syzbot


WARNING in nilfs_dat_commit_end

Status: upstream: reported C repro on 2022/09/30 13:59
Reported-by: syzbot+8e7d254e1b66afa8face@syzkaller.appspotmail.com
First crash: 572d, last: 420d
Fix bisection: failed (error log, bisect log)
  
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in nilfs_dat_commit_end nilfs C error 267 415d 571d 22/26 fixed on 2023/06/08 14:41
linux-5.15 WARNING in nilfs_dat_commit_end origin:lts-only C done 1069 2h53m 402d 0/3 upstream: reported C repro on 2023/03/19 13:38
linux-6.1 WARNING in nilfs_dat_commit_end origin:lts-only C done 981 3h33m 402d 0/3 upstream: reported C repro on 2023/03/19 21:57
linux-4.14 WARNING in nilfs_dat_commit_end nilfs2 C 6 420d 571d 0/1 upstream: reported C repro on 2022/10/01 18:00

Sample crash report:
NILFS error (device loop0): nilfs_check_page: bad entry in directory #2: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, name_len=0
Remounting filesystem read-only
------------[ cut here ]------------
WARNING: CPU: 1 PID: 8110 at fs/nilfs2/dat.c:186 nilfs_dat_commit_end.cold+0x11/0x18 fs/nilfs2/dat.c:186
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 8110 Comm: syz-executor408 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 panic+0x26a/0x50e kernel/panic.c:186
 __warn.cold+0x20/0x5a kernel/panic.c:541
 report_bug+0x262/0x2b0 lib/bug.c:183
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:nilfs_dat_commit_end.cold+0x11/0x18 fs/nilfs2/dat.c:186
Code: fa e8 98 4f 69 f9 48 c7 c7 80 df 9e 88 e8 f7 80 fa ff 0f 0b e9 1a 66 b6 fa e8 80 4f 69 f9 48 c7 c7 80 df 9e 88 e8 df 80 fa ff <0f> 0b e9 0e 69 b6 fa e8 68 4f 69 f9 48 c7 c7 80 df 9e 88 e8 c7 80
RSP: 0018:ffff8880b3fef4e0 EFLAGS: 00010286
RAX: 0000000000000024 RBX: ffff8880ac3dda80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff814dff01 RDI: ffffed10167fde8e
RBP: ffff8880b3fef588 R08: 0000000000000024 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff88808dbd89c0
R13: 00000026ae000002 R14: ffff8880b3fef5a0 R15: 0000000000000003
 nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:236
 nilfs_direct_propagate fs/nilfs2/direct.c:277 [inline]
 nilfs_direct_propagate+0x237/0x2f0 fs/nilfs2/direct.c:256
 nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337
 nilfs_collect_file_data+0x45/0xd0 fs/nilfs2/segment.c:573
 nilfs_segctor_apply_buffers+0x14a/0x490 fs/nilfs2/segment.c:1014
 nilfs_segctor_scan_file+0x3f4/0x6f0 fs/nilfs2/segment.c:1063
 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1191 [inline]
 nilfs_segctor_collect fs/nilfs2/segment.c:1494 [inline]
 nilfs_segctor_do_construct+0x1101/0x8360 fs/nilfs2/segment.c:2036
 nilfs_segctor_construct+0x764/0xae0 fs/nilfs2/segment.c:2372
 nilfs_segctor_write_out fs/nilfs2/segment.c:2694 [inline]
 nilfs_segctor_destroy fs/nilfs2/segment.c:2727 [inline]
 nilfs_detach_log_writer+0x3b8/0x9f0 fs/nilfs2/segment.c:2807
 nilfs_put_super+0x3f/0x1a0 fs/nilfs2/super.c:469
 generic_shutdown_super+0x144/0x370 fs/super.c:456
 kill_block_super+0x97/0xf0 fs/super.c:1185
 deactivate_locked_super+0x94/0x160 fs/super.c:329
 deactivate_super+0x174/0x1a0 fs/super.c:360
 cleanup_mnt+0x1a8/0x290 fs/namespace.c:1098
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbf3/0x2be0 kernel/exit.c:870
 do_group_exit+0x125/0x310 kernel/exit.c:967
 __do_sys_exit_group kernel/exit.c:978 [inline]
 __se_sys_exit_group kernel/exit.c:976 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:976
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f97e7b58b69
Code: Bad RIP value.
RSP: 002b:00007ffdea7332c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f97e7bd0330 RCX: 00007f97e7b58b69
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f97e7bcae40
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f97e7bd0330
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/10/03 03:26 linux-4.19.y 3f8a27f9e27b feb56351 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 WARNING in nilfs_dat_commit_end
2022/10/01 17:16 linux-4.19.y 3f8a27f9e27b feb56351 .config console log report syz C [disk image] [vmlinux] ci2-linux-4-19 WARNING in nilfs_dat_commit_end
2022/09/30 13:58 linux-4.19.y 3f8a27f9e27b 45fd7169 .config console log report syz C ci2-linux-4-19 WARNING in nilfs_dat_commit_end
2023/03/01 19:00 linux-4.19.y 3f8a27f9e27b ef65e6cb .config console log report info [disk image] [vmlinux] ci2-linux-4-19 WARNING in nilfs_dat_commit_end
* Struck through repros no longer work on HEAD.