[syzbot] [nilfs?] BUG: corrupted list in nilfs_lookup_dirty_data_buffers

[syzbot] [nilfs?] BUG: corrupted list in nilfs_lookup_dirty_data_buffers

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    f31c00c377cc Merge tag 'platform-drivers-x86-v7.2-1' of gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10f687f2580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=31a51e0acb798311
dashboard link: https://syzkaller.appspot.com/bug?extid=c37bed40868932d790e9
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10376ba1580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15c42341580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f31c00c3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/65376d2aeca1/vmlinux-f31c00c3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dba2c41e8c30/bzImage-f31c00c3.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/12e3220d6326/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c37bed40868932d790e9@syzkaller.appspotmail.com

list_add double add: new=ffff888043d25c80, prev=ffff888043d25c80, next=ffffc900034ff1c0.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:37!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5513 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35
Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 c7 c7 60 9f 2a 8c 4c 89 fe 4c 89 f2 48 89 d9 e8 7c 57 63 fc 90 <0f> 0b 48 c7 c7 40 9d 2a 8c e8 6d 57 63 fc 90 0f 0b 48 c7 c7 00 9e
RSP: 0018:ffffc900034fed48 EFLAGS: 00010246
RAX: 0000000000000058 RBX: ffffc900034ff1c0 RCX: 74a71100abd37800
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff9200069fe39 R08: ffff88801fc24713 R09: 1ffff11003f848e2
R10: dffffc0000000000 R11: ffffed1003f848e3 R12: 1ffff110087a4b90
R13: dffffc0000000000 R14: ffff888043d25c80 R15: ffff888043d25c80
FS:  00005555919bc500(0000) GS:ffff88808c821000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4434df8eb8 CR3: 000000001ab95000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __list_add_valid include/linux/list.h:96 [inline]
 __list_add include/linux/list.h:158 [inline]
 list_add_tail include/linux/list.h:191 [inline]
 nilfs_lookup_dirty_data_buffers+0x468/0x7b0 fs/nilfs2/segment.c:745
 nilfs_segctor_scan_file+0x26a/0xf70 fs/nilfs2/segment.c:1046
 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1198 [inline]
 nilfs_segctor_collect fs/nilfs2/segment.c:1547 [inline]
 nilfs_segctor_do_construct+0x1c8d/0x7bb0 fs/nilfs2/segment.c:2122
 nilfs_segctor_construct+0x170/0x690 fs/nilfs2/segment.c:2462
 nilfs_clean_segments+0x4ec/0xbb0 fs/nilfs2/segment.c:2557
 nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:922 [inline]
 nilfs_ioctl+0x2619/0x2780 fs/nilfs2/ioctl.c:1352
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f620d99ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffb7f16fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f620dc15fa0 RCX: 00007f620d99ce59
RDX: 0000200000000040 RSI: 0000000040786e88 RDI: 0000000000000004
RBP: 00007f620da32e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f620dc15fac R14: 00007f620dc15fa0 R15: 00007f620dc15fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35
Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 c7 c7 60 9f 2a 8c 4c 89 fe 4c 89 f2 48 89 d9 e8 7c 57 63 fc 90 <0f> 0b 48 c7 c7 40 9d 2a 8c e8 6d 57 63 fc 90 0f 0b 48 c7 c7 00 9e
RSP: 0018:ffffc900034fed48 EFLAGS: 00010246
RAX: 0000000000000058 RBX: ffffc900034ff1c0 RCX: 74a71100abd37800
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff9200069fe39 R08: ffff88801fc24713 R09: 1ffff11003f848e2
R10: dffffc0000000000 R11: ffffed1003f848e3 R12: 1ffff110087a4b90
R13: dffffc0000000000 R14: ffff888043d25c80 R15: ffff888043d25c80
FS:  00005555919bc500(0000) GS:ffff88808c821000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe0c8f2f440 CR3: 000000001ab95000 CR4: 0000000000352ef0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: BUG: corrupted list in nilfs_lookup_dirty_data_buffers

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: BUG: corrupted list in nilfs_lookup_dirty_data_buffers
Author: nico.antinori.7@gmail.com

#syz test

--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -741,6 +741,10 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
 		do {
 			if (!buffer_dirty(bh) || buffer_async_write(bh))
 				continue;
+
+			if (list_empty(&bh->b_assoc_buffers))
+				continue;
+
 			get_bh(bh);
 			list_add_tail(&bh->b_assoc_buffers, listp);
 			ndirties++;

Re: [syzbot] [nilfs?] BUG: corrupted list in nilfs_lookup_dirty_data_buffers

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine



Tested on:

commit:         ab9de95c Merge tag 'rust-7.2-2' of git://git.kernel.or..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1258540a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=3c3d59be33cf7e9a
dashboard link: https://syzkaller.appspot.com/bug?extid=c37bed40868932d790e9
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=145ba7a1580000

[PATCH] nilfs2: prevent double insertion of b_assoc_buffers in dirty buffer lookup

[wuyankun]

#syz test

syzbot reported list corruption caused by double list_add_tail() on
bh->b_assoc_buffers in nilfs_lookup_dirty_data_buffers().

A buffer_head can still be dirty and not under async write while already
linked on another association list. Add list state checks before enqueueing
in both data and node dirty buffer scanners to avoid re-adding already
linked nodes.

diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 1491a4d4b1e1..09202d155903 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -741,6 +741,8 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
 		do {
 			if (!buffer_dirty(bh) || buffer_async_write(bh))
 				continue;
+			if (!list_empty(&bh->b_assoc_buffers))
+				continue;
 			get_bh(bh);
 			list_add_tail(&bh->b_assoc_buffers, listp);
 			ndirties++;
@@ -779,7 +781,8 @@ static void nilfs_lookup_dirty_node_buffers(struct inode *inode,
 			bh = head = folio_buffers(fbatch.folios[i]);
 			do {
 				if (buffer_dirty(bh) &&
-						!buffer_async_write(bh)) {
+						!buffer_async_write(bh) &&
+						list_empty(&bh->b_assoc_buffers)) {
 					get_bh(bh);
 					list_add_tail(&bh->b_assoc_buffers,
 						      listp);
-- 
2.20.1

Re: [syzbot] [nilfs?] BUG: corrupted list in nilfs_lookup_dirty_data_buffers

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c37bed40868932d790e9@syzkaller.appspotmail.com
Tested-by: syzbot+c37bed40868932d790e9@syzkaller.appspotmail.com

Tested on:

commit:         ab9de95c Merge tag 'rust-7.2-2' of git://git.kernel.or..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=134eecde580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=3c3d59be33cf7e9a
dashboard link: https://syzkaller.appspot.com/bug?extid=c37bed40868932d790e9
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17c5db7a580000

Note: testing is done by a robot and is best-effort only.