* Re: [LTP] [PATCH v2 3/5] btrfs: move condition for log commit wait into wait_log_commit()
[not found] <842ef70c9ca3ddf17f8660ad24f63f6272621afa.1784733396.git.fdmanana@suse.com>
@ 2026-07-30 14:07 ` kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-07-30 14:07 UTC (permalink / raw)
To: fdmanana@kernel.orgFilipe Manana
Cc: oe-lkp, oliver.sang, ltp, lkp, linux-btrfs
Hello,
kernel test robot noticed "UBSAN:array-index-out-of-bounds_in_btrfs/tree-log.c" on:
commit: a99687b4edeead900d714fa0839a302a5a56d7aa ("[PATCH v2 3/5] btrfs: move condition for log commit wait into wait_log_commit()")
url: https://github.com/intel-lab-lkp/linux/commits/fdmanana-kernel-org/btrfs-stop-sleeping-for-one-jiffy-in-non-ssd-mounts-during-log-commit/20260722-235417
patch link: https://lore.kernel.org/all/842ef70c9ca3ddf17f8660ad24f63f6272621afa.1784733396.git.fdmanana@suse.com/
patch subject: [PATCH v2 3/5] btrfs: move condition for log commit wait into wait_log_commit()
in testcase: ltp
version:
with following parameters:
disk: 1SSD
fs: btrfs
test: syscalls-01
config: x86_64-rhel-9.4-ltp
compiler: gcc-14
test machine: 8 threads Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz (Skylake) with 16G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202607301616.c4685aab-lkp@intel.com
kern :warn : [ 104.466941] [ T5568] ------------[ cut here ]------------
kern :err : [ 104.467469] [ T5568] UBSAN: array-index-out-of-bounds in btrfs/tree-log.c:3173:35
kern :err : [ 104.467989] [ T5568] index -1 is out of range for type 'atomic_t [2]'
kern :warn : [ 104.468507] [ T5568] CPU: 4 UID: 0 PID: 5568 Comm: fdatasync03 Not tainted 7.2.0-rc4+ #1 PREEMPT(lazy)
kern :warn : [ 104.468512] [ T5568] Hardware name: System manufacturer System Product Name/Z170I PRO GAMING, BIOS 3805 05/16/2018
kern :warn : [ 104.468514] [ T5568] Call Trace:
kern :warn : [ 104.468516] [ T5568] <TASK>
kern :warn : [ 104.468519] [ T5568] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
kern :warn : [ 104.468528] [ T5568] ubsan_epilogue (ubsan.c:233)
kern :warn : [ 104.468533] [ T5568] __ubsan_handle_out_of_bounds.cold (ubsan.c:455 ubsan.c:442)
kern :warn : [ 104.468539] [ T5568] ? __pfx_stack_trace_consume_entry (usercopy_64.c:?)
kern :warn : [ 104.468544] [ T5568] wait_log_commit (btrfs/tree-log.c:3173) btrfs
kern :warn : [ 104.468751] [ T5568] ? kernel_text_address (extable.c:125 extable.c:94)
kern :warn : [ 104.468757] [ T5568] ? __pfx_wait_log_commit (btrfs/tree-log.c:4984) btrfs
kern :warn : [ 104.468950] [ T5568] ? arch_stack_walk (x86/kernel/stacktrace.c:26)
kern :warn : [ 104.468955] [ T5568] ? __pfx_autoremove_wake_function (linux/list.h:441 (discriminator 4))
kern :warn : [ 104.468961] [ T5568] ? mutex_lock (linux/instrumented.h:55 linux/atomic/atomic-instrumented.h:4457 locking/mutex.c:161 locking/mutex.c:318)
kern :warn : [ 104.468966] [ T5568] ? __pfx_mutex_lock (locking/mutex.c:1164 (discriminator 1))
kern :warn : [ 104.468973] [ T5568] btrfs_sync_log (btrfs/tree-log.c:3331) btrfs
kern :warn : [ 104.469161] [ T5568] ? __printk_deferred_exit (printk/printk_safe.c:55 (discriminator 1))
kern :warn : [ 104.469164] [ T5568] ? stack_depot_save_flags (stackdepot.c:728)
kern :warn : [ 104.469168] [ T5568] ? kasan_save_stack (kasan/common.c:58)
kern :warn : [ 104.469171] [ T5568] ? kasan_save_stack (kasan/common.c:57)
