 kernel/time/posix-timers.c:1132
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feea661dc19
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeab229a38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e4
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007feea661dc19
RDX: 00007feea661dc19 RSI: 0000000020000280 RDI: 0000000000000000
RBP: 00007feea66965f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 00007ffeab229a70
R13: 00007ffeab229c98 R14: 431bde82d7b634db R15: 00007feea666603b
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:f2fs_vm_page_mkwrite+0x1679/0x1bb0 fs/f2fs/file.c:105
Code: e7 41 83 e7 01 4c 89 fe e8 84 39 c8 fd 4d 85 ff 0f 84 f6 f8 ff ff e8 46 3e c8 fd 49 83 ec 01 e9 eb f8 ff ff e8 38 3e c8 fd 90 <0f> 0b e8 30 3e c8 fd e8 5b 0a 3b fd e9 f0 f1 ff ff 48 89 4c 24 08
RSP: 0018:ffffc9000316f828 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807aa48000 RCX: ffffffff83c58900
RDX: ffff8880123a0000 RSI: ffffffff83c596b8 RDI: 0000000000000007
RBP: ffffc9000316fb68 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff9393ffd0 R12: ffffc9000316f8a8
R13: 0000000000000001 R14: ffffea00013dfbc0 R15: ffff88807aa484a8
FS: 0000555581924380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000280 CR3: 00000000791d4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 40 83 f9 08 rex cmp $0x8,%ecx
4: 73 21 jae 0x27
6: 85 c9 test %ecx,%ecx
8: 74 0f je 0x19
a: 8a 06 mov (%rsi),%al
c: 88 07 mov %al,(%rdi)
e: 48 ff c7 inc %rdi
11: 48 ff c6 inc %rsi
14: 48 ff c9 dec %rcx
17: 75 f1 jne 0xa
19: c3 ret
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
25: 00 00
27: 48 8b 06 mov (%rsi),%rax
* 2a: 48 89 07 mov %rax,(%rdi) <-- trapping instruction
2d: 48 83 c6 08 add $0x8,%rsi
31: 48 83 c7 08 add $0x8,%rdi
35: 83 e9 08 sub $0x8,%ecx
38: 74 df je 0x19
3a: 83 f9 08 cmp $0x8,%ecx
3d: 73 e8 jae 0x27
3f: eb .byte 0xeb
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: syzbot <syzbot+f195123a45ad487ca66c@syzkaller.appspotmail.com>
To: chao@kernel.org, jaegeuk@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [f2fs?] kernel BUG in f2fs_vm_page_mkwrite
Date: Thu, 06 Jun 2024 15:22:28 -0700 [thread overview]
Message-ID: <0000000000004d2e4d061a401e51@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 83814698cf48 Merge tag 'powerpc-6.10-2' of git://git.kerne..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15cb1a16980000
kernel config: https://syzkaller.appspot.com/x/.config?x=238430243a58f702
dashboard link: https://syzkaller.appspot.com/bug?extid=f195123a45ad487ca66c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1129d362980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d4ce06980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/49e438bd237c/disk-83814698.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cc25a0ccc6f6/vmlinux-83814698.xz
kernel image: https://storage.googleapis.com/syzbot-assets/85871c08ab8f/bzImage-83814698.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/cc6db24192e2/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f195123a45ad487ca66c@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/f2fs/file.c:105!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 5092 Comm: syz-executor296 Not tainted 6.10.0-rc1-syzkaller-00304-g83814698cf48 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:f2fs_vm_page_mkwrite+0x1679/0x1bb0 fs/f2fs/file.c:105
Code: e7 41 83 e7 01 4c 89 fe e8 84 39 c8 fd 4d 85 ff 0f 84 f6 f8 ff ff e8 46 3e c8 fd 49 83 ec 01 e9 eb f8 ff ff e8 38 3e c8 fd 90 <0f> 0b e8 30 3e c8 fd e8 5b 0a 3b fd e9 f0 f1 ff ff 48 89 4c 24 08
RSP: 0018:ffffc9000316f828 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807aa48000 RCX: ffffffff83c58900
RDX: ffff8880123a0000 RSI: ffffffff83c596b8 RDI: 0000000000000007
RBP: ffffc9000316fb68 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff9393ffd0 R12: ffffc9000316f8a8
