syzbot


kernel BUG in ext4_es_cache_extent

Status: closed as invalid on 2022/09/13 19:49
Reported-by: syzbot+a22dc4b0744ac658ed9b@syzkaller.appspotmail.com
First crash: 607d, last: 607d
Cause bisection: failed (error log, bisect log)
  
Discussions (1)
Title Replies (including bot) Last reply
[PATCH] ext4: Add extend check to prevent BUG() in ext4_es_end 3 (3) 2022/11/28 21:16
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in ext4_es_cache_extent ext4 C inconclusive 6 450d 810d 22/26 fixed on 2023/02/24 13:50
android-54 kernel BUG in ext4_es_cache_extent ext4 C 16 6d04h 607d 0/2 upstream: reported C repro on 2022/08/28 10:36
linux-4.14 kernel BUG in __es_tree_search C error 1 607d 607d 0/1 upstream: reported C repro on 2022/08/28 11:40
linux-4.19 kernel BUG in __es_tree_search C error 2 546d 607d 0/1 upstream: reported C repro on 2022/08/28 11:40

Sample crash report:
EXT4-fs error (device loop0): ext4_quota_enable:6398: inode #5: comm syz-executor237: casefold flag without casefold feature
------------[ cut here ]------------
kernel BUG at fs/ext4/extents_status.c:202!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 371 Comm: syz-executor237 Not tainted 5.10.136-syzkaller-00029-ga634d588813f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:ext4_es_end fs/ext4/extents_status.c:202 [inline]
RIP: 0010:__es_tree_search fs/ext4/extents_status.c:220 [inline]
RIP: 0010:ext4_es_cache_extent+0x54e/0x660 fs/ext4/extents_status.c:903
Code: cf ff e9 e3 fe ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 74 fe ff ff 4c 89 e7 e8 0c 3e cf ff e9 67 fe ff ff e8 12 36 95 ff <0f> 0b e8 bb ee ba 02 65 8b 1d 0c 64 2a 7e 89 d8 c1 e8 06 48 8d 3c
RSP: 0018:ffffc90000b76e60 EFLAGS: 00010293
RAX: ffffffff81d7ad1e RBX: ffff88811a0b6d74 RCX: ffff8881067ae2c0
RDX: 0000000000000000 RSI: 000000002b754e16 RDI: 0000000000000000
RBP: ffffc90000b76f80 R08: ffffffff81d7aa8f R09: 0000000000000003
R10: fffff5200016edbd R11: 1ffff9200016edbc R12: ffff88811a0b6d74
R13: 0000000000000000 R14: 1ffff11023416dae R15: 000000002b754e16
FS:  0000555555e34300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff06eaddc4 CR3: 0000000105fd6000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ext4_cache_extents fs/ext4/extents.c:517 [inline]
 ext4_find_extent+0x49d/0xd80 fs/ext4/extents.c:913
 ext4_ext_map_blocks+0x219/0x3a30 fs/ext4/extents.c:4093
 ext4_map_blocks+0x42a/0x1ee0 fs/ext4/inode.c:563
 ext4_getblk+0x19c/0x660 fs/ext4/inode.c:849
 ext4_bread+0x2f/0x1d0 fs/ext4/inode.c:901
 ext4_quota_read+0x1bf/0x2c0 fs/ext4/super.c:6529
 v2_read_header fs/quota/quota_v2.c:62 [inline]
 v2_check_quota_file+0xf7/0x3d0 fs/quota/quota_v2.c:81
 dquot_load_quota_sb+0x67d/0xbe0 fs/quota/dquot.c:2395
 dquot_load_quota_inode+0x3ab/0x670 fs/quota/dquot.c:2438
 ext4_quota_enable fs/ext4/super.c:6407 [inline]
 ext4_enable_quotas+0x59a/0x960 fs/ext4/super.c:6433
 ext4_orphan_cleanup+0x2ee/0xdb0 fs/ext4/super.c:3067
 ext4_fill_super+0x8880/0x9150 fs/ext4/super.c:5092
 mount_bdev+0x25f/0x370 fs/super.c:1419
 ext4_mount+0x34/0x40 fs/ext4/super.c:6611
 legacy_get_tree+0xf0/0x190 fs/fs_context.c:592
 vfs_get_tree+0x88/0x290 fs/super.c:1549
 do_new_mount+0x289/0xad0 fs/namespace.c:2899
 path_mount+0x58d/0xce0 fs/namespace.c:3229
 do_mount fs/namespace.c:3242 [inline]
 __do_sys_mount fs/namespace.c:3450 [inline]
 __se_sys_mount+0x2d2/0x3c0 fs/namespace.c:3427
 __x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
 do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xc6
RIP: 0033:0x7f9ff476e5ca
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe39decb68 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe39decbc0 RCX: 00007f9ff476e5ca
RDX: 0000000020000000 RSI: 0000000020000040 RDI: 00007ffe39decb80
RBP: 00007ffe39decb80 R08: 00007ffe39decbc0 R09: 0000000800000015
R10: 0000000000000081 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000000000003 R14: 0000000000000003 R15: 000000000000041c
Modules linked in:
---[ end trace 26ff9ef6fc97571d ]---
RIP: 0010:ext4_es_end fs/ext4/extents_status.c:202 [inline]
RIP: 0010:__es_tree_search fs/ext4/extents_status.c:220 [inline]
RIP: 0010:ext4_es_cache_extent+0x54e/0x660 fs/ext4/extents_status.c:903
Code: cf ff e9 e3 fe ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 74 fe ff ff 4c 89 e7 e8 0c 3e cf ff e9 67 fe ff ff e8 12 36 95 ff <0f> 0b e8 bb ee ba 02 65 8b 1d 0c 64 2a 7e 89 d8 c1 e8 06 48 8d 3c
RSP: 0018:ffffc90000b76e60 EFLAGS: 00010293
RAX: ffffffff81d7ad1e RBX: ffff88811a0b6d74 RCX: ffff8881067ae2c0
RDX: 0000000000000000 RSI: 000000002b754e16 RDI: 0000000000000000
RBP: ffffc90000b76f80 R08: ffffffff81d7aa8f R09: 0000000000000003
R10: fffff5200016edbd R11: 1ffff9200016edbc R12: ffff88811a0b6d74
R13: 0000000000000000 R14: 1ffff11023416dae R15: 000000002b754e16
FS:  0000555555e34300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff06eaddc4 CR3: 0000000105fd6000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/08/28 11:25 android12-5.10-lts a634d588813f 07177916 .config strace log report syz C ci2-android-5-10 kernel BUG in ext4_es_cache_extent
* Struck through repros no longer work on HEAD.