kern :warn : [ 104.469174] [ T5568] ? __pfx_btrfs_sync_log (btrfs/tree-log.c:3254) btrfs
kern :warn : [ 104.469285] [ T5568] ? do_fsync (sync.c:186 sync.c:200 sync.c:211)
kern :warn : [ 104.469288] [ T5568] ? __x64_sys_fdatasync (sync.c:221 sync.c:219 sync.c:219)
kern :warn : [ 104.469291] [ T5568] ? do_syscall_64 (x86/entry/syscall_64.c:63 x86/entry/syscall_64.c:94)
kern :warn : [ 104.469294] [ T5568] ? entry_SYSCALL_64_after_hwframe (x86/entry/entry_64.S:121)
kern :warn : [ 104.469298] [ T5568] ? __pfx_free_extent_buffer_clear_reading (btrfs/extent_io.c:3746) btrfs
kern :warn : [ 104.469405] [ T5568] ? __pfx_copy_inode_items_to_log (linux/list.h:161) btrfs
kern :warn : [ 104.469512] [ T5568] ? kasan_save_track (kasan/common.c:78)
kern :warn : [ 104.469516] [ T5568] ? kmem_cache_free (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6532)
kern :warn : [ 104.469519] [ T5568] ? btrfs_release_path (btrfs/ctree.c:173 (discriminator 1)) btrfs
kern :warn : [ 104.469618] [ T5568] ? free_frozen_page_commit (linux/instrumented.h:82 asm-generic/bitops/instrumented-non-atomic.h:141 page_alloc.c:2809 page_alloc.c:2881)
kern :warn : [ 104.469622] [ T5568] ? __free_frozen_pages (linux/spinlock.h:390 page_alloc.c:2980)
kern :warn : [ 104.469626] [ T5568] ? __page_cache_release (linux/instrumented.h:82 asm-generic/bitops/instrumented-non-atomic.h:141 linux/page-flags.h:552 swap.c:76)
kern :warn : [ 104.469629] [ T5568] ? __virt_addr_valid (linux/mmzone.h:2187 (discriminator 1) linux/mmzone.h:2269 (discriminator 1) x86/mm/physaddr.c:54 (discriminator 1))
kern :warn : [ 104.469632] [ T5568] ? rcu_segcblist_enqueue (linux/instrumented.h:112 linux/atomic/atomic-instrumented.h:3260 rcu/rcu_segcblist.c:214 rcu/rcu_segcblist.c:231 rcu/rcu_segcblist.c:332)
kern :warn : [ 104.469635] [ T5568] ? __call_rcu_common+0x341/0x970
kern :warn : [ 104.469639] [ T5568] ? __pfx___call_rcu_common+0x10/0x10
kern :warn : [ 104.469642] [ T5568] ? _raw_spin_lock_irq (linux/instrumented.h:55 linux/atomic/atomic-instrumented.h:1301 asm-generic/qspinlock.h:111 linux/spinlock.h:187 linux/spinlock_api_smp.h:143 locking/spinlock.c:174)
kern :warn : [ 104.469645] [ T5568] ? detach_extent_buffer_folio (linux/mm.h:2124 linux/pagemap.h:636 btrfs/extent_io.c:2976) btrfs
kern :warn : [ 104.469753] [ T5568] ? release_extent_buffer (btrfs/extent_io.c:3758 btrfs/extent_io.c:3721) btrfs
kern :warn : [ 104.469860] [ T5568] ? free_extent_buffer_clear_reading (btrfs/extent_io.c:3821) btrfs
kern :warn : [ 104.469966] [ T5568] ? __pfx_free_extent_buffer_clear_reading (btrfs/extent_io.c:3746) btrfs
kern :warn : [ 104.470073] [ T5568] btrfs_sync_file (btrfs/file.c:1726) btrfs
kern :warn : [ 104.470181] [ T5568] ? __pfx_btrfs_sync_file (btrfs/file.c:1489) btrfs
kern :warn : [ 104.470296] [ T5568] ? fdget (linux/instrumented.h:82 linux/atomic/atomic-instrumented.h:49 file.c:1194 file.c:1208)
kern :warn : [ 104.470300] [ T5568] do_fsync (sync.c:186 sync.c:200 sync.c:211)
kern :warn : [ 104.470303] [ T5568] __x64_sys_fdatasync (sync.c:221 sync.c:219 sync.c:219)
kern :warn : [ 104.470306] [ T5568] do_syscall_64 (x86/entry/syscall_64.c:63 x86/entry/syscall_64.c:94)
kern :warn : [ 104.470310] [ T5568] ? do_syscall_64 (linux/irq-entry-common.h:210 linux/irq-entry-common.h:230 linux/entry-common.h:318 x86/entry/syscall_64.c:100)
kern :warn : [ 104.470313] [ T5568] ? __pfx_vfs_write (linux/fs.h:2733 (discriminator 1))
