syzbot

 sign-in | mailing list | source | docs
🐞 Open [73] 🐞 Fixed [70] 🐞 Invalid [133] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

kernel BUG in end_page_writeback

Status: fixed on 2023/06/30 00:53
Subsystems: f2fs
[Documentation on labels]
Reported-by: syzbot+e07a04819573e4acc535@syzkaller.appspotmail.com
Fix commit: b2f423fda64f f2fs: fix to avoid use-after-free for cached IPU bio
First crash: 443d, last: 392d
Cause bisection: failed (error log, bisect log)
  
Fix bisection the fix commit could be any of (bisect log):
  416c4356f372 Merge 5.10.161 into android12-5.10-lts
  a02b4a8660e1 Revert "nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property"
   
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 kernel BUG in end_page_writeback origin:lts-only C done 6 354d 403d 3/3 fixed on 2023/06/07 17:22
linux-4.14 kernel BUG in end_page_writeback nilfs2 C 1 417d 481d 0/1 upstream: reported C repro on 2022/12/30 20:15
android-54 kernel BUG in end_page_writeback f2fs C 6 27d 443d 0/2 upstream: reported C repro on 2023/02/06 23:18
▶ ▼ Last patch testing requests (14)
Created Duration User Patch Repo Result
2023/06/07 19:48 16m retest repro android13-5.10-lts OK log
2023/03/31 13:16 13m tudor.ambarus@linaro.org https://android.googlesource.com/kernel/common 8102df91f2ab error OK
2023/03/31 12:38 19m tudor.ambarus@linaro.org https://android.googlesource.com/kernel/common android12-5.10.136_r00 report log
2023/03/28 07:50 8m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git v5.10.176 error OK
2023/03/28 07:43 12m tudor.ambarus@linaro.org https://android.googlesource.com/kernel/common b9e54f8e02e2 error OK
2023/03/28 07:48 0m tudor.ambarus@linaro.org https://github.com/ambarus/linux.git v5.10.176 error OK
2023/03/28 05:19 8m tudor.ambarus@linaro.org https://github.com/ambarus/linux.git test-end_page_writeback report log
2023/03/28 05:17 0m tudor.ambarus@linaro.org git@github.com:ambarus/linux.git test-end_page_writeback error OK
2023/03/28 05:12 0m tudor.ambarus@linaro.org patch android12-5.10-lts error OK
2023/03/28 05:08 0m tudor.ambarus@linaro.org patch android12-5.10-lts error OK
2023/03/28 04:38 3m tudor.ambarus@linaro.org android12-5.10-lts error OK
2023/03/24 13:02 6m tudor.ambarus@linaro.org android12-5.10-lts error OK
2023/03/24 09:01 16m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git v5.10.161 OK log
2023/03/24 08:39 15m tudor.ambarus@linaro.org git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y OK log

Sample crash report:
------------[ cut here ]------------
kernel BUG at mm/filemap.c:1504!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 177 Comm: kworker/u4:2 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: writeback wb_workfn (flush-7:3)
RIP: 0010:end_page_writeback+0x28c/0x2a0 mm/filemap.c:1504
Code: 32 de ff 49 ff cc e9 d9 fe ff ff e8 1e 32 de ff 49 ff ce 4d 89 f7 eb 8c e8 11 32 de ff 49 ff cc e9 65 fe ff ff e8 04 32 de ff <0f> 0b e8 fd 31 de ff 4c 89 ff e8 75 85 1d 00 eb 87 0f 1f 00 55 48
RSP: 0018:ffffc90000c166d8 EFLAGS: 00010293
RAX: ffffffff818eefac RBX: 0000000000000000 RCX: ffff88810dbf62c0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000c16700 R08: ffffffff818eee8e R09: fffff940008735c1
R10: fffff940008735c1 R11: 1ffffd40008735c0 R12: ffffea000439ae00
R13: 1ffffd40008735c1 R14: ffffea000439ae08 R15: ffffea000439ae00
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7e66659000 CR3: 0000000106bd2000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 f2fs_write_end_io+0x597/0x950 fs/f2fs/data.c:342
 bio_endio+0x465/0x5c0 block/bio.c:1459
 submit_bio_checks+0x25c/0xe80 block/blk-core.c:925
 submit_bio_noacct+0x98/0x11f0 block/blk-core.c:1048
 submit_bio+0x1f8/0x6e0 block/blk-core.c:1133
 __submit_bio+0x717/0x920 fs/f2fs/data.c:499
 f2fs_submit_merged_ipu_write+0x668/0x720 fs/f2fs/data.c:858
 f2fs_write_single_data_page+0x16aa/0x1d30 fs/f2fs/data.c:2846
 f2fs_write_cache_pages fs/f2fs/data.c:3055 [inline]
 __f2fs_write_data_pages+0x179e/0x2c80 fs/f2fs/data.c:3206
 f2fs_write_data_pages+0x74/0x80 fs/f2fs/data.c:3233
 do_writepages+0x13a/0x280 mm/page-writeback.c:2358
 __writeback_single_inode+0xb8/0x6e0 fs/fs-writeback.c:1467
 writeback_sb_inodes+0x999/0x1700 fs/fs-writeback.c:1730
 wb_writeback+0x42f/0xc20 fs/fs-writeback.c:1905
 wb_do_writeback+0x222/0xbd0 fs/fs-writeback.c:2050
 wb_workfn+0xf8/0x3f0 fs/fs-writeback.c:2091
 process_one_work+0x726/0xc10 kernel/workqueue.c:2296
 worker_thread+0xb27/0x1550 kernel/workqueue.c:2442
 kthread+0x349/0x3d0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299
Modules linked in:
---[ end trace c23b2606343b3e06 ]---
RIP: 0010:end_page_writeback+0x28c/0x2a0 mm/filemap.c:1504
Code: 32 de ff 49 ff cc e9 d9 fe ff ff e8 1e 32 de ff 49 ff ce 4d 89 f7 eb 8c e8 11 32 de ff 49 ff cc e9 65 fe ff ff e8 04 32 de ff <0f> 0b e8 fd 31 de ff 4c 89 ff e8 75 85 1d 00 eb 87 0f 1f 00 55 48
RSP: 0018:ffffc90000c166d8 EFLAGS: 00010293
RAX: ffffffff818eefac RBX: 0000000000000000 RCX: ffff88810dbf62c0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000c16700 R08: ffffffff818eee8e R09: fffff940008735c1
R10: fffff940008735c1 R11: 1ffffd40008735c0 R12: ffffea000439ae00
R13: 1ffffd40008735c1 R14: ffffea000439ae08 R15: ffffea000439ae00
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7e6dc79808 CR3: 000000010c761000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/03/18 15:49 android12-5.10-lts 416c4356f372 7939252e .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-android-5-10 kernel BUG in end_page_writeback
2023/02/07 00:16 android12-5.10-lts 416c4356f372 0a9c11b6 .config strace log report syz C [mounted in repro] ci2-android-5-10 kernel BUG in end_page_writeback
2023/03/29 19:24 android12-5.10-lts 416c4356f372 f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 kernel BUG in end_page_writeback
* Struck through repros no longer work on HEAD.