* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
@ 2024-09-25 0:23 ` Edward Adam Davis
2024-09-25 0:41 ` syzbot
2024-09-25 1:26 ` Edward Adam Davis
` (4 subsequent siblings)
5 siblings, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2024-09-25 0:23 UTC (permalink / raw)
To: syzbot+c0360e8367d6d8d04a66; +Cc: linux-kernel, syzkaller-bugs
Add EPERM support
#syz test
diff --git a/fs/bcachefs/errcode.h b/fs/bcachefs/errcode.h
index 60b7875adada..4119ef5e1fa1 100644
--- a/fs/bcachefs/errcode.h
+++ b/fs/bcachefs/errcode.h
@@ -102,6 +102,7 @@
x(ENOSPC, ENOSPC_sb_downgrade) \
x(ENOSPC, ENOSPC_btree_slot) \
x(ENOSPC, ENOSPC_snapshot_tree) \
+ x(EPERM, EPERM_fc_root) \
x(ENOENT, ENOENT_bkey_type_mismatch) \
x(ENOENT, ENOENT_str_hash_lookup) \
x(ENOENT, ENOENT_str_hash_set_must_replace) \
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-09-25 0:23 ` Edward Adam Davis
@ 2024-09-25 0:41 ` syzbot
0 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2024-09-25 0:41 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in vfs_get_tree
bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root, returned 1
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5668 Comm: syz.0.15 Not tainted 6.11.0-syzkaller-10547-g684a64bf32b6-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc90002f3fd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba40 RCX: 1e1b0d788f0b2200
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100ab23e96 R08: ffffffff81746c8c R09: 1ffff920005e7f3c
R10: dffffc0000000000 R11: fffff520005e7f3d R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88805591f498 R15: ffff88805591f4b0
FS: 00007f6bb22e16c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe68be1000 CR3: 000000004b5ae000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4055 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6bb157f69a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6bb22e0e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f6bb22e0ef0 RCX: 00007f6bb157f69a
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007f6bb22e0eb0
RBP: 0000000020005d80 R08: 00007f6bb22e0ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020005dc0
R13: 00007f6bb22e0eb0 R14: 0000000000005dcb R15: 0000000020000240
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc90002f3fd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba40 RCX: 1e1b0d788f0b2200
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100ab23e96 R08: ffffffff81746c8c R09: 1ffff920005e7f3c
R10: dffffc0000000000 R11: fffff520005e7f3d R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88805591f498 R15: ffff88805591f4b0
FS: 00007f6bb22e16c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c00171dff8 CR3: 000000004b5ae000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 684a64bf Merge tag 'nfs-for-6.12-1' of git://git.linux..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=162dc99f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=bd75e1a00004094f
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=12b2dd3b980000
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
2024-09-25 0:23 ` Edward Adam Davis
@ 2024-09-25 1:26 ` Edward Adam Davis
2024-09-25 1:42 ` syzbot
2024-09-25 12:09 ` Edward Adam Davis
` (3 subsequent siblings)
5 siblings, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2024-09-25 1:26 UTC (permalink / raw)
To: syzbot+c0360e8367d6d8d04a66; +Cc: linux-kernel, syzkaller-bugs
db
#syz test
diff --git a/fs/bcachefs/fs.c b/fs/bcachefs/fs.c
index 4a1bb07a2574..49d711e9837e 100644
--- a/fs/bcachefs/fs.c
+++ b/fs/bcachefs/fs.c
@@ -2148,6 +2148,7 @@ static int bch2_fs_get_tree(struct fs_context *fc)
out:
fc->root = dget(sb->s_root);
err:
+ pr_info("ret: %d, sb: %p, fc: %p, fcroot: %p, %s\n", ret, sb, fc, fc->root, __func__);
darray_exit(&devs_to_fs);
bch2_darray_str_exit(&devs);
if (ret)
diff --git a/fs/bcachefs/recovery.c b/fs/bcachefs/recovery.c
index be1e7ca4362f..12835c0290f8 100644
--- a/fs/bcachefs/recovery.c
+++ b/fs/bcachefs/recovery.c
@@ -849,6 +849,7 @@ int bch2_fs_recovery(struct bch_fs *c)
atomic64_add(1 << 16, &c->key_version);
ret = read_btree_roots(c);
+ pr_info("ret: %d, %s\n", ret, __func__);
if (ret)
goto err;
diff --git a/fs/bcachefs/super.c b/fs/bcachefs/super.c
index 873e4be7e1dc..9fb45c7e7063 100644
--- a/fs/bcachefs/super.c
+++ b/fs/bcachefs/super.c
@@ -1011,6 +1011,7 @@ int bch2_fs_start(struct bch_fs *c)
mutex_lock(&c->sb_lock);
ret = bch2_sb_members_v2_init(c);
+ pr_info("ret: %d, %s\n", ret, __func__);
if (ret) {
mutex_unlock(&c->sb_lock);
goto err;
@@ -1036,6 +1037,7 @@ int bch2_fs_start(struct bch_fs *c)
ret = BCH_SB_INITIALIZED(c->disk_sb.sb)
? bch2_fs_recovery(c)
: bch2_fs_initialize(c);
+ pr_info("2ret: %d, %s\n", ret, __func__);
if (ret)
goto err;
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-09-25 1:26 ` Edward Adam Davis
@ 2024-09-25 1:42 ` syzbot
0 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2024-09-25 1:42 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in vfs_get_tree
bcachefs: bch2_fs_get_tree() ret: 1, sb: fffffffffffffff0, fc: ffff8880537ad800, fcroot: 0000000000000000, bch2_fs_get_tree
bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root, returned 1
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5755 Comm: syz.0.15 Not tainted 6.11.0-syzkaller-10547-g684a64bf32b6-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc9000313fd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba00 RCX: cdd8394f8f48fd00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100a6f5b16 R08: ffffffff81746c8c R09: 1ffff92000627f3c
R10: dffffc0000000000 R11: fffff52000627f3d R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880537ad898 R15: ffff8880537ad8b0
FS: 00007fed01cdb6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ca2d7dd000 CR3: 00000000577b4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4055 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fed00f7f69a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fed01cdae68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fed01cdaef0 RCX: 00007fed00f7f69a
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007fed01cdaeb0
RBP: 0000000020005d80 R08: 00007fed01cdaef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020005dc0
R13: 00007fed01cdaeb0 R14: 0000000000005dcb R15: 0000000020000240
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc9000313fd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba00 RCX: cdd8394f8f48fd00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100a6f5b16 R08: ffffffff81746c8c R09: 1ffff92000627f3c
R10: dffffc0000000000 R11: fffff52000627f3d R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880537ad898 R15: ffff8880537ad8b0
FS: 00007fed01cdb6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1c28ab5b47 CR3: 00000000577b4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 684a64bf Merge tag 'nfs-for-6.12-1' of git://git.linux..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=143e8a80580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bd75e1a00004094f
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10b3c99f980000
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
2024-09-25 0:23 ` Edward Adam Davis
2024-09-25 1:26 ` Edward Adam Davis
@ 2024-09-25 12:09 ` Edward Adam Davis
2024-09-25 12:26 ` syzbot
2024-09-25 12:42 ` Edward Adam Davis
` (2 subsequent siblings)
5 siblings, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2024-09-25 12:09 UTC (permalink / raw)
To: syzbot+c0360e8367d6d8d04a66; +Cc: linux-kernel, syzkaller-bugs
db
#syz test
diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..aa247ca6270d 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -280,7 +280,7 @@ static int read_btree_nodes(struct find_btree_nodes *f)
percpu_ref_put(&ca->io_ref);
closure_put(&cl);
f->ret = ret;
- bch_err(c, "error starting kthread: %i", ret);
+ bch_err(c, "error starting kthread: %i %d", ret, PTR_ERR(t));
break;
}
}
@@ -358,6 +358,7 @@ int bch2_scan_for_btree_nodes(struct bch_fs *c)
mutex_init(&f->lock);
ret = read_btree_nodes(f);
+ pr_info("ret: %d, %s\n", ret, __func__);
if (ret)
return ret;
diff --git a/fs/bcachefs/fs.c b/fs/bcachefs/fs.c
index 4a1bb07a2574..49d711e9837e 100644
--- a/fs/bcachefs/fs.c
+++ b/fs/bcachefs/fs.c
@@ -2148,6 +2148,7 @@ static int bch2_fs_get_tree(struct fs_context *fc)
out:
fc->root = dget(sb->s_root);
err:
+ pr_info("ret: %d, sb: %p, fc: %p, fcroot: %p, %s\n", ret, sb, fc, fc->root, __func__);
darray_exit(&devs_to_fs);
bch2_darray_str_exit(&devs);
if (ret)
diff --git a/fs/bcachefs/recovery.c b/fs/bcachefs/recovery.c
index be1e7ca4362f..aeeeda0f01d4 100644
--- a/fs/bcachefs/recovery.c
+++ b/fs/bcachefs/recovery.c
@@ -522,8 +522,8 @@ static int read_btree_roots(struct bch_fs *c)
bch2_btree_id_str(i)) ||
mustfix_fsck_err_on((ret = r->error = bch2_btree_root_read(c, i, &r->key, r->level)),
c, btree_root_read_error,
- "error reading btree root %s l=%u: %s",
- bch2_btree_id_str(i), r->level, bch2_err_str(ret))) {
