syzbot


KMSAN: uninit-value in inode_go_dump (4)

Status: upstream: reported on 2024/04/21 23:11
Subsystems: gfs2
[Documentation on labels]
Reported-by: syzbot+bec528924d6c98923e5d@syzkaller.appspotmail.com
First crash: 16d, last: 16d
Discussions (2)
Title Replies (including bot) Last reply
[syzbot] Monthly gfs2 report (Apr 2024) 0 (1) 2024/04/29 12:34
[syzbot] [gfs2?] KMSAN: uninit-value in inode_go_dump (4) 0 (1) 2024/04/21 23:11
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in inode_go_dump (2) gfs2 1 228d 228d 0/26 auto-obsoleted due to no activity on 2023/12/17 04:58
upstream KMSAN: uninit-value in inode_go_dump (3) gfs2 1 123d 115d 0/26 auto-obsoleted due to no activity on 2024/04/10 06:12
upstream KMSAN: uninit-value in inode_go_dump gfs2 8 329d 472d 0/26 auto-obsoleted due to no activity on 2023/09/17 03:31

Sample crash report:
gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz"
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.0: fatal: filesystem consistency error
  inode = 3 2074
  function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 470
gfs2: fsid=syz:syz.0: G:  s:SH n:2/81a f:qobnN t:SH d:EX/0 a:0 v:0 r:3 m:20 p:1
gfs2: fsid=syz:syz.0:  H: s:SH f:H e:0 p:20593 [syz-executor.0] init_inodes+0x125/0x510 fs/gfs2/ops_fstype.c:884
=====================================================
BUG: KMSAN: uninit-value in inode_go_dump+0x475/0x4b0 fs/gfs2/glops.c:549
 inode_go_dump+0x475/0x4b0 fs/gfs2/glops.c:549
 gfs2_dump_glock+0x221c/0x2340 fs/gfs2/glock.c:2410
 gfs2_consist_inode_i+0x19f/0x230 fs/gfs2/util.c:456
 gfs2_dinode_in fs/gfs2/glops.c:470 [inline]
 gfs2_inode_refresh+0x12c7/0x1560 fs/gfs2/glops.c:490
 inode_go_instantiate+0x6e/0xc0 fs/gfs2/glops.c:509
 gfs2_instantiate+0x272/0x4c0 fs/gfs2/glock.c:454
 gfs2_glock_holder_ready fs/gfs2/glock.c:1336 [inline]
 gfs2_glock_wait+0x2a4/0x3e0 fs/gfs2/glock.c:1356
 gfs2_glock_nq+0x288b/0x3a20 fs/gfs2/glock.c:1616
 gfs2_glock_nq_init fs/gfs2/glock.h:238 [inline]
 gfs2_jindex_hold fs/gfs2/ops_fstype.c:580 [inline]
 init_journal+0x315/0x3a40 fs/gfs2/ops_fstype.c:749
 init_inodes+0x125/0x510 fs/gfs2/ops_fstype.c:884
 gfs2_fill_super+0x3c15/0x42b0 fs/gfs2/ops_fstype.c:1263
 get_tree_bdev+0x681/0x890 fs/super.c:1614
 gfs2_get_tree+0x5c/0x340 fs/gfs2/ops_fstype.c:1341
 vfs_get_tree+0xa7/0x570 fs/super.c:1779
 do_new_mount+0x71f/0x15e0 fs/namespace.c:3352
 path_mount+0x742/0x1f20 fs/namespace.c:3679
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount+0x725/0x810 fs/namespace.c:3875
 __ia32_sys_mount+0xe3/0x150 fs/namespace.c:3875
 ia32_sys_call+0x3a9a/0x40a0 arch/x86/include/generated/asm/syscalls_32.h:22
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xb4/0x120 arch/x86/entry/common.c:321
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:346
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:384
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was created at:
 __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2175 [inline]
 allocate_slab mm/slub.c:2338 [inline]
 new_slab+0x2de/0x1400 mm/slub.c:2391
 ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525
 __slab_alloc mm/slub.c:3610 [inline]
 __slab_alloc_node mm/slub.c:3663 [inline]
 slab_alloc_node mm/slub.c:3835 [inline]
 kmem_cache_alloc_lru+0x6d7/0xbe0 mm/slub.c:3864
 alloc_inode_sb include/linux/fs.h:3091 [inline]
 gfs2_alloc_inode+0x66/0x210 fs/gfs2/super.c:1537
 alloc_inode+0x86/0x460 fs/inode.c:261
 iget5_locked+0xa9/0x210 fs/inode.c:1235
 gfs2_inode_lookup+0xbe/0x1450 fs/gfs2/inode.c:124
 gfs2_lookup_root fs/gfs2/ops_fstype.c:460 [inline]
 init_sb+0xe63/0x1880 fs/gfs2/ops_fstype.c:527
 gfs2_fill_super+0x3288/0x42b0 fs/gfs2/ops_fstype.c:1230
 get_tree_bdev+0x681/0x890 fs/super.c:1614
 gfs2_get_tree+0x5c/0x340 fs/gfs2/ops_fstype.c:1341
 vfs_get_tree+0xa7/0x570 fs/super.c:1779
 do_new_mount+0x71f/0x15e0 fs/namespace.c:3352
 path_mount+0x742/0x1f20 fs/namespace.c:3679
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount+0x725/0x810 fs/namespace.c:3875
 __ia32_sys_mount+0xe3/0x150 fs/namespace.c:3875
 ia32_sys_call+0x3a9a/0x40a0 arch/x86/include/generated/asm/syscalls_32.h:22
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xb4/0x120 arch/x86/entry/common.c:321
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:346
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:384
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

CPU: 0 PID: 20593 Comm: syz-executor.0 Tainted: G        W          6.9.0-rc4-syzkaller-00031-g96fca68c4fbf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/17 23:01 upstream 96fca68c4fbf bd38b692 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in inode_go_dump
* Struck through repros no longer work on HEAD.