From: Chao Yu via Linux-f2fs-devel <linux-f2fs-devel@lists.sourceforge.net>
To: sanan.hasanou@gmail.com, jaegeuk@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org
Cc: contact@pgazz.com, syzkaller@googlegroups.com
Subject: Re: [f2fs-dev] general protection fault in f2fs_in_warm_node_list
Date: Mon, 29 Jun 2026 19:45:45 +0800 [thread overview]
Message-ID: <88af8af1-3eec-4e00-a829-24671f24c0ea@kernel.org> (raw)
In-Reply-To: <6a3eeee8.516c2524.21c3a2.ac0d@mx.google.com>
On 6/27/26 05:28, sanan.hasanou@gmail.com wrote:
> Good day, dear maintainers,
>
> We found a bug using a modified version of syzkaller.
>
> Kernel Branch: 7.0-rc1
> Kernel Config: <https://drive.google.com/open?id=1SkS9U2y8MGrnaXhjJJI5n5SymSSMyYnS>
> Unfortunately, we don't have any reproducer for this bug yet.
Thanks for the report, I guess it should has been fix w/
2d9c4a4ed4ee ("f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()")
Thanks,
> Thank you!
>
> Best regards,
> Sanan Hasanov
>
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 0 UID: 0 PID: 3043 Comm: kworker/u8:10 Not tainted 7.0.0-rc1 #1 PREEMPT_{RT,(full)}
> Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> Workqueue: bat_events batadv_tt_purge
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2260 [inline]
> RIP: 0010:is_node_folio fs/f2fs/f2fs.h:2270 [inline]
> RIP: 0010:f2fs_in_warm_node_list+0xc5/0x2a0 fs/f2fs/node.c:330
> Code: 00 00 4d 03 3c 24 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 19 09 07 fe 4d 8b 3f 49 83 c7 30 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 fc 08 07 fe 4d 3b 37 74 14 e8 b2
> RSP: 0018:ffffc9000e9af568 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: ffffea0000ed41c0 RCX: ffff88802cf2b980
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
> RBP: ffffc9000e9af590 R08: ffff8880224bd66b R09: 1ffff11004497acd
> R10: dffffc0000000000 R11: ffffed1004497ace R12: ffff888050544780
> R13: dffffc0000000000 R14: ffff88803e405010 R15: 0000000000000030
> FS: 0000000000000000(0000) GS:ffff8880dc0a8000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055a77139e428 CR3: 0000000033d4c000 CR4: 00000000000006f0
> Call Trace:
> <TASK>
> f2fs_write_end_io+0x785/0x1390 fs/f2fs/data.c:400
> bio_endio+0x936/0x980 block/bio.c:1792
> blk_update_request+0x5a5/0xe40 block/blk-mq.c:1016
> blk_mq_end_request+0x4a/0x80 block/blk-mq.c:1178
> blk_flush_complete_seq+0x667/0xd10 block/blk-flush.c:191
> flush_end_io+0xc67/0xf40 block/blk-flush.c:251
> __blk_mq_end_request+0x5bf/0x710 block/blk-mq.c:1168
> blk_mq_end_request+0x5e/0x80 block/blk-mq.c:1180
> lo_complete_rq+0xe3/0x260 drivers/block/loop.c:314
> blk_complete_reqs block/blk-mq.c:1253 [inline]
> blk_done_softirq+0x10e/0x160 block/blk-mq.c:1258
> handle_softirqs+0x1c7/0x690 kernel/softirq.c:622
> __do_softirq kernel/softirq.c:656 [inline]
> __local_bh_enable_ip+0x16a/0x270 kernel/softirq.c:302
> local_bh_enable include/linux/bottom_half.h:33 [inline]
> spin_unlock_bh include/linux/spinlock_rt.h:116 [inline]
> batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline]
> batadv_tt_purge+0x45c/0x9e0 net/batman-adv/translation-table.c:3510
> process_one_work kernel/workqueue.c:3275 [inline]
> process_scheduled_works+0xa5a/0x15e0 kernel/workqueue.c:3358
> worker_thread+0xab9/0xff0 kernel/workqueue.c:3439
> kthread+0x355/0x410 kernel/kthread.c:467
> ret_from_fork+0x49c/0xa10 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2260 [inline]
> RIP: 0010:is_node_folio fs/f2fs/f2fs.h:2270 [inline]
> RIP: 0010:f2fs_in_warm_node_list+0xc5/0x2a0 fs/f2fs/node.c:330
> Code: 00 00 4d 03 3c 24 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 19 09 07 fe 4d 8b 3f 49 83 c7 30 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 fc 08 07 fe 4d 3b 37 74 14 e8 b2
> RSP: 0018:ffffc9000e9af568 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: ffffea0000ed41c0 RCX: ffff88802cf2b980
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
> RBP: ffffc9000e9af590 R08: ffff8880224bd66b R09: 1ffff11004497acd
> R10: dffffc0000000000 R11: ffffed1004497ace R12: ffff888050544780
> R13: dffffc0000000000 R14: ffff88803e405010 R15: 0000000000000030
> FS: 0000000000000000(0000) GS:ffff8880dc0a8000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055a77139e428 CR3: 0000000033d4c000 CR4: 00000000000006f0
> ----------------
> Code disassembly (best guess):
> 0: 00 00 add %al,(%rax)
> 2: 4d 03 3c 24 add (%r12),%r15
> 6: 4c 89 f8 mov %r15,%rax
> 9: 48 c1 e8 03 shr $0x3,%rax
> d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
> 12: 74 08 je 0x1c
> 14: 4c 89 ff mov %r15,%rdi
> 17: e8 19 09 07 fe call 0xfe070935
> 1c: 4d 8b 3f mov (%r15),%r15
> 1f: 49 83 c7 30 add $0x30,%r15
> 23: 4c 89 f8 mov %r15,%rax
> 26: 48 c1 e8 03 shr $0x3,%rax
> * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
> 2f: 74 08 je 0x39
> 31: 4c 89 ff mov %r15,%rdi
> 34: e8 fc 08 07 fe call 0xfe070935
> 39: 4d 3b 37 cmp (%r15),%r14
> 3c: 74 14 je 0x52
> 3e: e8 .byte 0xe8
> 3f: b2 .byte 0xb2
>
> <<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: Chao Yu <chao@kernel.org>
To: sanan.hasanou@gmail.com, jaegeuk@kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org
Cc: chao@kernel.org, syzkaller@googlegroups.com, contact@pgazz.com
Subject: Re: general protection fault in f2fs_in_warm_node_list
Date: Mon, 29 Jun 2026 19:45:45 +0800 [thread overview]
Message-ID: <88af8af1-3eec-4e00-a829-24671f24c0ea@kernel.org> (raw)
In-Reply-To: <6a3eeee8.516c2524.21c3a2.ac0d@mx.google.com>
On 6/27/26 05:28, sanan.hasanou@gmail.com wrote:
> Good day, dear maintainers,
>
> We found a bug using a modified version of syzkaller.
>
> Kernel Branch: 7.0-rc1
> Kernel Config: <https://drive.google.com/open?id=1SkS9U2y8MGrnaXhjJJI5n5SymSSMyYnS>
> Unfortunately, we don't have any reproducer for this bug yet.
Thanks for the report, I guess it should has been fix w/
2d9c4a4ed4ee ("f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()")
Thanks,
> Thank you!
>
> Best regards,
> Sanan Hasanov
>
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 0 UID: 0 PID: 3043 Comm: kworker/u8:10 Not tainted 7.0.0-rc1 #1 PREEMPT_{RT,(full)}
> Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> Workqueue: bat_events batadv_tt_purge
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2260 [inline]
> RIP: 0010:is_node_folio fs/f2fs/f2fs.h:2270 [inline]
> RIP: 0010:f2fs_in_warm_node_list+0xc5/0x2a0 fs/f2fs/node.c:330
> Code: 00 00 4d 03 3c 24 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 19 09 07 fe 4d 8b 3f 49 83 c7 30 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 fc 08 07 fe 4d 3b 37 74 14 e8 b2
> RSP: 0018:ffffc9000e9af568 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: ffffea0000ed41c0 RCX: ffff88802cf2b980
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
> RBP: ffffc9000e9af590 R08: ffff8880224bd66b R09: 1ffff11004497acd
> R10: dffffc0000000000 R11: ffffed1004497ace R12: ffff888050544780
> R13: dffffc0000000000 R14: ffff88803e405010 R15: 0000000000000030
> FS: 0000000000000000(0000) GS:ffff8880dc0a8000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055a77139e428 CR3: 0000000033d4c000 CR4: 00000000000006f0
