From: syzbot <syzbot+eda89a33c5856f66f823@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [jfs?] INFO: task hung in txBegin
Date: Sun, 04 Aug 2024 00:57:02 -0700 [thread overview]
Message-ID: <000000000000ea1291061ed6e7d0@google.com> (raw)
In-Reply-To: <tencent_3753976AB76BE6C03368E36CC96363BE2405@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in lmLogSync
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 114 Comm: jfsCommit Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 1e 97 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 01 97 d3 fe 48 8b 3b e8 b9 c5 a6
RSP: 0018:ffffc90002cefc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: 328fe0b8e03e5b00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002cefd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002cef9e8 R11: fffff5200059df6b R12: ffff88806a112800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807cb0ba38
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055559488b938 CR3: 000000000e132000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
jfs_syncpt+0x7d/0xa0 fs/jfs/jfs_logmgr.c:1041
txEnd+0x30f/0x560 fs/jfs/jfs_txnmgr.c:549
txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline]
jfs_lazycommit+0x634/0xb80 fs/jfs/jfs_txnmgr.c:2733
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 1e 97 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 01 97 d3 fe 48 8b 3b e8 b9 c5 a6
RSP: 0018:ffffc90002cefc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: 328fe0b8e03e5b00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002cefd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002cef9e8 R11: fffff5200059df6b R12: ffff88806a112800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807cb0ba38
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055559488b938 CR3: 000000002bf6a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: a6 cmpsb %es:(%rdi),%ds:(%rsi)
1: fe 49 8d decb -0x73(%rcx)
4: 5f pop %rdi
5: f0 48 89 d8 lock mov %rbx,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 1e 97 d3 fe call 0xfed3973a
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 30 add $0x30,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 01 97 d3 fe call 0xfed3973a
39: 48 8b 3b mov (%rbx),%rdi
3c: e8 .byte 0xe8
3d: b9 .byte 0xb9
3e: c5 .byte 0xc5
3f: a6 cmpsb %es:(%rdi),%ds:(%rsi)
Tested on:
commit: 50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16ca70f3980000
kernel config: https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1688319d980000
next prev parent reply other threads:[~2024-08-04 7:57 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-25 15:36 [syzbot] [jfs?] INFO: task hung in txBegin syzbot
2024-06-27 0:51 ` [syzbot] " syzbot
2024-06-27 1:59 ` syzbot
2024-06-27 2:53 ` syzbot
2024-07-20 2:31 ` Edward Adam Davis
2024-07-20 3:00 ` syzbot
2024-08-04 7:32 ` Edward Adam Davis
2024-08-04 7:57 ` syzbot [this message]
2024-08-05 11:46 ` Edward Adam Davis
2024-08-05 12:20 ` syzbot
[not found] <20240627005133.770565-1-lizhi.xu@windriver.com>
2024-06-27 1:24 ` syzbot
[not found] <20240627015934.1159978-1-lizhi.xu@windriver.com>
2024-06-27 2:20 ` syzbot
[not found] <20240627025257.1496287-1-lizhi.xu@windriver.com>
2024-06-27 3:14 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000ea1291061ed6e7d0@google.com \
--to=syzbot+eda89a33c5856f66f823@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.