syzbot


kernel BUG in ext4_da_write_end

Status: upstream: reported C repro on 2023/03/03 05:32
Reported-by: syzbot+d0dda2a71a6a01c87ec3@syzkaller.appspotmail.com
First crash: 471d, last: 471d

Sample crash report:
EXT4-fs error (device loop4): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs error (device loop3): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
------------[ cut here ]------------
EXT4-fs error (device loop5): ext4_mb_generate_buddy:754: group 0, 
kernel BUG at fs/ext4/inode.c:3192!
block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs error (device loop2): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue
EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop4): This should not happen!! Data will be lost

EXT4-fs (loop0): This should not happen!! Data will be lost

invalid opcode: 0000 [#1] PREEMPT SMP KASAN
EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
Modules linked in:
CPU: 1 PID: 8102 Comm: syz-executor384 Not tainted 4.14.307-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
task: ffff8880aacfe4c0 task.stack: ffff8880a1058000
RIP: 0010:ext4_da_should_update_i_disksize fs/ext4/inode.c:3192 [inline]
RIP: 0010:ext4_da_write_end+0x7b9/0x8e0 fs/ext4/inode.c:3231
RSP: 0018:ffff8880a105f5e0 EFLAGS: 00010297
RAX: ffff8880aacfe4c0 RBX: ffff88808a41f540 RCX: ffff88808a41f330
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffea000228cf08
RBP: ffff88808a41f330 R08: 0000000000000001 R09: ffffea000228cf00
R10: ffff88808a33c07e R11: ffff8880aacfe4c0 R12: 0000000000000001
R13: 000000000000007e R14: 0000000000000001 R15: 0000000000000001
FS:  00007f3f5d07d700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a24acc3cc8 CR3: 00000000a9139000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 generic_perform_write+0x274/0x430 mm/filemap.c:3066
 __generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
EXT4-fs (loop4): Total free blocks count 0
 ext4_file_write_iter+0x276/0xd20 fs/ext4/file.c:270
EXT4-fs (loop0): Total free blocks count 0
EXT4-fs (loop4): Free/Dirty block details
 call_write_iter include/linux/fs.h:1780 [inline]
 do_iter_readv_writev+0x4cf/0x5f0 fs/read_write.c:675
EXT4-fs (loop5): This should not happen!! Data will be lost

 do_iter_write+0x152/0x550 fs/read_write.c:954
EXT4-fs (loop0): Free/Dirty block details
 vfs_iter_write+0x70/0xa0 fs/read_write.c:967
 iter_file_splice_write+0x52b/0xa90 fs/splice.c:749
EXT4-fs (loop5): Total free blocks count 0
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x115/0x160 fs/splice.c:1018
 splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
EXT4-fs (loop4): free_blocks=2415919104
 do_splice_direct+0x164/0x210 fs/splice.c:1061
EXT4-fs (loop0): free_blocks=2415919104
 do_sendfile+0x47f/0xb30 fs/read_write.c:1441
 SYSC_sendfile64 fs/read_write.c:1502 [inline]
 SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f3f5d0d1679
EXT4-fs (loop5): Free/Dirty block details
RSP: 002b:00007f3f5d07d2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f3f5d1567a0 RCX: 00007f3f5d0d1679
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f3f5d12384c R08: 0000000000000000 R09: 0000000000000000
R10: 0001000000201005 R11: 0000000000000246 R12: 00007f3f5d1230e0
EXT4-fs (loop4): dirty_blocks=16
R13: 0000000020000fc0 R14: 0030656c69662f2e R15: 00007f3f5d1567a8
Code: 80 3c 02 
EXT4-fs (loop0): dirty_blocks=16
00 0f 85 22 01 00 00 48 8b 85 
EXT4-fs (loop5): free_blocks=2415919104
e0 00 00 00 48 85 c0 0f 85 a2 fe ff ff 
EXT4-fs (loop0): Block reservation details
e8 33 4d 99 ff 0f 0b e9 96 fe ff ff e8 
EXT4-fs (loop4): Block reservation details
27 4d 99 ff <0f> 0b 4c 89 f7 e8 8d 10 
EXT4-fs (loop4): i_reserved_data_blocks=1
c3 ff e9 f5 fc ff ff e8 83 10 c3 ff e9 
RIP: ext4_da_should_update_i_disksize fs/ext4/inode.c:3192 [inline] RSP: ffff8880a105f5e0
RIP: ext4_da_write_end+0x7b9/0x8e0 fs/ext4/inode.c:3231 RSP: ffff8880a105f5e0
EXT4-fs error (device loop1): ext4_mb_generate_buddy:754: group 0, 
EXT4-fs (loop5): dirty_blocks=16
block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
EXT4-fs (loop2): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop0): i_reserved_data_blocks=1
EXT4-fs (loop2): This should not happen!! Data will be lost

EXT4-fs (loop5): Block reservation details
EXT4-fs (loop2): Total free blocks count 0
EXT4-fs (loop5): i_reserved_data_blocks=1
EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 3 with error 28
EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2 with error 28
EXT4-fs (loop2): Free/Dirty block details
EXT4-fs (loop0): This should not happen!! Data will be lost

EXT4-fs (loop2): free_blocks=2415919104
EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop2): dirty_blocks=16
EXT4-fs (loop5): This should not happen!! Data will be lost

EXT4-fs (loop2): Block reservation details
EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 1 with error 28
EXT4-fs (loop2): i_reserved_data_blocks=1
EXT4-fs (loop4): This should not happen!! Data will be lost

---[ end trace c4aef23c239e7373 ]---
EXT4-fs (loop1): This should not happen!! Data will be lost


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/03/03 05:32 linux-4.14.y 7878a41b6cc1 f8902b57 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 kernel BUG in ext4_da_write_end
* Struck through repros no longer work on HEAD.