linux-kernel - Re: [syzbot] [f2fs?] kernel BUG in __destroy_extent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 27 Jan 2023 09:41:43 -0800
From:   syzbot <syzbot+15d87e3695975269de2c@...kaller.appspotmail.com>
To:     chao@...nel.org, jaegeuk@...nel.org,
        linux-f2fs-devel@...ts.sourceforge.net,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [f2fs?] kernel BUG in __destroy_extent_tree

syzbot has found a reproducer for the following issue on:

HEAD commit:    1dc22be1f91f Merge branch 'for-next/core' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=121135cd480000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e8cf742d9a45bfb6
dashboard link: https://syzkaller.appspot.com/bug?extid=15d87e3695975269de2c
compiler:       Debian clang version 13.0.1-6~deb11u1, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1322f625480000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=154ae485480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ae0fce51809c/disk-1dc22be1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2e13fba82ffb/vmlinux-1dc22be1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8d97a32221e2/Image-1dc22be1.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6bb4c8db9bf2/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+15d87e3695975269de2c@...kaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/f2fs/extent_cache.c:1191!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4444 Comm: syz-executor879 Not tainted 6.2.0-rc5-syzkaller-17295-g1dc22be1f91f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __destroy_extent_tree+0x2dc/0x324 fs/f2fs/extent_cache.c:1191
lr : __destroy_extent_tree+0x2dc/0x324 fs/f2fs/extent_cache.c:1191
sp : ffff80000ff0ba90
x29: ffff80000ff0bac0 x28: ffff0000caf45200 x27: 0000000000000000
x26: ffff0000ca1c2000 x25: ffff0000caf77000 x24: 0000000000000001
x23: ffff0000ca1c2bf0 x22: 0000000000000001 x21: ffff0000caf75120
x20: ffff0000caf44bf0 x19: 0000000000000000 x18: 0000000000000109
x17: 0000000000000000 x16: ffff80000dd97118 x15: ffff0000c9558000
x14: 00000000000000c0 x13: 00000000ffffffff x12: ffff0000c9558000
x11: ff8080000937af04 x10: 0000000000000000 x9 : ffff80000937af04
x8 : ffff0000c9558000 x7 : ffff80000937ae40 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0000c9558000 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
 __destroy_extent_tree+0x2dc/0x324 fs/f2fs/extent_cache.c:1191
 f2fs_destroy_extent_tree+0x24/0x40 fs/f2fs/extent_cache.c:1204
 f2fs_evict_inode+0x180/0x97c fs/f2fs/inode.c:789
 evict+0xec/0x334 fs/inode.c:664
 iput_final fs/inode.c:1747 [inline]
 iput+0x2c4/0x324 fs/inode.c:1773
 f2fs_abort_atomic_write+0x60/0x2c0 fs/f2fs/segment.c:196
 f2fs_ioc_abort_atomic_write fs/f2fs/file.c:2182 [inline]
 __f2fs_ioctl+0x1338/0x3320 fs/f2fs/file.c:4156
 f2fs_ioctl+0x74/0xbc fs/f2fs/file.c:4242
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __arm64_sys_ioctl+0xd0/0x140 fs/ioctl.c:856
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x104 arch/arm64/kernel/syscall.c:193
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
Code: 17ffffed 97bce56a d4210000 97bce568 (d4210000) 
---[ end trace 0000000000000000 ]---