syzbot


general protection fault in update_sit_entry

Status: upstream: reported C repro on 2022/11/12 02:17
Subsystems: f2fs
[Documentation on labels]
Reported-by: syzbot+04a357a6933e5765086d@syzkaller.appspotmail.com
First crash: 503d, last: 390d
Fix bisection attempts (1)
Created Duration User Patch Repo Result
2023/02/07 16:59 25m bisect fix linux-4.14.y job log (0) log

Sample crash report:
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): Found nat_bits in checkpoint
F2FS-fs (loop0): Mounted with checkpoint version = 3e17dab1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 22 Comm: kworker/u4:1 Not tainted 4.14.299-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: writeback wb_workfn (flush-7:0)
task: ffff8880b55ee5c0 task.stack: ffff8880b55f8000
RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline]
RIP: 0010:update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682
RSP: 0018:ffff8880b55ff1b8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880b336e5c0 RCX: 000000000000007c
RDX: 0000000000000000 RSI: 1ffff110145be4c4 RDI: ffff8880b3121730
RBP: ffff8880b3121710 R08: ffff8880b3048780 R09: ffffed1012b40535
R10: ffff888095a029a9 R11: ffff8880b55ee5c0 R12: 0000000000000000
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0a28ad2fb0 CR3: 000000009a7c1000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 refresh_sit_entry+0x2c/0x730 fs/f2fs/segment.c:1728
 allocate_data_block+0x47d/0xf60 fs/f2fs/segment.c:2372
 do_write_page+0x222/0x7f0 fs/f2fs/segment.c:2402
 write_data_page+0x15d/0x3a0 fs/f2fs/segment.c:2456
 do_write_data_page+0xc63/0x2ca0 fs/f2fs/data.c:1493
 __write_data_page+0x115a/0x1480 fs/f2fs/data.c:1567
 f2fs_write_cache_pages+0x40d/0xe50 fs/f2fs/data.c:1744
 __f2fs_write_data_pages+0x2e2/0xb90 fs/f2fs/data.c:1838
 do_writepages+0xc3/0x240 mm/page-writeback.c:2361
 __writeback_single_inode+0xda/0x1010 fs/fs-writeback.c:1382
 writeback_sb_inodes+0x48b/0xd30 fs/fs-writeback.c:1645
 wb_writeback+0x243/0xb80 fs/fs-writeback.c:1820
 wb_do_writeback fs/fs-writeback.c:1952 [inline]
 wb_workfn+0x2bd/0xf50 fs/fs-writeback.c:1988
 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117
 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 6c 0e 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 75 20 4d 01 e6 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 57 0e 00 
RIP: f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline] RSP: ffff8880b55ff1b8
RIP: update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682 RSP: ffff8880b55ff1b8
---[ end trace eec8cf03e5f7b5aa ]---
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 48 89             	fisttps -0x77(%rax)
   3:	fa                   	cli
   4:	48 c1 ea 03          	shr    $0x3,%rdx
   8:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   c:	0f 85 6c 0e 00 00    	jne    0xe7e
  12:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  19:	fc ff df
  1c:	4c 8b 75 20          	mov    0x20(%rbp),%r14
  20:	4d 01 e6             	add    %r12,%r14
  23:	4c 89 f2             	mov    %r14,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	4c 89 f2             	mov    %r14,%rdx
  31:	83 e2 07             	and    $0x7,%edx
  34:	38 d0                	cmp    %dl,%al
  36:	7f 08                	jg     0x40
  38:	84 c0                	test   %al,%al
  3a:	0f                   	.byte 0xf
  3b:	85 57 0e             	test   %edx,0xe(%rdi)

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/11/12 03:50 linux-4.14.y e911713e40ca f42ee5d8 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-4-14 general protection fault in update_sit_entry
2023/03/05 01:24 linux-4.14.y 7878a41b6cc1 f8902b57 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 general protection fault in update_sit_entry
2023/02/27 11:33 linux-4.14.y 7878a41b6cc1 9189cb53 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 general protection fault in update_sit_entry
2023/02/08 18:40 linux-4.14.y a8ad60f2af58 fc9c934e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 general protection fault in update_sit_entry
2023/01/07 19:54 linux-4.14.y c4215ee4771b 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 general protection fault in update_sit_entry
2022/12/22 22:52 linux-4.14.y c4215ee4771b 9da18ae8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 general protection fault in update_sit_entry
2022/12/22 12:22 linux-4.14.y c4215ee4771b 9da18ae8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 general protection fault in update_sit_entry
2022/12/15 16:44 linux-4.14.y c4215ee4771b 6f9c033e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 general protection fault in update_sit_entry
2022/11/12 02:16 linux-4.14.y e911713e40ca f42ee5d8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 general protection fault in update_sit_entry
* Struck through repros no longer work on HEAD.