[syzbot] [erofs?] WARNING in get_next_unlocked_entry

[syzbot] [erofs?] WARNING in get_next_unlocked_entry

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    e927c520e1ba Merge tag 'loongarch-fixes-6.18-1' of git://g..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=129957cd980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=929790bc044e87d7
dashboard link: https://syzkaller.appspot.com/bug?extid=31b8fb02cb8a25bd5e78
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16994692580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16d58d32580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-e927c520.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/924fb782edf1/vmlinux-e927c520.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7e6af189c28e/bzImage-e927c520.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6a0aec9d15b8/mount_0.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1740497c580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 16
erofs (device loop0): mounted with root inode @ nid 36.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5492 at fs/dax.c:224 get_next_unlocked_entry+0x329/0x340 fs/dax.c:224
Modules linked in:
CPU: 0 UID: 0 PID: 5492 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:get_next_unlocked_entry+0x329/0x340 fs/dax.c:224
Code: 45 1d 10 48 3b 84 24 c0 00 00 00 75 22 4c 89 e8 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 3e 8a f9 08 cc e8 08 59 6e ff 90 <0f> 0b 90 eb a0 e8 6d a6 f6 08 66 66 66 66 2e 0f 1f 84 00 00 00 00
RSP: 0018:ffffc90002b7e8a0 EFLAGS: 00010093
RAX: ffffffff8251ba68 RBX: 1ffff9200056fd9c RCX: ffff8880354e4900
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002b7e9b0 R08: ffffc90002b7e937 R09: 0000000000000000
R10: ffffc90002b7e900 R11: fffff5200056fd27 R12: ffffc90002b7e918
R13: ffffea00010af380 R14: ffffc90002b7e900 R15: dffffc0000000000
FS:  0000555581eb2500(0000) GS:ffff88808d730000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557f23763138 CR3: 00000000424dd000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 grab_mapping_entry+0x176/0x660 fs/dax.c:660
 dax_iomap_pte_fault fs/dax.c:1891 [inline]
 dax_iomap_fault+0x8ab/0x18d0 fs/dax.c:2080
 __do_fault+0x138/0x390 mm/memory.c:5281
 do_cow_fault mm/memory.c:5746 [inline]
 do_fault mm/memory.c:5852 [inline]
 do_pte_missing mm/memory.c:4362 [inline]
 handle_pte_fault mm/memory.c:6195 [inline]
 __handle_mm_fault+0x1719/0x5400 mm/memory.c:6336
 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6505
 faultin_page mm/gup.c:1126 [inline]
 __get_user_pages+0x165c/0x2a00 mm/gup.c:1428
 __get_user_pages_locked mm/gup.c:1692 [inline]
 get_user_pages_remote+0x2f1/0xac0 mm/gup.c:2614
 uprobe_write+0x1b6/0x2160 kernel/events/uprobes.c:529
 uprobe_write_opcode+0xa8/0xf0 kernel/events/uprobes.c:493
 set_swbp+0x121/0x290 arch/x86/kernel/uprobes.c:1090
 install_breakpoint+0x451/0x5a0 kernel/events/uprobes.c:1170
 register_for_each_vma+0xabb/0xc30 kernel/events/uprobes.c:1315
 uprobe_apply+0xfb/0x270 kernel/events/uprobes.c:1459
 uprobe_perf_open kernel/trace/trace_uprobe.c:1371 [inline]
 trace_uprobe_register+0x4df/0x560 kernel/trace/trace_uprobe.c:1533
 perf_trace_event_open kernel/trace/trace_event_perf.c:184 [inline]
 perf_trace_event_init+0x19a/0x9d0 kernel/trace/trace_event_perf.c:206
 perf_uprobe_init+0x12e/0x1a0 kernel/trace/trace_event_perf.c:332
 perf_uprobe_event_init+0xe6/0x180 kernel/events/core.c:11170
 perf_try_init_event+0x17f/0x870 kernel/events/core.c:12615
 perf_init_event kernel/events/core.c:12713 [inline]
 perf_event_alloc+0x133e/0x2be0 kernel/events/core.c:12988
 __do_sys_perf_event_open kernel/events/core.c:13506 [inline]
 __se_sys_perf_event_open+0x772/0x1d70 kernel/events/core.c:13387
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe38998f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe19690378 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007fe389be5fa0 RCX: 00007fe38998f6c9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0
RBP: 00007fe389a11f91 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe389be5fa0 R14: 00007fe389be5fa0 R15: 0000000000000005
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[PATCH] erofs: correct FSDAX detection

[Gao Xiang]

The detection of the primary device is skipped incorrectly
if the multiple or flattened feature is enabled.

It also fixes the FSDAX misdetection for non-block extra blobs.

