2020-09-18 11:24:10

by syzbot

[permalink] [raw]
Subject: WARNING in close_fs_devices (2)

Hello,

syzbot found the following issue on:

HEAD commit: e4c26faa Merge tag 'usb-5.9-rc5' of git://git.kernel.org/p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15bf1621900000
kernel config: https://syzkaller.appspot.com/x/.config?x=c61610091f4ca8c4
dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

------------[ cut here ]------------
WARNING: CPU: 1 PID: 3612 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 3612 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x198/0x1fd lib/dump_stack.c:118
panic+0x347/0x7c0 kernel/panic.c:231
__warn.cold+0x20/0x46 kernel/panic.c:600
report_bug+0x1bd/0x210 lib/bug.c:198
handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
Code: 0f b6 04 02 84 c0 74 02 7e 33 48 8b 44 24 18 c6 80 30 01 00 00 00 48 83 c4 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 99 ce 6a fe <0f> 0b e9 71 ff ff ff e8 8d ce 6a fe 0f 0b e9 20 ff ff ff e8 d1 d5
RSP: 0018:ffffc900091777e0 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffffffffffffffff RCX: ffffc9000c8b7000
RDX: 0000000000040000 RSI: ffffffff83097f47 RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880988a187f
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88809593a130
R13: ffff88809593a1ec R14: ffff8880988a1908 R15: ffff88809593a050
close_fs_devices fs/btrfs/volumes.c:1193 [inline]
btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
open_ctree+0x4984/0x4a2d fs/btrfs/disk-io.c:3434
btrfs_fill_super fs/btrfs/super.c:1316 [inline]
btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1547
fc_mount fs/namespace.c:978 [inline]
vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1008
vfs_kern_mount+0x3c/0x60 fs/namespace.c:995
btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1547
do_new_mount fs/namespace.c:2875 [inline]
path_mount+0x1387/0x2070 fs/namespace.c:3192
do_mount fs/namespace.c:3205 [inline]
__do_sys_mount fs/namespace.c:3413 [inline]
__se_sys_mount fs/namespace.c:3390 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x46004a
Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da 89 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007f414d78da88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f414d78db20 RCX: 000000000046004a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f414d78dae0
RBP: 00007f414d78dae0 R08: 00007f414d78db20 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
R13: 0000000020000100 R14: 0000000020000200 R15: 000000002001a800
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.


2020-09-18 12:34:31

by David Sterba

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

On Fri, Sep 18, 2020 at 04:22:16AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e4c26faa Merge tag 'usb-5.9-rc5' of git://git.kernel.org/p..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15bf1621900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c61610091f4ca8c4
> dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
> compiler: gcc (GCC) 10.1.0-syz 20200507
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 3612 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166

1152 static int close_fs_devices(struct btrfs_fs_devices *fs_devices)
1153 {
1154 struct btrfs_device *device, *tmp;
1155
1156 if (--fs_devices->opened > 0)
1157 return 0;
1158
1159 mutex_lock(&fs_devices->device_list_mutex);
1160 list_for_each_entry_safe(device, tmp, &fs_devices->devices, dev_list) {
1161 btrfs_close_one_device(device);
1162 }
1163 mutex_unlock(&fs_devices->device_list_mutex);
1164
1165 WARN_ON(fs_devices->open_devices);
1166 WARN_ON(fs_devices->rw_devices);

1167 fs_devices->opened = 0;
1168 fs_devices->seeding = false;
1169
1170 return 0;
1171 }

It's the 2nd warning, rw_devices > 0 .

> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 1 PID: 3612 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0

5.9-rc4, we've had some changes around device locking but no idea which
one it could be.

2020-09-20 22:43:37

by syzbot

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

syzbot has found a reproducer for the following issue on:

HEAD commit: b652d2a5 Add linux-next specific files for 20200918
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17e84b07900000
kernel config: https://syzkaller.appspot.com/x/.config?x=3cf0782933432b43
dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=112425d9900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1486929b900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

------------[ cut here ]------------
WARNING: CPU: 0 PID: 6972 at fs/btrfs/volumes.c:1172 close_fs_devices+0x715/0x930 fs/btrfs/volumes.c:1172
Modules linked in:
CPU: 1 PID: 6972 Comm: syz-executor044 Not tainted 5.9.0-rc5-next-20200918-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:close_fs_devices+0x715/0x930 fs/btrfs/volumes.c:1172
Code: e8 00 b8 4c fe 85 db 0f 85 65 f9 ff ff e8 93 bb 4c fe 0f 0b e9 59 f9 ff ff e8 87 bb 4c fe 0f 0b e9 c0 fe ff ff e8 7b bb 4c fe <0f> 0b e9 f9 fe ff ff 48 c7 c7 fc a1 8f 8b e8 e8 0b 8e fe e9 19 f9
RSP: 0018:ffffc900061b7758 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffffffffffffff RCX: ffffffff83285c2c
RDX: ffff8880a6bbe4c0 RSI: ffffffff83285d35 RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff8880a2be1133
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a2be1130
R13: ffff8880a2be11ec R14: ffff888093ab0508 R15: ffff8880a2be1050
FS: 000000000208a880(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004babec CR3: 00000000a7bc7000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
btrfs_close_devices+0x8e/0x4b0 fs/btrfs/volumes.c:1184
open_ctree+0x492a/0x49cf fs/btrfs/disk-io.c:3381
btrfs_fill_super fs/btrfs/super.c:1316 [inline]
btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1547
fc_mount fs/namespace.c:983 [inline]
vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1013
vfs_kern_mount+0x3c/0x60 fs/namespace.c:1000
btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1547
do_new_mount fs/namespace.c:2896 [inline]
path_mount+0x12ae/0x1e70 fs/namespace.c:3216
do_mount fs/namespace.c:3229 [inline]
__do_sys_mount fs/namespace.c:3437 [inline]
__se_sys_mount fs/namespace.c:3414 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3414
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x44851a
Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd a2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 aa a2 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffcb26bce08 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000044851a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffcb26bce50
RBP: 00007ffcb26bce90 R08: 00007ffcb26bce90 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 00007ffcb26bce50 R14: 0000000000000003 R15: 0000000000000001

2020-09-21 07:59:45

by Anand Jain

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

On 21/9/20 6:42 am, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: b652d2a5 Add linux-next specific files for 20200918
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=17e84b07900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3cf0782933432b43
> dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
> compiler: gcc (GCC) 10.1.0-syz 20200507
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=112425d9900000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1486929b900000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 6972 at fs/btrfs/volumes.c:1172 close_fs_devices+0x715/0x930 fs/btrfs/volumes.c:1172
> Modules linked in:
> CPU: 1 PID: 6972 Comm: syz-executor044 Not tainted 5.9.0-rc5-next-20200918-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:close_fs_devices+0x715/0x930 fs/btrfs/volumes.c:1172
> Code: e8 00 b8 4c fe 85 db 0f 85 65 f9 ff ff e8 93 bb 4c fe 0f 0b e9 59 f9 ff ff e8 87 bb 4c fe 0f 0b e9 c0 fe ff ff e8 7b bb 4c fe <0f> 0b e9 f9 fe ff ff 48 c7 c7 fc a1 8f 8b e8 e8 0b 8e fe e9 19 f9
> RSP: 0018:ffffc900061b7758 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: ffffffffffffffff RCX: ffffffff83285c2c
> RDX: ffff8880a6bbe4c0 RSI: ffffffff83285d35 RDI: 0000000000000007
> RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff8880a2be1133
> R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a2be1130
> R13: ffff8880a2be11ec R14: ffff888093ab0508 R15: ffff8880a2be1050
> FS: 000000000208a880(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000004babec CR3: 00000000a7bc7000 CR4: 00000000001506e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> btrfs_close_devices+0x8e/0x4b0 fs/btrfs/volumes.c:1184
> open_ctree+0x492a/0x49cf fs/btrfs/disk-io.c:3381
> btrfs_fill_super fs/btrfs/super.c:1316 [inline]
> btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> fc_mount fs/namespace.c:983 [inline]
> vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1013
> vfs_kern_mount+0x3c/0x60 fs/namespace.c:1000
> btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> do_new_mount fs/namespace.c:2896 [inline]
> path_mount+0x12ae/0x1e70 fs/namespace.c:3216
> do_mount fs/namespace.c:3229 [inline]
> __do_sys_mount fs/namespace.c:3437 [inline]
> __se_sys_mount fs/namespace.c:3414 [inline]
> __x64_sys_mount+0x27f/0x300 fs/namespace.c:3414
> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x44851a
> Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd a2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 aa a2 fb ff c3 66 0f 1f 84 00 00 00 00 00
> RSP: 002b:00007ffcb26bce08 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000044851a
> RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffcb26bce50
> RBP: 00007ffcb26bce90 R08: 00007ffcb26bce90 R09: 0000000020000000
> R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
> R13: 00007ffcb26bce50 R14: 0000000000000003 R15: 0000000000000001
>


I am able to reproduce. And its quite strange at the moment. A devid 0
is being scanned. Looks like crafted image.

