* [syzbot] [bcachefs?] [jfs?] kernel BUG in vfs_get_tree
@ 2024-08-21 21:35 syzbot
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
2024-09-25 7:24 ` [syzbot] [bcachefs?] kernel BUG in vfs_get_tree syzbot
0 siblings, 2 replies; 5+ messages in thread
From: syzbot @ 2024-08-21 21:35 UTC (permalink / raw)
To: brauner, jack, jfs-discussion, kent.overstreet, linux-bcachefs,
linux-fsdevel, linux-kernel, shaggy, syzkaller-bugs, viro
Hello,
syzbot found the following issue on:
HEAD commit: b311c1b497e5 Merge tag '6.11-rc4-server-fixes' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17dfa42b980000
kernel config: https://syzkaller.appspot.com/x/.config?x=df2f0ed7e30a639d
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16210a7b980000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-b311c1b4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1c99fa48192f/vmlinux-b311c1b4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/16d5710a012a/bzImage-b311c1b4.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/bcc0f964f07d/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/8d5780313c65/mount_1.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5368 Comm: syz.0.15 Not tainted 6.11.0-rc4-syzkaller-00019-gb311c1b497e5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29c/0x2a0 fs/super.c:1810
Code: ff 49 8b 1f 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 74 95 ee ff 48 8b 33 48 c7 c7 60 93 18 8c e8 b5 82 a7 09 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f
RSP: 0018:ffffc90002c0fd08 EFLAGS: 00010246
RAX: 0000000000000032 RBX: ffffffff8ef44540 RCX: 3e1a74824a3f5500
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff11007074696 R08: ffffffff8174034c R09: 1ffff1100410519a
R10: dffffc0000000000 R11: ffffed100410519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880383a34b0 R15: ffff8880383a3498
FS: 00007fea882896c0(0000) GS:ffff888020800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7345eec538 CR3: 0000000037c0e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_new_mount+0x2be/0xb40 fs/namespace.c:3472
do_mount fs/namespace.c:3812 [inline]
__do_sys_mount fs/namespace.c:4020 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3997
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fea8757b61a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fea88288e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fea88288ef0 RCX: 00007fea8757b61a
RDX: 000000002000fec0 RSI: 000000002000ff00 RDI: 00007fea88288eb0
RBP: 000000002000fec0 R08: 00007fea88288ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000002000ff00
R13: 00007fea88288eb0 R14: 000000000000fe88 R15: 0000000020000040
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29c/0x2a0 fs/super.c:1810
Code: ff 49 8b 1f 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 74 95 ee ff 48 8b 33 48 c7 c7 60 93 18 8c e8 b5 82 a7 09 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f
RSP: 0018:ffffc90002c0fd08 EFLAGS: 00010246
RAX: 0000000000000032 RBX: ffffffff8ef44540 RCX: 3e1a74824a3f5500
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff11007074696 R08: ffffffff8174034c R09: 1ffff1100410519a
R10: dffffc0000000000 R11: ffffed100410519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880383a34b0 R15: ffff8880383a3498
FS: 00007fea882896c0(0000) GS:ffff888020800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efe67e50469 CR3: 0000000037c0e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-08-21 21:35 [syzbot] [bcachefs?] [jfs?] kernel BUG in vfs_get_tree syzbot
@ 2024-09-24 22:18 ` syzbot
2024-09-25 13:53 ` [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL Edward Adam Davis
2024-09-25 7:24 ` [syzbot] [bcachefs?] kernel BUG in vfs_get_tree syzbot
1 sibling, 1 reply; 5+ messages in thread
From: syzbot @ 2024-09-24 22:18 UTC (permalink / raw)
To: brauner, jack, jfs-discussion, kent.overstreet, linux-bcachefs,
linux-fsdevel, linux-kernel, shaggy, syzkaller-bugs, viro
syzbot has found a reproducer for the following issue on:
HEAD commit: abf2050f51fd Merge tag 'media/v6.12-1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11f08a80580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bc30a30374b0753
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fad2a9980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17b7b107980000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-abf2050f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2179ebeade58/vmlinux-abf2050f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f05289b5cf7c/bzImage-abf2050f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/326532b68b88/mount_1.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root, returned 1
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5200 Comm: syz-executor203 Not tainted 6.11.0-syzkaller-09959-gabf2050f51fd #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 22 b3 ae 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc9000b457d08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef58520 RCX: 12995cb9c2040600
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff11008249016 R08: ffffffff81746c8c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff888041248098 R15: ffff8880412480b0
FS: 0000555567b69480(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555567b72918 CR3: 000000004ebe6000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4055 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff4a950680a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 7e 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdb635bea8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffdb635bec0 RCX: 00007ff4a950680a
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007ffdb635bec0
RBP: 0000000000000004 R08: 00007ffdb635bf00 R09: 0000000000005dc5
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 00007ffdb635bf00 R14: 0000000000000003 R15: 0000000001000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 22 b3 ae 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc9000b457d08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef58520 RCX: 12995cb9c2040600
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff11008249016 R08: ffffffff81746c8c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff888041248098 R15: ffff8880412480b0
FS: 0000555567b69480(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff4a1141000 CR3: 000000004ebe6000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
@ 2024-09-25 13:53 ` Edward Adam Davis
2024-09-25 15:20 ` Kent Overstreet
0 siblings, 1 reply; 5+ messages in thread
From: Edward Adam Davis @ 2024-09-25 13:53 UTC (permalink / raw)
To: syzbot+c0360e8367d6d8d04a66
Cc: brauner, jack, jfs-discussion, kent.overstreet, linux-bcachefs,
linux-fsdevel, linux-kernel, shaggy, syzkaller-bugs, viro
Syzbot report a kernel BUG in vfs_get_tree.
