syzbot

 sign-in | mailing list | source | docs
🐞 Open [561] 🐞 Fixed [32] 🐞 Invalid [301] ⬇ Missing Backports [45] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

kernel BUG in end_page_writeback

Status: fixed on 2023/06/07 17:22
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+2fec40eb12db588050b1@syzkaller.appspotmail.com
Fix commit: 9a7f63283af6 f2fs: fix to avoid use-after-free for cached IPU bio
First crash: 413d, last: 363d
Fix bisection: fixed by (bisect log) :
commit 9a7f63283af6befc0f91d549f4f6917dff7479a9
Author: Chao Yu <chao@kernel.org>
Date: Mon Apr 10 02:14:02 2023 +0000

  f2fs: fix to avoid use-after-free for cached IPU bio

  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2023/05/07 linux-5.15.y (ToT) 8a7f2a5c5aa1 C [report] kernel BUG in end_page_writeback
2023/05/07 upstream (ToT) fc4354c6e5c2 C Didn't crash
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 kernel BUG in end_page_writeback nilfs2 C 1 426d 490d 0/1 upstream: reported C repro on 2022/12/30 20:15
android-5-10 kernel BUG in end_page_writeback f2fs C error inconclusive 3 401d 452d 2/2 fixed on 2023/06/30 00:53
android-54 kernel BUG in end_page_writeback f2fs C 7 2d14h 452d 0/2 upstream: reported C repro on 2023/02/06 23:18
▶ ▼ Last patch testing requests (13)
Created Duration User Patch Repo Result
2023/04/05 08:45 28m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git 90a77bca4240c82e46fca69d22ed8bba50c024dd OK log
2023/04/04 08:43 28m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git b7d0fbe4976d4dbf4e1b60b99f41e0f39f544279 OK log
2023/04/04 08:08 25m tudor.ambarus@linaro.org https://github.com/ambarus/linux.git bug-end_page_writeback report log
2023/04/04 07:07 24m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git 90a77bca4240c82e46fca69d22ed8bba50c024dd report log
2023/04/04 06:29 26m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git bde1ae2407514ce7a7e0ee8965cfa418643551ce report log
2023/04/04 05:56 26m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git ac5f88642cb211152041f84a985309e9af4baf59 report log
2023/04/03 16:57 28m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git b7d0fbe4976d4dbf4e1b60b99f41e0f39f544279 OK log
2023/04/03 16:31 20m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git 02904e8a2f6530b3d8381fabde8feebfcb6d03f6 report log
2023/04/03 15:58 27m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git 87b9ac7bd301f53b122224fc8eddb1f4045e3f2c report log
2023/04/03 15:19 25m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git 088da6b80539816e22656df0e5333e06a43316a8 report log
2023/04/03 14:51 23m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git 4ca3fd39c72efa250129d2af406c3bb56eec7dd9 OK log
2023/04/03 14:17 24m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git v5.15.105 OK log
2023/04/03 13:46 23m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git v5.15.103 report log
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2023/06/06 09:56 4h06m bisect fix linux-5.15.y job log (1)
2023/04/28 06:49 48m bisect fix linux-5.15.y job log (0) log

Sample crash report:
------------[ cut here ]------------
kernel BUG at mm/filemap.c:1604!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 5.15.109-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:end_page_writeback+0x501/0x690 mm/filemap.c:1604
Code: 00 00 e8 92 62 d8 ff 4d 89 fd e9 45 01 00 00 e8 85 62 d8 ff 4c 89 e7 48 c7 c6 e0 e3 92 8a e8 a6 33 0e 00 0f 0b e8 6f 62 d8 ff <0f> 0b e8 68 62 d8 ff 4c 89 ff 48 c7 c6 a0 de 92 8a e8 89 33 0e 00
RSP: 0018:ffffc90000d37b68 EFLAGS: 00010246
RAX: ffffffff81a77c11 RBX: 0000000000000000 RCX: ffff88813fe21d00
RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000082 R08: ffffffff81a779c1 R09: fffffbfff1bc7466
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffea0001dd8240
R13: dffffc0000000000 R14: ffffea0001dd8248 R15: ffffea0001dd8240
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0829582000 CR3: 00000000750f4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 end_bio_bh_io_sync+0xb3/0x110 fs/buffer.c:3007
 req_bio_endio block/blk-core.c:261 [inline]
 blk_update_request+0x81a/0x13d0 block/blk-core.c:1440
 blk_mq_end_request+0x3a/0x70 block/blk-mq.c:575
 blk_complete_reqs block/blk-mq.c:587 [inline]
 blk_done_softirq+0xf2/0x130 block/blk-mq.c:592
 __do_softirq+0x3b3/0x93a kernel/softirq.c:558
 run_ksoftirqd+0xc1/0x120 kernel/softirq.c:920
 smpboot_thread_fn+0x51b/0x9d0 kernel/smpboot.c:164
 kthread+0x3f6/0x4f0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Modules linked in:
---[ end trace fcb0cd777eea9bdb ]---
RIP: 0010:end_page_writeback+0x501/0x690 mm/filemap.c:1604
Code: 00 00 e8 92 62 d8 ff 4d 89 fd e9 45 01 00 00 e8 85 62 d8 ff 4c 89 e7 48 c7 c6 e0 e3 92 8a e8 a6 33 0e 00 0f 0b e8 6f 62 d8 ff <0f> 0b e8 68 62 d8 ff 4c 89 ff 48 c7 c6 a0 de 92 8a e8 89 33 0e 00
RSP: 0018:ffffc90000d37b68 EFLAGS: 00010246
RAX: ffffffff81a77c11 RBX: 0000000000000000 RCX: ffff88813fe21d00
RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000082 R08: ffffffff81a779c1 R09: fffffbfff1bc7466
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffea0001dd8240
R13: dffffc0000000000 R14: ffffea0001dd8248 R15: ffffea0001dd8240
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0829582000 CR3: 00000000750f4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/04/30 10:21 linux-5.15.y f48aeeaaa64c 62df2017 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in end_page_writeback
2023/03/18 15:16 linux-5.15.y 8020ae3c051d 7939252e .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in end_page_writeback
2023/04/30 20:01 linux-5.15.y f48aeeaaa64c 62df2017 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in end_page_writeback
2023/03/29 06:17 linux-5.15.y 115472395b0a fc067f05 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in end_page_writeback
2023/03/29 04:38 linux-5.15.y 115472395b0a fc067f05 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in end_page_writeback
2023/03/18 14:29 linux-5.15.y 8020ae3c051d 7939252e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in end_page_writeback
* Struck through repros no longer work on HEAD.