From: "yebin (H)" <yebin10@huawei.com>
To: syzbot <syzbot+0f4d9f68fb6632330c6c@syzkaller.appspotmail.com>,
<adilger.kernel@dilger.ca>, <linux-ext4@vger.kernel.org>,
<linux-fsdevel@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<syzkaller-bugs@googlegroups.com>, <tytso@mit.edu>
Subject: Re: [syzbot] [ext4?] kernel BUG in ext4_split_extent_at (2)
Date: Mon, 10 Jul 2023 23:06:28 +0800 [thread overview]
Message-ID: <64AC1E74.30606@huawei.com> (raw)
In-Reply-To: <000000000000f1378f0600025915@google.com>
On 2023/7/9 7:45, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 8689f4f2ea56 Merge tag 'mmc-v6.5-2' of git://git.kernel.or..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=12b9cb02a80000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7ad417033279f15a
> dashboard link: https://syzkaller.appspot.com/bug?extid=0f4d9f68fb6632330c6c
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13977778a80000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1004666aa80000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/21b63023cf5a/disk-8689f4f2.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/e04836fe057e/vmlinux-8689f4f2.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/ee05dfd52843/bzImage-8689f4f2.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/e2ab005f1edb/mount_0.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+0f4d9f68fb6632330c6c@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> kernel BUG at fs/ext4/ext4_extents.h:200!
> invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> CPU: 1 PID: 5885 Comm: syz-executor219 Not tainted 6.4.0-syzkaller-12365-g8689f4f2ea56 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
> RIP: 0010:ext4_ext_mark_unwritten fs/ext4/ext4_extents.h:200 [inline]
> RIP: 0010:ext4_split_extent_at+0xd11/0xe10 fs/ext4/extents.c:3221
> Code: e9 d2 f8 ff ff e8 1f 6d 5d ff 66 81 c5 00 80 e9 32 fd ff ff e8 10 6d 5d ff 44 8d bd 00 80 ff ff e9 d1 fc ff ff e8 ff 6c 5d ff <0f> 0b 48 8b 7c 24 18 e8 73 9d b0 ff e9 7f f3 ff ff 48 89 cf e8 46
> RSP: 0018:ffffc900055ef268 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: ffff88807d9c0000 RSI: ffffffff82277271 RDI: 0000000000000007
> RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000001 R12: ffff88807587d00c
> R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807587d012
> FS: 00007f4820ae9700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f4820ae8fe8 CR3: 0000000028105000 CR4: 0000000000350ee0
> Call Trace:
> <TASK>
> ext4_split_extent+0x3fc/0x530 fs/ext4/extents.c:3384
> ext4_ext_handle_unwritten_extents fs/ext4/extents.c:3874 [inline]
> ext4_ext_map_blocks+0x2e22/0x5bc0 fs/ext4/extents.c:4166
> ext4_map_blocks+0x760/0x1890 fs/ext4/inode.c:621
> ext4_iomap_alloc fs/ext4/inode.c:3276 [inline]
> ext4_iomap_begin+0x43d/0x7a0 fs/ext4/inode.c:3326
> iomap_iter+0x446/0x10e0 fs/iomap/iter.c:91
> __iomap_dio_rw+0x6e3/0x1d80 fs/iomap/direct-io.c:574
> iomap_dio_rw+0x40/0xa0 fs/iomap/direct-io.c:665
> ext4_dio_write_iter fs/ext4/file.c:609 [inline]
> ext4_file_write_iter+0x1102/0x1880 fs/ext4/file.c:720
> call_write_iter include/linux/fs.h:1871 [inline]
> new_sync_write fs/read_write.c:491 [inline]
> vfs_write+0x981/0xda0 fs/read_write.c:584
> ksys_write+0x122/0x250 fs/read_write.c:637
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f4828f26cd9
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f4820ae9208 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 0000000000000034 RCX: 00007f4828f26cd9
> RDX: 0000000000000012 RSI: 0000000020000000 RDI: 0000000000000004
> RBP: 00007f4828fa4790 R08: 00007f4828fa4798 R09: 00007f4828fa4798
> R10: 00007f4828fa4798 R11: 0000000000000246 R12: 00007f4828fa479c
> R13: 00007ffef851f96f R14: 00007f4820ae9300 R15: 0000000000022000
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:ext4_ext_mark_unwritten fs/ext4/ext4_extents.h:200 [inline]
> RIP: 0010:ext4_split_extent_at+0xd11/0xe10 fs/ext4/extents.c:3221
> Code: e9 d2 f8 ff ff e8 1f 6d 5d ff 66 81 c5 00 80 e9 32 fd ff ff e8 10 6d 5d ff 44 8d bd 00 80 ff ff e9 d1 fc ff ff e8 ff 6c 5d ff <0f> 0b 48 8b 7c 24 18 e8 73 9d b0 ff e9 7f f3 ff ff 48 89 cf e8 46
> RSP: 0018:ffffc900055ef268 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: ffff88807d9c0000 RSI: ffffffff82277271 RDI: 0000000000000007
> RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000001 R12: ffff88807587d00c
> R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807587d012
> FS: 00007f4820ae9700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffef85799a0 CR3: 0000000028105000 CR4: 0000000000350ee0
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> .
This should be caused by the write block device.
Here's the log I captured writing the block device：
[T15721] blkdev_write_iter:---------bdev=0xffff888117fc5080 loop2-----
[T15722] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5718:
Corrupt filesystem
[T15722] EXT4-fs (loop2): Remounting filesystem read-only
[T15722] EXT4-fs error (device loop2): ext4_ext_grow_indepth:1468: inode
#16: comm rep: mark_inode_dirty error
[T15722] general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
[T15722] KASAN: null-ptr-deref in range
[0x0000000000000000-0x0000000000000007]
next prev parent reply other threads:[~2023-07-10 15:06 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-13 5:51 [syzbot] [ext4?] kernel BUG in ext4_split_extent_at (2) syzbot
2023-07-08 23:45 ` syzbot
2023-07-10 15:06 ` yebin (H) [this message]
2024-01-24 19:21 ` syzbot
2024-01-25 12:55 ` Theodore Ts'o
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=64AC1E74.30606@huawei.com \
--to=yebin10@huawei.com \
--cc=adilger.kernel@dilger.ca \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzbot+0f4d9f68fb6632330c6c@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.