[19592.946397] BTRFS: device fsid f90cac8b-044b-4fa8-8bee-4b8d3da88dc2
devid 0 transid 0 /dev/loop0 scanned by t (70902)


2020-09-21 08:11:44

by Johannes Thumshirn

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

On 21/09/2020 09:58, Anand Jain wrote:
> On 21/9/20 6:42 am, syzbot wrote:
>> syzbot has found a reproducer for the following issue on:
>>
>> HEAD commit: b652d2a5 Add linux-next specific files for 20200918
>> git tree: linux-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=17e84b07900000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=3cf0782933432b43
>> dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
>> compiler: gcc (GCC) 10.1.0-syz 20200507
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=112425d9900000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1486929b900000
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: [email protected]
>>
>> ------------[ cut here ]------------
>> WARNING: CPU: 0 PID: 6972 at fs/btrfs/volumes.c:1172 close_fs_devices+0x715/0x930 fs/btrfs/volumes.c:1172
>> Modules linked in:
>> CPU: 1 PID: 6972 Comm: syz-executor044 Not tainted 5.9.0-rc5-next-20200918-syzkaller #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>> RIP: 0010:close_fs_devices+0x715/0x930 fs/btrfs/volumes.c:1172
>> Code: e8 00 b8 4c fe 85 db 0f 85 65 f9 ff ff e8 93 bb 4c fe 0f 0b e9 59 f9 ff ff e8 87 bb 4c fe 0f 0b e9 c0 fe ff ff e8 7b bb 4c fe <0f> 0b e9 f9 fe ff ff 48 c7 c7 fc a1 8f 8b e8 e8 0b 8e fe e9 19 f9
>> RSP: 0018:ffffc900061b7758 EFLAGS: 00010293
>> RAX: 0000000000000000 RBX: ffffffffffffffff RCX: ffffffff83285c2c
>> RDX: ffff8880a6bbe4c0 RSI: ffffffff83285d35 RDI: 0000000000000007
>> RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff8880a2be1133
>> R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a2be1130
>> R13: ffff8880a2be11ec R14: ffff888093ab0508 R15: ffff8880a2be1050
>> FS: 000000000208a880(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00000000004babec CR3: 00000000a7bc7000 CR4: 00000000001506e0
>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> Call Trace:
>> btrfs_close_devices+0x8e/0x4b0 fs/btrfs/volumes.c:1184
>> open_ctree+0x492a/0x49cf fs/btrfs/disk-io.c:3381
>> btrfs_fill_super fs/btrfs/super.c:1316 [inline]
>> btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
>> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
>> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
>> fc_mount fs/namespace.c:983 [inline]
>> vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1013
>> vfs_kern_mount+0x3c/0x60 fs/namespace.c:1000
>> btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
>> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
>> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
>> do_new_mount fs/namespace.c:2896 [inline]
>> path_mount+0x12ae/0x1e70 fs/namespace.c:3216
>> do_mount fs/namespace.c:3229 [inline]
>> __do_sys_mount fs/namespace.c:3437 [inline]
>> __se_sys_mount fs/namespace.c:3414 [inline]
>> __x64_sys_mount+0x27f/0x300 fs/namespace.c:3414
>> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
>> entry_SYSCALL_64_after_hwframe+0x44/0xa9
>> RIP: 0033:0x44851a
>> Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd a2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 aa a2 fb ff c3 66 0f 1f 84 00 00 00 00 00
>> RSP: 002b:00007ffcb26bce08 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5
>> RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000044851a
>> RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffcb26bce50
>> RBP: 00007ffcb26bce90 R08: 00007ffcb26bce90 R09: 0000000020000000
>> R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
>> R13: 00007ffcb26bce50 R14: 0000000000000003 R15: 0000000000000001
>>
>
>
> I am able to reproduce. And its quite strange at the moment. A devid 0
> is being scanned. Looks like crafted image.
>
> [19592.946397] BTRFS: device fsid f90cac8b-044b-4fa8-8bee-4b8d3da88dc2
> devid 0 transid 0 /dev/loop0 scanned by t (70902)

Yeah if you look at the C reproducer it crafts an image in memory and
then loop mounts it.