kern :warn : [ 104.470317] [ T5568] ? __x64_sys_munmap (mmap.c:1079 mmap.c:1076 mmap.c:1076)
kern :warn : [ 104.470320] [ T5568] ? do_syscall_64 (linux/irq-entry-common.h:210 linux/irq-entry-common.h:230 linux/entry-common.h:318 x86/entry/syscall_64.c:100)
kern :warn : [ 104.470324] [ T5568] ? fdget_pos (linux/instrumented.h:82 linux/atomic/atomic-instrumented.h:3188 linux/file_ref.h:215 file.c:1231 file.c:1257)
kern :warn : [ 104.470327] [ T5568] ? ksys_write (read_write.c:739)
kern :warn : [ 104.470330] [ T5568] ? __pfx_ksys_write (read_write.c:723)
kern :warn : [ 104.470333] [ T5568] ? __pfx_ksys_write (read_write.c:723)
kern :warn : [ 104.470337] [ T5568] ? do_syscall_64 (linux/irq-entry-common.h:210 linux/irq-entry-common.h:230 linux/entry-common.h:318 x86/entry/syscall_64.c:100)
kern :warn : [ 104.470340] [ T5568] ? do_syscall_64 (linux/irq-entry-common.h:210 linux/irq-entry-common.h:230 linux/entry-common.h:318 x86/entry/syscall_64.c:100)
kern :warn : [ 104.470344] [ T5568] ? do_syscall_64 (linux/randomize_kstack.h:57 x86/entry/syscall_64.c:92)
kern :warn : [ 104.470347] [ T5568] entry_SYSCALL_64_after_hwframe (x86/entry/entry_64.S:121)
kern :warn : [ 104.470350] [ T5568] RIP: 0033:0x7f28a60b5687
kern :warn : [ 104.470353] [ T5568] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
All code
========
0: 48 89 fa mov %rdi,%rdx
3: 4c 89 df mov %r11,%rdi
6: e8 58 b3 00 00 call 0xb363
b: 8b 93 08 03 00 00 mov 0x308(%rbx),%edx
11: 59 pop %rcx
12: 5e pop %rsi
13: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax
17: 74 1a je 0x33
19: 5b pop %rbx
1a: c3 ret
1b: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
22: 00
23: 48 8b 44 24 10 mov 0x10(%rsp),%rax
28: 0f 05 syscall
2a:* 5b pop %rbx <-- trapping instruction
2b: c3 ret
2c: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
33: 83 e2 39 and $0x39,%edx
36: 83 fa 08 cmp $0x8,%edx
39: 75 de jne 0x19
3b: e8 23 ff ff ff call 0xffffffffffffff63
Code starting with the faulting instruction
===========================================
0: 5b pop %rbx
1: c3 ret
2: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
9: 83 e2 39 and $0x39,%edx
c: 83 fa 08 cmp $0x8,%edx
f: 75 de jne 0xffffffffffffffef
11: e8 23 ff ff ff call 0xffffffffffffff39
kern :warn : [ 104.470356] [ T5568] RSP: 002b:00007ffcb7666460 EFLAGS: 00000202 ORIG_RAX: 000000000000004b
kern :warn : [ 104.470360] [ T5568] RAX: ffffffffffffffda RBX: 00007f28a6023780 RCX: 00007f28a60b5687
kern :warn : [ 104.470362] [ T5568] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
kern :warn : [ 104.470363] [ T5568] RBP: 00007f28a6023720 R08: 0000000000000000 R09: 0000000000000000
kern :warn : [ 104.470365] [ T5568] R10: 0000000000000000 R11: 0000000000000202 R12: 000056382db4c047
kern :warn : [ 104.470367] [ T5568] R13: 0000000000000004 R14: 0000000000000000 R15: 000056382db4d260
kern :warn : [ 104.470370] [ T5568] </TASK>
kern :warn : [ 104.504778] [ T5568] ---[ end trace ]---
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260730/202607301616.c4685aab-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-30 14:08 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <842ef70c9ca3ddf17f8660ad24f63f6272621afa.1784733396.git.fdmanana@suse.com>
2026-07-30 14:07 ` [LTP] [PATCH v2 3/5] btrfs: move condition for log commit wait into wait_log_commit() kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox