syzbot


kernel BUG at fs/ext4/ext4.h:LINE!

Status: upstream: reported C repro on 2020/11/15 12:08
Reported-by: syzbot+c66c23b1d3271b709121@syzkaller.appspotmail.com
First crash: 684d, last: 88d

Fix bisection: failed (bisect log)
similar bugs (6):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 kernel BUG at fs/ext4/ext4.h:LINE! C 7 45d 722d 0/2 upstream: reported C repro on 2020/10/08 13:59
upstream kernel BUG at fs/ext4/ext4.h:LINE! 1 638d 634d 0/24 auto-closed as invalid on 2021/05/01 06:31
android-5-10 kernel BUG in ext4_free_blocks 3 291d 324d 0/2 auto-closed as invalid on 2022/03/13 09:34
linux-4.14 kernel BUG in ext4_mb_load_buddy_gfp C 4 29d 519d 0/1 upstream: reported C repro on 2021/04/29 16:39
android-5-10 kernel BUG in ext4_free_blocks (2) C error 2 89d 89d 0/2 upstream: reported C repro on 2022/07/04 02:04
upstream kernel BUG in ext4_get_group_info C error 2 56d 408d 0/24 upstream: reported C repro on 2021/08/19 08:21

Sample crash report:
EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (14603!=0)
EXT4-fs (loop0): orphan cleanup on readonly fs
EXT4-fs error (device loop0): ext4_free_blocks:4856: comm syz-executor114: Freeing blocks in system zone - Block = 16, count = 16
EXT4-fs (loop0): Remounting filesystem read-only
------------[ cut here ]------------
kernel BUG at fs/ext4/ext4.h:2870!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8078 Comm: syz-executor114 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
RIP: 0010:ext4_get_group_info fs/ext4/ext4.h:2870 [inline]
RIP: 0010:ext4_free_blocks+0x22d0/0x2ac0 fs/ext4/mballoc.c:4823
Code: ff 48 c7 c2 20 7b 7a 88 be 74 02 00 00 48 c7 c7 80 7b 7a 88 c6 05 3b 49 2a 09 01 e8 7e f0 0e 06 e9 c6 f4 ff ff e8 30 40 7e ff <0f> 0b e8 29 40 7e ff 89 de bf a1 ff ff ff 8b ac 24 e8 00 00 00 e8
RSP: 0018:ffff888090ccf2a0 EFLAGS: 00010293
RAX: ffff8880b45a4640 RBX: 00000000ffffffff RCX: ffffffff81e426a7
RDX: 0000000000000000 RSI: ffffffff81e44540 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000ffffffff
R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000001
R13: ffff88809561abc0 R14: 000000000000000c R15: ffff8880950c8ec0
FS:  0000555557403300(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3b592a76c0 CR3: 00000000a8daa000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ext4_clear_blocks+0x34e/0x8b0 fs/ext4/indirect.c:877
 ext4_free_data+0x16f/0x390 fs/ext4/indirect.c:950
 ext4_ind_truncate+0x66d/0x910 fs/ext4/indirect.c:1141
 ext4_truncate+0x7a3/0x1380 fs/ext4/inode.c:4559
 ext4_evict_inode+0x934/0x17b0 fs/ext4/inode.c:305
 evict+0x2ed/0x760 fs/inode.c:559
 iput_final fs/inode.c:1555 [inline]
 iput+0x4f1/0x860 fs/inode.c:1581
 ext4_quota_enable fs/ext4/super.c:5856 [inline]
 ext4_enable_quotas+0x4fa/0x780 fs/ext4/super.c:5879
 ext4_orphan_cleanup fs/ext4/super.c:2637 [inline]
 ext4_fill_super+0x8f4b/0xc850 fs/ext4/super.c:4549
 mount_bdev+0x2fc/0x3b0 fs/super.c:1158
 mount_fs+0xa3/0x310 fs/super.c:1261
 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2492 [inline]
 do_mount+0x115c/0x2f50 fs/namespace.c:2822
 ksys_mount+0xcf/0x130 fs/namespace.c:3038
 __do_sys_mount fs/namespace.c:3052 [inline]
 __se_sys_mount fs/namespace.c:3049 [inline]
 __x64_sys_mount+0xba/0x150 fs/namespace.c:3049
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fcf59d2f4fa
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdbf4fc958 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffdbf4fc9b0 RCX: 00007fcf59d2f4fa
RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007ffdbf4fc970
RBP: 00007ffdbf4fc970 R08: 00007ffdbf4fc9b0 R09: 0000000800000015
R10: 0000000000000081 R11: 0000000000000202 R12: 0000000000000004
R13: 0000000000000003 R14: 0000000000000003 R15: 0000000000000010
Modules linked in:
---[ end trace b50e096428ca2327 ]---
RIP: 0010:ext4_get_group_info fs/ext4/ext4.h:2870 [inline]
RIP: 0010:ext4_free_blocks+0x22d0/0x2ac0 fs/ext4/mballoc.c:4823
Code: ff 48 c7 c2 20 7b 7a 88 be 74 02 00 00 48 c7 c7 80 7b 7a 88 c6 05 3b 49 2a 09 01 e8 7e f0 0e 06 e9 c6 f4 ff ff e8 30 40 7e ff <0f> 0b e8 29 40 7e ff 89 de bf a1 ff ff ff 8b ac 24 e8 00 00 00 e8
RSP: 0018:ffff888090ccf2a0 EFLAGS: 00010293
RAX: ffff8880b45a4640 RBX: 00000000ffffffff RCX: ffffffff81e426a7
RDX: 0000000000000000 RSI: ffffffff81e44540 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000ffffffff
R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000001
R13: ffff88809561abc0 R14: 000000000000000c R15: ffff8880950c8ec0
FS:  0000555557403300(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3b592a76c0 CR3: 00000000a8daa000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (8):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2022/07/05 00:56 linux-4.19.y 3f8a27f9e27b bff65f44 .config log report syz C kernel BUG in ext4_free_blocks
ci2-linux-4-19 2021/08/21 19:40 linux-4.19.y 59456c9cc40c b599f2fc .config log report syz C kernel BUG in ext4_mb_load_buddy_gfp
ci2-linux-4-19 2021/05/01 02:19 linux-4.19.y 97a8651cadce 77e2b668 .config log report syz C kernel BUG in ext4_mb_load_buddy_gfp
ci2-linux-4-19 2020/11/15 12:07 linux-4.19.y 31acccdc8774 1bf9a662 .config log report syz C
ci2-linux-4-19 2021/08/19 05:41 linux-4.19.y 59456c9cc40c a2fe1cb5 .config log report syz kernel BUG in ext4_mb_load_buddy_gfp
ci2-linux-4-19 2021/01/29 01:50 linux-4.19.y c4ff839de17f 7df34f59 .config log report syz kernel BUG in ext4_mb_find_by_goal
ci2-linux-4-19 2021/10/05 02:37 linux-4.19.y c2276d585654 ce697b49 .config log report info kernel BUG in ext4_mb_load_buddy_gfp
ci2-linux-4-19 2021/06/13 13:07 linux-4.19.y 9a2dc0e6c531 1ba81399 .config log report info kernel BUG in ext4_mb_load_buddy_gfp
* Struck through repros no longer work on HEAD.