Messages in this thread | | | Date | Fri, 27 Jan 2023 09:41:43 -0800 | Subject | Re: [syzbot] [f2fs?] kernel BUG in __destroy_extent_tree | From | syzbot <> |
| |
syzbot has found a reproducer for the following issue on:
HEAD commit: 1dc22be1f91f Merge branch 'for-next/core' into for-kernelci git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci console output: https://syzkaller.appspot.com/x/log.txt?x=121135cd480000 kernel config: https://syzkaller.appspot.com/x/.config?x=e8cf742d9a45bfb6 dashboard link: https://syzkaller.appspot.com/bug?extid=15d87e3695975269de2c compiler: Debian clang version 13.0.1-6~deb11u1, GNU ld (GNU Binutils for Debian) 2.35.2 userspace arch: arm64 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1322f625480000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=154ae485480000
Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/ae0fce51809c/disk-1dc22be1.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/2e13fba82ffb/vmlinux-1dc22be1.xz kernel image: https://storage.googleapis.com/syzbot-assets/8d97a32221e2/Image-1dc22be1.gz.xz mounted in repro: https://storage.googleapis.com/syzbot-assets/6bb4c8db9bf2/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+15d87e3695975269de2c@syzkaller.appspotmail.com
------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:1191! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4444 Comm: syz-executor879 Not tainted 6.2.0-rc5-syzkaller-17295-g1dc22be1f91f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __destroy_extent_tree+0x2dc/0x324 fs/f2fs/extent_cache.c:1191 lr : __destroy_extent_tree+0x2dc/0x324 fs/f2fs/extent_cache.c:1191 sp : ffff80000ff0ba90 x29: ffff80000ff0bac0 x28: ffff0000caf45200 x27: 0000000000000000 x26: ffff0000ca1c2000 x25: ffff0000caf77000 x24: 0000000000000001 x23: ffff0000ca1c2bf0 x22: 0000000000000001 x21: ffff0000caf75120 x20: ffff0000caf44bf0 x19: 0000000000000000 x18: 0000000000000109 x17: 0000000000000000 x16: ffff80000dd97118 x15: ffff0000c9558000 x14: 00000000000000c0 x13: 00000000ffffffff x12: ffff0000c9558000 x11: ff8080000937af04 x10: 0000000000000000 x9 : ffff80000937af04 x8 : ffff0000c9558000 x7 : ffff80000937ae40 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0000c9558000 x1 : 0000000000000001 x0 : 0000000000000000 Call trace: __destroy_extent_tree+0x2dc/0x324 fs/f2fs/extent_cache.c:1191 f2fs_destroy_extent_tree+0x24/0x40 fs/f2fs/extent_cache.c:1204 f2fs_evict_inode+0x180/0x97c fs/f2fs/inode.c:789 evict+0xec/0x334 fs/inode.c:664 iput_final fs/inode.c:1747 [inline] iput+0x2c4/0x324 fs/inode.c:1773 f2fs_abort_atomic_write+0x60/0x2c0 fs/f2fs/segment.c:196 f2fs_ioc_abort_atomic_write fs/f2fs/file.c:2182 [inline] __f2fs_ioctl+0x1338/0x3320 fs/f2fs/file.c:4156 f2fs_ioctl+0x74/0xbc fs/f2fs/file.c:4242 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0xd0/0x140 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x104 arch/arm64/kernel/syscall.c:193 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 Code: 17ffffed 97bce56a d4210000 97bce568 (d4210000) ---[ end trace 0000000000000000 ]---
| |