syzbot
kernel BUG in __journal_res_get
Status:
fixed on 2024/06/11 03:41
Subsystems:
ext4
[Documentation on labels]
Reported-by: syzbot+c60cd352aedb109528bf@syzkaller.appspotmail.com
Fix commit:
cd3b31f9d417
bcachefs: Ensure we're RW before journalling
First crash: 818d, last: 794d
Sample crash report:
cached_sectors 0
stripe 0
stripe_redundancy 0
io_time[READ] 1
io_time[WRITE] 512
fragmentation 67108864
bp_start 7, fixing
bcachefs (loop0): alloc_read... done
bcachefs (loop0): stripes_read... done
bcachefs (loop0): snapshots_read... done
------------[ cut here ]------------
kernel BUG at fs/bcachefs/journal.c:370!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 5071 Comm: syz-executor319 Not tainted 6.9.0-rc7-syzkaller-00056-g45db3ab70092 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:journal_entry_open fs/bcachefs/journal.c:370 [inline]
RIP: 0010:__journal_res_get+0x21a7/0x2320 fs/bcachefs/journal.c:555
Code: 8c 03 fe ff ff e8 e9 45 c8 fd 48 8d 9c 24 c0 01 00 00 e9 f1 fd ff ff e8 a7 5e 48 07 e8 92 e9 66 fd 90 0f 0b e8 8a e9 66 fd 90 <0f> 0b e8 82 e9 66 fd 90 0f 0b e8 7a e9 66 fd 90 0f 0b e8 72 e9 66
RSP: 0018:ffffc90003356d20 EFLAGS: 00010293
RAX: ffffffff842f1e06 RBX: 0000000000000002 RCX: ffff888027970000
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc90003356fd0 R08: ffffffff842f03ac R09: 1ffff1100ef594f7
R10: dffffc0000000000 R11: ffffed100ef594f8 R12: dffffc0000000000
R13: 1ffff1100ef594f8 R14: ffff888077a80870 R15: 00000000003ffffe
FS: 000055556b42e380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559021ca6b80 CR3: 0000000077b18000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bch2_journal_res_get_slowpath+0x93/0x310 fs/bcachefs/journal.c:617
bch2_journal_res_get+0x12b/0x1c0 fs/bcachefs/journal.h:382
bch2_journal_meta+0x8d/0x280 fs/bcachefs/journal.c:838
bch2_fs_recovery+0x455b/0x63b0 fs/bcachefs/recovery.c:798
bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1043
bch2_fs_open+0xa8d/0xdf0 fs/bcachefs/super.c:2105
bch2_mount+0x71d/0x1320 fs/bcachefs/fs.c:1903
legacy_get_tree+0xee/0x190 fs/fs_context.c:662
vfs_get_tree+0x90/0x2a0 fs/super.c:1779
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fee63065dfa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc36e16f18 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc36e16f60 RCX: 00007fee63065dfa
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007ffc36e16f60
RBP: 0000000020005dc0 R08: 00007ffc36e16fa0 R09: 0000000000005d73
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000020005d80
R13: 0000000000005d79 R14: 00007ffc36e16fa0 R15: 0000000000000004
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:journal_entry_open fs/bcachefs/journal.c:370 [inline]
RIP: 0010:__journal_res_get+0x21a7/0x2320 fs/bcachefs/journal.c:555
Code: 8c 03 fe ff ff e8 e9 45 c8 fd 48 8d 9c 24 c0 01 00 00 e9 f1 fd ff ff e8 a7 5e 48 07 e8 92 e9 66 fd 90 0f 0b e8 8a e9 66 fd 90 <0f> 0b e8 82 e9 66 fd 90 0f 0b e8 7a e9 66 fd 90 0f 0b e8 72 e9 66
RSP: 0018:ffffc90003356d20 EFLAGS: 00010293
RAX: ffffffff842f1e06 RBX: 0000000000000002 RCX: ffff888027970000
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffffc90003356fd0 R08: ffffffff842f03ac R09: 1ffff1100ef594f7
R10: dffffc0000000000 R11: ffffed100ef594f8 R12: dffffc0000000000
R13: 1ffff1100ef594f8 R14: ffff888077a80870 R15: 00000000003ffffe
FS: 000055556b42e380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559021ca6b80 CR3: 0000000077b18000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
* Struck through repros no longer work on HEAD.