[syzbot] [block?] [trace?] WARNING in __blk_add_trace

[syzbot] [block?] [trace?] WARNING in __blk_add_trace

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    72fb0170ef1f Add linux-next specific files for 20251024
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1640f734580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f02d98016cc9c137
dashboard link: https://syzkaller.appspot.com/bug?extid=153e64c0aa875d7e4c37
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=105853e2580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12722614580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f63074a739fa/disk-72fb0170.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b15d7b8b9621/vmlinux-72fb0170.xz
kernel image: https://storage.googleapis.com/syzbot-assets/449963b71f60/bzImage-72fb0170.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+153e64c0aa875d7e4c37@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: kernel/trace/blktrace.c:368 at __blk_add_trace+0x79c/0x8d0 kernel/trace/blktrace.c:367, CPU#0: jbd2/sda1-8/5163
Modules linked in:
CPU: 0 UID: 0 PID: 5163 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__blk_add_trace+0x79c/0x8d0 kernel/trace/blktrace.c:367
Code: ff 4d 85 e4 75 4f e8 83 0e f8 ff e9 fb fd ff ff e8 79 0e f8 ff e9 ec fd ff ff e8 6f 0e f8 ff e9 d8 fd ff ff e8 65 0e f8 ff 90 <0f> 0b 90 e9 ca fd ff ff e8 57 0e f8 ff 48 8b 7c 24 30 e8 cd 51 00
RSP: 0018:ffffc9000e54f460 EFLAGS: 00010293
RAX: ffffffff81c81b4b RBX: 0000000000000001 RCX: ffff8880341abc80
RDX: 0000000000000000 RSI: 00000000901e000f RDI: 000000008000ffff
RBP: ffffc9000e54f578 R08: ffff8880341abc80 R09: 0000000000000009
R10: 0000000000000011 R11: 0000000000000000 R12: 000000008000ffff
R13: ffff888075c86080 R14: 00000000901e000f R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888125f22000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555577629808 CR3: 000000000dd38000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 blk_add_trace_bio_remap+0x4b8/0x560 kernel/trace/blktrace.c:1200
 __do_trace_block_bio_remap include/trace/events/block.h:526 [inline]
 trace_block_bio_remap include/trace/events/block.h:526 [inline]
 blk_partition_remap block/blk-core.c:585 [inline]
 submit_bio_noacct+0x187b/0x1b80 block/blk-core.c:804
 journal_submit_commit_record+0x665/0x8b0 fs/jbd2/commit.c:156
 jbd2_journal_commit_transaction+0x3455/0x5a00 fs/jbd2/commit.c:875
 kjournald2+0x3cf/0x750 fs/jbd2/journal.c:201
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [block?] [trace?] WARNING in __blk_add_trace

[syzbot]

syzbot has bisected this issue to:

commit f9ee38bbf70fb20584625849a253c8652176fa66
Author: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Date:   Wed Oct 22 11:41:12 2025 +0000

    blktrace: add block trace commands for zone operations

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1750c7e2580000
start commit:   72fb0170ef1f Add linux-next specific files for 20251024
git tree:       linux-next
final oops:     https://syzkaller.appspot.com/x/report.txt?x=14d0c7e2580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10d0c7e2580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f02d98016cc9c137
dashboard link: https://syzkaller.appspot.com/bug?extid=153e64c0aa875d7e4c37
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=145ae3cd980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13f58be2580000

Reported-by: syzbot+153e64c0aa875d7e4c37@syzkaller.appspotmail.com
Fixes: f9ee38bbf70f ("blktrace: add block trace commands for zone operations")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [block?] [trace?] WARNING in __blk_add_trace

[Jens Axboe]

