[Cluster-devel] [syzbot] [gfs2?] KMSAN: uninit-value in inode_go_dump
Hello, syzbot found the following issue on: HEAD commit:e919e2b1bc1c Revert "kmsan: disallow CONFIG_KMSAN with CON.. git tree: https://github.com/google/kmsan.git master console output: https://syzkaller.appspot.com/x/log.txt?x=1153019148 kernel config: https://syzkaller.appspot.com/x/.config?x=b63e082c4fda2e77 dashboard link: https://syzkaller.appspot.com/bug?extid=79333ce1ae874ab7ffbb compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project.git 610139d2d9ce6746b3c617fb3e2f7886272d26ff), GNU ld (GNU Binutils for Debian) 2.35.2 userspace arch: i386 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/5676c9771994/disk-e919e2b1.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/7f53a1472ca4/vmlinux-e919e2b1.xz kernel image: https://storage.googleapis.com/syzbot-assets/eb021c0a44de/bzImage-e919e2b1.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+79333ce1ae874ab7f...@syzkaller.appspotmail.com gfs2: fsid=syz:syz.0: G: s:SH n:2/13 f:qobnN t:SH d:EX/0 a:0 v:0 r:3 m:20 p:1 gfs2: fsid=syz:syz.0: H: s:SH f:eEcH e:0 p:0 [(none)] init_inodes+0x125/0x510 fs/gfs2/ops_fstype.c:889 = BUG: KMSAN: uninit-value in inode_go_dump+0x499/0x4d0 fs/gfs2/glops.c:544 inode_go_dump+0x499/0x4d0 fs/gfs2/glops.c:544 gfs2_dump_glock+0x21d1/0x2300 fs/gfs2/glock.c:2379 gfs2_consist_inode_i+0x19b/0x220 fs/gfs2/util.c:465 gfs2_dinode_in fs/gfs2/glops.c:460 [inline] gfs2_inode_refresh+0x10d9/0x14e0 fs/gfs2/glops.c:480 inode_go_instantiate+0x6a/0xc0 fs/gfs2/glops.c:499 gfs2_instantiate+0x253/0x490 fs/gfs2/glock.c:456 gfs2_glock_holder_ready fs/gfs2/glock.c:1299 [inline] gfs2_glock_wait+0x28a/0x3d0 fs/gfs2/glock.c:1319 gfs2_glock_nq+0x8ce/0xbe0 fs/gfs2/glock.c:1567 gfs2_glock_nq_init fs/gfs2/glock.h:262 [inline] init_journal+0x11f2/0x38e0 fs/gfs2/ops_fstype.c:794 init_inodes+0x125/0x510 fs/gfs2/ops_fstype.c:889 gfs2_fill_super+0x3b2d/0x43a0 fs/gfs2/ops_fstype.c:1247 get_tree_bdev+0x8a3/0xd30 fs/super.c:1282 gfs2_get_tree+0x58/0x340 fs/gfs2/ops_fstype.c:1330 vfs_get_tree+0xa1/0x500 fs/super.c:1489 do_new_mount+0x694/0x1580 fs/namespace.c:3145 path_mount+0x71a/0x1eb0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x734/0x840 fs/namespace.c:3674 __ia32_sys_mount+0xdf/0x140 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9f1/0xe80 mm/page_alloc.c:5572 alloc_pages+0xaae/0xd80 mm/mempolicy.c:2286 alloc_slab_page mm/slub.c:1851 [inline] allocate_slab+0x235/0x1200 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0x10c3/0x2d60 mm/slub.c:3193 __slab_alloc mm/slub.c:3292 [inline] __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] slab_alloc mm/slub.c:3460 [inline] __kmem_cache_alloc_lru mm/slub.c:3467 [inline] kmem_cache_alloc_lru+0x713/0xb60 mm/slub.c:3483 alloc_inode_sb include/linux/fs.h:3119 [inline] gfs2_alloc_inode+0x62/0x210 fs/gfs2/super.c:1440 alloc_inode+0x83/0x440 fs/inode.c:259 iget5_locked+0xa5/0x200 fs/inode.c:1241 gfs2_inode_lookup+0xc7/0x14b0 fs/gfs2/inode.c:124 gfs2_lookup_root fs/gfs2/ops_fstype.c:462 [inline] init_sb+0xf27/0x19d0 fs/gfs2/ops_fstype.c:529 gfs2_fill_super+0x315b/0x43a0 fs/gfs2/ops_fstype.c:1214 get_tree_bdev+0x8a3/0xd30 fs/super.c:1282 gfs2_get_tree+0x58/0x340 fs/gfs2/ops_fstype.c:1330 vfs_get_tree+0xa1/0x500 fs/super.c:1489 do_new_mount+0x694/0x1580 fs/namespace.c:3145 path_mount+0x71a/0x1eb0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x734/0x840 fs/namespace.c:3674 __ia32_sys_mount+0xdf/0x140 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 CPU: 0 PID: 5906 Comm: syz-executor.3 Not tainted 6.2.0-rc3-syzkaller-79343-ge919e2b1bc1c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 = --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkal...@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
[Cluster-devel] [syzbot] [gfs2?] BUG: sleeping function called from invalid context in gfs2_glock_wait
Hello,
syzbot found the following issue on:
HEAD commit:d532dd102151 Merge tag 'for-6.2-rc4-tag' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16c88b2c48
kernel config: https://syzkaller.appspot.com/x/.config?x=c3574635786f74ca
dashboard link: https://syzkaller.appspot.com/bug?extid=cdb448c6e82c20d7960c
compiler: Debian clang version
13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU
Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a30e7e48
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=164a8ab148
Downloadable assets:
disk image:
https://storage.googleapis.com/syzbot-assets/a644dc38be2c/disk-d532dd10.raw.xz
vmlinux:
https://storage.googleapis.com/syzbot-assets/30e89b0598f8/vmlinux-d532dd10.xz
kernel image:
https://storage.googleapis.com/syzbot-assets/5bb4bab3f67d/bzImage-d532dd10.xz
mounted in repro:
https://storage.googleapis.com/syzbot-assets/89f4e6ce/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cdb448c6e82c20d79...@syzkaller.appspotmail.com
gfs2: fsid=syz:syz.0: found 1 quota changes
syz-executor390: attempt to access beyond end of device
loop0: rw=1, sector=131324, nr_sectors = 4 limit=32768
gfs2: fsid=syz:syz.0: Error 10 writing to journal, jid=0
gfs2: fsid=syz:syz.0: fatal: I/O error(s)
gfs2: fsid=syz:syz.0: about to withdraw this file system
BUG: sleeping function called from invalid context at fs/gfs2/glock.c:1316
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5053, name:
syz-executor390
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
4 locks held by syz-executor390/5053:
#0: 88807a14c0e0 (&type->s_umount_key#47){+.+.}-{3:3}, at:
deactivate_super+0x96/0xd0 fs/super.c:362
#1: 888023a48b70 (&sdp->sd_quota_sync_mutex){+.+.}-{3:3}, at:
gfs2_quota_sync+0x9b/0x8b0 fs/gfs2/quota.c:1302
#2: 888023a49058 (&sdp->sd_log_flush_lock){}-{3:3}, at:
gfs2_log_flush+0xe7/0x26a0 fs/gfs2/log.c:1034
#3: 888023a48e80 (&sdp->sd_log_lock){+.+.}-{2:2}, at: spin_lock
include/linux/spinlock.h:350 [inline]
#3: 888023a48e80 (&sdp->sd_log_lock){+.+.}-{2:2}, at: gfs2_log_lock
fs/gfs2/log.h:32 [inline]
#3: 888023a48e80 (&sdp->sd_log_lock){+.+.}-{2:2}, at:
gfs2_flush_revokes+0x4e/0x80 fs/gfs2/log.c:805
Preemption disabled at:
[<>] 0x0
CPU: 0 PID: 5053 Comm: syz-executor390 Not tainted
6.2.0-rc4-syzkaller-9-gd532dd102151 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
__might_resched+0x538/0x6a0 kernel/sched/core.c:10036
gfs2_glock_wait+0x52/0x2a0 fs/gfs2/glock.c:1316
gfs2_glock_nq_init fs/gfs2/glock.h:262 [inline]
gfs2_freeze_lock+0x5f/0xc0 fs/gfs2/util.c:107
signal_our_withdraw fs/gfs2/util.c:160 [inline]
gfs2_withdraw+0x5ab/0x14e0 fs/gfs2/util.c:351
gfs2_ail1_empty+0x8c9/0x950 fs/gfs2/log.c:368
gfs2_flush_revokes+0x59/0x80 fs/gfs2/log.c:806
revoke_lo_before_commit+0x2b/0xcf0 fs/gfs2/lops.c:869
lops_before_commit fs/gfs2/lops.h:40 [inline]
gfs2_log_flush+0xc8e/0x26a0 fs/gfs2/log.c:1093
do_sync+0xa4c/0xc90 fs/gfs2/quota.c:975
gfs2_quota_sync+0x3da/0x8b0 fs/gfs2/quota.c:1318
gfs2_sync_fs+0x49/0xb0 fs/gfs2/super.c:650
sync_filesystem+0xe8/0x220 fs/sync.c:56
generic_shutdown_super+0x6b/0x310 fs/super.c:474
kill_block_super+0x79/0xd0 fs/super.c:1386
deactivate_locked_super+0xa7/0xf0 fs/super.c:332
cleanup_mnt+0x494/0x520 fs/namespace.c:1291
task_work_run+0x243/0x300 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x644/0x2150 kernel/exit.c:867
do_group_exit+0x1fd/0x2b0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1021
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f8d53bb09c9
Code: Unable to access opcode bytes at 0x7f8d53bb099f.
RSP: 002b:7ffda1438d78 EFLAGS: 0246 ORIG_RAX: 00e7
RAX: ffda RBX: 7f8d53c45330 RCX: 7f8d53bb09c9
RDX: 003c RSI: 00e7 RDI: 0001
RBP: 0001 R08: ffc0 R09: 0001f6db
R10: R11: 0246 R12: 7f8d53c45330
R13: 0001 R14: R15: 0001
=
[ BUG: Invalid wait context ]
6.2.0-rc4-syzkaller-9-gd532dd102151 #0 Tainted: GW
-
syz-executor390/5053 is trying to lock:
888019021c88 (&wq->mutex){+.+.}-{3:3}, at: __flush_workqueue+0x1b7/0x16a0
kernel/workqueue.c:2812
other info that might help us debug this:
context-{4:4}
4 locks hel