The root cause is that read_btree_nodes() returned 1 and returned -EINTR
due to kthread_run() execution failure.
The -EINTR needs to be returnned to bch2_fs_recovery(), not return to
"ret = IS_ERR_OR_NULL(t)".
Reported-and-tested-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
fs/bcachefs/btree_node_scan.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..df7090ca1e81 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -281,6 +281,10 @@ static int read_btree_nodes(struct find_btree_nodes *f)
closure_put(&cl);
f->ret = ret;
bch_err(c, "error starting kthread: %i", ret);
+ if (IS_ERR(t)) {
+ closure_sync(&cl);
+ return PTR_ERR(t);
+ }
break;
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL
2024-09-25 13:53 ` [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL Edward Adam Davis
@ 2024-09-25 15:20 ` Kent Overstreet
0 siblings, 0 replies; 5+ messages in thread
From: Kent Overstreet @ 2024-09-25 15:20 UTC (permalink / raw)
To: Edward Adam Davis
Cc: syzbot+c0360e8367d6d8d04a66, brauner, jack, jfs-discussion,
linux-bcachefs, linux-fsdevel, linux-kernel, shaggy,
syzkaller-bugs, viro
On Wed, Sep 25, 2024 at 09:53:00PM GMT, Edward Adam Davis wrote:
> Syzbot report a kernel BUG in vfs_get_tree.
> The root cause is that read_btree_nodes() returned 1 and returned -EINTR
> due to kthread_run() execution failure.
>
> The -EINTR needs to be returnned to bch2_fs_recovery(), not return to
> "ret = IS_ERR_OR_NULL(t)".
>
> Reported-and-tested-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
> fs/bcachefs/btree_node_scan.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
> index b28c649c6838..df7090ca1e81 100644
> --- a/fs/bcachefs/btree_node_scan.c
> +++ b/fs/bcachefs/btree_node_scan.c
> @@ -281,6 +281,10 @@ static int read_btree_nodes(struct find_btree_nodes *f)
> closure_put(&cl);
> f->ret = ret;
> bch_err(c, "error starting kthread: %i", ret);
> + if (IS_ERR(t)) {
> + closure_sync(&cl);
> + return PTR_ERR(t);
> + }
> break;
> }
> }
> --
> 2.43.0
>
I fixed this last night with the patch below...
commit c1a6f5ca052b7f8609917d13cd11fc60c94396aa
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Tue Sep 24 19:31:22 2024 -0400
bcachefs: Fix incorrect IS_ERR_OR_NULL usage
Returning a positive integer instead of an error code causes error paths
to become very confused.
Closes: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..1e694fedc5da 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -275,7 +275,7 @@ static int read_btree_nodes(struct find_btree_nodes *f)
w->ca = ca;
t = kthread_run(read_btree_nodes_worker, w, "read_btree_nodes/%s", ca->name);
- ret = IS_ERR_OR_NULL(t);
+ ret = PTR_ERR_OR_ZERO(t);
if (ret) {
percpu_ref_put(&ca->io_ref);
closure_put(&cl);
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-08-21 21:35 [syzbot] [bcachefs?] [jfs?] kernel BUG in vfs_get_tree syzbot
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
@ 2024-09-25 7:24 ` syzbot
1 sibling, 0 replies; 5+ messages in thread
From: syzbot @ 2024-09-25 7:24 UTC (permalink / raw)
To: brauner, eadavis, jack, jfs-discussion, kent.overstreet,
linux-bcachefs, linux-fsdevel, linux-kernel, shaggy,
syzkaller-bugs, viro
syzbot has bisected this issue to:
commit d97de0d017cde0d442c3d144b4f969f43064cc0f
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Tue Aug 13 01:31:25 2024 +0000
bcachefs: Make bkey_fsck_err() a wrapper around fsck_err()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=147a0989980000
start commit: 2004cef11ea0 Merge tag 'sched-core-2024-09-19' of git://gi..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=167a0989980000
console output: https://syzkaller.appspot.com/x/log.txt?x=127a0989980000
kernel config: https://syzkaller.appspot.com/x/.config?x=38d475ce6711b8b4
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=171f769f980000
Reported-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
Fixes: d97de0d017cd ("bcachefs: Make bkey_fsck_err() a wrapper around fsck_err()")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-09-25 15:20 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-21 21:35 [syzbot] [bcachefs?] [jfs?] kernel BUG in vfs_get_tree syzbot
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
2024-09-25 13:53 ` [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL Edward Adam Davis
2024-09-25 15:20 ` Kent Overstreet
2024-09-25 7:24 ` [syzbot] [bcachefs?] kernel BUG in vfs_get_tree syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).