Fixes: c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device")
Reported-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/691af9f6.a70a0220.3124cb.0097.GAE@google.com
Cc: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
---
 fs/erofs/super.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index f3f8d8c066e4..cd8ff98c2938 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -174,15 +174,15 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
 		if (!erofs_is_fileio_mode(sbi)) {
 			dif->dax_dev = fs_dax_get_by_bdev(file_bdev(file),
 					&dif->dax_part_off, NULL, NULL);
-			if (!dif->dax_dev && test_opt(&sbi->opt, DAX_ALWAYS)) {
-				erofs_info(sb, "DAX unsupported by %s. Turning off DAX.",
-					   dif->path);
-				clear_opt(&sbi->opt, DAX_ALWAYS);
-			}
 		} else if (!S_ISREG(file_inode(file)->i_mode)) {
 			fput(file);
 			return -EINVAL;
 		}
+		if (!dif->dax_dev && test_opt(&sbi->opt, DAX_ALWAYS)) {
+			erofs_info(sb, "DAX unsupported by %s. Turning off DAX.",
+				   dif->path);
+			clear_opt(&sbi->opt, DAX_ALWAYS);
+		}
 		dif->file = file;
 	}
 
@@ -215,13 +215,13 @@ static int erofs_scan_devices(struct super_block *sb,
 			  ondisk_extradevs, sbi->devs->extra_devices);
 		return -EINVAL;
 	}
-	if (!ondisk_extradevs) {
-		if (test_opt(&sbi->opt, DAX_ALWAYS) && !sbi->dif0.dax_dev) {
-			erofs_info(sb, "DAX unsupported by block device. Turning off DAX.");
-			clear_opt(&sbi->opt, DAX_ALWAYS);
-		}
-		return 0;
+
+	if (test_opt(&sbi->opt, DAX_ALWAYS) && !sbi->dif0.dax_dev) {
+		erofs_info(sb, "DAX unsupported by block device. Turning off DAX.");
+		clear_opt(&sbi->opt, DAX_ALWAYS);
 	}
+	if (!ondisk_extradevs)
+		return 0;
 
 	if (!sbi->devs->extra_devices && !erofs_is_fscache_mode(sb))
 		sbi->devs->flatdev = true;
-- 
2.43.5

Re: [syzbot] [erofs?] WARNING in get_next_unlocked_entry

[Gao Xiang]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git dev-test

Re: [syzbot] [erofs?] WARNING in get_next_unlocked_entry

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com
Tested-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com

Tested on:

commit:         3027b141 erofs: correct FSDAX detection
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git dev-test
console output: https://syzkaller.appspot.com/x/log.txt?x=16e2597c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f
dashboard link: https://syzkaller.appspot.com/bug?extid=31b8fb02cb8a25bd5e78
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

Re: [PATCH] erofs: correct FSDAX detection

[Yuezhang.Mo]

On November 17, 2025 19:57 Gao Xiang wrote:
> The detection of the primary device is skipped incorrectly
> if the multiple or flattened feature is enabled.
> 
> It also fixes the FSDAX misdetection for non-block extra blobs.
> 
> Fixes: c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device")
> Reported-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/r/691af9f6.a70a0220.3124cb.0097.GAE@google.com
> Cc: Yuezhang Mo <Yuezhang.Mo@sony.com>
> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
> ---
>  fs/erofs/super.c | 22 +++++++++++-----------
>  1 file changed, 11 insertions(+), 11 deletions(-)
> 
> diff --git a/fs/erofs/super.c b/fs/erofs/super.c
> index f3f8d8c066e4..cd8ff98c2938 100644
> --- a/fs/erofs/super.c
> +++ b/fs/erofs/super.c
> @@ -174,15 +174,15 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
>                 if (!erofs_is_fileio_mode(sbi)) {
>                         dif->dax_dev = fs_dax_get_by_bdev(file_bdev(file),
>                                         &dif->dax_part_off, NULL, NULL);
> -                       if (!dif->dax_dev && test_opt(&sbi->opt, DAX_ALWAYS)) {
> -                               erofs_info(sb, "DAX unsupported by %s. Turning off DAX.",
> -                                          dif->path);
> -                               clear_opt(&sbi->opt, DAX_ALWAYS);
> -                       }
>                 } else if (!S_ISREG(file_inode(file)->i_mode)) {
>                         fput(file);
>                         return -EINVAL;
>                 }
> +               if (!dif->dax_dev && test_opt(&sbi->opt, DAX_ALWAYS)) {
> +                       erofs_info(sb, "DAX unsupported by %s. Turning off DAX.",
> +                                  dif->path);
> +                       clear_opt(&sbi->opt, DAX_ALWAYS);
> +               }
>                 dif->file = file;
>         }
> 
> @@ -215,13 +215,13 @@ static int erofs_scan_devices(struct super_block *sb,
>                           ondisk_extradevs, sbi->devs->extra_devices);
>                 return -EINVAL;
>         }
> -       if (!ondisk_extradevs) {
> -               if (test_opt(&sbi->opt, DAX_ALWAYS) && !sbi->dif0.dax_dev) {
> -                       erofs_info(sb, "DAX unsupported by block device. Turning off DAX.");
> -                       clear_opt(&sbi->opt, DAX_ALWAYS);
> -               }
> -               return 0;
> +
> +       if (test_opt(&sbi->opt, DAX_ALWAYS) && !sbi->dif0.dax_dev) {
> +               erofs_info(sb, "DAX unsupported by block device. Turning off DAX.");
> +               clear_opt(&sbi->opt, DAX_ALWAYS);
>         }
> +       if (!ondisk_extradevs)
> +               return 0;

Hi Gao Xiang,

If using multiple devices, is there still file data on the primary device?
If the primary device only contains metadata, the primary device does not need
to support DAX.

