syzbot


kernel BUG in ext4_write_inline_data

Status: upstream: reported C repro on 2022/11/04 18:44
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+da175c0c1945da84be10@syzkaller.appspotmail.com
First crash: 748d, last: 652d
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG at fs/ext4/inline.c:LINE! ext4 C done done 76 676d 1499d 22/28 fixed on 2023/02/24 13:50
upstream kernel BUG in ext4_write_inline_data ext4 C error 36 130d 615d 27/28 fixed on 2024/08/22 01:52
android-6-1 kernel BUG in ext4_write_inline_data origin:lts C error 20 4d06h 507d 0/2 upstream: reported C repro on 2023/07/02 21:30
linux-4.19 kernel BUG in ext4_write_inline_data_end ext4 C error 12 629d 1376d 0/1 upstream: reported C repro on 2021/02/14 13:39
upstream kernel BUG in ext4_write_inline_data (2) ext4 C error 4 4d05h 11h08m 0/28 upstream: reported C repro on 2024/11/21 09:00
android-5-10 kernel BUG in ext4_write_inline_data ext4 C error inconclusive 3 648d 746d 2/2 fixed on 2023/05/04 14:51
android-54 kernel BUG in ext4_write_inline_data C 3 708d 746d 2/2 fixed on 2023/04/05 17:17
Fix bisection attempts (1)
Created Duration User Patch Repo Result
2023/02/08 12:55 34m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
EXT4-fs (loop5): Free/Dirty block details
EXT4-fs (loop1): i_reserved_data_blocks=1
EXT4-fs error (device loop2): ext4_mb_generate_buddy:754: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters
------------[ cut here ]------------
kernel BUG at fs/ext4/inline.c:231!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
audit: type=1804 audit(1672077820.028:4): pid=7994 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor524" name="/root/file0/bus" dev="loop3" ino=18 res=1
Modules linked in:
CPU: 1 PID: 8000 Comm: syz-executor524 Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff8880b311e4c0 task.stack: ffff8880a2a80000
RIP: 0010:ext4_write_inline_data+0x2e6/0x380 fs/ext4/inline.c:231
RSP: 0018:ffff8880a2a874b0 EFLAGS: 00010297
RAX: ffff8880b311e4c0 RBX: ffff88808d37b4b0 RCX: 000000000000006c
RDX: 0000000000000000 RSI: ffff8880a2a87538 RDI: ffff88808d37b978
audit: type=1804 audit(1672077820.028:5): pid=7993 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor524" name="/root/file0/bus" dev="loop1" ino=18 res=1
RBP: 000000000000006c R08: 0000000000000009 R09: 0000000000000000
audit: type=1804 audit(1672077820.028:6): pid=7994 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor524" name="/root/file0/bus" dev="loop3" ino=18 res=1
R10: ffff8880a2a87488 R11: 0000000000000000 R12: 0000000000000009
R13: ffff8880a2a87538 R14: ffff88808d37b976 R15: ffff88808d37b318
FS:  00007f8dc25cf700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8dc26741e8 CR3: 00000000a1fcc000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ext4_write_inline_data_end+0x1db/0x490 fs/ext4/inline.c:769
 ext4_da_write_inline_data_end+0x30/0x410 fs/ext4/inline.c:966
 ext4_da_write_end+0x3b5/0x8e0 fs/ext4/inode.c:3244
audit: type=1804 audit(1672077820.028:7): pid=7993 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor524" name="/root/file0/bus" dev="loop1" ino=18 res=1
 generic_perform_write+0x274/0x430 mm/filemap.c:3066
audit: type=1804 audit(1672077820.108:8): pid=7998 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor524" name="/root/file0/bus" dev="loop5" ino=18 res=1
 __generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
 ext4_file_write_iter+0x276/0xd20 fs/ext4/file.c:270
audit: type=1804 audit(1672077820.108:9): pid=7998 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor524" name="/root/file0/bus" dev="loop5" ino=18 res=1
 call_write_iter include/linux/fs.h:1780 [inline]
 do_iter_readv_writev+0x4cf/0x5f0 fs/read_write.c:675
audit: type=1804 audit(1672077820.108:10): pid=7998 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor524" name="/root/file0/bus" dev="loop5" ino=18 res=1
 do_iter_write+0x152/0x550 fs/read_write.c:954
 vfs_iter_write+0x70/0xa0 fs/read_write.c:967
 iter_file_splice_write+0x52b/0xa90 fs/splice.c:749
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x115/0x160 fs/splice.c:1018
audit: type=1804 audit(1672077820.108:11): pid=8000 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor524" name="/root/file0/bus" dev="loop0" ino=18 res=1
 splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
 do_splice_direct+0x164/0x210 fs/splice.c:1061
EXT4-fs (loop3): Total free blocks count 0
 do_sendfile+0x47f/0xb30 fs/read_write.c:1441
 SYSC_sendfile64 fs/read_write.c:1502 [inline]
 SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
EXT4-fs (loop3): Free/Dirty block details
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f8dc262af49
RSP: 002b:00007f8dc25cf208 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
EXT4-fs (loop3): free_blocks=2415919104
RAX: ffffffffffffffda RBX: 00007f8dc26a86c8 RCX: 00007f8dc262af49
EXT4-fs (loop3): dirty_blocks=16
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f8dc26a86c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000080000041 R11: 0000000000000246 R12: 00007f8dc26a86cc
R13: 00007fff8009f66f R14: 00007f8dc25cf300 R15: 0000000000022000
Code: 5f e9 3f 13 9c ff e8 3a 13 9c ff 45 8d 64 
EXT4-fs (loop3): Block reservation details
2c c4 b8 3c 00 00 00 29 e8 89 04 24 e9 e7 fe ff ff e8 21 13 9c ff 
EXT4-fs (loop3): i_reserved_data_blocks=1
0f 0b e8 1a 13 9c ff <0f> 0b e8 33 d3 c5 ff e9 2a fe ff ff 4c 89 f7 e8 26 d3 c5 ff e9 
RIP: ext4_write_inline_data+0x2e6/0x380 fs/ext4/inline.c:231 RSP: ffff8880a2a874b0
---[ end trace c1d634e663bab862 ]---
syz-executor524 (7994) used greatest stack depth: 23808 bytes left

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/12/26 18:06 linux-4.14.y c4215ee4771b 9da18ae8 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 kernel BUG in ext4_write_inline_data
2022/11/05 12:44 linux-4.14.y a901bb6c7db7 6d752409 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 kernel BUG in ext4_write_inline_data
2022/11/04 18:44 linux-4.14.y a901bb6c7db7 6d752409 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 kernel BUG in ext4_write_inline_data
2023/01/09 05:26 linux-4.14.y c4215ee4771b 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 kernel BUG in ext4_write_inline_data
* Struck through repros no longer work on HEAD.