+ "error reading btree root %s l=%u: %s ret: %d",
+ bch2_btree_id_str(i), r->level, bch2_err_str(ret), ret)) {
if (btree_id_is_alloc(i)) {
c->opts.recovery_passes |= BIT_ULL(BCH_RECOVERY_PASS_check_allocations);
c->opts.recovery_passes |= BIT_ULL(BCH_RECOVERY_PASS_check_alloc_info);
@@ -849,6 +849,7 @@ int bch2_fs_recovery(struct bch_fs *c)
atomic64_add(1 << 16, &c->key_version);
ret = read_btree_roots(c);
+ pr_info("ret: %d, %s\n", ret, __func__);
if (ret)
goto err;
@@ -967,6 +968,7 @@ int bch2_fs_recovery(struct bch_fs *c)
ret = 0;
out:
+ pr_info("out ret: %d, %s\n", ret, __func__);
bch2_flush_fsck_errs(c);
if (!c->opts.retain_recovery_info) {
diff --git a/fs/bcachefs/super.c b/fs/bcachefs/super.c
index 873e4be7e1dc..74d0af559a77 100644
--- a/fs/bcachefs/super.c
+++ b/fs/bcachefs/super.c
@@ -1036,6 +1036,7 @@ int bch2_fs_start(struct bch_fs *c)
ret = BCH_SB_INITIALIZED(c->disk_sb.sb)
? bch2_fs_recovery(c)
: bch2_fs_initialize(c);
+ pr_info("2ret: %d, %s\n", ret, __func__);
if (ret)
goto err;
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-09-25 12:09 ` Edward Adam Davis
@ 2024-09-25 12:26 ` syzbot
0 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2024-09-25 12:26 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in vfs_get_tree
bcachefs: bch2_fs_get_tree() ret: 1, sb: fffffffffffffff0, fc: ffff88804b373c00, fcroot: 0000000000000000, bch2_fs_get_tree
bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root, returned 1
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5758 Comm: syz.0.15 Not tainted 6.11.0-syzkaller-10547-g684a64bf32b6-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0000:ffffc90002ddfd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba40 RCX: 09535156e62e3f00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100966e796 R08: ffffffff81746c8c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88804b373c98 R15: ffff88804b373cb0
FS: 00007f939e8e66c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa76e92b000 CR3: 0000000058070000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4055 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f939db7f69a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f939e8e5e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f939e8e5ef0 RCX: 00007f939db7f69a
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007f939e8e5eb0
RBP: 0000000020005d80 R08: 00007f939e8e5ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020005dc0
R13: 00007f939e8e5eb0 R14: 0000000000005dcb R15: 0000000020000240
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0000:ffffc90002ddfd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba40 RCX: 09535156e62e3f00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100966e796 R08: ffffffff81746c8c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88804b373c98 R15: ffff88804b373cb0
FS: 00007f939e8e66c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005615655e7000 CR3: 0000000058070000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: 684a64bf Merge tag 'nfs-for-6.12-1' of git://git.linux..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1270d627980000
kernel config: https://syzkaller.appspot.com/x/.config?x=bd75e1a00004094f
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13834a80580000
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
` (2 preceding siblings ...)
2024-09-25 12:09 ` Edward Adam Davis
@ 2024-09-25 12:42 ` Edward Adam Davis
2024-09-25 12:53 ` syzbot
2024-09-25 13:01 ` Edward Adam Davis
2024-09-25 13:53 ` [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL Edward Adam Davis
5 siblings, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2024-09-25 12:42 UTC (permalink / raw)
To: syzbot+c0360e8367d6d8d04a66; +Cc: linux-kernel, syzkaller-bugs
kthread_run return -EINTR in read_btree_nodes(), it needs to be returnned
to bch2_fs_recovery(), not back to "ret = IS_ERR_OR_NULL(t)".
#syz test
diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..aa0f84d35895 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -280,12 +280,15 @@ static int read_btree_nodes(struct find_btree_nodes *f)
percpu_ref_put(&ca->io_ref);
closure_put(&cl);
f->ret = ret;
- bch_err(c, "error starting kthread: %i", ret);
+ bch_err(c, "error starting kthread: %i %d", ret, PTR_ERR(t));
break;
}
}
err:
closure_sync(&cl);
+ if (IS_ERR(t))
+ return PTR_ERR(t);
+
return f->ret ?: ret;
}
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
` (3 preceding siblings ...)
