WARNING in nilfs_dat_commit_end

Status: upstream: reported C repro on 2022/10/01 18:00
Subsystems: nilfs2
[Documentation on labels]
Reported-by: syzbot+0c020101894a4ceb0fe0@syzkaller.appspotmail.com
First crash: 1402d, last: 1251d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in nilfs_dat_commit_end nilfs -1 syz, C error 267 1247d 1403d 22/29 fixed on 2023/06/08 14:41
linux-5.15 WARNING in nilfs_dat_commit_end origin:lts-only -1 syz, C done 29560 6h37m 1233d 0/3 upstream: reported C repro on 2023/03/19 13:38
linux-4.19 WARNING in nilfs_dat_commit_end -1 syz, C error 4 1251d 1403d 0/1 upstream: reported C repro on 2022/09/30 13:59
linux-6.1 WARNING in nilfs_dat_commit_end origin:lts-only -1 syz, C done 3102 704d 1233d 0/3 upstream: reported C repro on 2023/03/19 21:57
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2023/02/02 04:17 29m bisect fix linux-4.14.y OK (0) job log log
2022/11/04 16:15 24m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
NILFS error (device loop0): nilfs_check_page: bad entry in directory #2: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, name_len=0
Remounting filesystem read-only
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7973 at fs/nilfs2/dat.c:195 nilfs_dat_commit_end+0x469/0x5c0 fs/nilfs2/dat.c:195
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 7973 Comm: syz-executor125 Not tainted 4.14.295-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 panic+0x1f9/0x42d kernel/panic.c:183
 __warn.cold+0x20/0x44 kernel/panic.c:547
 report_bug+0x208/0x250 lib/bug.c:183
 fixup_bug arch/x86/kernel/traps.c:177 [inline]
 fixup_bug arch/x86/kernel/traps.c:172 [inline]
 do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:nilfs_dat_commit_end+0x469/0x5c0 fs/nilfs2/dat.c:195
RSP: 0018:ffff888095c5f5f8 EFLAGS: 00010297
RAX: ffff8880b39c04c0 RBX: ffff8880a919ea80 RCX: 1ffff1101694e529
RDX: 0000000000000000 RSI: 0000000000000014 RDI: ffff8880b4a732b8
RBP: ffff888095c5f6a0 R08: ffff88808dea10a8 R09: 0000000000000003
R10: 0000000000000000 R11: ffff8880b39c04c0 R12: ffff88808dea09c8
R13: ffff888095c5f6b8 R14: 0000000000000003 R15: 00000026ae000002
 nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:245
 nilfs_direct_propagate fs/nilfs2/direct.c:286 [inline]
 nilfs_direct_propagate+0x1d4/0x270 fs/nilfs2/direct.c:265
 nilfs_bmap_propagate+0x73/0x160 fs/nilfs2/bmap.c:346
 nilfs_collect_file_data+0x41/0xb0 fs/nilfs2/segment.c:582
 nilfs_segctor_apply_buffers+0x191/0x450 fs/nilfs2/segment.c:1027
 nilfs_segctor_scan_file+0x366/0x630 fs/nilfs2/segment.c:1076
 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1204 [inline]
 nilfs_segctor_collect fs/nilfs2/segment.c:1507 [inline]
 nilfs_segctor_do_construct+0x1057/0x78d0 fs/nilfs2/segment.c:2049
 nilfs_segctor_construct+0x6db/0x8e0 fs/nilfs2/segment.c:2385
 nilfs_segctor_write_out fs/nilfs2/segment.c:2708 [inline]
 nilfs_segctor_destroy fs/nilfs2/segment.c:2741 [inline]
 nilfs_detach_log_writer+0x398/0x980 fs/nilfs2/segment.c:2821
 nilfs_put_super+0x3f/0x190 fs/nilfs2/super.c:479
 generic_shutdown_super+0x144/0x370 fs/super.c:446
 kill_block_super+0x95/0xe0 fs/super.c:1161
 deactivate_locked_super+0x6c/0xd0 fs/super.c:319
 deactivate_super+0x7f/0xa0 fs/super.c:350
 cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183
 task_work_run+0x11f/0x190 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xa44/0x2850 kernel/exit.c:868
 do_group_exit+0x100/0x2e0 kernel/exit.c:965
 SYSC_exit_group kernel/exit.c:976 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:974
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f1110147b69
RSP: 002b:00007ffc820f90b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f11101bf330 RCX: 00007f1110147b69
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f11101b9e40
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f11101bf330
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/10/03 14:38 linux-4.14.y 9d5c0b3a8e1a feb56351 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-14 WARNING in nilfs_dat_commit_end
2022/10/02 11:36 linux-4.14.y 9d5c0b3a8e1a feb56351 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-14 WARNING in nilfs_dat_commit_end
2022/10/01 18:00 linux-4.14.y 9d5c0b3a8e1a feb56351 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-14 WARNING in nilfs_dat_commit_end
2023/03/01 18:59 linux-4.14.y 7878a41b6cc1 ef65e6cb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 WARNING in nilfs_dat_commit_end
2023/02/26 11:24 linux-4.14.y 7878a41b6cc1 ee50e71c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 WARNING in nilfs_dat_commit_end
2022/12/28 23:31 linux-4.14.y c4215ee4771b 44712fbc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 WARNING in nilfs_dat_commit_end
* Struck through repros no longer work on HEAD.