From: syzbot <syzbot+776b5fc6c99745aa7860@syzkaller.appspotmail.com>
To: jfs-discussion@lists.sourceforge.net,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
shaggy@kernel.org, syzkaller-bugs@googlegroups.com,
xrivendell7@gmail.com
Subject: Re: [syzbot] [jfs?] kernel BUG in txEnd (2)
Date: Fri, 29 Mar 2024 00:57:18 -0700 [thread overview]
Message-ID: <00000000000022ef250614c7fd94@google.com> (raw)
In-Reply-To: <000000000000a12738061144f9d1@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=157a3321180000
kernel config: https://syzkaller.appspot.com/x/.config?x=1a07d5da4eb21586
dashboard link: https://syzkaller.appspot.com/bug?extid=776b5fc6c99745aa7860
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1623f5b1180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=110d1129180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b42ab0fd4947/disk-fe46a7dd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b8a6e7231930/vmlinux-fe46a7dd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4fbf3e4ce6f8/bzImage-fe46a7dd.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/8dce556379ee/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+776b5fc6c99745aa7860@syzkaller.appspotmail.com
jfs_dirty_inode called on read-only volume
Is remount racy?
BUG at fs/jfs/jfs_txnmgr.c:528 assert(tblk->next == 0)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_txnmgr.c:528!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 5253 Comm: syz-executor989 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:txEnd+0x583/0x5a0 fs/jfs/jfs_txnmgr.c:528
Code: e9 59 fb ff ff e8 bd 24 84 fe 48 c7 c1 40 a4 4a 8b ba 10 02 00 00 48 c7 c6 c0 9e 4a 8b 48 c7 c7 00 9f 4a 8b e8 5e f5 64 fe 90 <0f> 0b 48 89 ef e8 03 07 df fe e9 40 fd ff ff e8 c9 06 df fe e9 2e
RSP: 0018:ffffc90008cc7ab8 EFLAGS: 00010282
RAX: 0000000000000036 RBX: ffffc900025d1110 RCX: ffffffff816f2339
RDX: 0000000000000000 RSI: ffffffff816fab26 RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000001 R14: ffffffff8dd43da0 R15: ffffc900025d1112
FS: 00007fc48c2826c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc484d0b000 CR3: 000000001511e000 CR4: 0000000000350ef0
Call Trace:
<TASK>
add_missing_indices fs/jfs/jfs_dtree.c:2663 [inline]
jfs_readdir+0x2952/0x4310 fs/jfs/jfs_dtree.c:3009
wrap_directory_iterator+0xa8/0xe0 fs/readdir.c:67
iterate_dir+0x295/0x9e0 fs/readdir.c:110
__do_sys_getdents fs/readdir.c:326 [inline]
__se_sys_getdents fs/readdir.c:311 [inline]
__x64_sys_getdents+0x14f/0x2d0 fs/readdir.c:311
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7fc48c2f6c39
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc48c282168 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007fc48c37e6d8 RCX: 00007fc48c2f6c39
RDX: 0000000000001000 RSI: 0000000020006600 RDI: 0000000000000005
RBP: 00007fc48c37e6d0 R08: 00007fc48c2826c0 R09: 0000000000000000
R10: 00007fc48c2826c0 R11: 0000000000000246 R12: 00007fc48c37e6dc
R13: 000000000000006e R14: 00007ffdf1f02700 R15: 00007ffdf1f027e8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:txEnd+0x583/0x5a0 fs/jfs/jfs_txnmgr.c:528
Code: e9 59 fb ff ff e8 bd 24 84 fe 48 c7 c1 40 a4 4a 8b ba 10 02 00 00 48 c7 c6 c0 9e 4a 8b 48 c7 c7 00 9f 4a 8b e8 5e f5 64 fe 90 <0f> 0b 48 89 ef e8 03 07 df fe e9 40 fd ff ff e8 c9 06 df fe e9 2e
RSP: 0018:ffffc90008cc7ab8 EFLAGS: 00010282
RAX: 0000000000000036 RBX: ffffc900025d1110 RCX: ffffffff816f2339
RDX: 0000000000000000 RSI: ffffffff816fab26 RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000001 R14: ffffffff8dd43da0 R15: ffffc900025d1112
FS: 00007fc48c2826c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc484d0b000 CR3: 000000001511e000 CR4: 0000000000350ef0
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-03-29 7:57 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-13 15:23 [syzbot] [jfs?] kernel BUG in txEnd (2) syzbot
2024-03-29 7:57 ` syzbot [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-02-20 3:00 xingwei lee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=00000000000022ef250614c7fd94@google.com \
--to=syzbot+776b5fc6c99745aa7860@syzkaller.appspotmail.com \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=shaggy@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=xrivendell7@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.