syzbot


kernel BUG in __folio_start_writeback

Status: upstream: reported C repro on 2024/11/24 13:45
Subsystems: btrfs
[Documentation on labels]
Reported-by: syzbot+aac7bff85be224de5156@syzkaller.appspotmail.com
First crash: 64d, last: 40d
Cause bisection: introduced by (bisect log) :
commit c87c299776e4d75bcc5559203ae2c37dc0396d80
Author: Qu Wenruo <wqu@suse.com>
Date: Thu Oct 10 04:46:12 2024 +0000

  btrfs: make buffered write to copy one page a time

Crash: VFS: Busy inodes after unmount (use-after-free) (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit 66951e4860d3c688bfa550ea4a19635b57e00eca
Author: Peter Zijlstra <peterz@infradead.org>
Date: Mon Jan 13 12:50:11 2025 +0000

  sched/fair: Fix update_cfs_group() vs DELAY_DEQUEUE

  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [btrfs?] kernel BUG in __folio_start_writeback 9 (15) 2025/01/23 05:06
Last patch testing requests (4)
Created Duration User Patch Repo Result
2024/12/28 13:19 22m retest repro upstream report log
2024/11/30 06:37 23m wqu@suse.com https://github.com/adam900710/linux.git writeback_fix report log
2024/11/29 21:17 1h07m wqu@suse.com https://github.com/adam900710/linux.git writeback_fix report log
2024/11/26 06:42 13m wqu@suse.com https://github.com/btrfs/linux.git for-next report log

Sample crash report:
 tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465
 exit_mmap+0x496/0xc20 mm/mmap.c:1681
 __mmput+0x115/0x3b0 kernel/fork.c:1353
 exit_mm+0x220/0x310 kernel/exit.c:570
 do_exit+0x9b2/0x28e0 kernel/exit.c:925
 do_group_exit+0x207/0x2c0 kernel/exit.c:1087
 __do_sys_exit_group kernel/exit.c:1098 [inline]
 __se_sys_exit_group kernel/exit.c:1096 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096
 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at mm/page-writeback.c:3126!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 3532 Comm: kworker/u8:6 Not tainted 6.13.0-rc2-syzkaller-00018-g7cb1b4663150 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: btrfs-delalloc btrfs_work_helper
RIP: 0010:__folio_start_writeback+0xbae/0xc40 mm/page-writeback.c:3126
Code: 3d c4 ff 4c 89 f7 48 c7 c6 a0 be 13 8c e8 4a b5 0b 00 90 0f 0b e8 62 3d c4 ff 4c 89 f7 48 c7 c6 e0 ba 13 8c e8 33 b5 0b 00 90 <0f> 0b e8 4b 3d c4 ff 4c 89 f7 48 c7 c6 60 bf 13 8c e8 1c b5 0b 00
RSP: 0018:ffffc9000d6cf500 EFLAGS: 00010246
RAX: d2cd35b70a882100 RBX: 0000000000000002 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff8c0a9760 RDI: 0000000000000001
RBP: ffffc9000d6cf670 R08: ffffffff9426d9af R09: 1ffffffff284db35
R10: dffffc0000000000 R11: fffffbfff284db36 R12: dffffc0000000000
R13: 1ffffd40003b7bb8 R14: ffffea0001dbddc0 R15: 1ffff92001ad9eac
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f959254d378 CR3: 000000007ba80000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 process_one_folio fs/btrfs/extent_io.c:187 [inline]
 __process_folios_contig+0x31c/0x540 fs/btrfs/extent_io.c:216
 submit_one_async_extent fs/btrfs/inode.c:1229 [inline]
 submit_compressed_extents+0xde5/0x1630 fs/btrfs/inode.c:1632
 run_ordered_work fs/btrfs/async-thread.c:245 [inline]
 btrfs_work_helper+0x56b/0xc40 fs/btrfs/async-thread.c:324
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__folio_start_writeback+0xbae/0xc40 mm/page-writeback.c:3126
Code: 3d c4 ff 4c 89 f7 48 c7 c6 a0 be 13 8c e8 4a b5 0b 00 90 0f 0b e8 62 3d c4 ff 4c 89 f7 48 c7 c6 e0 ba 13 8c e8 33 b5 0b 00 90 <0f> 0b e8 4b 3d c4 ff 4c 89 f7 48 c7 c6 60 bf 13 8c e8 1c b5 0b 00
RSP: 0018:ffffc9000d6cf500 EFLAGS: 00010246
RAX: d2cd35b70a882100 RBX: 0000000000000002 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff8c0a9760 RDI: 0000000000000001
RBP: ffffc9000d6cf670 R08: ffffffff9426d9af R09: 1ffffffff284db35
R10: dffffc0000000000 R11: fffffbfff284db36 R12: dffffc0000000000
R13: 1ffffd40003b7bb8 R14: ffffea0001dbddc0 R15: 1ffff92001ad9eac
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005595810ad950 CR3: 0000000033916000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/10 03:48 upstream 7cb1b4663150 cfc402b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/12/08 05:51 upstream 7503345ac5f5 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/12/04 18:40 upstream feffde684ac2 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/12/03 04:43 upstream cdd30ebb1b9f 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/11/24 01:25 upstream 228a1157fb9f 68da6d95 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/11/23 23:32 upstream 228a1157fb9f 68da6d95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/11/20 22:13 upstream 8f7c8b88bda4 4fca1650 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/11/20 22:12 upstream 8f7c8b88bda4 4fca1650 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/11/20 21:20 upstream 8f7c8b88bda4 4fca1650 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in __folio_start_writeback
2024/12/05 09:45 upstream feffde684ac2 29f61fce .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in __folio_start_writeback
2024/11/30 00:22 upstream 7af08b57bcb9 b5d2be89 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in __folio_start_writeback
2024/11/26 11:11 upstream 7eef7e306d3c e9a9a9f2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in __folio_start_writeback
2024/11/22 22:25 upstream 28eb75e178d3 68da6d95 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in __folio_start_writeback
2024/11/20 13:34 upstream bf9aa14fc523 4fca1650 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in __folio_start_writeback
2024/12/14 09:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2e7aff49b5da 7cbfbb3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 kernel BUG in __folio_start_writeback
* Struck through repros no longer work on HEAD.