2020-09-21 17:04:13

by David Sterba

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

On Fri, Sep 18, 2020 at 04:22:16AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e4c26faa Merge tag 'usb-5.9-rc5' of git://git.kernel.org/p..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15bf1621900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c61610091f4ca8c4
> dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
> compiler: gcc (GCC) 10.1.0-syz 20200507
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 3612 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 1 PID: 3612 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x198/0x1fd lib/dump_stack.c:118
> panic+0x347/0x7c0 kernel/panic.c:231
> __warn.cold+0x20/0x46 kernel/panic.c:600
> report_bug+0x1bd/0x210 lib/bug.c:198
> handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
> exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
> asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
> RIP: 0010:close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
> Code: 0f b6 04 02 84 c0 74 02 7e 33 48 8b 44 24 18 c6 80 30 01 00 00 00 48 83 c4 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 99 ce 6a fe <0f> 0b e9 71 ff ff ff e8 8d ce 6a fe 0f 0b e9 20 ff ff ff e8 d1 d5
> RSP: 0018:ffffc900091777e0 EFLAGS: 00010246
> RAX: 0000000000040000 RBX: ffffffffffffffff RCX: ffffc9000c8b7000
> RDX: 0000000000040000 RSI: ffffffff83097f47 RDI: 0000000000000007
> RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880988a187f
> R10: 0000000000000000 R11: 0000000000000001 R12: ffff88809593a130
> R13: ffff88809593a1ec R14: ffff8880988a1908 R15: ffff88809593a050
> close_fs_devices fs/btrfs/volumes.c:1193 [inline]
> btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
> open_ctree+0x4984/0x4a2d fs/btrfs/disk-io.c:3434
> btrfs_fill_super fs/btrfs/super.c:1316 [inline]
> btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> fc_mount fs/namespace.c:978 [inline]
> vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1008
> vfs_kern_mount+0x3c/0x60 fs/namespace.c:995
> btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> do_new_mount fs/namespace.c:2875 [inline]
> path_mount+0x1387/0x2070 fs/namespace.c:3192
> do_mount fs/namespace.c:3205 [inline]
> __do_sys_mount fs/namespace.c:3413 [inline]
> __se_sys_mount fs/namespace.c:3390 [inline]
> __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x46004a
> Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da 89 fb ff c3 66 0f 1f 84 00 00 00 00 00
> RSP: 002b:00007f414d78da88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 00007f414d78db20 RCX: 000000000046004a
> RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f414d78dae0
> RBP: 00007f414d78dae0 R08: 00007f414d78db20 R09: 0000000020000000
> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
> R13: 0000000020000100 R14: 0000000020000200 R15: 000000002001a800
> Kernel Offset: disabled
> Rebooting in 86400 seconds..

#syz test: git://github.com/kdave/btrfs-devel.git misc-5.9

2020-09-21 20:46:11

by syzbot

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in close_fs_devices

BTRFS info (device loop5): enabling ssd optimizations
BTRFS warning (device loop5): failed to read fs tree: -5
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8915 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 8915 Comm: syz-executor.4 Not tainted 5.8.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x18f/0x20d lib/dump_stack.c:118
panic+0x31e/0x797 kernel/panic.c:231
__warn.cold+0x20/0x4a kernel/panic.c:600
report_bug+0x1bd/0x210 lib/bug.c:198
handle_bug+0x38/0x90 arch/x86/kernel/traps.c:235
exc_invalid_op+0x13/0x40 arch/x86/kernel/traps.c:255
asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:540
RIP: 0010:close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
Code: 0f b6 04 02 84 c0 74 02 7e 33 48 8b 44 24 18 c6 80 30 01 00 00 00 48 83 c4 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 e9 19 4d fe <0f> 0b e9 71 ff ff ff e8 dd 19 4d fe 0f 0b e9 20 ff ff ff e8 e1 33
RSP: 0018:ffffc90006777818 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffffffffffffff RCX: ffffffff83288276
RDX: ffff8880921402c0 RSI: ffffffff83288307 RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880a7206c7f
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888095742130
R13: ffff8880957421ec R14: ffff8880a7206d08 R15: ffff888095742050
close_fs_devices fs/btrfs/volumes.c:1193 [inline]
btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
open_ctree+0x49e6/0x4a96 fs/btrfs/disk-io.c:3456
btrfs_fill_super fs/btrfs/super.c:1316 [inline]
btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1547
fc_mount fs/namespace.c:978 [inline]
vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1008
vfs_kern_mount+0x3c/0x60 fs/namespace.c:995
btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
legacy_get_tree+0x105/0x220 fs/fs_context.c:592
vfs_get_tree+0x89/0x2f0 fs/super.c:1547
do_new_mount fs/namespace.c:2875 [inline]
do_mount+0x159c/0x2000 fs/namespace.c:3200
__do_sys_mount fs/namespace.c:3410 [inline]
__se_sys_mount fs/namespace.c:3387 [inline]
__x64_sys_mount+0x18f/0x230 fs/namespace.c:3387
do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x46004a
Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da 89 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007f5e059b1a88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f5e059b1b20 RCX: 000000000046004a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f5e059b1ae0
RBP: 00007f5e059b1ae0 R08: 00007f5e059b1b20 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000000
R13: 0000000020000100 R14: 0000000020000200 R15: 0000000020000140
Kernel Offset: disabled
Rebooting in 86400 seconds..


