syzbot


WARNING: locking bug in ext4_es_lookup_extent

Status: upstream: reported on 2022/10/13 08:05
Reported-by: syzbot+c07a3726c89b814d58f1@syzkaller.appspotmail.com
First crash: 51d, last: 16d

Sample crash report:
loop5: detected capacity change from 0 to 32832
EXT4-fs (loop5): invalid journal inode
EXT4-fs (loop5): can't get journal size
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 0 PID: 23839 at kernel/locking/lockdep.c:231 check_wait_context kernel/locking/lockdep.c:4729 [inline]
WARNING: CPU: 0 PID: 23839 at kernel/locking/lockdep.c:231 __lock_acquire+0x2b0/0x3084 kernel/locking/lockdep.c:5005
Modules linked in:
CPU: 0 PID: 23839 Comm: syz-executor.5 Not tainted 6.1.0-rc5-syzkaller-32269-g9500fc6e9e60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : check_wait_context kernel/locking/lockdep.c:4729 [inline]
pc : __lock_acquire+0x2b0/0x3084 kernel/locking/lockdep.c:5005
lr : hlock_class kernel/locking/lockdep.c:231 [inline]
lr : check_wait_context kernel/locking/lockdep.c:4729 [inline]
lr : __lock_acquire+0x298/0x3084 kernel/locking/lockdep.c:5005
sp : ffff800013ad3750
x29: ffff800013ad3830 x28: 0000000000000001 x27: ffff000116581a68
x26: ffff000113ab86f8 x25: ffff000116582470 x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000001 x19: aaaaab555542fe02 x18: 0000000000000100
x17: ffff80000c0ed83c x16: ffff80000dc18158 x15: ffff000116581a40
x14: 0000000000000000 x13: 0000000000000012 x12: 0000000000040000
x11: 000000000000edac x10: ffff80000ddda198 x9 : dcf89c575cc11200
x8 : 0000000000000000 x7 : 4e5241575f534b43 x6 : ffff80000c0b2b74
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000001 x0 : 0000000000000016
Call trace:
 check_wait_context kernel/locking/lockdep.c:4729 [inline]
 __lock_acquire+0x2b0/0x3084 kernel/locking/lockdep.c:5005
 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
 _raw_read_lock+0x68/0x84 kernel/locking/spinlock.c:228
 ext4_es_lookup_extent+0x64/0x25c fs/ext4/extents_status.c:932
 ext4_map_blocks+0xb4/0xaec fs/ext4/inode.c:528
 ext4_protect_reserved_inode fs/ext4/block_validity.c:168 [inline]
 ext4_setup_system_zone+0x3bc/0x76c fs/ext4/block_validity.c:251
 __ext4_fill_super+0x23d8/0x2c2c fs/ext4/super.c:5411
 ext4_fill_super+0x100/0x2d8 fs/ext4/super.c:5643
 get_tree_bdev+0x1e8/0x2a0 fs/super.c:1324
 ext4_get_tree+0x28/0x38 fs/ext4/super.c:5673
 vfs_get_tree+0x40/0x140 fs/super.c:1531
 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040
 path_mount+0x358/0x890 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __arm64_sys_mount+0x2c4/0x3c4 fs/namespace.c:3568
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
irq event stamp: 881
hardirqs last  enabled at (881): [<ffff80000c0b7c04>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (881): [<ffff80000c0b7c04>] _raw_spin_unlock_irqrestore+0x48/0x8c kernel/locking/spinlock.c:194
hardirqs last disabled at (880): [<ffff80000c0b7a40>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (880): [<ffff80000c0b7a40>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last  enabled at (560): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (551): [<ffff800008017c88>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
---[ end trace 0000000000000000 ]---
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000177315000
[00000000000000b8] pgd=080000017716d003, p4d=080000017716d003, pud=0800000156e60003, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 23839 Comm: syz-executor.5 Tainted: G        W          6.1.0-rc5-syzkaller-32269-g9500fc6e9e60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : check_wait_context kernel/locking/lockdep.c:4729 [inline]
pc : __lock_acquire+0x2d0/0x3084 kernel/locking/lockdep.c:5005
lr : hlock_class kernel/locking/lockdep.c:231 [inline]
lr : check_wait_context kernel/locking/lockdep.c:4729 [inline]
lr : __lock_acquire+0x298/0x3084 kernel/locking/lockdep.c:5005
sp : ffff800013ad3750
x29: ffff800013ad3830 x28: 0000000000000001 x27: ffff000116581a68
x26: ffff000113ab86f8 x25: ffff000116582470 x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000001 x19: aaaaab555542fe02 x18: 0000000000000100
x17: ffff80000c0ed83c x16: ffff80000dc18158 x15: ffff000116581a40
x14: 0000000000000000 x13: 0000000000000012 x12: 0000000000040000
x11: 000000000000edac x10: ffff80000ddda198 x9 : 0000000000051e02
x8 : 0000000000000000 x7 : 4e5241575f534b43 x6 : ffff80000c0b2b74
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000001 x0 : 0000000000000016
Call trace:
 hlock_class kernel/locking/lockdep.c:222 [inline]
 check_wait_context kernel/locking/lockdep.c:4730 [inline]
 __lock_acquire+0x2d0/0x3084 kernel/locking/lockdep.c:5005
 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
 _raw_read_lock+0x68/0x84 kernel/locking/spinlock.c:228
 ext4_es_lookup_extent+0x64/0x25c fs/ext4/extents_status.c:932
 ext4_map_blocks+0xb4/0xaec fs/ext4/inode.c:528
 ext4_protect_reserved_inode fs/ext4/block_validity.c:168 [inline]
 ext4_setup_system_zone+0x3bc/0x76c fs/ext4/block_validity.c:251
 __ext4_fill_super+0x23d8/0x2c2c fs/ext4/super.c:5411
 ext4_fill_super+0x100/0x2d8 fs/ext4/super.c:5643
 get_tree_bdev+0x1e8/0x2a0 fs/super.c:1324
 ext4_get_tree+0x28/0x38 fs/ext4/super.c:5673
 vfs_get_tree+0x40/0x140 fs/super.c:1531
 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040
 path_mount+0x358/0x890 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __arm64_sys_mount+0x2c4/0x3c4 fs/namespace.c:3568
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
Code: d002e1ca 91056210 9106614a b9400329 (3942e114) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d002e1ca 	adrp	x10, 0x5c3a000
   4:	91056210 	add	x16, x16, #0x158
   8:	9106614a 	add	x10, x10, #0x198
   c:	b9400329 	ldr	w9, [x25]
* 10:	3942e114 	ldrb	w20, [x8, #184] <-- trapping instruction

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-gce-arm64 2022/11/17 02:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 3a127a31 .config log report info WARNING: locking bug in ext4_es_lookup_extent
ci-upstream-gce-arm64 2022/11/07 00:53 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 6d752409 .config log report info WARNING: locking bug in ext4_es_lookup_extent
ci-upstream-gce-arm64 2022/10/13 02:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 89b5a509 .config log report info WARNING: locking bug in ext4_es_lookup_extent
* Struck through repros no longer work on HEAD.