On 10/24/25 5:11 PM, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    72fb0170ef1f Add linux-next specific files for 20251024
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1640f734580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f02d98016cc9c137
> dashboard link: https://syzkaller.appspot.com/bug?extid=153e64c0aa875d7e4c37
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=105853e2580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12722614580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/f63074a739fa/disk-72fb0170.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/b15d7b8b9621/vmlinux-72fb0170.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/449963b71f60/bzImage-72fb0170.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+153e64c0aa875d7e4c37@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> WARNING: kernel/trace/blktrace.c:368 at __blk_add_trace+0x79c/0x8d0 kernel/trace/blktrace.c:367, CPU#0: jbd2/sda1-8/5163
> Modules linked in:
> CPU: 0 UID: 0 PID: 5163 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> RIP: 0010:__blk_add_trace+0x79c/0x8d0 kernel/trace/blktrace.c:367
> Code: ff 4d 85 e4 75 4f e8 83 0e f8 ff e9 fb fd ff ff e8 79 0e f8 ff e9 ec fd ff ff e8 6f 0e f8 ff e9 d8 fd ff ff e8 65 0e f8 ff 90 <0f> 0b 90 e9 ca fd ff ff e8 57 0e f8 ff 48 8b 7c 24 30 e8 cd 51 00
> RSP: 0018:ffffc9000e54f460 EFLAGS: 00010293
> RAX: ffffffff81c81b4b RBX: 0000000000000001 RCX: ffff8880341abc80
> RDX: 0000000000000000 RSI: 00000000901e000f RDI: 000000008000ffff
> RBP: ffffc9000e54f578 R08: ffff8880341abc80 R09: 0000000000000009
> R10: 0000000000000011 R11: 0000000000000000 R12: 000000008000ffff
> R13: ffff888075c86080 R14: 00000000901e000f R15: 0000000000000001
> FS:  0000000000000000(0000) GS:ffff888125f22000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000555577629808 CR3: 000000000dd38000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  blk_add_trace_bio_remap+0x4b8/0x560 kernel/trace/blktrace.c:1200
>  __do_trace_block_bio_remap include/trace/events/block.h:526 [inline]
>  trace_block_bio_remap include/trace/events/block.h:526 [inline]
>  blk_partition_remap block/blk-core.c:585 [inline]
>  submit_bio_noacct+0x187b/0x1b80 block/blk-core.c:804
>  journal_submit_commit_record+0x665/0x8b0 fs/jbd2/commit.c:156
>  jbd2_journal_commit_transaction+0x3455/0x5a00 fs/jbd2/commit.c:875
>  kjournald2+0x3cf/0x750 fs/jbd2/journal.c:201
>  kthread+0x711/0x8a0 kernel/kthread.c:463
>  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>

Adding Johannes.

-- 
Jens Axboe

Re: [syzbot] [block?] [trace?] WARNING in __blk_add_trace

[Chaitanya Kulkarni]

On 10/25/25 06:35, Jens Axboe wrote:
>> ------------[ cut here ]------------
>> WARNING: kernel/trace/blktrace.c:368 at __blk_add_trace+0x79c/0x8d0 kernel/trace/blktrace.c:367, CPU#0: jbd2/sda1-8/5163
>> Modules linked in:
>> CPU: 0 UID: 0 PID: 5163 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full)
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
>> RIP: 0010:__blk_add_trace+0x79c/0x8d0 kernel/trace/blktrace.c:367
>> Code: ff 4d 85 e4 75 4f e8 83 0e f8 ff e9 fb fd ff ff e8 79 0e f8 ff e9 ec fd ff ff e8 6f 0e f8 ff e9 d8 fd ff ff e8 65 0e f8 ff 90 <0f> 0b 90 e9 ca fd ff ff e8 57 0e f8 ff 48 8b 7c 24 30 e8 cd 51 00
>> RSP: 0018:ffffc9000e54f460 EFLAGS: 00010293
>> RAX: ffffffff81c81b4b RBX: 0000000000000001 RCX: ffff8880341abc80
>> RDX: 0000000000000000 RSI: 00000000901e000f RDI: 000000008000ffff
>> RBP: ffffc9000e54f578 R08: ffff8880341abc80 R09: 0000000000000009
>> R10: 0000000000000011 R11: 0000000000000000 R12: 000000008000ffff
>> R13: ffff888075c86080 R14: 00000000901e000f R15: 0000000000000001
>> FS:  0000000000000000(0000)GS:ffff888125f22000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 0000555577629808 CR3: 000000000dd38000 CR4: 00000000003526f0
>> Call Trace:
>>   <TASK>
>>   blk_add_trace_bio_remap+0x4b8/0x560 kernel/trace/blktrace.c:1200
>>   __do_trace_block_bio_remap include/trace/events/block.h:526 [inline]
>>   trace_block_bio_remap include/trace/events/block.h:526 [inline]
>>   blk_partition_remap block/blk-core.c:585 [inline]
>>   submit_bio_noacct+0x187b/0x1b80 block/blk-core.c:804
>>   journal_submit_commit_record+0x665/0x8b0 fs/jbd2/commit.c:156
>>   jbd2_journal_commit_transaction+0x3455/0x5a00 fs/jbd2/commit.c:875
>>   kjournald2+0x3cf/0x750 fs/jbd2/journal.c:201
>>   kthread+0x711/0x8a0 kernel/kthread.c:463
>>   ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>   </TASK>
> Adding Johannes.

This seems to make WARN_ON_ONCE() go away if you find this fix useful
I'll send a proper patch :-

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 6ad3807a5b73..b4662c5636a6 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -365,7 +365,7 @@ static void __blk_add_trace(struct blk_trace *bt, 
sector_t sector, int bytes,
         }

         if (WARN_ON_ONCE(bt->version == 1 &&
-                    (what >> BLK_TC_SHIFT) > BLK_TC_END_V1))
+           (what >> BLK_TC_SHIFT) & ~((u64)BLK_TC_END_V1 * 2 - 1)))
                 return;

         if (cgid)

also would you prefer this to be ratelimited print or keep warn_on_once()
and add debug print ?

when I sent you the code for blktrace_ext that cover letter has some tests,
not demanding anything here but it'd nice to have those in the blktests
especially for the REQ_OP_ZONEXXX, so we all can run regularly.

Else I'll add this to my TODO for blktests along with 15 testcases sitting
in my private tree to go upstream.

-ck

Re: [syzbot] [block?] [trace?] WARNING in __blk_add_trace

[Chaitanya Kulkarni]

On 10/25/25 21:55, Chaitanya Kulkarni wrote:
> (what >> BLK_TC_SHIFT) & ~((u64)BLK_TC_END_V1 * 2 - 1)))

Following is the test I used :-

  tests/blktrace/001     | 97 ++++++++++++++++++++++++++++++++++++++++++
  tests/blktrace/001.out |  2 +
  tests/blktrace/rc      | 11 +++++
  3 files changed, 110 insertions(+)
  create mode 100755 tests/blktrace/001
  create mode 100644 tests/blktrace/001.out
  create mode 100644 tests/blktrace/rc

diff --git a/tests/blktrace/001 b/tests/blktrace/001
new file mode 100755
index 0000000..fa72f89
--- /dev/null
+++ b/tests/blktrace/001
@@ -0,0 +1,97 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-3.0+
+# Copyright (C) 2025 Chaitanya Kulkarni <kch@nvidia.com>
+#
+# Regression test for blktrace false positive WARNING on zone management
+# commands.
+#
+# Bug: https://syzkaller.appspot.com/bug?extid=153e64c0aa875d7e4c37
+# Location: kernel/trace/blktrace.c:367-368
+#
+# The bug triggers a WARNING when zone management commands (zone 
open/close/
+# finish/reset) are traced with blktrace on V1 version. This is a false
+# positive that should be fixed.
+
+. tests/blktrace/rc
+. common/null_blk
+
+DESCRIPTION="blktrace zone management command tracing"
+QUICK=1
+
+requires() {
+    _have_program blkzone
+    _have_null_blk
+    _have_module_param null_blk zoned
+}
+
+test() {
+    echo "Running ${TEST_NAME}"
+
+    local blktrace_pid
+    local warning_count
+    local device
+
+    # Initialize null_blk with no default devices
+    if ! _init_null_blk nr_devices=0; then
+        return 1
+    fi
+
+    # Create zoned null_blk device via configfs
+    # 8 zones, 1GB total, 128MB per zone, no conventional zones
+    if ! _configure_null_blk nullb0 \
+        memory_backed=1 \
+        zone_size=128 \
+        zone_nr_conv=0 \
+        size=1024 \
+        zoned=1 \
+        power=1; then
+        return 1
+    fi
+
+    device=/dev/nullb0
+
+    # Verify it's a zoned device
+    local zoned_mode
+    zoned_mode=$(cat /sys/block/nullb0/queue/zoned)
+    if [[ "$zoned_mode" != "host-managed" ]]; then
+        echo "Device is not zoned (mode: $zoned_mode)"
+        _exit_null_blk
+        return 1
+    fi
+
+    # Clear dmesg to isolate test output
+    dmesg -C 2>/dev/null || true
+
+    # Start blktrace
+    blktrace -d "${device}" -o trace >> "$FULL" 2>&1 &
+    blktrace_pid=$!
+    sleep 2
+
+    # Verify blktrace started
+    if ! ps -p $blktrace_pid > /dev/null 2>&1; then
+        echo "blktrace failed to start"
+        _exit_null_blk
+        return 1
+    fi
+
+    # Issue zone open command for all zones (triggers bug if present)
+    blkzone open "${device}" >> "$FULL" 2>&1
+
+    sleep 1
+
+    # Stop blktrace
+    kill $blktrace_pid 2>/dev/null
+    wait $blktrace_pid 2>/dev/null || true
+
+    # Check for WARNING (bug present if WARNING found)
+    warning_count=$(dmesg | grep -c "WARNING.*blktrace.c:367" || true)
+
+    if [[ $warning_count -gt 0 ]]; then
+        echo "WARNING: blktrace bug detected at blktrace.c:367"
+        dmesg | grep -A 10 "WARNING.*blktrace.c:367" >> "$FULL"
+    fi
+
+    _exit_null_blk
+
+    echo "Test complete"
+}
diff --git a/tests/blktrace/001.out b/tests/blktrace/001.out
new file mode 100644
index 0000000..a122a65
--- /dev/null
+++ b/tests/blktrace/001.out
@@ -0,0 +1,2 @@
+Running blktrace/001
+Test complete
diff --git a/tests/blktrace/rc b/tests/blktrace/rc
new file mode 100644
index 0000000..019ff7d
--- /dev/null
+++ b/tests/blktrace/rc
@@ -0,0 +1,11 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-3.0+
+# Copyright (C) 2025 Chaitanya Kulkarni <kch@nvidia.com>
+#
+# Tests for blktrace infrastructure
+
+. common/rc
+
+group_requires() {
+    _have_root && _have_blktrace && _have_program blkparse
+}
-- 
2.40.0

