From: syzbot <syzbot+553d90297e6d2f50dbc7@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diNewExt
Date: Mon, 11 Dec 2023 04:50:06 -0800 [thread overview]
Message-ID: <0000000000008f62a9060c3b5f6d@google.com> (raw)
In-Reply-To: <tencent_996A377566D793682361297D63A5244B3705@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in lbmIODone
BUG at fs/jfs/jfs_logmgr.c:2303 assert(bp->l_flag & lbmRELEASE)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_logmgr.c:2303!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 22 Comm: ksoftirqd/1 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:lbmIODone+0x16fa/0x1750 fs/jfs/jfs_logmgr.c:2303
Code: fe 07 90 0f 0b e8 e6 cf 78 fe 48 c7 c7 c0 73 a2 8b 48 c7 c6 c0 6e a2 8b ba ff 08 00 00 48 c7 c1 20 7d a2 8b e8 67 a8 fe 07 90 <0f> 0b e8 bf cf 78 fe 48 c7 c7 c0 73 a2 8b 48 c7 c6 c0 6e a2 8b ba
RSP: 0018:ffffc900001c7ad8 EFLAGS: 00010046
RAX: 000000000000003f RBX: 0000000000000020 RCX: f6d0cfb74fb3eb00
RDX: 0000000080000101 RSI: 0000000080000101 RDI: 0000000000000000
RBP: ffff8880278cb008 R08: ffffffff8171379c R09: 1ffff92000038efc
R10: dffffc0000000000 R11: fffff52000038efd R12: dffffc0000000000
R13: ffff8880278cb000 R14: ffff88807eb3da78 R15: 0000000000000246
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0013fe000 CR3: 00000000702ba000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
req_bio_endio block/blk-mq.c:788 [inline]
blk_update_request+0x53f/0x1020 block/blk-mq.c:933
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1056
blk_complete_reqs block/blk-mq.c:1131 [inline]
blk_done_softirq+0x103/0x150 block/blk-mq.c:1136
__do_softirq+0x2b8/0x939 kernel/softirq.c:553
run_ksoftirqd+0xc5/0x120 kernel/softirq.c:921
smpboot_thread_fn+0x530/0x9f0 kernel/smpboot.c:164
kthread+0x2d3/0x370 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:lbmIODone+0x16fa/0x1750 fs/jfs/jfs_logmgr.c:2303
Code: fe 07 90 0f 0b e8 e6 cf 78 fe 48 c7 c7 c0 73 a2 8b 48 c7 c6 c0 6e a2 8b ba ff 08 00 00 48 c7 c1 20 7d a2 8b e8 67 a8 fe 07 90 <0f> 0b e8 bf cf 78 fe 48 c7 c7 c0 73 a2 8b 48 c7 c6 c0 6e a2 8b ba
RSP: 0018:ffffc900001c7ad8 EFLAGS: 00010046
RAX: 000000000000003f RBX: 0000000000000020 RCX: f6d0cfb74fb3eb00
RDX: 0000000080000101 RSI: 0000000080000101 RDI: 0000000000000000
RBP: ffff8880278cb008 R08: ffffffff8171379c R09: 1ffff92000038efc
R10: dffffc0000000000 R11: fffff52000038efd R12: dffffc0000000000
R13: ffff8880278cb000 R14: ffff88807eb3da78 R15: 0000000000000246
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0013fe000 CR3: 00000000702ba000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: bee0e776 Merge tag 'for-linus-iommufd' of git://git.ke..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13272966e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=b45dfd882e46ec91
dashboard link: https://syzkaller.appspot.com/bug?extid=553d90297e6d2f50dbc7
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=165f472ee80000
next parent reply other threads:[~2023-12-11 12:50 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <tencent_996A377566D793682361297D63A5244B3705@qq.com>
2023-12-11 12:50 ` syzbot [this message]
[not found] <tencent_5FBE6E042F496EB89494EB7AED4ECD84780A@qq.com>
2023-12-12 1:04 ` [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diNewExt syzbot
[not found] <tencent_B4064DC995AEF2AEC3CC9E27EE06ED12D706@qq.com>
2023-12-10 7:36 ` syzbot
2023-12-10 6:40 syzbot
2023-12-10 7:24 ` syzbot
2023-12-11 12:30 ` syzbot
2023-12-12 0:30 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000008f62a9060c3b5f6d@google.com \
--to=syzbot+553d90297e6d2f50dbc7@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.