syzbot


kernel BUG in ext4_es_cache_extent

Status: fixed on 2023/02/24 13:50
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+c7358a3cd05ee786eb31@syzkaller.appspotmail.com
Fix commit: c878bea3c9d7 ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state
First crash: 802d, last: 439d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: kernel BUG in ext4_es_cache_extent (log)
Repro: C syz .config
  
Discussions (6)
Title Replies (including bot) Last reply
[PATCH 5.17 000/772] 5.17.14-rc1 review 793 (793) 2022/06/20 15:05
[PATCH 5.10 000/452] 5.10.121-rc1 review 474 (474) 2022/06/16 13:09
[PATCH 5.18 000/879] 5.18.3-rc1 review 893 (893) 2022/06/09 06:12
[PATCH 5.15 000/667] 5.15.46-rc1 review 678 (678) 2022/06/09 00:23
[PATCH] ext4: Fix block validation on non-journal fs in __ext4_iget() 3 (3) 2022/05/17 17:40
[syzbot] kernel BUG in ext4_es_cache_extent 3 (5) 2022/04/20 13:57
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 kernel BUG in ext4_es_cache_extent ext4 C 16 8d09h 595d 0/2 upstream: reported C repro on 2022/08/28 10:36
android-5-10 kernel BUG in ext4_es_cache_extent C error 1 595d 595d 0/2 closed as invalid on 2022/09/13 19:49
linux-4.14 kernel BUG in __es_tree_search C error 1 595d 595d 0/1 upstream: reported C repro on 2022/08/28 11:40
linux-4.19 kernel BUG in __es_tree_search C error 2 535d 595d 0/1 upstream: reported C repro on 2022/08/28 11:40
Last patch testing requests (7)
Created Duration User Patch Repo Result
2022/09/30 19:20 9m tadeusz.struk@linaro.org https://android.googlesource.com/kernel/common android12-5.10-lts report log
2022/09/30 19:20 10m tadeusz.struk@linaro.org upstream report log
2022/09/30 18:32 16m tadeusz.struk@linaro.org patch upstream OK log
2022/09/30 18:30 17m tadeusz.struk@linaro.org patch https://android.googlesource.com/kernel/common android12-5.10-lts OK log
2022/02/13 18:03 9m phind.uet@gmail.com patch upstream OK
2022/02/13 15:38 8m phind.uet@gmail.com upstream report log
2022/02/13 11:55 8m phind.uet@gmail.com linux-next error OK
Fix bisection attempts (3)
Created Duration User Patch Repo Result
2022/05/19 20:31 19m bisect fix upstream job log (0) log
2022/04/19 20:12 18m bisect fix upstream job log (0) log
2022/03/19 10:42 18m bisect fix upstream job log (0) log

