From: sanan.hasanou@gmail.com
To: jaegeuk@kernel.org, chao@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com, contact@pgazz.com
Subject: [f2fs-dev] general protection fault in f2fs_in_warm_node_list
Date: Fri, 26 Jun 2026 14:28:08 -0700 (PDT) [thread overview]
Message-ID: <6a3eeee8.516c2524.21c3a2.ac0d@mx.google.com> (raw)
Good day, dear maintainers,
We found a bug using a modified version of syzkaller.
Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1SkS9U2y8MGrnaXhjJJI5n5SymSSMyYnS>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!
Best regards,
Sanan Hasanov
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 UID: 0 PID: 3043 Comm: kworker/u8:10 Not tainted 7.0.0-rc1 #1 PREEMPT_{RT,(full)}
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: bat_events batadv_tt_purge
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2260 [inline]
RIP: 0010:is_node_folio fs/f2fs/f2fs.h:2270 [inline]
RIP: 0010:f2fs_in_warm_node_list+0xc5/0x2a0 fs/f2fs/node.c:330
Code: 00 00 4d 03 3c 24 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 19 09 07 fe 4d 8b 3f 49 83 c7 30 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 fc 08 07 fe 4d 3b 37 74 14 e8 b2
RSP: 0018:ffffc9000e9af568 EFLAGS: 00010216
RAX: 0000000000000006 RBX: ffffea0000ed41c0 RCX: ffff88802cf2b980
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
RBP: ffffc9000e9af590 R08: ffff8880224bd66b R09: 1ffff11004497acd
R10: dffffc0000000000 R11: ffffed1004497ace R12: ffff888050544780
R13: dffffc0000000000 R14: ffff88803e405010 R15: 0000000000000030
FS: 0000000000000000(0000) GS:ffff8880dc0a8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a77139e428 CR3: 0000000033d4c000 CR4: 00000000000006f0
Call Trace:
<TASK>
f2fs_write_end_io+0x785/0x1390 fs/f2fs/data.c:400
bio_endio+0x936/0x980 block/bio.c:1792
blk_update_request+0x5a5/0xe40 block/blk-mq.c:1016
blk_mq_end_request+0x4a/0x80 block/blk-mq.c:1178
blk_flush_complete_seq+0x667/0xd10 block/blk-flush.c:191
flush_end_io+0xc67/0xf40 block/blk-flush.c:251
__blk_mq_end_request+0x5bf/0x710 block/blk-mq.c:1168
blk_mq_end_request+0x5e/0x80 block/blk-mq.c:1180
lo_complete_rq+0xe3/0x260 drivers/block/loop.c:314
blk_complete_reqs block/blk-mq.c:1253 [inline]
blk_done_softirq+0x10e/0x160 block/blk-mq.c:1258
handle_softirqs+0x1c7/0x690 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
__local_bh_enable_ip+0x16a/0x270 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
spin_unlock_bh include/linux/spinlock_rt.h:116 [inline]
batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline]
batadv_tt_purge+0x45c/0x9e0 net/batman-adv/translation-table.c:3510
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xa5a/0x15e0 kernel/workqueue.c:3358
worker_thread+0xab9/0xff0 kernel/workqueue.c:3439
kthread+0x355/0x410 kernel/kthread.c:467
ret_from_fork+0x49c/0xa10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2260 [inline]
RIP: 0010:is_node_folio fs/f2fs/f2fs.h:2270 [inline]
RIP: 0010:f2fs_in_warm_node_list+0xc5/0x2a0 fs/f2fs/node.c:330
Code: 00 00 4d 03 3c 24 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 19 09 07 fe 4d 8b 3f 49 83 c7 30 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 fc 08 07 fe 4d 3b 37 74 14 e8 b2
RSP: 0018:ffffc9000e9af568 EFLAGS: 00010216
RAX: 0000000000000006 RBX: ffffea0000ed41c0 RCX: ffff88802cf2b980
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
RBP: ffffc9000e9af590 R08: ffff8880224bd66b R09: 1ffff11004497acd
R10: dffffc0000000000 R11: ffffed1004497ace R12: ffff888050544780
R13: dffffc0000000000 R14: ffff88803e405010 R15: 0000000000000030
FS: 0000000000000000(0000) GS:ffff8880dc0a8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a77139e428 CR3: 0000000033d4c000 CR4: 00000000000006f0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 4d 03 3c 24 add (%r12),%r15
6: 4c 89 f8 mov %r15,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
12: 74 08 je 0x1c
14: 4c 89 ff mov %r15,%rdi
17: e8 19 09 07 fe call 0xfe070935
1c: 4d 8b 3f mov (%r15),%r15
1f: 49 83 c7 30 add $0x30,%r15
23: 4c 89 f8 mov %r15,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 ff mov %r15,%rdi
34: e8 fc 08 07 fe call 0xfe070935
39: 4d 3b 37 cmp (%r15),%r14
3c: 74 14 je 0x52
3e: e8 .byte 0xe8
3f: b2 .byte 0xb2
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: sanan.hasanou@gmail.com
To: jaegeuk@kernel.org, chao@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com, contact@pgazz.com
Subject: general protection fault in f2fs_in_warm_node_list
Date: Fri, 26 Jun 2026 14:28:08 -0700 (PDT) [thread overview]
Message-ID: <6a3eeee8.516c2524.21c3a2.ac0d@mx.google.com> (raw)
Good day, dear maintainers,
We found a bug using a modified version of syzkaller.
Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1SkS9U2y8MGrnaXhjJJI5n5SymSSMyYnS>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!
Best regards,
Sanan Hasanov
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 UID: 0 PID: 3043 Comm: kworker/u8:10 Not tainted 7.0.0-rc1 #1 PREEMPT_{RT,(full)}
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: bat_events batadv_tt_purge
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2260 [inline]
RIP: 0010:is_node_folio fs/f2fs/f2fs.h:2270 [inline]
RIP: 0010:f2fs_in_warm_node_list+0xc5/0x2a0 fs/f2fs/node.c:330
Code: 00 00 4d 03 3c 24 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 19 09 07 fe 4d 8b 3f 49 83 c7 30 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 fc 08 07 fe 4d 3b 37 74 14 e8 b2
RSP: 0018:ffffc9000e9af568 EFLAGS: 00010216
RAX: 0000000000000006 RBX: ffffea0000ed41c0 RCX: ffff88802cf2b980
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
RBP: ffffc9000e9af590 R08: ffff8880224bd66b R09: 1ffff11004497acd
R10: dffffc0000000000 R11: ffffed1004497ace R12: ffff888050544780
R13: dffffc0000000000 R14: ffff88803e405010 R15: 0000000000000030
FS: 0000000000000000(0000) GS:ffff8880dc0a8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a77139e428 CR3: 0000000033d4c000 CR4: 00000000000006f0
Call Trace:
<TASK>
f2fs_write_end_io+0x785/0x1390 fs/f2fs/data.c:400
bio_endio+0x936/0x980 block/bio.c:1792
blk_update_request+0x5a5/0xe40 block/blk-mq.c:1016
blk_mq_end_request+0x4a/0x80 block/blk-mq.c:1178
blk_flush_complete_seq+0x667/0xd10 block/blk-flush.c:191
flush_end_io+0xc67/0xf40 block/blk-flush.c:251
__blk_mq_end_request+0x5bf/0x710 block/blk-mq.c:1168
blk_mq_end_request+0x5e/0x80 block/blk-mq.c:1180
lo_complete_rq+0xe3/0x260 drivers/block/loop.c:314
blk_complete_reqs block/blk-mq.c:1253 [inline]
blk_done_softirq+0x10e/0x160 block/blk-mq.c:1258
handle_softirqs+0x1c7/0x690 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
__local_bh_enable_ip+0x16a/0x270 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
spin_unlock_bh include/linux/spinlock_rt.h:116 [inline]
batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline]
batadv_tt_purge+0x45c/0x9e0 net/batman-adv/translation-table.c:3510
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xa5a/0x15e0 kernel/workqueue.c:3358
worker_thread+0xab9/0xff0 kernel/workqueue.c:3439
kthread+0x355/0x410 kernel/kthread.c:467
ret_from_fork+0x49c/0xa10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2260 [inline]
RIP: 0010:is_node_folio fs/f2fs/f2fs.h:2270 [inline]
RIP: 0010:f2fs_in_warm_node_list+0xc5/0x2a0 fs/f2fs/node.c:330
Code: 00 00 4d 03 3c 24 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 19 09 07 fe 4d 8b 3f 49 83 c7 30 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 fc 08 07 fe 4d 3b 37 74 14 e8 b2
RSP: 0018:ffffc9000e9af568 EFLAGS: 00010216
RAX: 0000000000000006 RBX: ffffea0000ed41c0 RCX: ffff88802cf2b980
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
RBP: ffffc9000e9af590 R08: ffff8880224bd66b R09: 1ffff11004497acd
R10: dffffc0000000000 R11: ffffed1004497ace R12: ffff888050544780
R13: dffffc0000000000 R14: ffff88803e405010 R15: 0000000000000030
FS: 0000000000000000(0000) GS:ffff8880dc0a8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a77139e428 CR3: 0000000033d4c000 CR4: 00000000000006f0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 4d 03 3c 24 add (%r12),%r15
6: 4c 89 f8 mov %r15,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
12: 74 08 je 0x1c
14: 4c 89 ff mov %r15,%rdi
17: e8 19 09 07 fe call 0xfe070935
1c: 4d 8b 3f mov (%r15),%r15
1f: 49 83 c7 30 add $0x30,%r15
23: 4c 89 f8 mov %r15,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 ff mov %r15,%rdi
34: e8 fc 08 07 fe call 0xfe070935
39: 4d 3b 37 cmp (%r15),%r14
3c: 74 14 je 0x52
3e: e8 .byte 0xe8
3f: b2 .byte 0xb2
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
next reply other threads:[~2026-06-26 21:28 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-26 21:28 sanan.hasanou [this message]
2026-06-26 21:28 ` general protection fault in f2fs_in_warm_node_list sanan.hasanou
2026-06-29 11:45 ` [f2fs-dev] " Chao Yu via Linux-f2fs-devel
2026-06-29 11:45 ` Chao Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a3eeee8.516c2524.21c3a2.ac0d@mx.google.com \
--to=sanan.hasanou@gmail.com \
--cc=chao@kernel.org \
--cc=contact@pgazz.com \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.