syzbot


kernel BUG in f2fs_do_truncate_blocks

Status: upstream: reported on 2025/08/31 08:03
Subsystems: f2fs
[Documentation on labels]
Reported-by: syzbot+1867a378155795cb1680@syzkaller.appspotmail.com
First crash: 5d21h, last: 5d21h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [f2fs?] kernel BUG in f2fs_do_truncate_blocks 0 (1) 2025/08/31 08:03

Sample crash report:
loop0: detected capacity change from 0 to 131072
F2FS-fs (loop0): QUOTA feature is enabled, so ignore qf_name
F2FS-fs (loop0): build fault injection rate: 7
F2FS-fs (loop0): build fault injection type: 0x40004
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0 fs/f2fs/checkpoint.c:77
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of f2fs_ra_meta_pages+0x615/0x970 fs/f2fs/checkpoint.c:303
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of f2fs_ra_meta_pages+0x615/0x970 fs/f2fs/checkpoint.c:303
F2FS-fs (loop0): inject invalid blkaddr in f2fs_is_valid_blkaddr of f2fs_ra_meta_pages+0x1cb/0x970 fs/f2fs/checkpoint.c:275
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0 fs/f2fs/checkpoint.c:77
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0 fs/f2fs/checkpoint.c:77
------------[ cut here ]------------
kernel BUG at fs/f2fs/file.c:824!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5364 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:f2fs_do_truncate_blocks+0x1075/0x10c0 fs/f2fs/file.c:824
Code: 27 fd 90 0f 0b e8 bb 30 bf fd 90 0f 0b e8 b3 30 bf fd 48 89 df 48 c7 c6 00 8c d1 8b e8 e4 71 27 fd 90 0f 0b e8 9c 30 bf fd 90 <0f> 0b e8 94 30 bf fd 90 0f 0b 90 e9 dd fd ff ff e8 86 30 bf fd 90
RSP: 0018:ffffc9000d387620 EFLAGS: 00010287
RAX: ffffffff84008aa4 RBX: 0000000000000003 RCX: 0000000000100000
RDX: ffffc9000e2d2000 RSI: 00000000000385b6 RDI: 00000000000385b7
RBP: ffffc9000d387740 R08: ffff888000714880 R09: 0000000000000002
R10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 00000000ffff039c
FS:  00007f95562866c0(0000) GS:ffff88808d210000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f38293909c0 CR3: 0000000042d26000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:861
 f2fs_truncate+0x452/0x780 fs/f2fs/file.c:911
 f2fs_evict_inode+0x9aa/0x19c0 fs/f2fs/inode.c:897
 evict+0x501/0x9c0 fs/inode.c:810
 f2fs_fill_super+0x563c/0x6ff0 fs/f2fs/super.c:5047
 get_tree_bdev_flags+0x40b/0x4d0 fs/super.c:1692
 vfs_get_tree+0x92/0x2b0 fs/super.c:1815
 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
 do_mount fs/namespace.c:4136 [inline]
 __do_sys_mount fs/namespace.c:4347 [inline]
 __se_sys_mount+0x317/0x410 fs/namespace.c:4324
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f955539038a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9556285e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f9556285ef0 RCX: 00007f955539038a
RDX: 0000200000010580 RSI: 00002000000105c0 RDI: 00007f9556285eb0
RBP: 0000200000010580 R08: 00007f9556285ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00002000000105c0
R13: 00007f9556285eb0 R14: 0000000000010595 R15: 0000200000000100
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:f2fs_do_truncate_blocks+0x1075/0x10c0 fs/f2fs/file.c:824
Code: 27 fd 90 0f 0b e8 bb 30 bf fd 90 0f 0b e8 b3 30 bf fd 48 89 df 48 c7 c6 00 8c d1 8b e8 e4 71 27 fd 90 0f 0b e8 9c 30 bf fd 90 <0f> 0b e8 94 30 bf fd 90 0f 0b 90 e9 dd fd ff ff e8 86 30 bf fd 90
RSP: 0018:ffffc9000d387620 EFLAGS: 00010287
RAX: ffffffff84008aa4 RBX: 0000000000000003 RCX: 0000000000100000
RDX: ffffc9000e2d2000 RSI: 00000000000385b6 RDI: 00000000000385b7
RBP: ffffc9000d387740 R08: ffff888000714880 R09: 0000000000000002
R10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 00000000ffff039c
FS:  00007f95562866c0(0000) GS:ffff88808d210000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f38293909c0 CR3: 0000000042d26000 CR4: 0000000000352ef0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/27 07:56 upstream fab1beda7597 e12e5ba4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in f2fs_do_truncate_blocks
* Struck through repros no longer work on HEAD.