Tested on:

commit: d1db82c9 btrfs: move btrfs_rm_dev_replace_free_srcdev outs..
git tree: git://github.com/kdave/btrfs-devel.git misc-5.9
console output: https://syzkaller.appspot.com/x/log.txt?x=1007c6c3900000
kernel config: https://syzkaller.appspot.com/x/.config?x=72e4ae28d563b993
dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
compiler: gcc (GCC) 10.1.0-syz 20200507

2020-09-22 12:42:02

by Anand Jain

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

On 18/9/20 7:22 pm, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e4c26faa Merge tag 'usb-5.9-rc5' of git://git.kernel.org/p..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15bf1621900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c61610091f4ca8c4
> dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
> compiler: gcc (GCC) 10.1.0-syz 20200507
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 3612 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 1 PID: 3612 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x198/0x1fd lib/dump_stack.c:118
> panic+0x347/0x7c0 kernel/panic.c:231
> __warn.cold+0x20/0x46 kernel/panic.c:600
> report_bug+0x1bd/0x210 lib/bug.c:198
> handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
> exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
> asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
> RIP: 0010:close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
> Code: 0f b6 04 02 84 c0 74 02 7e 33 48 8b 44 24 18 c6 80 30 01 00 00 00 48 83 c4 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 99 ce 6a fe <0f> 0b e9 71 ff ff ff e8 8d ce 6a fe 0f 0b e9 20 ff ff ff e8 d1 d5
> RSP: 0018:ffffc900091777e0 EFLAGS: 00010246
> RAX: 0000000000040000 RBX: ffffffffffffffff RCX: ffffc9000c8b7000
> RDX: 0000000000040000 RSI: ffffffff83097f47 RDI: 0000000000000007
> RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880988a187f
> R10: 0000000000000000 R11: 0000000000000001 R12: ffff88809593a130
> R13: ffff88809593a1ec R14: ffff8880988a1908 R15: ffff88809593a050
> close_fs_devices fs/btrfs/volumes.c:1193 [inline]
> btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
> open_ctree+0x4984/0x4a2d fs/btrfs/disk-io.c:3434
> btrfs_fill_super fs/btrfs/super.c:1316 [inline]
> btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> fc_mount fs/namespace.c:978 [inline]
> vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1008
> vfs_kern_mount+0x3c/0x60 fs/namespace.c:995
> btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> do_new_mount fs/namespace.c:2875 [inline]
> path_mount+0x1387/0x2070 fs/namespace.c:3192
> do_mount fs/namespace.c:3205 [inline]
> __do_sys_mount fs/namespace.c:3413 [inline]
> __se_sys_mount fs/namespace.c:3390 [inline]
> __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x46004a
> Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da 89 fb ff c3 66 0f 1f 84 00 00 00 00 00
> RSP: 002b:00007f414d78da88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 00007f414d78db20 RCX: 000000000046004a
> RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f414d78dae0
> RBP: 00007f414d78dae0 R08: 00007f414d78db20 R09: 0000000020000000
> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
> R13: 0000000020000100 R14: 0000000020000200 R15: 000000002001a800
> Kernel Offset: disabled
> Rebooting in 86400 seconds..


