From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bob Peterson Date: Thu, 27 Apr 2023 15:04:19 -0400 Subject: [Cluster-devel] We found a general protection fault in evict In-Reply-To: References: Message-ID: <224ae998-d264-c984-263d-a9a7cf6c7a00@redhat.com> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit On 4/27/23 11:15 AM, yang lan wrote: > Hi, > > We use our modified Syzkaller to fuzz the latest Linux kernel and find a > bug in the gfs2 file system. > > We have used the utility syz-execprog to reproduce this bug with > ./syz-execprog -executor=./syz-executor -repeat=100 -procs=6 -cover=1 poc. > Now, this bug can be triggered with the following prog provided: > > HEAD commit: f1b32fda06d2 tag: v5.10.179 > console log: https://pastebin.com/raw/3XhteWrX > > kernel config: https://pastebin.com/raw/BiggLxRg > > Syz reproducer: https://pastebin.com/raw/PwbMR8ag > > C reproducer: > https://drive.google.com/file/d/1j4g8EUrFb1GGdaaRBNHE4ATXiqeg6-zI/view?usp=sharing > > gfs2: fsid=syz:syz.0: no resource groups found in the file system. Hi, The upstream kernel doesn't seem to GPF here. I get a non-fatal file system withdraw (which seems reasonable given what the resulting fs looks like): [root at bob-upstream9 /home/bob/xfstests-dev]# /home/bob/tools/c/poc_evict [root at bob-upstream9 /home/bob/xfstests-dev]# echo $? 0 [ 2530.707005] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 2530.707576] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 2530.708349] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 2530.708349] inode = 3 2076 [ 2530.708349] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 472 [ 2530.709534] gfs2: fsid=syz:syz.0: G: s:SH n:2/81c f:qobnN t:SH d:EX/0 a:0 v:0 r:3 m:200 p:1 [ 2530.710165] gfs2: fsid=syz:syz.0: H: s:SH f:H e:0 p:1825 [mount] gfs2_fill_super+0x8f0/0xef0 [gfs2] [ 2530.710846] gfs2: fsid=syz:syz.0: I: n:3/2076 t:4 f:0x00 d:0x00000000 s:0 p:0 [ 2530.711387] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 2530.711857] gfs2: fsid=syz:syz.0: File system withdrawn [ 2530.712256] CPU: 6 PID: 1825 Comm: mount Kdump: loaded Not tainted 6.3.0-rc3+ #26 [ 2530.712803] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.1-1.el9 04/01/2014 [ 2530.713324] Call Trace: [ 2530.713513] [ 2530.713678] dump_stack_lvl+0x48/0x60 [ 2530.713959] gfs2_withdraw+0x479/0x5c0 [gfs2] [ 2530.714299] gfs2_inode_refresh+0x267/0x2d0 [gfs2] [ 2530.714667] gfs2_instantiate+0x87/0xc0 [gfs2] [ 2530.715013] gfs2_glock_wait+0x8b/0xb0 [gfs2] [ 2530.715356] init_journal+0x302/0xaf0 [gfs2] [ 2530.715693] ? vsnprintf+0x2ba/0x560 [ 2530.715966] ? gfs2_fill_super+0x8f0/0xef0 [gfs2] [ 2530.716326] ? snprintf+0x3d/0x50 [ 2530.716576] gfs2_fill_super+0x8f0/0xef0 [gfs2] [ 2530.716927] ? gfs2_fill_super+0x7aa/0xef0 [gfs2] [ 2530.717287] ? mutex_lock+0x12/0x40 [ 2530.717552] ? __pfx_gfs2_fill_super+0x10/0x10 [gfs2] [ 2530.717938] ? snprintf+0x3d/0x50 [ 2530.718190] ? sget_fc+0x208/0x300 [ 2530.718453] ? __pfx_gfs2_fill_super+0x10/0x10 [gfs2] [ 2530.718837] get_tree_bdev+0x171/0x270 [ 2530.719126] gfs2_get_tree+0x22/0x90 [gfs2] [ 2530.719446] vfs_get_tree+0x26/0xd0 [ 2530.719711] path_mount+0x464/0xa80 [ 2530.719981] __x64_sys_mount+0xeb/0x120 [ 2530.720271] do_syscall_64+0x5d/0x90 [ 2530.720544] ? syscall_exit_to_user_mode+0x1b/0x40 [ 2530.720902] ? do_syscall_64+0x6d/0x90 [ 2530.721185] ? do_syscall_64+0x6d/0x90 [ 2530.721467] ? syscall_exit_to_user_mode+0x1b/0x40 [ 2530.721823] ? do_syscall_64+0x6d/0x90 [ 2530.722106] ? do_syscall_64+0x6d/0x90 [ 2530.722386] ? do_syscall_64+0x6d/0x90 [ 2530.722668] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2530.723046] RIP: 0033:0x7f7dcd83f7be [ 2530.723316] Code: 48 8b 0d 65 a6 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 32 a6 1b 00 f7 d8 64 89 01 48 [ 2530.724659] RSP: 002b:00007fffe0f3d248 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 2530.725211] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7dcd83f7be [ 2530.725733] RDX: 000055b230c02e20 RSI: 000055b230c02e60 RDI: 000055b230c02e40 [ 2530.726256] RBP: 000055b230c02bf0 R08: 0000000000000000 R09: 00007fffe0f3bf70 [ 2530.726776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2530.727298] R13: 000055b230c02e20 R14: 000055b230c02e40 R15: 000055b230c02bf0 [ 2530.727819] [ 2530.728005] gfs2: fsid=syz:syz.0: can't read journal index: -5 I'm guessing it's a problem we've already fixed in newer versions, but I don't have easy access to that kernel. Perhaps you can bisect it? I could try older kernels but I've already spent a lot of time on this today, so I need to move on to other things. Regards, Bob Peterson