BUG: unable to handle kernel paging request in xfs_trans_committed_bulk

Status: moderation: reported on 2023/01/08 21:19
Subsystems: xfs (incorrect?)
First crash: 76d, last: 76d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in xfs_trans_committed_bulk xfs C 8 21d 63d 0/1 upstream: reported C repro on 2023/01/18 09:53
linux-4.14 KASAN: use-after-free Read in xfs_trans_committed_bulk xfs C 4 17d 79d 0/1 upstream: reported C repro on 2023/01/02 11:47
linux-5.15 KASAN: use-after-free Write in xfs_trans_committed_bulk C 8 11h02m 10d 0/3 upstream: reported C repro on 2023/03/12 11:46
linux-6.1 KASAN: use-after-free Read in xfs_trans_committed_bulk C 108 2h04m 13d 0/3 upstream: reported C repro on 2023/03/09 08:20

Sample crash report:
XFS (loop1): Filesystem has been shut down due to log error (0x2).
XFS (loop1): Please unmount the filesystem and rectify the problem(s).
Unable to handle kernel paging request at virtual address dead4ead00000000
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[dead4ead00000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 77 Comm: kworker/1:1H Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: xfs-log/loop1 xlog_ioend_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : xfs_trans_committed_bulk+0xf0/0x460 fs/xfs/xfs_trans.c:785
lr : arch_set_bit include/asm-generic/bitops/atomic.h:18 [inline]
lr : set_bit include/asm-generic/bitops/instrumented-atomic.h:29 [inline]
lr : xfs_trans_committed_bulk+0xd4/0x460 fs/xfs/xfs_trans.c:783
sp : ffff80000f76ba60
x29: ffff80000f76bba0 x28: ffff00011cdb4040 x27: 0000000000000001
x26: 0000000100000000 x25: ffff0000c4c1a330 x24: ffff00011cdb4000
x23: ffff00011ccc9c58 x22: 0000000000000001 x21: dead4ead00000000
x20: 0000000100000000 x19: ffff000128f14a80 x18: 00000000000000c0
x17: ffff80000dda8198 x16: ffff80000dbe6158 x15: ffff0000c0f43480
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c0f43480
x11: ff80800008e9f600 x10: 0000000000000000 x9 : 0000000000000002
x8 : ffff0000c4c1a370 x7 : ffff8000095d6a64 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff80000ceb269e x0 : 0000000000000000
Call trace:
 xfs_trans_committed_bulk+0xf0/0x460 fs/xfs/xfs_trans.c:785
 xlog_cil_committed+0xcc/0x340 fs/xfs/xfs_log_cil.c:795
 xlog_cil_process_committed+0x6c/0xa8 fs/xfs/xfs_log_cil.c:823
 xlog_state_shutdown_callbacks+0xac/0x140 fs/xfs/xfs_log.c:538
 xlog_force_shutdown+0x1ac/0x230 fs/xfs/xfs_log.c:3821
 xlog_ioend_work+0x68/0xa0 fs/xfs/xfs_log.c:1402
 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
 worker_thread+0x340/0x610 kernel/workqueue.c:2436
 kthread+0x12c/0x158 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
Code: 14000002 97d01d05 f9403335 2a1f03e0 (b94002ba) 
---[ end trace 0000000000000000 ]---
Code disassembly (best guess):
   0:	14000002 	b	0x8
   4:	97d01d05 	bl	0xffffffffff407418
   8:	f9403335 	ldr	x21, [x25, #96]
   c:	2a1f03e0 	mov	w0, wzr
* 10:	b94002ba 	ldr	w26, [x21] <-- trapping instruction

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-gce-arm64 2023/01/04 21:09 git:// for-kernelci a5541c0811a0 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] BUG: unable to handle kernel paging request in xfs_trans_committed_bulk
* Struck through repros no longer work on HEAD.