syzbot


kernel BUG at fs/reiserfs/prints.c:LINE!

Status: fixed on 2021/01/12 18:45
Reported-by: syzbot+511567b57e0eb92bdf00@syzkaller.appspotmail.com
Fix commit: b74d5f70523a reiserfs: add check for an invalid ih_entry_count
First crash: 793d, last: 712d

Fix bisection: fixed by (bisect log) :
commit b74d5f70523a819aac71e0eee4f4b530e69e463a
Author: Rustam Kovhaev <rkovhaev@gmail.com>
Date: Sun Nov 1 14:09:58 2020 +0000

  reiserfs: add check for an invalid ih_entry_count

similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG at fs/reiserfs/journal.c:LINE! C done 738 8h06m 1700d 0/24 upstream: reported C repro on 2018/03/31 15:55
linux-4.19 kernel BUG at fs/reiserfs/journal.c:LINE! C error 102 14d 796d 0/1 upstream: reported C repro on 2020/09/21 00:32
linux-4.19 kernel BUG at fs/reiserfs/prints.c:LINE! C done 5 690d 781d 1/1 fixed on 2021/02/21 17:18
upstream kernel BUG at fs/reiserfs/prints.c:LINE! C done done 5 717d 795d 21/24 fixed on 2021/03/10 01:48

Sample crash report:
REISERFS (device loop0): Using tea hash to sort names
REISERFS (device loop0): using 3.5.x disk format
REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
REISERFS panic (device loop0): journal-2332 do_journal_end: Trying to log block 8211, which is a log block
------------[ cut here ]------------
kernel BUG at fs/reiserfs/prints.c:390!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 8000 Comm: syz-executor078 Not tainted 4.14.203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff888095674580 task.stack: ffff8880b2f48000
RIP: 0010:__reiserfs_panic.cold+0x37/0x8a fs/reiserfs/prints.c:390
RSP: 0018:ffff8880b2f4f9f8 EFLAGS: 00010297
RAX: ffff888095674580 RBX: ffff8880b184e500 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff878bb940 RDI: ffffed10165e9f35
RBP: ffff8880b2f4faa8 R08: 000000000000006a R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff87977780
R13: ffffffff87977f80 R14: ffffffff87971d00 R15: ffffc90005bc30d8
FS:  0000000000d59880(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006d00a0 CR3: 0000000008e6a000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_journal_end+0x3c72/0x4260 fs/reiserfs/journal.c:4146
 reiserfs_sync_fs+0xbb/0xd0 fs/reiserfs/super.c:78
 __sync_filesystem fs/sync.c:39 [inline]
 sync_filesystem fs/sync.c:64 [inline]
 sync_filesystem+0xe2/0x230 fs/sync.c:48
 generic_shutdown_super+0x70/0x370 fs/super.c:432
 kill_block_super+0x95/0xe0 fs/super.c:1161
 deactivate_locked_super+0x6c/0xd0 fs/super.c:319
 deactivate_super+0x7f/0xa0 fs/super.c:350
 cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183
 task_work_run+0x11f/0x190 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xa08/0x27f0 kernel/exit.c:865
 do_group_exit+0x100/0x2e0 kernel/exit.c:962
 SYSC_exit_group kernel/exit.c:973 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:971
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x4437a8
RSP: 002b:00007fff9a63a248 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004437a8
RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
RBP: 00000000004c3c30 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d6180 R14: 0000000000000000 R15: 0000000000000000
Code: 1d 97 87 74 6d e8 cc a7 a4 ff 4c 89 e9 4c 89 f2 4c 89 e6 49 c7 c0 c0 47 f2 8b 48 c7 c7 c0 1e 97 87 e8 51 34 93 ff e8 ab a7 a4 ff <0f> 0b e8 a4 a7 a4 ff 4d 85 e4 49 c7 c6 00 1d 97 87 75 0a 49 c7 
RIP: __reiserfs_panic.cold+0x37/0x8a fs/reiserfs/prints.c:390 RSP: ffff8880b2f4f9f8
---[ end trace 94f96bf5f0416d27 ]---

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-14 2020/10/31 09:56 linux-4.14.y 2b7915014161 18e33098 .config log report syz C
ci2-linux-4-14 2020/09/24 01:15 linux-4.14.y cbfa1702aaf6 54289b08 .config log report syz C
ci2-linux-4-14 2020/11/13 11:54 linux-4.14.y 27ce4f2a6817 4a7fa9b4 .config log report info
* Struck through repros no longer work on HEAD.