* [syzbot] [jfs?] general protection fault in metapage_write_folio
@ 2024-10-08 18:13 syzbot
0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2024-10-08 18:13 UTC (permalink / raw)
To: dave.kleikamp, jfs-discussion, linux-kernel, shaggy,
syzkaller-bugs, willy
Hello,
syzbot found the following issue on:
HEAD commit: c02d24a5af66 Add linux-next specific files for 20241003
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1746fd27980000
kernel config: https://syzkaller.appspot.com/x/.config?x=94f9caf16c0af42d
dashboard link: https://syzkaller.appspot.com/bug?extid=d7ffeb5538fe5c793f74
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10c6fd27980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10b87380580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/641e642c9432/disk-c02d24a5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/98aaf20c29e0/vmlinux-c02d24a5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c23099f2d86b/bzImage-c02d24a5.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/3f7113d64967/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/fc2de7358212/mount_6.gz
mounted in repro #3: https://storage.googleapis.com/syzbot-assets/627888892b4e/mount_11.gz
The issue was bisected to:
commit 35474d52c6056976e675e9130d755cdb749ded5a
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date: Wed Apr 17 17:56:46 2024 +0000
jfs: Convert metapage_writepage to metapage_write_folio
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=155f47d0580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=175f47d0580000
console output: https://syzkaller.appspot.com/x/log.txt?x=135f47d0580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d7ffeb5538fe5c793f74@syzkaller.appspotmail.com
Fixes: 35474d52c605 ("jfs: Convert metapage_writepage to metapage_write_folio")
loop0: rw=0, sector=120, nr_sectors = 8 limit=0
ERROR: (device loop0): remounting filesystem as read-only
syz-executor140: attempt to access beyond end of device
loop0: rw=2049, sector=30744, nr_sectors = 8 limit=0
lbmIODone: I/O error in JFS log
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5242 Comm: syz-executor140 Not tainted 6.12.0-rc1-next-20241003-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:metapage_write_folio+0xb7/0x10e0 fs/jfs/jfs_metapage.c:346
Code: 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 6d 3c cf fe 48 8b 1b 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 4b 3c cf fe 4c 8b 2b 48 8d 84 24 b0
RSP: 0018:ffffc900036172a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffc90003617400 RDI: ffffea0000b5ec40
RBP: ffffc900036173b0 R08: ffffea0000b5ec77 R09: 1ffffd400016bd8e
R10: dffffc0000000000 R11: fffff9400016bd8f R12: ffffea0000b5ec74
R13: ffffea0000b5ec40 R14: dffffc0000000000 R15: ffffc90003617400
FS: 00007f1541cdd6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fe70fb1000 CR3: 000000007aad2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
metapage_write_one+0x2c7/0x680 fs/jfs/jfs_metapage.c:710
force_metapage+0x10a/0x2b0 fs/jfs/jfs_metapage.c:732
txForce fs/jfs/jfs_txnmgr.c:2215 [inline]
txCommit+0x6250/0x6b90 fs/jfs/jfs_txnmgr.c:1315
diNewIAG fs/jfs/jfs_imap.c:2592 [inline]
diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
diAllocAG+0x17ab/0x1e50 fs/jfs/jfs_imap.c:1669
diAlloc+0x1d2/0x1630 fs/jfs/jfs_imap.c:1590
ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
jfs_mkdir+0x1c5/0xba0 fs/jfs/namei.c:225
vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257
do_mkdirat+0x264/0x3a0 fs/namei.c:4280
__do_sys_mkdirat fs/namei.c:4295 [inline]
__se_sys_mkdirat fs/namei.c:4293 [inline]
__x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1541d37e49
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1541cdd168 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f1541dc64a8 RCX: 00007f1541d37e49
RDX: 0000000000000135 RSI: 0000000020000140 RDI: 00000000ffffff9c
RBP: 00007f1541dc64a0 R08: 00007f1541cdd6c0 R09: 0000000000000000
R10: 00007f1541cdd6c0 R11: 0000000000000246 R12: 00007f1541dc64ac
R13: 000000000000000b R14: 00007ffcfa87d490 R15: 00007ffcfa87d578
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:metapage_write_folio+0xb7/0x10e0 fs/jfs/jfs_metapage.c:346
Code: 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 6d 3c cf fe 48 8b 1b 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 4b 3c cf fe 4c 8b 2b 48 8d 84 24 b0
RSP: 0018:ffffc900036172a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffc90003617400 RDI: ffffea0000b5ec40
RBP: ffffc900036173b0 R08: ffffea0000b5ec77 R09: 1ffffd400016bd8e
R10: dffffc0000000000 R11: fffff9400016bd8f R12: ffffea0000b5ec74
R13: ffffea0000b5ec40 R14: dffffc0000000000 R15: ffffc90003617400
FS: 00007f1541cdd6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1541dc3f18 CR3: 000000007aad2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 89 d8 mov %rbx,%rax
3: 48 c1 e8 03 shr $0x3,%rax
7: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
c: 74 08 je 0x16
e: 48 89 df mov %rbx,%rdi
11: e8 6d 3c cf fe call 0xfecf3c83
16: 48 8b 1b mov (%rbx),%rbx
19: 48 89 d8 mov %rbx,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 4b 3c cf fe call 0xfecf3c83
38: 4c 8b 2b mov (%rbx),%r13
3b: 48 rex.W
3c: 8d .byte 0x8d
