Re: [syzbot] [jfs?] INFO: task hung in txBegin

syzbot
2024-08-04T07:57:03Z

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in lmLogSync

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 114 Comm: jfsCommit Not tainted 6.10.0-rc4-syzkaller-00148-g50736169ecc8-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 1e 97 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 01 97 d3 fe 48 8b 3b e8 b9 c5 a6
RSP: 0018:ffffc90002cefc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: 328fe0b8e03e5b00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002cefd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002cef9e8 R11: fffff5200059df6b R12: ffff88806a112800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807cb0ba38
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055559488b938 CR3: 000000000e132000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
jfs_syncpt+0x7d/0xa0 fs/jfs/jfs_logmgr.c:1041
txEnd+0x30f/0x560 fs/jfs/jfs_txnmgr.c:549
txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline]
jfs_lazycommit+0x634/0xb80 fs/jfs/jfs_txnmgr.c:2733
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:208 [inline]
RIP: 0010:lmLogSync+0x130/0xae0 fs/jfs/jfs_logmgr.c:935
Code: a6 fe 49 8d 5f f0 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 1e 97 d3 fe 48 8b 1b 48 83 c3 30 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 01 97 d3 fe 48 8b 3b e8 b9 c5 a6
RSP: 0018:ffffc90002cefc00 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: 328fe0b8e03e5b00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002cefd18 R08: ffffffff81cbb49a R09: 0000000000000000
R10: ffffc90002cef9e8 R11: fffff5200059df6b R12: ffff88806a112800
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88807cb0ba38
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055559488b938 CR3: 000000002bf6a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: a6 cmpsb %es:(%rdi),%ds:(%rsi)
1: fe 49 8d decb -0x73(%rcx)
4: 5f pop %rdi
5: f0 48 89 d8 lock mov %rbx,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 1e 97 d3 fe call 0xfed3973a
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 30 add $0x30,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 01 97 d3 fe call 0xfed3973a
39: 48 8b 3b mov (%rbx),%rdi
3c: e8 .byte 0xe8
3d: b9 .byte 0xb9
3e: c5 .byte 0xc5
3f: a6 cmpsb %es:(%rdi),%ds:(%rsi)

Tested on:

commit: 50736169 Merge tag 'for-6.10-rc4-tag' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16ca70f3980000
kernel config: https://syzkaller.appspot.com/x/.config?x=12f98862a3c0c799
dashboard link: https://syzkaller.appspot.com/bug?extid=eda89a33c5856f66f823
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1688319d980000