> Call Trace:
> <TASK>
> f2fs_write_end_io+0x785/0x1390 fs/f2fs/data.c:400
> bio_endio+0x936/0x980 block/bio.c:1792
> blk_update_request+0x5a5/0xe40 block/blk-mq.c:1016
> blk_mq_end_request+0x4a/0x80 block/blk-mq.c:1178
> blk_flush_complete_seq+0x667/0xd10 block/blk-flush.c:191
> flush_end_io+0xc67/0xf40 block/blk-flush.c:251
> __blk_mq_end_request+0x5bf/0x710 block/blk-mq.c:1168
> blk_mq_end_request+0x5e/0x80 block/blk-mq.c:1180
> lo_complete_rq+0xe3/0x260 drivers/block/loop.c:314
> blk_complete_reqs block/blk-mq.c:1253 [inline]
> blk_done_softirq+0x10e/0x160 block/blk-mq.c:1258
> handle_softirqs+0x1c7/0x690 kernel/softirq.c:622
> __do_softirq kernel/softirq.c:656 [inline]
> __local_bh_enable_ip+0x16a/0x270 kernel/softirq.c:302
> local_bh_enable include/linux/bottom_half.h:33 [inline]
> spin_unlock_bh include/linux/spinlock_rt.h:116 [inline]
> batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline]
> batadv_tt_purge+0x45c/0x9e0 net/batman-adv/translation-table.c:3510
> process_one_work kernel/workqueue.c:3275 [inline]
> process_scheduled_works+0xa5a/0x15e0 kernel/workqueue.c:3358
> worker_thread+0xab9/0xff0 kernel/workqueue.c:3439
> kthread+0x355/0x410 kernel/kthread.c:467
> ret_from_fork+0x49c/0xa10 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2260 [inline]
> RIP: 0010:is_node_folio fs/f2fs/f2fs.h:2270 [inline]
> RIP: 0010:f2fs_in_warm_node_list+0xc5/0x2a0 fs/f2fs/node.c:330
> Code: 00 00 4d 03 3c 24 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 19 09 07 fe 4d 8b 3f 49 83 c7 30 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 fc 08 07 fe 4d 3b 37 74 14 e8 b2
> RSP: 0018:ffffc9000e9af568 EFLAGS: 00010216
> RAX: 0000000000000006 RBX: ffffea0000ed41c0 RCX: ffff88802cf2b980
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
> RBP: ffffc9000e9af590 R08: ffff8880224bd66b R09: 1ffff11004497acd
> R10: dffffc0000000000 R11: ffffed1004497ace R12: ffff888050544780
> R13: dffffc0000000000 R14: ffff88803e405010 R15: 0000000000000030
> FS: 0000000000000000(0000) GS:ffff8880dc0a8000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055a77139e428 CR3: 0000000033d4c000 CR4: 00000000000006f0
> ----------------
> Code disassembly (best guess):
> 0: 00 00 add %al,(%rax)
> 2: 4d 03 3c 24 add (%r12),%r15
> 6: 4c 89 f8 mov %r15,%rax
> 9: 48 c1 e8 03 shr $0x3,%rax
> d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
> 12: 74 08 je 0x1c
> 14: 4c 89 ff mov %r15,%rdi
> 17: e8 19 09 07 fe call 0xfe070935
> 1c: 4d 8b 3f mov (%r15),%r15
> 1f: 49 83 c7 30 add $0x30,%r15
> 23: 4c 89 f8 mov %r15,%rax
> 26: 48 c1 e8 03 shr $0x3,%rax
> * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
> 2f: 74 08 je 0x39
> 31: 4c 89 ff mov %r15,%rdi
> 34: e8 fc 08 07 fe call 0xfe070935
> 39: 4d 3b 37 cmp (%r15),%r14
> 3c: 74 14 je 0x52
> 3e: e8 .byte 0xe8
> 3f: b2 .byte 0xb2
>
> <<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
next prev parent reply other threads:[~2026-06-29 11:46 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-26 21:28 [f2fs-dev] general protection fault in f2fs_in_warm_node_list sanan.hasanou
2026-06-26 21:28 ` sanan.hasanou
2026-06-29 11:45 ` Chao Yu via Linux-f2fs-devel [this message]
2026-06-29 11:45 ` Chao Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=88af8af1-3eec-4e00-a829-24671f24c0ea@kernel.org \
--to=linux-f2fs-devel@lists.sourceforge.net \
--cc=chao@kernel.org \
--cc=contact@pgazz.com \
--cc=jaegeuk@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sanan.hasanou@gmail.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.