#syz fix: btrfs: fix rw_devices count in __btrfs_free_extra_devids

2020-10-30 10:14:43

by Dmitry Vyukov

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

On Tue, Sep 22, 2020 at 2:37 PM Anand Jain <[email protected]> wrote:
>
> On 18/9/20 7:22 pm, syzbot wrote:
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: e4c26faa Merge tag 'usb-5.9-rc5' of git://git.kernel.org/p..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=15bf1621900000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=c61610091f4ca8c4
> > dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
> > compiler: gcc (GCC) 10.1.0-syz 20200507
> >
> > Unfortunately, I don't have any reproducer for this issue yet.
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: [email protected]
> >
> > ------------[ cut here ]------------
> > WARNING: CPU: 1 PID: 3612 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
> > Kernel panic - not syncing: panic_on_warn set ...
> > CPU: 1 PID: 3612 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > Call Trace:
> > __dump_stack lib/dump_stack.c:77 [inline]
> > dump_stack+0x198/0x1fd lib/dump_stack.c:118
> > panic+0x347/0x7c0 kernel/panic.c:231
> > __warn.cold+0x20/0x46 kernel/panic.c:600
> > report_bug+0x1bd/0x210 lib/bug.c:198
> > handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
> > exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
> > asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
> > RIP: 0010:close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
> > Code: 0f b6 04 02 84 c0 74 02 7e 33 48 8b 44 24 18 c6 80 30 01 00 00 00 48 83 c4 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 99 ce 6a fe <0f> 0b e9 71 ff ff ff e8 8d ce 6a fe 0f 0b e9 20 ff ff ff e8 d1 d5
> > RSP: 0018:ffffc900091777e0 EFLAGS: 00010246
> > RAX: 0000000000040000 RBX: ffffffffffffffff RCX: ffffc9000c8b7000
> > RDX: 0000000000040000 RSI: ffffffff83097f47 RDI: 0000000000000007
> > RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880988a187f
> > R10: 0000000000000000 R11: 0000000000000001 R12: ffff88809593a130
> > R13: ffff88809593a1ec R14: ffff8880988a1908 R15: ffff88809593a050
> > close_fs_devices fs/btrfs/volumes.c:1193 [inline]
> > btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
> > open_ctree+0x4984/0x4a2d fs/btrfs/disk-io.c:3434
> > btrfs_fill_super fs/btrfs/super.c:1316 [inline]
> > btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
> > legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> > vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> > fc_mount fs/namespace.c:978 [inline]
> > vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1008
> > vfs_kern_mount+0x3c/0x60 fs/namespace.c:995
> > btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
> > legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> > vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> > do_new_mount fs/namespace.c:2875 [inline]
> > path_mount+0x1387/0x2070 fs/namespace.c:3192
> > do_mount fs/namespace.c:3205 [inline]
> > __do_sys_mount fs/namespace.c:3413 [inline]
> > __se_sys_mount fs/namespace.c:3390 [inline]
> > __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
> > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> > entry_SYSCALL_64_after_hwframe+0x44/0xa9
> > RIP: 0033:0x46004a
> > Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da 89 fb ff c3 66 0f 1f 84 00 00 00 00 00
> > RSP: 002b:00007f414d78da88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
> > RAX: ffffffffffffffda RBX: 00007f414d78db20 RCX: 000000000046004a
> > RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f414d78dae0
> > RBP: 00007f414d78dae0 R08: 00007f414d78db20 R09: 0000000020000000
> > R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
> > R13: 0000000020000100 R14: 0000000020000200 R15: 000000002001a800
> > Kernel Offset: disabled
> > Rebooting in 86400 seconds..
>
>
> #syz fix: btrfs: fix rw_devices count in __btrfs_free_extra_devids

Is it the correct patch title? It still does not exist anywhere
including linux-next...

2020-10-30 12:29:14

by David Sterba

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

On Fri, Oct 30, 2020 at 11:10:58AM +0100, Dmitry Vyukov wrote:
> On Tue, Sep 22, 2020 at 2:37 PM Anand Jain <[email protected]> wrote:
> > On 18/9/20 7:22 pm, syzbot wrote:
> > #syz fix: btrfs: fix rw_devices count in __btrfs_free_extra_devids
>
> Is it the correct patch title? It still does not exist anywhere
> including linux-next...

The patch hasn't been merged yet, the title should be still correct.

2020-10-30 14:04:34

by Anand Jain

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)



On 30/10/20 6:10 pm, Dmitry Vyukov wrote:
> On Tue, Sep 22, 2020 at 2:37 PM Anand Jain <[email protected]> wrote:
>>
>> On 18/9/20 7:22 pm, syzbot wrote:
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit: e4c26faa Merge tag 'usb-5.9-rc5' of git://git.kernel.org/p..
>>> git tree: upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=15bf1621900000
>>> kernel config: https://syzkaller.appspot.com/x/.config?x=c61610091f4ca8c4
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
>>> compiler: gcc (GCC) 10.1.0-syz 20200507
>>>
>>> Unfortunately, I don't have any reproducer for this issue yet.
>>>
>>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>>> Reported-by: [email protected]
>>>
>>> ------------[ cut here ]------------
>>> WARNING: CPU: 1 PID: 3612 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
>>> Kernel panic - not syncing: panic_on_warn set ...
>>> CPU: 1 PID: 3612 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0
>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>>> Call Trace:
>>> __dump_stack lib/dump_stack.c:77 [inline]
>>> dump_stack+0x198/0x1fd lib/dump_stack.c:118
>>> panic+0x347/0x7c0 kernel/panic.c:231
>>> __warn.cold+0x20/0x46 kernel/panic.c:600
>>> report_bug+0x1bd/0x210 lib/bug.c:198
>>> handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
>>> exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
>>> asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
>>> RIP: 0010:close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
>>> Code: 0f b6 04 02 84 c0 74 02 7e 33 48 8b 44 24 18 c6 80 30 01 00 00 00 48 83 c4 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 99 ce 6a fe <0f> 0b e9 71 ff ff ff e8 8d ce 6a fe 0f 0b e9 20 ff ff ff e8 d1 d5
>>> RSP: 0018:ffffc900091777e0 EFLAGS: 00010246
>>> RAX: 0000000000040000 RBX: ffffffffffffffff RCX: ffffc9000c8b7000
>>> RDX: 0000000000040000 RSI: ffffffff83097f47 RDI: 0000000000000007
>>> RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880988a187f
>>> R10: 0000000000000000 R11: 0000000000000001 R12: ffff88809593a130
>>> R13: ffff88809593a1ec R14: ffff8880988a1908 R15: ffff88809593a050
>>> close_fs_devices fs/btrfs/volumes.c:1193 [inline]
>>> btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
>>> open_ctree+0x4984/0x4a2d fs/btrfs/disk-io.c:3434
>>> btrfs_fill_super fs/btrfs/super.c:1316 [inline]
>>> btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
>>> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
>>> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
>>> fc_mount fs/namespace.c:978 [inline]
>>> vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1008
>>> vfs_kern_mount+0x3c/0x60 fs/namespace.c:995
>>> btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
>>> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
>>> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
>>> do_new_mount fs/namespace.c:2875 [inline]
>>> path_mount+0x1387/0x2070 fs/namespace.c:3192
>>> do_mount fs/namespace.c:3205 [inline]
>>> __do_sys_mount fs/namespace.c:3413 [inline]
>>> __se_sys_mount fs/namespace.c:3390 [inline]
>>> __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
>>> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
>>> entry_SYSCALL_64_after_hwframe+0x44/0xa9
>>> RIP: 0033:0x46004a
>>> Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da 89 fb ff c3 66 0f 1f 84 00 00 00 00 00
>>> RSP: 002b:00007f414d78da88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
>>> RAX: ffffffffffffffda RBX: 00007f414d78db20 RCX: 000000000046004a
>>> RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f414d78dae0
>>> RBP: 00007f414d78dae0 R08: 00007f414d78db20 R09: 0000000020000000
>>> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
>>> R13: 0000000020000100 R14: 0000000020000200 R15: 000000002001a800
>>> Kernel Offset: disabled
>>> Rebooting in 86400 seconds..
>>
>>
>> #syz fix: btrfs: fix rw_devices count in __btrfs_free_extra_devids
>
> Is it the correct patch title? It still does not exist anywhere
> including linux-next...
>

V2 is here [1]. The patch title is changed. Also the cover letter talks
about the path dependency. It is not yet integrated.

[1]
https://patchwork.kernel.org/project/linux-btrfs/patch/d0b5790792b8b826504dd239ad9efc514f3d9109.1604009248.git.anand.jain@oracle.com/


Thanks, Anand


2020-10-30 18:38:19

by Dmitry Vyukov

[permalink] [raw]
Subject: Re: WARNING in close_fs_devices (2)