Sample crash report:
EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors
EXT4-fs (loop0): orphan cleanup on readonly fs
EXT4-fs error (device loop0): ext4_quota_enable:6779: inode #5: comm syz-executor227: casefold flag without casefold feature
------------[ cut here ]------------
kernel BUG at fs/ext4/extents_status.c:899!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3605 Comm: syz-executor227 Not tainted 6.0.0-rc3-syzkaller-00007-gdcf8e5633e2e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:ext4_es_cache_extent+0x4e3/0x540 fs/ext4/extents_status.c:899
Code: 00 48 c7 c7 40 a1 02 8a c6 05 84 a4 b2 0b 01 e8 b3 e5 23 07 e9 5a ff ff ff e8 e9 44 65 ff 0f 0b e9 d7 fc ff ff e8 dd 44 65 ff <0f> 0b e8 d6 44 65 ff 0f 0b e9 13 fe ff ff e8 fa ae b1 ff e9 c7 fb
RSP: 0018:ffffc900039ff020 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00000000000063de RCX: 0000000000000000
RDX: ffff8880211c1d80 RSI: ffffffff8216c553 RDI: 0000000000000004
RBP: ffff8880729daad0 R08: 0000000000000004 R09: 00000000ffffffff
R10: 00000000000063de R11: 000000000000000d R12: 0000000000000001
R13: 00000000ffffffff R14: 1ffff9200073fe05 R15: 00008f51ffffffff
FS:  00005555558ce300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000002185268 CR3: 0000000070751000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 ext4_cache_extents+0x13e/0x2d0 fs/ext4/extents.c:518
 ext4_find_extent+0x8f6/0xd10 fs/ext4/extents.c:916
 ext4_ext_map_blocks+0x1dd/0x5f50 fs/ext4/extents.c:4097
 ext4_map_blocks+0xa7b/0x18d0 fs/ext4/inode.c:570
 ext4_getblk+0x167/0x750 fs/ext4/inode.c:858
 ext4_bread+0x2a/0x140 fs/ext4/inode.c:914
 ext4_quota_read+0x246/0x320 fs/ext4/super.c:6910
 v2_read_header+0x73/0x100 fs/quota/quota_v2.c:62
 v2_check_quota_file+0x6f/0x1c0 fs/quota/quota_v2.c:81
 dquot_load_quota_sb+0x573/0xef0 fs/quota/dquot.c:2400
 dquot_load_quota_inode fs/quota/dquot.c:2443 [inline]
 dquot_load_quota_inode+0x200/0x390 fs/quota/dquot.c:2435
 ext4_quota_enable fs/ext4/super.c:6788 [inline]
 ext4_enable_quotas+0x5a1/0xb70 fs/ext4/super.c:6814
 ext4_orphan_cleanup+0xde1/0x10f0 fs/ext4/orphan.c:432
 __ext4_fill_super fs/ext4/super.c:5378 [inline]
 ext4_fill_super+0xab06/0xe8d0 fs/ext4/super.c:5517
 get_tree_bdev+0x440/0x760 fs/super.c:1323
 vfs_get_tree+0x89/0x2f0 fs/super.c:1530
 do_new_mount fs/namespace.c:3040 [inline]
 path_mount+0x1326/0x1e20 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fd0372695ca
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc73d7a508 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc73d7a560 RCX: 00007fd0372695ca
RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007ffc73d7a520
RBP: 00007ffc73d7a520 R08: 00007ffc73d7a560 R09: 0000000800000015
R10: 0000000000000081 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000000000003 R14: 0000000000000003 R15: 000000000000041c
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_es_cache_extent+0x4e3/0x540 fs/ext4/extents_status.c:899
Code: 00 48 c7 c7 40 a1 02 8a c6 05 84 a4 b2 0b 01 e8 b3 e5 23 07 e9 5a ff ff ff e8 e9 44 65 ff 0f 0b e9 d7 fc ff ff e8 dd 44 65 ff <0f> 0b e8 d6 44 65 ff 0f 0b e9 13 fe ff ff e8 fa ae b1 ff e9 c7 fb
RSP: 0018:ffffc900039ff020 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00000000000063de RCX: 0000000000000000
RDX: ffff8880211c1d80 RSI: ffffffff8216c553 RDI: 0000000000000004
RBP: ffff8880729daad0 R08: 0000000000000004 R09: 00000000ffffffff
R10: 00000000000063de R11: 000000000000000d R12: 0000000000000001
R13: 00000000ffffffff R14: 1ffff9200073fe05 R15: 00008f51ffffffff
FS:  00005555558ce300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000002185268 CR3: 0000000070751000 CR4: 0000000000350ef0

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/08/31 08:58 upstream dcf8e5633e2e 4a380809 .config strace log report syz C ci-upstream-kasan-gce-root kernel BUG in ext4_es_cache_extent
2022/03/20 18:18 upstream 14702b3b2438 e2d91b1d .config console log report syz C ci-upstream-kasan-gce-selinux-root kernel BUG in ext4_es_cache_extent
2022/02/17 10:42 upstream 359303076163 2bea8a27 .config console log report syz C ci-upstream-kasan-gce-smack-root kernel BUG in ext4_es_cache_extent
2022/02/02 13:45 upstream 9f7fb8de5d9b 4ebb2798 .config console log report syz C ci-upstream-kasan-gce-root kernel BUG in ext4_es_cache_extent
2022/08/29 03:06 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a41a877bc12d 07177916 .config console log report syz C ci-upstream-gce-arm64 kernel BUG in ext4_es_cache_extent
2023/01/31 18:38 upstream 22b8077d0fce b68fb8d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in ext4_es_cache_extent
* Struck through repros no longer work on HEAD.