> 
>         if (!sbi->devs->extra_devices && !erofs_is_fscache_mode(sb))
>                 sbi->devs->flatdev = true;
> --
> 2.43.5

Re: [PATCH] erofs: correct FSDAX detection

[Gao Xiang]

On 2025/11/21 12:12, Yuezhang.Mo@sony.com wrote:
> On November 17, 2025 19:57 Gao Xiang wrote:
>> The detection of the primary device is skipped incorrectly
>> if the multiple or flattened feature is enabled.
>>
>> It also fixes the FSDAX misdetection for non-block extra blobs.
>>
>> Fixes: c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device")
>> Reported-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com
>> Closes: https://lore.kernel.org/r/691af9f6.a70a0220.3124cb.0097.GAE@google.com
>> Cc: Yuezhang Mo <Yuezhang.Mo@sony.com>
>> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
>> ---
>>   fs/erofs/super.c | 22 +++++++++++-----------
>>   1 file changed, 11 insertions(+), 11 deletions(-)
>>
>> diff --git a/fs/erofs/super.c b/fs/erofs/super.c
>> index f3f8d8c066e4..cd8ff98c2938 100644
>> --- a/fs/erofs/super.c
>> +++ b/fs/erofs/super.c
>> @@ -174,15 +174,15 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
>>                  if (!erofs_is_fileio_mode(sbi)) {
>>                          dif->dax_dev = fs_dax_get_by_bdev(file_bdev(file),
>>                                          &dif->dax_part_off, NULL, NULL);
>> -                       if (!dif->dax_dev && test_opt(&sbi->opt, DAX_ALWAYS)) {
>> -                               erofs_info(sb, "DAX unsupported by %s. Turning off DAX.",
>> -                                          dif->path);
>> -                               clear_opt(&sbi->opt, DAX_ALWAYS);
>> -                       }
>>                  } else if (!S_ISREG(file_inode(file)->i_mode)) {
>>                          fput(file);
>>                          return -EINVAL;
>>                  }
>> +               if (!dif->dax_dev && test_opt(&sbi->opt, DAX_ALWAYS)) {
>> +                       erofs_info(sb, "DAX unsupported by %s. Turning off DAX.",
>> +                                  dif->path);
>> +                       clear_opt(&sbi->opt, DAX_ALWAYS);
>> +               }
>>                  dif->file = file;
>>          }
>>
>> @@ -215,13 +215,13 @@ static int erofs_scan_devices(struct super_block *sb,
>>                            ondisk_extradevs, sbi->devs->extra_devices);
>>                  return -EINVAL;
>>          }
>> -       if (!ondisk_extradevs) {
>> -               if (test_opt(&sbi->opt, DAX_ALWAYS) && !sbi->dif0.dax_dev) {
>> -                       erofs_info(sb, "DAX unsupported by block device. Turning off DAX.");
>> -                       clear_opt(&sbi->opt, DAX_ALWAYS);
>> -               }
>> -               return 0;
>> +
>> +       if (test_opt(&sbi->opt, DAX_ALWAYS) && !sbi->dif0.dax_dev) {
>> +               erofs_info(sb, "DAX unsupported by block device. Turning off DAX.");
>> +               clear_opt(&sbi->opt, DAX_ALWAYS);
>>          }
>> +       if (!ondisk_extradevs)
>> +               return 0;
> 
> Hi Gao Xiang,
> 
> If using multiple devices, is there still file data on the primary device?
> If the primary device only contains metadata, the primary device does not need
> to support DAX.

Hi Yuezhang,

Currently we don't have a per-device/file fsdax selection
design/implementation.

If fsdax is on, for example, directory data arranged in the primary
device will go through fsdax path (but your case above is that the
primary device does not need to support fsdax.)

Anyway, in principle, we could make them work, but per-device FSDAX
needs a detailed design, I think we should restrict them on the
per-filesystem basis now.

Thanks,
Gao Xiang

> 
>>
>>          if (!sbi->devs->extra_devices && !erofs_is_fscache_mode(sb))
>>                  sbi->devs->flatdev = true;
>> --
>> 2.43.5

Re: [PATCH] erofs: correct FSDAX detection

[Chao Yu]

On 11/17/2025 7:57 PM, Gao Xiang wrote:
> The detection of the primary device is skipped incorrectly
> if the multiple or flattened feature is enabled.
> 
> It also fixes the FSDAX misdetection for non-block extra blobs.
> 
> Fixes: c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device")
> Reported-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/r/691af9f6.a70a0220.3124cb.0097.GAE@google.com
> Cc: Yuezhang Mo <Yuezhang.Mo@sony.com>
> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>

Reviewed-by: Chao Yu <chao@kernel.org>

Thanks,