Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <0000000000000d9d6f05ec498263@google.com> <000000000000fa42c105ec5339ec@google.com>
 <Y1/SqIuP4tbszPAW@casper.infradead.org>
In-Reply-To: <Y1/SqIuP4tbszPAW@casper.infradead.org>
From:   Aleksandr Nogikh <nogikh@google.com>
Date:   Mon, 31 Oct 2022 11:57:00 -0700
Message-ID: <CANp29Y68VeE9NHM2ekCvuZNVVaEZkmaG_NhyaUTH5DMOu0=QgA@mail.gmail.com>
Subject: Re: [syzbot] WARNING in btrfs_space_info_update_bytes_may_use
To:     Matthew Wilcox <willy@infradead.org>
Cc:     syzbot <syzbot+8edfa01e46fd9fe3fbfb@syzkaller.appspotmail.com>,
        akpm@linux-foundation.org, clm@fb.com, dsterba@suse.com,
        hch@lst.de, josef@toxicpanda.com, linmiaohe@huawei.com,
        linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org,
        syzkaller-bugs@googlegroups.com, torvalds@linux-foundation.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Mon, Oct 31, 2022 at 6:50 AM Matthew Wilcox <willy@infradead.org> wrote:
>
> Dmitry, I don't see a way to tell syzbot that its bisection has gone
> astray.  Can you add one or document it if it already exists?

No, unfortunately it's not possible now. I've filed an issue:
https://github.com/google/syzkaller/issues/3491

>
> On Mon, Oct 31, 2022 at 04:51:22AM -0700, syzbot wrote:
> > syzbot has bisected this issue to:
> >
> > commit 0c7c575df56b957390206deb018c41acbb412159
> > Author: Matthew Wilcox (Oracle) <willy@infradead.org>
> > Date:   Wed Feb 24 20:01:52 2021 +0000
> >
> >     mm/filemap: remove dynamically allocated array from filemap_read
>
> This change affects the read path.  The crash happens in the unmount
> path.  The data structure that's being checked is modified in the write
> path.  I just can't see how this commit is in any way related.

Most likely the bisection pointed at your patch because it removed
kmalloc while the reproducer for the bug does fault injection (see the
"(fail_nth: 10)" line in syz repro). So it might have inadvertently
made the issue more visible to the fuzzer.

>
> > bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=119e21b6880000
> > start commit:   b229b6ca5abb Merge tag 'perf-tools-fixes-for-v6.1-2022-10-..
> > git tree:       upstream
> > final oops:     https://syzkaller.appspot.com/x/report.txt?x=139e21b6880000
> > console output: https://syzkaller.appspot.com/x/log.txt?x=159e21b6880000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=a66c6c673fb555e8
> > dashboard link: https://syzkaller.appspot.com/bug?extid=8edfa01e46fd9fe3fbfb
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17db9ab1880000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=124e21b6880000
> >
> > Reported-by: syzbot+8edfa01e46fd9fe3fbfb@syzkaller.appspotmail.com
> > Fixes: 0c7c575df56b ("mm/filemap: remove dynamically allocated array from filemap_read")
> >
> > For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/Y1/SqIuP4tbszPAW%40casper.infradead.org.