Re: [syzbot] [block?] [trace?] WARNING in __blk_add_trace

[Johannes Thumshirn]

On 10/26/25 5:55 AM, Chaitanya Kulkarni wrote:
> On 10/25/25 06:35, Jens Axboe wrote:
>>> ------------[ cut here ]------------
>>> WARNING: kernel/trace/blktrace.c:368 at __blk_add_trace+0x79c/0x8d0 kernel/trace/blktrace.c:367, CPU#0: jbd2/sda1-8/5163
>>> Modules linked in:
>>> CPU: 0 UID: 0 PID: 5163 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full)
>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
>>> RIP: 0010:__blk_add_trace+0x79c/0x8d0 kernel/trace/blktrace.c:367
>>> Code: ff 4d 85 e4 75 4f e8 83 0e f8 ff e9 fb fd ff ff e8 79 0e f8 ff e9 ec fd ff ff e8 6f 0e f8 ff e9 d8 fd ff ff e8 65 0e f8 ff 90 <0f> 0b 90 e9 ca fd ff ff e8 57 0e f8 ff 48 8b 7c 24 30 e8 cd 51 00
>>> RSP: 0018:ffffc9000e54f460 EFLAGS: 00010293
>>> RAX: ffffffff81c81b4b RBX: 0000000000000001 RCX: ffff8880341abc80
>>> RDX: 0000000000000000 RSI: 00000000901e000f RDI: 000000008000ffff
>>> RBP: ffffc9000e54f578 R08: ffff8880341abc80 R09: 0000000000000009
>>> R10: 0000000000000011 R11: 0000000000000000 R12: 000000008000ffff
>>> R13: ffff888075c86080 R14: 00000000901e000f R15: 0000000000000001
>>> FS:  0000000000000000(0000)GS:ffff888125f22000(0000) knlGS:0000000000000000
>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 0000555577629808 CR3: 000000000dd38000 CR4: 00000000003526f0
>>> Call Trace:
>>>    <TASK>
>>>    blk_add_trace_bio_remap+0x4b8/0x560 kernel/trace/blktrace.c:1200
>>>    __do_trace_block_bio_remap include/trace/events/block.h:526 [inline]
>>>    trace_block_bio_remap include/trace/events/block.h:526 [inline]
>>>    blk_partition_remap block/blk-core.c:585 [inline]
>>>    submit_bio_noacct+0x187b/0x1b80 block/blk-core.c:804
>>>    journal_submit_commit_record+0x665/0x8b0 fs/jbd2/commit.c:156
>>>    jbd2_journal_commit_transaction+0x3455/0x5a00 fs/jbd2/commit.c:875
>>>    kjournald2+0x3cf/0x750 fs/jbd2/journal.c:201
>>>    kthread+0x711/0x8a0 kernel/kthread.c:463
>>>    ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>>>    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>>    </TASK>
>> Adding Johannes.
> This seems to make WARN_ON_ONCE() go away if you find this fix useful
> I'll send a proper patch :-
>
> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> index 6ad3807a5b73..b4662c5636a6 100644
> --- a/kernel/trace/blktrace.c
> +++ b/kernel/trace/blktrace.c
> @@ -365,7 +365,7 @@ static void __blk_add_trace(struct blk_trace *bt,
> sector_t sector, int bytes,
>           }
>
>           if (WARN_ON_ONCE(bt->version == 1 &&
> -                    (what >> BLK_TC_SHIFT) > BLK_TC_END_V1))
> +           (what >> BLK_TC_SHIFT) & ~((u64)BLK_TC_END_V1 * 2 - 1)))
>                   return;
>
>           if (cgid)
>
> also would you prefer this to be ratelimited print or keep warn_on_once()
> and add debug print ?
>
> when I sent you the code for blktrace_ext that cover letter has some tests,
> not demanding anything here but it'd nice to have those in the blktests
> especially for the REQ_OP_ZONEXXX, so we all can run regularly.
>
> Else I'll add this to my TODO for blktests along with 15 testcases sitting
> in my private tree to go upstream.
>
> -ck
>
>
>
Looks good, thanks Chaitanya