From: syzbot <syzbot+0f4d9f68fb6632330c6c@syzkaller.appspotmail.com>
To: adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, tytso@mit.edu
Subject: Re: [syzbot] [ext4?] kernel BUG in ext4_split_extent_at (2)
Date: Sat, 08 Jul 2023 16:45:59 -0700 [thread overview]
Message-ID: <000000000000f1378f0600025915@google.com> (raw)
In-Reply-To: <00000000000099887f05fdfc6e10@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 8689f4f2ea56 Merge tag 'mmc-v6.5-2' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12b9cb02a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=7ad417033279f15a
dashboard link: https://syzkaller.appspot.com/bug?extid=0f4d9f68fb6632330c6c
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13977778a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1004666aa80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/21b63023cf5a/disk-8689f4f2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e04836fe057e/vmlinux-8689f4f2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ee05dfd52843/bzImage-8689f4f2.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/e2ab005f1edb/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0f4d9f68fb6632330c6c@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/ext4/ext4_extents.h:200!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5885 Comm: syz-executor219 Not tainted 6.4.0-syzkaller-12365-g8689f4f2ea56 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
RIP: 0010:ext4_ext_mark_unwritten fs/ext4/ext4_extents.h:200 [inline]
RIP: 0010:ext4_split_extent_at+0xd11/0xe10 fs/ext4/extents.c:3221
Code: e9 d2 f8 ff ff e8 1f 6d 5d ff 66 81 c5 00 80 e9 32 fd ff ff e8 10 6d 5d ff 44 8d bd 00 80 ff ff e9 d1 fc ff ff e8 ff 6c 5d ff <0f> 0b 48 8b 7c 24 18 e8 73 9d b0 ff e9 7f f3 ff ff 48 89 cf e8 46
RSP: 0018:ffffc900055ef268 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88807d9c0000 RSI: ffffffff82277271 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88807587d00c
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807587d012
FS: 00007f4820ae9700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4820ae8fe8 CR3: 0000000028105000 CR4: 0000000000350ee0
Call Trace:
<TASK>
ext4_split_extent+0x3fc/0x530 fs/ext4/extents.c:3384
ext4_ext_handle_unwritten_extents fs/ext4/extents.c:3874 [inline]
ext4_ext_map_blocks+0x2e22/0x5bc0 fs/ext4/extents.c:4166
ext4_map_blocks+0x760/0x1890 fs/ext4/inode.c:621
ext4_iomap_alloc fs/ext4/inode.c:3276 [inline]
ext4_iomap_begin+0x43d/0x7a0 fs/ext4/inode.c:3326
iomap_iter+0x446/0x10e0 fs/iomap/iter.c:91
__iomap_dio_rw+0x6e3/0x1d80 fs/iomap/direct-io.c:574
iomap_dio_rw+0x40/0xa0 fs/iomap/direct-io.c:665
ext4_dio_write_iter fs/ext4/file.c:609 [inline]
ext4_file_write_iter+0x1102/0x1880 fs/ext4/file.c:720
call_write_iter include/linux/fs.h:1871 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x981/0xda0 fs/read_write.c:584
ksys_write+0x122/0x250 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f4828f26cd9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4820ae9208 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000034 RCX: 00007f4828f26cd9
RDX: 0000000000000012 RSI: 0000000020000000 RDI: 0000000000000004
RBP: 00007f4828fa4790 R08: 00007f4828fa4798 R09: 00007f4828fa4798
R10: 00007f4828fa4798 R11: 0000000000000246 R12: 00007f4828fa479c
R13: 00007ffef851f96f R14: 00007f4820ae9300 R15: 0000000000022000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_ext_mark_unwritten fs/ext4/ext4_extents.h:200 [inline]
RIP: 0010:ext4_split_extent_at+0xd11/0xe10 fs/ext4/extents.c:3221
Code: e9 d2 f8 ff ff e8 1f 6d 5d ff 66 81 c5 00 80 e9 32 fd ff ff e8 10 6d 5d ff 44 8d bd 00 80 ff ff e9 d1 fc ff ff e8 ff 6c 5d ff <0f> 0b 48 8b 7c 24 18 e8 73 9d b0 ff e9 7f f3 ff ff 48 89 cf e8 46
RSP: 0018:ffffc900055ef268 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88807d9c0000 RSI: ffffffff82277271 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88807587d00c
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807587d012
FS: 00007f4820ae9700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffef85799a0 CR3: 0000000028105000 CR4: 0000000000350ee0
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2023-07-08 23:46 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-13 5:51 [syzbot] [ext4?] kernel BUG in ext4_split_extent_at (2) syzbot
2023-07-08 23:45 ` syzbot [this message]
2023-07-10 15:06 ` yebin (H)
2024-01-24 19:21 ` syzbot
2024-01-25 12:55 ` Theodore Ts'o
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000f1378f0600025915@google.com \
--to=syzbot+0f4d9f68fb6632330c6c@syzkaller.appspotmail.com \
--cc=adilger.kernel@dilger.ca \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.