From: Bob Peterson <rpeterso@redhat.com>
To: cluster-devel.redhat.com
Subject: [Cluster-devel] We found a general protection fault in evict
Date: Thu, 27 Apr 2023 15:04:19 -0400 [thread overview]
Message-ID: <224ae998-d264-c984-263d-a9a7cf6c7a00@redhat.com> (raw)
In-Reply-To: <CAAehj2ntp=h1ob2MVWv7_3NuT=wtA6Gpdk9ZWWYU=pDy8PvmBw@mail.gmail.com>
On 4/27/23 11:15 AM, yang lan wrote:
> Hi,
>
> We use our modified Syzkaller to fuzz the latest Linux kernel and find a
> bug in the gfs2 file system.
>
> We have used the utility syz-execprog to reproduce this bug with
> ./syz-execprog -executor=./syz-executor -repeat=100 -procs=6 -cover=1 poc.
> Now, this bug can be triggered with the following prog provided:
>
> HEAD commit: f1b32fda06d2 tag: v5.10.179
> console log: https://pastebin.com/raw/3XhteWrX
> <https://pastebin.com/raw/3XhteWrX>
> kernel config: https://pastebin.com/raw/BiggLxRg
> <https://pastebin.com/raw/BiggLxRg>
> Syz reproducer: https://pastebin.com/raw/PwbMR8ag
> <https://pastebin.com/raw/PwbMR8ag>
> C reproducer:
> https://drive.google.com/file/d/1j4g8EUrFb1GGdaaRBNHE4ATXiqeg6-zI/view?usp=sharing <https://drive.google.com/file/d/1j4g8EUrFb1GGdaaRBNHE4ATXiqeg6-zI/view?usp=sharing>
>
> gfs2: fsid=syz:syz.0: no resource groups found in the file system.
Hi,
The upstream kernel doesn't seem to GPF here. I get a non-fatal file
system withdraw (which seems reasonable given what the resulting fs
looks like):
[root at bob-upstream9 /home/bob/xfstests-dev]# /home/bob/tools/c/poc_evict
[root at bob-upstream9 /home/bob/xfstests-dev]# echo $?
0
[ 2530.707005] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock",
"syz:syz"
[ 2530.707576] gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
[ 2530.708349] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error
[ 2530.708349] inode = 3 2076
[ 2530.708349] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line
= 472
[ 2530.709534] gfs2: fsid=syz:syz.0: G: s:SH n:2/81c f:qobnN t:SH
d:EX/0 a:0 v:0 r:3 m:200 p:1
[ 2530.710165] gfs2: fsid=syz:syz.0: H: s:SH f:H e:0 p:1825 [mount]
gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.710846] gfs2: fsid=syz:syz.0: I: n:3/2076 t:4 f:0x00
d:0x00000000 s:0 p:0
[ 2530.711387] gfs2: fsid=syz:syz.0: about to withdraw this file system
[ 2530.711857] gfs2: fsid=syz:syz.0: File system withdrawn
[ 2530.712256] CPU: 6 PID: 1825 Comm: mount Kdump: loaded Not tainted
6.3.0-rc3+ #26
[ 2530.712803] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.1-1.el9
04/01/2014
[ 2530.713324] Call Trace:
[ 2530.713513] <TASK>
[ 2530.713678] dump_stack_lvl+0x48/0x60
[ 2530.713959] gfs2_withdraw+0x479/0x5c0 [gfs2]
[ 2530.714299] gfs2_inode_refresh+0x267/0x2d0 [gfs2]
[ 2530.714667] gfs2_instantiate+0x87/0xc0 [gfs2]
[ 2530.715013] gfs2_glock_wait+0x8b/0xb0 [gfs2]
[ 2530.715356] init_journal+0x302/0xaf0 [gfs2]
[ 2530.715693] ? vsnprintf+0x2ba/0x560
[ 2530.715966] ? gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.716326] ? snprintf+0x3d/0x50
[ 2530.716576] gfs2_fill_super+0x8f0/0xef0 [gfs2]
[ 2530.716927] ? gfs2_fill_super+0x7aa/0xef0 [gfs2]
[ 2530.717287] ? mutex_lock+0x12/0x40
[ 2530.717552] ? __pfx_gfs2_fill_super+0x10/0x10 [gfs2]
[ 2530.717938] ? snprintf+0x3d/0x50
[ 2530.718190] ? sget_fc+0x208/0x300
[ 2530.718453] ? __pfx_gfs2_fill_super+0x10/0x10 [gfs2]
[ 2530.718837] get_tree_bdev+0x171/0x270
[ 2530.719126] gfs2_get_tree+0x22/0x90 [gfs2]
[ 2530.719446] vfs_get_tree+0x26/0xd0
[ 2530.719711] path_mount+0x464/0xa80
[ 2530.719981] __x64_sys_mount+0xeb/0x120
[ 2530.720271] do_syscall_64+0x5d/0x90
[ 2530.720544] ? syscall_exit_to_user_mode+0x1b/0x40
[ 2530.720902] ? do_syscall_64+0x6d/0x90
[ 2530.721185] ? do_syscall_64+0x6d/0x90
[ 2530.721467] ? syscall_exit_to_user_mode+0x1b/0x40
[ 2530.721823] ? do_syscall_64+0x6d/0x90
[ 2530.722106] ? do_syscall_64+0x6d/0x90
[ 2530.722386] ? do_syscall_64+0x6d/0x90
[ 2530.722668] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2530.723046] RIP: 0033:0x7f7dcd83f7be
[ 2530.723316] Code: 48 8b 0d 65 a6 1b 00 f7 d8 64 89 01 48 83 c8 ff c3
66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f
05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 32 a6 1b 00 f7 d8 64 89 01 48
[ 2530.724659] RSP: 002b:00007fffe0f3d248 EFLAGS: 00000246 ORIG_RAX:
00000000000000a5
[ 2530.725211] RAX: ffffffffffffffda RBX: 0000000000000000 RCX:
00007f7dcd83f7be
[ 2530.725733] RDX: 000055b230c02e20 RSI: 000055b230c02e60 RDI:
000055b230c02e40
[ 2530.726256] RBP: 000055b230c02bf0 R08: 0000000000000000 R09:
00007fffe0f3bf70
[ 2530.726776] R10: 0000000000000000 R11: 0000000000000246 R12:
0000000000000000
[ 2530.727298] R13: 000055b230c02e20 R14: 000055b230c02e40 R15:
000055b230c02bf0
[ 2530.727819] </TASK>
[ 2530.728005] gfs2: fsid=syz:syz.0: can't read journal index: -5
I'm guessing it's a problem we've already fixed in newer versions, but I
don't have easy access to that kernel. Perhaps you can bisect it?
I could try older kernels but I've already spent a lot of time on this
today, so I need to move on to other things.
Regards,
Bob Peterson
prev parent reply other threads:[~2023-04-27 19:04 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-27 15:15 [Cluster-devel] We found a general protection fault in evict yang lan
2023-04-27 19:04 ` Bob Peterson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=224ae998-d264-c984-263d-a9a7cf6c7a00@redhat.com \
--to=rpeterso@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).