From: syzbot <syzbot+eda89a33c5856f66f823@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [jfs?] INFO: task hung in txBegin
Date: Mon, 05 Aug 2024 05:20:02 -0700 [thread overview]
Message-ID: <000000000000509a88061eeeb2cd@google.com> (raw)
In-Reply-To: <tencent_48AA749F76BD66F03C5F3724972036684A09@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in lmLogSync
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 112 Comm: jfsCommit Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 fe 96 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 e1 96 d3 fe 48 8b 3b e8 99 c5 a6
RSP: 0018:ffffc90002c8fc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: cec33d79cc59c000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002c8fd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002c8f9e8 R11: fffff52000591f6b R12: ffff88807720a800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807dc3f238
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0017f8000 CR3: 000000002f11c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
jfs_syncpt+0x7d/0xa0 fs/jfs/jfs_logmgr.c:1041
txEnd+0x30f/0x560 fs/jfs/jfs_txnmgr.c:549
txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline]
jfs_lazycommit+0x634/0xb80 fs/jfs/jfs_txnmgr.c:2733
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 fe 96 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 e1 96 d3 fe 48 8b 3b e8 99 c5 a6
RSP: 0018:ffffc90002c8fc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: cec33d79cc59c000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002c8fd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002c8f9e8 R11: fffff52000591f6b R12: ffff88807720a800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807dc3f238
FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f43bc3ff000 CR3: 000000002f11c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: a6 cmpsb %es:(%rdi),%ds:(%rsi)
1: fe 49 8d decb -0x73(%rcx)
4: 5f pop %rdi
5: f0 48 89 d8 lock mov %rbx,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 fe 96 d3 fe call 0xfed3971a
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 30 add $0x30,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 e1 96 d3 fe call 0xfed3971a
39: 48 8b 3b mov (%rbx),%rdi
3c: e8 .byte 0xe8
3d: 99 cltd
3e: c5 .byte 0xc5
3f: a6 cmpsb %es:(%rdi),%ds:(%rsi)
Tested on:
commit: 50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1500d4d3980000
kernel config: https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13a018f3980000
next prev parent reply other threads:[~2024-08-05 12:20 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-25 15:36 [syzbot] [jfs?] INFO: task hung in txBegin syzbot
2024-06-27 0:51 ` [syzbot] " syzbot
2024-06-27 1:59 ` syzbot
2024-06-27 2:53 ` syzbot
2024-07-20 2:31 ` Edward Adam Davis
2024-07-20 3:00 ` syzbot
2024-08-04 7:32 ` Edward Adam Davis
2024-08-04 7:57 ` syzbot
2024-08-05 11:46 ` Edward Adam Davis
2024-08-05 12:20 ` syzbot [this message]
[not found] <20240627005133.770565-1-lizhi.xu@windriver.com>
2024-06-27 1:24 ` syzbot
[not found] <20240627015934.1159978-1-lizhi.xu@windriver.com>
2024-06-27 2:20 ` syzbot
[not found] <20240627025257.1496287-1-lizhi.xu@windriver.com>
2024-06-27 3:14 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000509a88061eeeb2cd@google.com \
--to=syzbot+eda89a33c5856f66f823@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.