Message-ID: <45b62d6f-40fb-41c0-9c1a-e97b341930e3@suse.com>
Date: Sat, 2 Aug 2025 07:18:04 +0930
From: Qu Wenruo <wqu@...e.com>
To: syzbot <syzbot+c035bce0effd1de39e05@...kaller.appspotmail.com>,
 clm@...com, dsterba@...e.com, josef@...icpanda.com,
 linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [btrfs?] WARNING in btrfs_lookup_extent_info (2)



在 2025/8/2 04:26, syzbot 写道:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    038d61fd6422 Linux 6.16
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17bd14a2580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=831eea247244ce8c
> dashboard link: https://syzkaller.appspot.com/bug?extid=c035bce0effd1de39e05
> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-038d61fd.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/45453fb53a5d/vmlinux-038d61fd.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/4094774b8a7e/bzImage-038d61fd.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c035bce0effd1de39e05@...kaller.appspotmail.com

The real problem happens before that:

[   76.684845][ T5354] FAULT_INJECTION: forcing a failure.
[   76.684845][ T5354] name failslab, interval 1, probability 0, space 
0, times 1
[   76.699734][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 
6.16.0-syzkaller #0 PREEMPT(full)
[   76.699754][ T5354] Hardware name: QEMU Standard PC (Q35 + ICH9, 
2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   76.699761][ T5354] Call Trace:
[   76.699766][ T5354]  <TASK>
[   76.699772][ T5354]  dump_stack_lvl+0x189/0x250
[   76.699851][ T5354]  ? __pfx____ratelimit+0x10/0x10
[   76.699894][ T5354]  ? __pfx_dump_stack_lvl+0x10/0x10
[   76.699908][ T5354]  ? __pfx__printk+0x10/0x10
[   76.699927][ T5354]  ? __pfx___might_resched+0x10/0x10
[   76.699940][ T5354]  ? fs_reclaim_acquire+0x7d/0x100
[   76.699992][ T5354]  should_fail_ex+0x414/0x560
[   76.700013][ T5354]  should_failslab+0xa8/0x100
[   76.700030][ T5354]  kmem_cache_alloc_noprof+0x73/0x3c0
[   76.700043][ T5354]  ? __btrfs_inc_extent_ref+0x1e0/0x710
[   76.700063][ T5354]  __btrfs_inc_extent_ref+0x1e0/0x710
[   76.700085][ T5354]  ? __pfx___btrfs_inc_extent_ref+0x10/0x10
[   76.700113][ T5354]  __btrfs_run_delayed_refs+0xea2/0x3a50

An ENOMEM is injected to a critical path. And we handled it gracefully, 
not crashing the kernel.

But this also means the extent tree is not properly updated (thus can be 
considered as a corrupted extent tree)>
> BTRFS info (device loop0): balance: start -d -m
> BTRFS info (device loop0): relocating block group 6881280 flags data|metadata
> BTRFS info (device loop0): relocating block group 5242880 flags data|metadata
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 5337 at fs/btrfs/extent-tree.c:209 btrfs_lookup_extent_info+0xcc6/0xd80 fs/btrfs/extent-tree.c:209

The warning is very likely to be caused by the previous error injection.

I'd say, if you're injecting errors, please allow us to give a warning 
or two.

Thanks,
Qu

> Modules linked in:
> CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted 6.16.0-syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> RIP: 0010:btrfs_lookup_extent_info+0xcc6/0xd80 fs/btrfs/extent-tree.c:209
> Code: 8b ff ff ff 48 8b 7c 24 50 48 c7 c6 31 97 ae 8d ba a9 00 00 00 b9 8b ff ff ff e8 c5 85 6a fd e9 16 fe ff ff e8 0b ee 00 fe 90 <0f> 0b 90 e9 6d fd ff ff e8 dd 44 b0 07 89 d9 80 e1 07 38 c1 0f 8c
> RSP: 0018:ffffc9000ddfeea0 EFLAGS: 00010293
> RAX: ffffffff83bf4305 RBX: ffff8880363d43b0 RCX: ffff8880118c0000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffffc9000ddff000 R08: ffff8880363d43b3 R09: 1ffff11006c7a876
> R10: dffffc0000000000 R11: ffffed1006c7a877 R12: dffffc0000000000
> R13: ffff88805325c6d4 R14: 0000000000000000 R15: ffffc9000ddff0c0
> FS:  00007fe87d3d46c0(0000) GS:ffff88808d218000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000200000453000 CR3: 0000000011d7e000 CR4: 0000000000352ef0
> Call Trace:
>   <TASK>
>   update_ref_for_cow+0x998/0x1210 fs/btrfs/ctree.c:373
>   btrfs_force_cow_block+0x9d4/0x1e10 fs/btrfs/ctree.c:527
>   btrfs_cow_block+0x40a/0x830 fs/btrfs/ctree.c:688
>   do_relocation+0xd64/0x1610 fs/btrfs/relocation.c:2275
>   relocate_tree_block fs/btrfs/relocation.c:2528 [inline]
>   relocate_tree_blocks+0x118b/0x1e90 fs/btrfs/relocation.c:2635
>   relocate_block_group+0x760/0xd90 fs/btrfs/relocation.c:3607
>   btrfs_relocate_block_group+0x966/0xde0 fs/btrfs/relocation.c:4008
>   btrfs_relocate_chunk+0x12a/0x3b0 fs/btrfs/volumes.c:3437
>   __btrfs_balance+0x1870/0x21d0 fs/btrfs/volumes.c:4212
>   btrfs_balance+0xc94/0x11d0 fs/btrfs/volumes.c:4589
>   btrfs_ioctl_balance+0x3d3/0x610 fs/btrfs/ioctl.c:3583
>   vfs_ioctl fs/ioctl.c:51 [inline]
>   __do_sys_ioctl fs/ioctl.c:907 [inline]
>   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
>   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>   entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fe880f8e9a9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fe87d3d4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fe8811b6080 RCX: 00007fe880f8e9a9
> RDX: 0000200000000180 RSI: 00000000c4009420 RDI: 0000000000000005
> RBP: 00007fe881010d69 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 0000000000000001 R14: 00007fe8811b6080 R15: 00007ffc53dc1948
>   </TASK>
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@...glegroups.com.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup
> 

Powered by blists - more mailing lists