2024-09-25 12:42 ` Edward Adam Davis
@ 2024-09-25 13:01 ` Edward Adam Davis
2024-09-25 13:26 ` syzbot
2024-09-25 13:53 ` [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL Edward Adam Davis
5 siblings, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2024-09-25 13:01 UTC (permalink / raw)
To: syzbot+c0360e8367d6d8d04a66; +Cc: linux-kernel, syzkaller-bugs
kthread_run return -EINTR in read_btree_nodes(), it needs to be returnned
to bch2_fs_recovery(), not back to "ret = IS_ERR_OR_NULL(t)".
#syz test
diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..df7090ca1e81 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -281,6 +281,10 @@ static int read_btree_nodes(struct find_btree_nodes *f)
closure_put(&cl);
f->ret = ret;
bch_err(c, "error starting kthread: %i", ret);
+ if (IS_ERR(t)) {
+ closure_sync(&cl);
+ return PTR_ERR(t);
+ }
break;
}
}
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL
2024-09-24 22:18 ` [syzbot] [bcachefs?] " syzbot
` (4 preceding siblings ...)
2024-09-25 13:01 ` Edward Adam Davis
@ 2024-09-25 13:53 ` Edward Adam Davis
2024-09-25 15:20 ` Kent Overstreet
5 siblings, 1 reply; 15+ messages in thread
From: Edward Adam Davis @ 2024-09-25 13:53 UTC (permalink / raw)
To: syzbot+c0360e8367d6d8d04a66
Cc: brauner, jack, jfs-discussion, kent.overstreet, linux-bcachefs,
linux-fsdevel, linux-kernel, shaggy, syzkaller-bugs, viro
Syzbot report a kernel BUG in vfs_get_tree.
The root cause is that read_btree_nodes() returned 1 and returned -EINTR
due to kthread_run() execution failure.
The -EINTR needs to be returnned to bch2_fs_recovery(), not return to
"ret = IS_ERR_OR_NULL(t)".
Reported-and-tested-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
fs/bcachefs/btree_node_scan.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..df7090ca1e81 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -281,6 +281,10 @@ static int read_btree_nodes(struct find_btree_nodes *f)
closure_put(&cl);
f->ret = ret;
bch_err(c, "error starting kthread: %i", ret);
+ if (IS_ERR(t)) {
+ closure_sync(&cl);
+ return PTR_ERR(t);
+ }
break;
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL
2024-09-25 13:53 ` [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL Edward Adam Davis
@ 2024-09-25 15:20 ` Kent Overstreet
0 siblings, 0 replies; 15+ messages in thread
From: Kent Overstreet @ 2024-09-25 15:20 UTC (permalink / raw)
To: Edward Adam Davis
Cc: syzbot+c0360e8367d6d8d04a66, brauner, jack, jfs-discussion,
linux-bcachefs, linux-fsdevel, linux-kernel, shaggy,
syzkaller-bugs, viro
On Wed, Sep 25, 2024 at 09:53:00PM GMT, Edward Adam Davis wrote:
> Syzbot report a kernel BUG in vfs_get_tree.
> The root cause is that read_btree_nodes() returned 1 and returned -EINTR
> due to kthread_run() execution failure.
>
> The -EINTR needs to be returnned to bch2_fs_recovery(), not return to
> "ret = IS_ERR_OR_NULL(t)".
>
> Reported-and-tested-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
> fs/bcachefs/btree_node_scan.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
> index b28c649c6838..df7090ca1e81 100644
> --- a/fs/bcachefs/btree_node_scan.c
> +++ b/fs/bcachefs/btree_node_scan.c
> @@ -281,6 +281,10 @@ static int read_btree_nodes(struct find_btree_nodes *f)
> closure_put(&cl);
> f->ret = ret;
> bch_err(c, "error starting kthread: %i", ret);
> + if (IS_ERR(t)) {
> + closure_sync(&cl);
> + return PTR_ERR(t);
> + }
> break;
> }
> }
> --
> 2.43.0
>
I fixed this last night with the patch below...
commit c1a6f5ca052b7f8609917d13cd11fc60c94396aa
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Tue Sep 24 19:31:22 2024 -0400
bcachefs: Fix incorrect IS_ERR_OR_NULL usage
Returning a positive integer instead of an error code causes error paths
to become very confused.
Closes: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..1e694fedc5da 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -275,7 +275,7 @@ static int read_btree_nodes(struct find_btree_nodes *f)
w->ca = ca;
t = kthread_run(read_btree_nodes_worker, w, "read_btree_nodes/%s", ca->name);
- ret = IS_ERR_OR_NULL(t);
+ ret = PTR_ERR_OR_ZERO(t);
if (ret) {
percpu_ref_put(&ca->io_ref);
closure_put(&cl);
^ permalink raw reply related [flat|nested] 15+ messages in thread