syzbot


kernel BUG in submit_bh_wbc (2)

Status: upstream: reported on 2024/07/26 16:49
Reported-by: syzbot+e2f0d8715ecd9cb1024c@syzkaller.appspotmail.com
First crash: 43d, last: 43d
Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 kernel BUG in submit_bh_wbc origin:lts-only C done 19 93d 522d 3/3 fixed on 2024/07/20 06:27
upstream kernel BUG at fs/buffer.c:LINE! nilfs C done error 567 151d 2333d 25/27 fixed on 2024/04/10 03:59
upstream kernel BUG in submit_bh_wbc (2) udf C done 123 30d 135d 27/27 fixed on 2024/08/14 03:44
linux-4.14 kernel BUG at fs/buffer.c:LINE! C error 59 565d 1960d 0/1 upstream: reported C repro on 2019/04/27 19:47
linux-4.19 kernel BUG at fs/buffer.c:LINE! (2) udf ext4 C error 31 572d 1386d 0/1 upstream: reported C repro on 2020/11/21 07:48
android-54 kernel BUG at fs/buffer.c:LINE! ext4 C 1187 24d 1691d 0/2 upstream: reported C repro on 2020/01/21 13:12
linux-5.15 kernel BUG in submit_bh_wbc C error 8 183d 461d 0/3 auto-obsoleted due to no activity on 2024/06/16 14:58
upstream kernel BUG in submit_bh_wbc nilfs C done 10 136d 145d 25/27 fixed on 2024/04/24 18:26
android-6-1 kernel BUG in submit_bh_wbc missing-backport origin:lts C done done 201 13h16m 450d 0/2 upstream: reported C repro on 2023/06/15 00:20

Sample crash report:
loop0: detected capacity change from 0 to 1024
------------[ cut here ]------------
kernel BUG at fs/buffer.c:2666!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4618 Comm: syz.0.101 Not tainted 6.1.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : submit_bh_wbc+0x3f4/0x468 fs/buffer.c:2666
lr : submit_bh_wbc+0x3f4/0x468 fs/buffer.c:2666
sp : ffff80001e3a74f0
x29: ffff80001e3a7500 x28: dfff800000000000 x27: dfff800000000000
x26: 1ffff00003c74ec0 x25: 0000000000000000 x24: 1fffe0001e331674
x23: 1fffe0001e331674 x22: dfff800000000000 x21: 0000000000003000
x20: ffff0000f198b3a0 x19: 0000000000000004 x18: 0000000000000140
x17: ffff8000159bd000 x16: ffff800008303a38 x15: 0000000000000000
x14: 1ffff00002b380b0 x13: dfff800000000000 x12: 0000000000040000
x11: 000000000000be3d x10: ffff80001e86a000 x9 : ffff800008b408c4
x8 : 000000000000be3e x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : ffff800008f18478
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 submit_bh_wbc+0x3f4/0x468 fs/buffer.c:2666
 submit_bh+0x2c/0x3c fs/buffer.c:2707
 __ext4_read_bh fs/ext4/super.c:174 [inline]
 ext4_read_bh+0x160/0x268 fs/ext4/super.c:198
 read_mmp_block+0x224/0x708 fs/ext4/mmp.c:97
 ext4_multi_mount_protect+0x50c/0x8b0 fs/ext4/mmp.c:378
 __ext4_fill_super fs/ext4/super.c:5287 [inline]
 ext4_fill_super+0x4e44/0x7570 fs/ext4/super.c:5664
 get_tree_bdev+0x360/0x54c fs/super.c:1355
 ext4_get_tree+0x28/0x38 fs/ext4/super.c:5694
 vfs_get_tree+0x90/0x274 fs/super.c:1562
 do_new_mount+0x278/0x8fc fs/namespace.c:3051
 path_mount+0x590/0xe5c fs/namespace.c:3381
 do_mount fs/namespace.c:3394 [inline]
 __do_sys_mount fs/namespace.c:3602 [inline]
 __se_sys_mount fs/namespace.c:3579 [inline]
 __arm64_sys_mount+0x45c/0x594 fs/namespace.c:3579
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 17ffffad 97e6e6c5 d4210000 97e6e6c3 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/26 16:49 linux-6.1.y c18e82d3ee44 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in submit_bh_wbc
* Struck through repros no longer work on HEAD.