R13: 0000000000000001 R14: ffffea00013dfbc0 R15: ffff88807aa484a8
FS: 0000555581924380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000280 CR3: 00000000791d4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_page_mkwrite+0x17d/0x390 mm/memory.c:3099
wp_page_shared mm/memory.c:3501 [inline]
do_wp_page+0xc89/0x3380 mm/memory.c:3651
handle_pte_fault mm/memory.c:5396 [inline]
__handle_mm_fault+0x2311/0x53f0 mm/memory.c:5523
handle_mm_fault+0x476/0xa00 mm/memory.c:5688
do_user_addr_fault+0x2e5/0xe50 arch/x86/mm/fault.c:1389
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58
Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb
RSP: 0018:ffffc9000316fdd8 EFLAGS: 00050212
RAX: 00000000665cff9a RBX: 0000000000000010 RCX: 0000000000000010
RDX: fffff5200062dfc8 RSI: ffffc9000316fe30 RDI: 0000000020000280
RBP: 0000000020000280 R08: 0000000000000000 R09: fffff5200062dfc7
R10: ffffc9000316fe3f R11: 0000000000000000 R12: ffffc9000316fe30
R13: 0000000020000290 R14: 0000000000000000 R15: 0000000000000000
copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline]
_copy_to_user lib/usercopy.c:46 [inline]
_copy_to_user+0xac/0xc0 lib/usercopy.c:39
copy_to_user include/linux/uaccess.h:191 [inline]
put_timespec64+0xb6/0x120 kernel/time/time.c:910
__do_sys_clock_gettime kernel/time/posix-timers.c:1144 [inline]
__se_sys_clock_gettime kernel/time/posix-timers.c:1132 [inline]
__x64_sys_clock_gettime+0x1d5/0x270 kernel/time/posix-timers.c:1132
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feea661dc19
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeab229a38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e4
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007feea661dc19
RDX: 00007feea661dc19 RSI: 0000000020000280 RDI: 0000000000000000
RBP: 00007feea66965f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 00007ffeab229a70
R13: 00007ffeab229c98 R14: 431bde82d7b634db R15: 00007feea666603b
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:f2fs_vm_page_mkwrite+0x1679/0x1bb0 fs/f2fs/file.c:105
Code: e7 41 83 e7 01 4c 89 fe e8 84 39 c8 fd 4d 85 ff 0f 84 f6 f8 ff ff e8 46 3e c8 fd 49 83 ec 01 e9 eb f8 ff ff e8 38 3e c8 fd 90 <0f> 0b e8 30 3e c8 fd e8 5b 0a 3b fd e9 f0 f1 ff ff 48 89 4c 24 08
RSP: 0018:ffffc9000316f828 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807aa48000 RCX: ffffffff83c58900
RDX: ffff8880123a0000 RSI: ffffffff83c596b8 RDI: 0000000000000007
RBP: ffffc9000316fb68 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff9393ffd0 R12: ffffc9000316f8a8
R13: 0000000000000001 R14: ffffea00013dfbc0 R15: ffff88807aa484a8
FS: 0000555581924380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000280 CR3: 00000000791d4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 40 83 f9 08 rex cmp $0x8,%ecx
4: 73 21 jae 0x27
6: 85 c9 test %ecx,%ecx
8: 74 0f je 0x19
a: 8a 06 mov (%rsi),%al
c: 88 07 mov %al,(%rdi)
e: 48 ff c7 inc %rdi
11: 48 ff c6 inc %rsi
14: 48 ff c9 dec %rcx
17: 75 f1 jne 0xa
19: c3 ret
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
25: 00 00
27: 48 8b 06 mov (%rsi),%rax
* 2a: 48 89 07 mov %rax,(%rdi) <-- trapping instruction
2d: 48 83 c6 08 add $0x8,%rsi
31: 48 83 c7 08 add $0x8,%rdi
35: 83 e9 08 sub $0x8,%ecx
38: 74 df je 0x19
3a: 83 f9 08 cmp $0x8,%ecx
3d: 73 e8 jae 0x27
3f: eb .byte 0xeb
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2024-06-06 22:22 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-06 22:22 syzbot [this message]
2024-06-06 22:22 ` [syzbot] [f2fs?] kernel BUG in f2fs_vm_page_mkwrite syzbot
2024-08-05 15:22 ` [f2fs-dev] " syzbot
2024-08-05 15:22 ` syzbot
2024-08-20 1:41 ` [f2fs-dev] " Chao Yu
2024-08-20 1:41 ` Chao Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000004d2e4d061a401e51@google.com \
--to=syzbot+f195123a45ad487ca66c@syzkaller.appspotmail.com \
--cc=chao@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.