3d: 84 24 b0 test %ah,(%rax,%rsi,4)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [syzbot] [jfs?] general protection fault in metapage_write_folio
[not found] <20260417124259.996996-1-jie.wang@intel.com>
@ 2026-04-17 5:11 ` syzbot
0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2026-04-17 5:11 UTC (permalink / raw)
To: jie.wang, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lbmIODone
=========================[ 161.221911][ C1] ==================================================================
BUG: KASAN: slab-use-after-free in lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
Read of size 4 at addr ffff888045e46008 by task ksoftirqd/1/30
CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
blk_update_request+0x57e/0xe60 block/blk-mq.c:1016
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178
blk_complete_reqs block/blk-mq.c:1253 [inline]
blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
run_ksoftirqd+0x52/0x180 kernel/softirq.c:1076
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6655:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5415
kmalloc_noprof include/linux/slab.h:950 [inline]
lbmLogInit fs/jfs/jfs_logmgr.c:1819 [inline]
lmLogInit+0x3e5/0x1a00 fs/jfs/jfs_logmgr.c:1267
open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3834
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4360
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6479:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6246 [inline]
kfree+0x1c5/0x6c0 mm/slub.c:6561
lbmLogShutdown fs/jfs/jfs_logmgr.c:1862 [inline]
lmLogShutdown+0x456/0x850 fs/jfs/jfs_logmgr.c:1681
lmLogClose+0x28a/0x520 fs/jfs/jfs_logmgr.c:1457
jfs_umount+0x2fb/0x3d0 fs/jfs/jfs_umount.c:124
jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:328 [inline]
do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888045e46000
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
freed 256-byte region [ffff888045e46000, ffff888045e46100)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888045e47200 pfn:0x45e46
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000240(workingset|head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000240 ffff88801a020b40 ffffea0000c36490 ffff88801a01b988
raw: ffff888045e47200 0000000800100009 00000000f5000000 0000000000000000
head: 0080000000000240 ffff88801a020b40 ffffea0000c36490 ffff88801a01b988
head: ffff888045e47200 0000000800100009 00000000f5000000 0000000000000000
head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6655, tgid 6654 (syz.0.34), ts 161120062767, free_ts 160211674287
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1860
prep_new_page mm/page_alloc.c:1868 [inline]
get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3948
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5228
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x33c/0x3d0 mm/slub.c:7251
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
__kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5410
kmalloc_noprof include/linux/slab.h:950 [inline]
lbmLogInit fs/jfs/jfs_logmgr.c:1819 [inline]
lmLogInit+0x3e5/0x1a00 fs/jfs/jfs_logmgr.c:1267
open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3834
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4360
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
page last free pid 6651 tgid 6650 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1404 [inline]
__free_frozen_pages+0xfa6/0x10f0 mm/page_alloc.c:2945
__slab_free+0x252/0x2a0 mm/slub.c:5608
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x33b/0x680 mm/slub.c:4905
ptlock_alloc+0x20/0x70 mm/memory.c:7563
ptlock_init include/linux/mm.h:3736 [inline]
pagetable_pte_ctor include/linux/mm.h:3785 [inline]
__pte_alloc_one_noprof include/asm-generic/pgalloc.h:79 [inline]
pte_alloc_one+0x7e/0x380 arch/x86/mm/pgtable.c:18
__pte_alloc+0x25/0x1a0 mm/memory.c:453
do_anonymous_page mm/memory.c:5338 [inline]
do_pte_missing+0x1c13/0x2950 mm/memory.c:4548
handle_pte_fault mm/memory.c:6411 [inline]
__handle_mm_fault mm/memory.c:6549 [inline]
handle_mm_fault+0xd0a/0x13c0 mm/memory.c:6718
do_user_addr_fault+0xa73/0x1340 arch/x86/mm/fault.c:1334
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
Memory state around the buggy address:
ffff888045e45f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888045e45f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888045e46000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888045e46080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888045e46100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: a89e3204 jfs: mark metapages discard on invalidate
git tree: https://github.com/wangjie220704/linux.git fix/jfs_invalid_metapage_d7ff
console output: https://syzkaller.appspot.com/x/log.txt?x=16049a6a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=aa6f9ac81297fac6
dashboard link: https://syzkaller.appspot.com/bug?extid=d7ffeb5538fe5c793f74
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Note: no patches were applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-17 5:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260417124259.996996-1-jie.wang@intel.com>
2026-04-17 5:11 ` [syzbot] [jfs?] general protection fault in metapage_write_folio syzbot
2024-10-08 18:13 syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox