syzbot


BUG: sleeping function called from invalid context in f2fs_register_inmem_page

Status: upstream: reported C repro on 2023/03/11 15:33
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+0f88499e6ce46b4e9300@syzkaller.appspotmail.com
First crash: 641d, last: 11d
Fix commit to backport (bisect log) :
tree: upstream
commit 3db1de0e582c358dd013f3703cd55b5fe4076436
Author: Daeho Jeong <daehojeong@google.com>
Date: Thu Apr 28 18:18:09 2022 +0000

  f2fs: change the current atomic write way

  
Fix bisection: the issue occurs on the latest tested release (bisect log)
Crash: BUG: sleeping function called from invalid context in f2fs_register_inmem_page (log)
Repro: C syz .config
  
Bug presence (2)
Date Name Commit Repro Result
2023/05/04 linux-5.15.y (ToT) 8a7f2a5c5aa1 C [report] BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/05/04 upstream (ToT) fa31fc82fb77 C Didn't crash
Last patch testing requests (5)
Created Duration User Patch Repo Result
2024/11/30 21:40 16m retest repro linux-5.15.y report log
2024/10/09 19:17 14m retest repro linux-5.15.y report log
2024/10/09 19:17 19m retest repro linux-5.15.y report log
2024/10/09 19:17 14m retest repro linux-5.15.y report log
2024/10/09 19:17 20m retest repro linux-5.15.y report log
Fix bisection attempts (4)
Created Duration User Patch Repo Result
2023/09/17 18:39 5h29m fix candidate upstream OK (1) job log
2023/07/06 05:09 5h18m bisect fix linux-5.15.y OK (0) job log log
2023/06/03 07:03 34m bisect fix linux-5.15.y OK (0) job log log
2023/05/02 08:45 37m bisect fix linux-5.15.y OK (0) job log log

Sample crash report:
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:209
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3758, name: syz-executor389
1 lock held by syz-executor389/3758:
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pte_range mm/memory.c:1331 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pmd_range mm/memory.c:1494 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pud_range mm/memory.c:1523 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_p4d_range mm/memory.c:1544 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: unmap_page_range+0x9c3/0x2630 mm/memory.c:1565
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 3758 Comm: syz-executor389 Not tainted 5.15.105-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 ___might_sleep+0x547/0x6a0 kernel/sched/core.c:9625
 might_alloc include/linux/sched/mm.h:209 [inline]
 slab_pre_alloc_hook+0x44/0xc0 mm/slab.h:492
 slab_alloc_node mm/slub.c:3134 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0x3f/0x280 mm/slub.c:3233
 f2fs_kmem_cache_alloc_nofail fs/f2fs/f2fs.h:2627 [inline]
 f2fs_kmem_cache_alloc fs/f2fs/f2fs.h:2637 [inline]
 f2fs_register_inmem_page+0x1d0/0x6f0 fs/f2fs/segment.c:192
 f2fs_set_data_page_dirty+0x7bb/0xa90 fs/f2fs/data.c:3781
 zap_pte_range mm/memory.c:1366 [inline]
 zap_pmd_range mm/memory.c:1494 [inline]
 zap_pud_range mm/memory.c:1523 [inline]
 zap_p4d_range mm/memory.c:1544 [inline]
 unmap_page_range+0xdcd/0x2630 mm/memory.c:1565
 unmap_vmas+0x1f8/0x390 mm/memory.c:1642
 exit_mmap+0x3b6/0x670 mm/mmap.c:3186
 __mmput+0x112/0x3b0 kernel/fork.c:1118
 exit_mm+0x688/0x7f0 kernel/exit.c:548
 do_exit+0x626/0x2480 kernel/exit.c:859
 do_group_exit+0x144/0x310 kernel/exit.c:994
 get_signal+0xc66/0x14e0 kernel/signal.c:2889
 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:865
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x5d/0x250 kernel/entry/common.c:301
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f20c94ce799
Code: Unable to access opcode bytes at RIP 0x7f20c94ce76f.
RSP: 002b:00007f20c947a308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f20c955b7e8 RCX: 00007f20c94ce799
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f20c955b7e8
RBP: 00007f20c955b7e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f20c955b7ec
R13: 00007f20c9527f48 R14: 0032656c69662f2e R15: 0000000000022000
 </TASK>

=============================
[ BUG: Invalid wait context ]
5.15.105-syzkaller #0 Tainted: G        W        
-----------------------------
syz-executor389/3758 is trying to lock:
ffff88807092ac98 (&fi->inmem_lock){+.+.}-{3:3}, at: f2fs_register_inmem_page+0x31b/0x6f0 fs/f2fs/segment.c:201
other info that might help us debug this:
context-{4:4}
1 lock held by syz-executor389/3758:
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pte_range mm/memory.c:1331 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pmd_range mm/memory.c:1494 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pud_range mm/memory.c:1523 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_p4d_range mm/memory.c:1544 [inline]
 #0: ffff88807970f9d8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: unmap_page_range+0x9c3/0x2630 mm/memory.c:1565
stack backtrace:
CPU: 1 PID: 3758 Comm: syz-executor389 Tainted: G        W         5.15.105-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4663 [inline]
 check_wait_context kernel/locking/lockdep.c:4724 [inline]
 __lock_acquire+0x14f5/0x1ff0 kernel/locking/lockdep.c:4961
 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5622
 __mutex_lock_common+0x1da/0x25a0 kernel/locking/mutex.c:596
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 f2fs_register_inmem_page+0x31b/0x6f0 fs/f2fs/segment.c:201
 f2fs_set_data_page_dirty+0x7bb/0xa90 fs/f2fs/data.c:3781
 zap_pte_range mm/memory.c:1366 [inline]
 zap_pmd_range mm/memory.c:1494 [inline]
 zap_pud_range mm/memory.c:1523 [inline]
 zap_p4d_range mm/memory.c:1544 [inline]
 unmap_page_range+0xdcd/0x2630 mm/memory.c:1565
 unmap_vmas+0x1f8/0x390 mm/memory.c:1642
 exit_mmap+0x3b6/0x670 mm/mmap.c:3186
 __mmput+0x112/0x3b0 kernel/fork.c:1118
 exit_mm+0x688/0x7f0 kernel/exit.c:548
 do_exit+0x626/0x2480 kernel/exit.c:859
 do_group_exit+0x144/0x310 kernel/exit.c:994
 get_signal+0xc66/0x14e0 kernel/signal.c:2889
 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:865
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x5d/0x250 kernel/entry/common.c:301
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f20c94ce799
Code: Unable to access opcode bytes at RIP 0x7f20c94ce76f.
RSP: 002b:00007f20c947a308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f20c955b7e8 RCX: 00007f20c94ce799
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f20c955b7e8
RBP: 00007f20c955b7e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f20c955b7ec
R13: 00007f20c9527f48 R14: 0032656c69662f2e R15: 0000000000022000
 </TASK>

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/04/02 08:32 linux-5.15.y c957cbb87315 f325deb0 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/03/13 07:38 linux-5.15.y bbf9f29bac04 5205ef30 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2024/11/16 21:14 linux-5.15.y d98fd109f827 cfe3a04a .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/19 17:37 linux-5.15.y 80529b4968a8 cb976f63 .config console log report syz [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/03/27 07:23 linux-5.15.y 115472395b0a fbf0499a .config console log report syz [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/19 17:19 linux-5.15.y 80529b4968a8 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2024/11/16 20:00 linux-5.15.y d98fd109f827 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/12/06 18:43 linux-5.15.y 9b91d36ba301 e3299f55 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/12/05 23:27 linux-5.15.y 9b91d36ba301 858d62d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/12/03 10:25 linux-5.15.y 9b91d36ba301 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/30 01:38 linux-5.15.y a78d278e01b1 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/29 17:30 linux-5.15.y a78d278e01b1 6e78f9ce .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/29 02:19 linux-5.15.y a78d278e01b1 1adfb6f6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/28 19:16 linux-5.15.y a78d278e01b1 9fe51b7c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/28 09:33 linux-5.15.y 2a910f4af54d 9fe51b7c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/23 17:45 linux-5.15.y 2a910f4af54d 5b429f39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/11/22 19:14 linux-5.15.y 2a910f4af54d 03e12510 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/03/27 22:27 linux-5.15.y 115472395b0a 47f3aaf1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/03/27 13:18 linux-5.15.y 115472395b0a f8f96aa9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/03/27 10:14 linux-5.15.y 115472395b0a f8f96aa9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/03/26 22:41 linux-5.15.y 115472395b0a fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/03/12 19:18 linux-5.15.y bbf9f29bac04 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
2023/03/11 15:33 linux-5.15.y d214f240b0f6 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: sleeping function called from invalid context in f2fs_register_inmem_page
* Struck through repros no longer work on HEAD.