From: syzbot <syzbot+d66de4cbf532749df35f@syzkaller.appspotmail.com>
To: bragathemanick0908@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [btrfs?] memory leak in btrfs_ref_tree_mod
Date: Sun, 12 Nov 2023 03:52:03 -0800 [thread overview]
Message-ID: <0000000000009e04940609f32e7a@google.com> (raw)
In-Reply-To: <7f87b3b9-6876-40d7-b159-94f2119851f9@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: corrupted list in btrfs_ref_tree_mod
list_add corruption. prev->next should be next (ffff888122a51108), but was 0000000000058000. (prev=ffff88810e236d50).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:30!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 45 Comm: kworker/u4:2 Not tainted 6.5.0-rc5-syzkaller-00182-g25aa0bebba72-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Workqueue: btrfs-qgroup-rescan btrfs_work_helper
RIP: 0010:__list_add_valid+0x74/0x90 lib/list_debug.c:30
Code: e2 fe 0f 0b 48 89 c1 48 c7 c7 68 ff af 85 e8 a3 d7 e2 fe 0f 0b 48 89 d1 48 89 c6 4c 89 c2 48 c7 c7 c0 ff af 85 e8 8c d7 e2 fe <0f> 0b 48 89 f2 48 89 c1 48 89 fe 48 c7 c7 18 00 b0 85 e8 75 d7 e2
RSP: 0018:ffffc900001cf920 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff88810e236d50 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8131cbd0 RDI: 0000000000000001
RBP: ffff888122a51108 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 205d353454202020 R12: 0000000000000000
R13: ffff888122aec700 R14: ffff888122aec750 R15: ffff888122a510c0
FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd2648f75e8 CR3: 000000010a57a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__list_add include/linux/list.h:69 [inline]
list_add_tail include/linux/list.h:102 [inline]
btrfs_ref_tree_mod+0x454/0xbb0 fs/btrfs/ref-verify.c:887
btrfs_free_tree_block+0x116/0x450 fs/btrfs/extent-tree.c:3250
__btrfs_cow_block+0x6a5/0xa30 fs/btrfs/ctree.c:601
btrfs_cow_block+0x154/0x2b0 fs/btrfs/ctree.c:712
btrfs_search_slot+0xa49/0x1770 fs/btrfs/ctree.c:2194
btrfs_update_root+0x6f/0x500 fs/btrfs/root-tree.c:137
commit_fs_roots+0x236/0x360 fs/btrfs/transaction.c:1450
btrfs_commit_transaction+0x93e/0x15c0 fs/btrfs/transaction.c:2393
btrfs_qgroup_rescan_worker+0x389/0x610 fs/btrfs/qgroup.c:3417
btrfs_work_helper+0x158/0x540 fs/btrfs/async-thread.c:314
process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
kthread+0x12b/0x170 kernel/kthread.c:389
ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid+0x74/0x90 lib/list_debug.c:30
Code: e2 fe 0f 0b 48 89 c1 48 c7 c7 68 ff af 85 e8 a3 d7 e2 fe 0f 0b 48 89 d1 48 89 c6 4c 89 c2 48 c7 c7 c0 ff af 85 e8 8c d7 e2 fe <0f> 0b 48 89 f2 48 89 c1 48 89 fe 48 c7 c7 18 00 b0 85 e8 75 d7 e2
RSP: 0018:ffffc900001cf920 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff88810e236d50 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8131cbd0 RDI: 0000000000000001
RBP: ffff888122a51108 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 205d353454202020 R12: 0000000000000000
R13: ffff888122aec700 R14: ffff888122aec750 R15: ffff888122a510c0
FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd2648f75e8 CR3: 000000010a57a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 25aa0beb Merge tag 'net-6.5-rc6' of git://git.kernel.o..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=10deb938e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=2bf8962e4f7984f4
dashboard link: https://syzkaller.appspot.com/bug?extid=d66de4cbf532749df35f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16a72ca7680000
next parent reply other threads:[~2023-11-12 11:52 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <7f87b3b9-6876-40d7-b159-94f2119851f9@gmail.com>
2023-11-12 11:52 ` syzbot [this message]
[not found] <ceaf0f0d-d943-4c1a-a531-5193ea64dd29@gmail.com>
2023-11-16 10:22 ` [syzbot] [btrfs?] memory leak in btrfs_ref_tree_mod syzbot
[not found] <739186bcb83d46101812b06d7e9abb80@foxhound.fi>
2023-11-13 12:28 ` syzbot
[not found] <441aa0e4-b676-4d0a-a35e-c2f7a912f987@gmail.com>
2023-11-12 10:31 ` syzbot
[not found] <143960be-a7d7-44fc-a69f-60e1d12eacdb@gmail.com>
2023-11-12 9:58 ` syzbot
[not found] <077cd80b-022f-4401-a32a-33c452bd0179@gmail.com>
2023-11-12 9:23 ` syzbot
2023-08-15 9:15 syzbot
2023-11-12 13:08 ` Bragatheswaran Manickavel
2023-11-12 13:45 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000009e04940609f32e7a@google.com \
--to=syzbot+d66de4cbf532749df35f@syzkaller.appspotmail.com \
--cc=bragathemanick0908@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.