syzbot


WARNING in ext4_expand_extra_isize_ea

Status: upstream: reported C repro on 2022/11/30 20:09
Reported-by: syzbot+4d99a966fd74bdeeec36@syzkaller.appspotmail.com
Fix commit: cc12a6f25e07 ext4: allocate extended attribute value in vmalloc area
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 71d, last: 55d

Cause bisection: failed (bisect log)

Fix bisection: fixed by (bisect log) :
commit cc12a6f25e07ed05d5825a1664b67a970842b2ca
Author: Ye Bin <yebin10@huawei.com>
Date: Thu Dec 8 02:32:31 2022 +0000

  ext4: allocate extended attribute value in vmalloc area


Sample crash report:
loop0: detected capacity change from 0 to 512
EXT4-fs: Ignoring removed nobh option
EXT4-fs (loop0): orphan cleanup on readonly fs
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3629 at mm/page_alloc.c:5534 __alloc_pages+0x412/0x5b0 mm/page_alloc.c:5534
Modules linked in:
CPU: 0 PID: 3629 Comm: syz-executor401 Not tainted 6.1.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:__alloc_pages+0x412/0x5b0 mm/page_alloc.c:5534
Code: ff ff 00 0f 84 c3 fd ff ff 80 ce 01 e9 bb fd ff ff 83 fe 0a 0f 86 ce fc ff ff 80 3d 16 b9 79 0c 00 75 09 c6 05 0d b9 79 0c 01 <0f> 0b 45 31 f6 e9 52 fe ff ff 65 ff 05 1d ce 3f 7e 48 c7 c0 40 f9
RSP: 0018:ffffc90003c9f2c0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff92000793e59 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000
RBP: 0000000000040c40 R08: 0000000000000011 R09: ffff88823bb9b880
R10: 0000000000000011 R11: 0000000000092080 R12: 000000000000000c
R13: 0000000000000000 R14: 0000000000040c40 R15: dffffc0000000000
FS:  00005555561fd300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0721d32a70 CR3: 000000007662c000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 __alloc_pages_node include/linux/gfp.h:237 [inline]
 alloc_pages_node include/linux/gfp.h:260 [inline]
 __kmalloc_large_node+0x85/0x160 mm/slab_common.c:1096
 __do_kmalloc_node mm/slab_common.c:943 [inline]
 __kmalloc+0x91/0xd0 mm/slab_common.c:968
 kmalloc include/linux/slab.h:558 [inline]
 ext4_xattr_move_to_block fs/ext4/xattr.c:2558 [inline]
 ext4_xattr_make_inode_space fs/ext4/xattr.c:2673 [inline]
 ext4_expand_extra_isize_ea+0x7d1/0x1670 fs/ext4/xattr.c:2765
 __ext4_expand_extra_isize+0x31e/0x450 fs/ext4/inode.c:5857
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5900 [inline]
 __ext4_mark_inode_dirty+0x534/0x940 fs/ext4/inode.c:5978
 ext4_inline_data_truncate+0x5ec/0xce0 fs/ext4/inline.c:2021
 ext4_truncate+0xb79/0x1530 fs/ext4/inode.c:4221
 ext4_process_orphan+0x158/0x410 fs/ext4/orphan.c:339
 ext4_orphan_cleanup+0x6fb/0x10f0 fs/ext4/orphan.c:474
 __ext4_fill_super fs/ext4/super.c:5515 [inline]
 ext4_fill_super+0x9ecd/0xb1d0 fs/ext4/super.c:5643
 get_tree_bdev+0x444/0x760 fs/super.c:1324
 vfs_get_tree+0x8d/0x2f0 fs/super.c:1531
 do_new_mount fs/namespace.c:3040 [inline]
 path_mount+0x132a/0x1e20 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __x64_sys_mount+0x283/0x300 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fba98d40e2a
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcd9184318 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fba98d40e2a
RDX: 0000000020000440 RSI: 0000000020000480 RDI: 00007ffcd9184320
RBP: 00007ffcd9184320 R08: 00007ffcd9184360 R09: 000000000000041e
R10: 0000000000000011 R11: 0000000000000202 R12: 0000000000000004
R13: 00005555561fd2c0 R14: 00007ffcd9184360 R15: 0000000000000000
 </TASK>

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce-root 2022/12/12 14:28 upstream 830b3c68c1fb 67be1ae7 .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] WARNING in ext4_expand_extra_isize_ea
ci-upstream-gce-arm64 2022/11/27 07:34 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6d464646530f 74a66371 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] WARNING in ext4_expand_extra_isize_ea
ci2-upstream-fs 2022/11/26 20:02 upstream 644e9524388a f4470a7b .config strace log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] WARNING in ext4_expand_extra_isize_ea
* Struck through repros no longer work on HEAD.