On Fri, Oct 30, 2020 at 3:01 PM Anand Jain <[email protected]> wrote:
> On 30/10/20 6:10 pm, Dmitry Vyukov wrote:
> > On Tue, Sep 22, 2020 at 2:37 PM Anand Jain <[email protected]> wrote:
> >>
> >> On 18/9/20 7:22 pm, syzbot wrote:
> >>> Hello,
> >>>
> >>> syzbot found the following issue on:
> >>>
> >>> HEAD commit: e4c26faa Merge tag 'usb-5.9-rc5' of git://git.kernel.org/p..
> >>> git tree: upstream
> >>> console output: https://syzkaller.appspot.com/x/log.txt?x=15bf1621900000
> >>> kernel config: https://syzkaller.appspot.com/x/.config?x=c61610091f4ca8c4
> >>> dashboard link: https://syzkaller.appspot.com/bug?extid=4cfe71a4da060be47502
> >>> compiler: gcc (GCC) 10.1.0-syz 20200507
> >>>
> >>> Unfortunately, I don't have any reproducer for this issue yet.
> >>>
> >>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >>> Reported-by: [email protected]
> >>>
> >>> ------------[ cut here ]------------
> >>> WARNING: CPU: 1 PID: 3612 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
> >>> Kernel panic - not syncing: panic_on_warn set ...
> >>> CPU: 1 PID: 3612 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0
> >>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> >>> Call Trace:
> >>> __dump_stack lib/dump_stack.c:77 [inline]
> >>> dump_stack+0x198/0x1fd lib/dump_stack.c:118
> >>> panic+0x347/0x7c0 kernel/panic.c:231
> >>> __warn.cold+0x20/0x46 kernel/panic.c:600
> >>> report_bug+0x1bd/0x210 lib/bug.c:198
> >>> handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
> >>> exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
> >>> asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
> >>> RIP: 0010:close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166
> >>> Code: 0f b6 04 02 84 c0 74 02 7e 33 48 8b 44 24 18 c6 80 30 01 00 00 00 48 83 c4 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 99 ce 6a fe <0f> 0b e9 71 ff ff ff e8 8d ce 6a fe 0f 0b e9 20 ff ff ff e8 d1 d5
> >>> RSP: 0018:ffffc900091777e0 EFLAGS: 00010246
> >>> RAX: 0000000000040000 RBX: ffffffffffffffff RCX: ffffc9000c8b7000
> >>> RDX: 0000000000040000 RSI: ffffffff83097f47 RDI: 0000000000000007
> >>> RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880988a187f
> >>> R10: 0000000000000000 R11: 0000000000000001 R12: ffff88809593a130
> >>> R13: ffff88809593a1ec R14: ffff8880988a1908 R15: ffff88809593a050
> >>> close_fs_devices fs/btrfs/volumes.c:1193 [inline]
> >>> btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179
> >>> open_ctree+0x4984/0x4a2d fs/btrfs/disk-io.c:3434
> >>> btrfs_fill_super fs/btrfs/super.c:1316 [inline]
> >>> btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
> >>> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> >>> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> >>> fc_mount fs/namespace.c:978 [inline]
> >>> vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1008
> >>> vfs_kern_mount+0x3c/0x60 fs/namespace.c:995
> >>> btrfs_mount+0x234/0xaa0 fs/btrfs/super.c:1732
> >>> legacy_get_tree+0x105/0x220 fs/fs_context.c:592
> >>> vfs_get_tree+0x89/0x2f0 fs/super.c:1547
> >>> do_new_mount fs/namespace.c:2875 [inline]
> >>> path_mount+0x1387/0x2070 fs/namespace.c:3192
> >>> do_mount fs/namespace.c:3205 [inline]
> >>> __do_sys_mount fs/namespace.c:3413 [inline]
> >>> __se_sys_mount fs/namespace.c:3390 [inline]
> >>> __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
> >>> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> >>> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> >>> RIP: 0033:0x46004a
> >>> Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 89 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da 89 fb ff c3 66 0f 1f 84 00 00 00 00 00
> >>> RSP: 002b:00007f414d78da88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
> >>> RAX: ffffffffffffffda RBX: 00007f414d78db20 RCX: 000000000046004a
> >>> RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f414d78dae0
> >>> RBP: 00007f414d78dae0 R08: 00007f414d78db20 R09: 0000000020000000
> >>> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
> >>> R13: 0000000020000100 R14: 0000000020000200 R15: 000000002001a800
> >>> Kernel Offset: disabled
> >>> Rebooting in 86400 seconds..
> >>
> >>
> >> #syz fix: btrfs: fix rw_devices count in __btrfs_free_extra_devids
> >
> > Is it the correct patch title? It still does not exist anywhere
> > including linux-next...
> >
>
> V2 is here [1]. The patch title is changed. Also the cover letter talks
> about the path dependency. It is not yet integrated.
>
> [1]
> https://patchwork.kernel.org/project/linux-btrfs/patch/d0b5790792b8b826504dd239ad9efc514f3d9109.1604009248.git.anand.jain@oracle.com/
>
> Thanks, Anand


Thanks for double checking.
I was confused by the fact that the previous patch appeared briefly in
linux-next, but then disappeared.

I see the new patch contains the syzbot tag, so we are all good here.