syzbot


BUG: sleeping function called from invalid context in f2fs_drop_inode

Status: fixed on 2025/11/21 09:17
Subsystems: f2fs
[Documentation on labels]
Reported-by: syzbot+635fba516c2c7858f799@syzkaller.appspotmail.com
Fix commit: 1ee889fdf409 f2fs: don't call iput() from f2fs_drop_inode()
First crash: 51d, last: 28d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [f2fs?] BUG: sleeping function called from invalid context in f2fs_drop_inode 1 (2) 2025/10/10 03:29

Sample crash report:
BUG: sleeping function called from invalid context at fs/inode.c:1928
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6164, name: syz.4.83
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
3 locks held by syz.4.83/6164:
 #0: ffff88807c64e420 (sb_writers#16){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
 #1: ffff8880576e9c30 (&type->i_mutex_dir_key#14/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
 #1: ffff8880576e9c30 (&type->i_mutex_dir_key#14/1){+.+.}-{4:4}, at: do_rmdir+0x1b2/0x550 fs/namei.c:4595
 #2: ffff8880576ea478 (&sb->s_type->i_lock_key#44){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #2: ffff8880576ea478 (&sb->s_type->i_lock_key#44){+.+.}-{3:3}, at: f2fs_drop_inode+0x67e/0x950 fs/f2fs/super.c:1822
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 0 UID: 0 PID: 6164 Comm: syz.4.83 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 __might_resched+0x495/0x610 kernel/sched/core.c:8925
 iput+0x2b/0xc50 fs/inode.c:1928
 f2fs_drop_inode+0x686/0x950 fs/f2fs/super.c:1823
 iput_final fs/inode.c:1884 [inline]
 iput+0x6dc/0xc50 fs/inode.c:1966
 d_delete_notify include/linux/fsnotify.h:377 [inline]
 vfs_rmdir+0x3ec/0x520 fs/namei.c:4561
 do_rmdir+0x25f/0x550 fs/namei.c:4603
 __do_sys_rmdir fs/namei.c:4622 [inline]
 __se_sys_rmdir fs/namei.c:4620 [inline]
 __x64_sys_rmdir+0x47/0x50 fs/namei.c:4620
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f55a158eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f559f7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f55a17e5fa0 RCX: 00007f55a158eec9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0
RBP: 00007f55a1611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f55a17e6038 R14: 00007f55a17e5fa0 R15: 00007ffe8bcfb178
 </TASK>
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6164 at fs/inode.c:1933 iput+0x38c/0xc50 fs/inode.c:1933
Modules linked in:
CPU: 0 UID: 0 PID: 6164 Comm: syz.4.83 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:iput+0x38c/0xc50 fs/inode.c:1933
Code: 80 3d c3 d6 49 0d 01 0f 85 b2 00 00 00 e8 1c fb 81 ff 4c 89 f7 be 10 00 00 00 e8 cf 85 06 00 e9 2c fd ff ff e8 05 fb 81 ff 90 <0f> 0b 90 e9 70 fd ff ff e8 f7 fa 81 ff 90 0f 0b 90 e9 d7 fe ff ff
RSP: 0018:ffffc9000beb7c30 EFLAGS: 00010246
RAX: ffffffff823e48eb RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000c7da000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffff8880576ea4b0 R08: ffffffff9297b047 R09: 1ffffffff252f608
R10: dffffc0000000000 R11: fffffbfff252f609 R12: ffff8880576ea5e0
R13: dffffc0000000000 R14: ffff8880576ea3e0 R15: 1ffffffff1f3c832
FS:  00007f559f7f66c0(0000) GS:ffff888125d0c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f958a7d1000 CR3: 0000000079a1a000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 f2fs_drop_inode+0x686/0x950 fs/f2fs/super.c:1823
 iput_final fs/inode.c:1884 [inline]
 iput+0x6dc/0xc50 fs/inode.c:1966
 d_delete_notify include/linux/fsnotify.h:377 [inline]
 vfs_rmdir+0x3ec/0x520 fs/namei.c:4561
 do_rmdir+0x25f/0x550 fs/namei.c:4603
 __do_sys_rmdir fs/namei.c:4622 [inline]
 __se_sys_rmdir fs/namei.c:4620 [inline]
 __x64_sys_rmdir+0x47/0x50 fs/namei.c:4620
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f55a158eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f559f7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f55a17e5fa0 RCX: 00007f55a158eec9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0
RBP: 00007f55a1611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f55a17e6038 R14: 00007f55a17e5fa0 R15: 00007ffe8bcfb178
 </TASK>

Crashes (43):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/13 03:25 upstream 3a8660878839 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/08 04:07 upstream 971199ad2a0f 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/16 17:25 upstream 7ea30958b305 19568248 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/16 10:59 upstream 7ea30958b305 19568248 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/15 23:23 upstream 1f4a222b0e33 82df6b00 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/15 20:30 upstream 1f4a222b0e33 82df6b00 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/15 07:42 upstream 9b332cece987 b6605ba8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/15 02:27 upstream 9b332cece987 b6605ba8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/15 00:35 upstream 9b332cece987 b6605ba8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/14 16:13 upstream 3a8660878839 b6605ba8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/14 10:18 upstream 3a8660878839 b6605ba8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/14 07:41 upstream 3a8660878839 b6605ba8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/13 03:25 upstream 3a8660878839 ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/12 23:09 upstream 67029a49db6c ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/12 13:29 upstream 67029a49db6c ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/12 09:23 upstream 98906f9d850e ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/12 04:49 upstream 98906f9d850e ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/12 04:40 upstream 98906f9d850e ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/11 21:02 upstream 0739473694c4 ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/11 20:29 upstream 0739473694c4 ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/11 15:47 upstream 0739473694c4 ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/11 11:39 upstream 0739473694c4 ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/11 06:27 upstream 917167ed1211 ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/10 15:15 upstream 5472d60c129f ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/10 09:59 upstream 5472d60c129f ff1712fe .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/09 19:00 upstream ec714e371f22 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/09 08:03 upstream cd5a0afbdf80 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/09 05:21 upstream cd5a0afbdf80 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/09 02:21 upstream cd5a0afbdf80 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/09 00:58 upstream cd5a0afbdf80 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/09 00:58 upstream cd5a0afbdf80 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/08 22:34 upstream cd5a0afbdf80 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/08 17:44 upstream 0d97f2067c16 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/08 07:40 upstream 0d97f2067c16 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/08 03:57 upstream c746c3b51698 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/08 02:32 upstream c746c3b51698 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/07 17:40 upstream c746c3b51698 7e2882b3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/07 00:21 upstream ba9dac987319 8ef35d49 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/04 10:33 upstream 2ccb4d203fe4 49379ee0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/04 04:04 upstream 2ccb4d203fe4 49379ee0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/03 16:25 upstream e406d57be7bd 49379ee0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/27 04:20 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci b98c94eed4a9 c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: sleeping function called from invalid context in f2fs_drop_inode
2025/10/21 20:31 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 143937ca51cc 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: sleeping function called from invalid context in f2fs_drop_inode
* Struck through repros no longer work on HEAD.