From: bugzilla-daemon@bugzilla.kernel.org
To: linux-f2fs-devel@lists.sourceforge.net
Subject: [Bug 203215] New: failure at fs/f2fs/f2fs.h:2809/verify_blkaddr()!
Date: Tue, 09 Apr 2019 20:43:18 +0000 [thread overview]
Message-ID: <bug-203215-202145@https.bugzilla.kernel.org/> (raw)
https://bugzilla.kernel.org/show_bug.cgi?id=203215
Bug ID: 203215
Summary: failure at fs/f2fs/f2fs.h:2809/verify_blkaddr()!
Product: File System
Version: 2.5
Kernel Version: 5.0.0
Hardware: All
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: f2fs
Assignee: filesystem_f2fs@kernel-bugs.kernel.org
Reporter: jungyeon@gatech.edu
Regression: No
Created attachment 282209
--> https://bugzilla.kernel.org/attachment.cgi?id=282209&action=edit
The (compressed) crafted image which causes crash
- Overview
When mounting the attached crafted image, this error is reported.
The image is intentionally fuzzed from a normal f2fs image for testing and I
run with option CONFIG_F2FS_CHECK_FS on.
- Reproduces
mkdir test
mount -t f2fs tmp.img test
- Messages
[ 168.408970] F2FS-fs (sdb): Can't find valid F2FS filesystem in 2th
superblock
[ 168.413779] F2FS-fs (sdb): invalid blkaddr: 1, type: 6, run fsck to fix.
[ 168.415138] kernel BUG at fs/f2fs/f2fs.h:2809!
[ 168.415858] invalid opcode: 0000 [#1] SMP PTI
[ 168.416530] CPU: 0 PID: 1886 Comm: mount Tainted: G W 5.0.0
#4
[ 168.417529] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 168.418806] RIP: 0010:f2fs_do_replace_block+0x499/0x4e0
[ 168.419618] Code: 6c 7e 8a e8 d9 c9 fd ff 0f 0b 8b 4c 24 08 49 8b 3e 41 b8
06 00 00 00 48 c7 c2 b0 39 81 8a 48 c7 c6 7b 6c 7e 8a e8 b7 c9 fd ff <0f> 0b 49
8b 3e 41 b8 06 00 00 00 44 89 e1 48 c7 c2 b0 39 81 8a 48
[ 168.422287] RSP: 0018:ffffacdec0cffa88 EFLAGS: 00010282
[ 168.423042] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[ 168.424023] RDX: 0000000000000000 RSI: ffff9ef677a15418 RDI:
ffff9ef677a15418
[ 168.425092] RBP: ffff9ef6734dd000 R08: 0000000000065053 R09:
0000000000000005
[ 168.426043] R10: 00000000ffffff00 R11: ffffacdec0cff8cd R12:
0000000000001700
[ 168.427153] R13: 0000000000000003 R14: ffff9ef67603a800 R15:
0000000000000003
[ 168.428088] FS: 00007f77a1e99840(0000) GS:ffff9ef677a00000(0000)
knlGS:0000000000000000
[ 168.429121] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 168.429876] CR2: 00007ffd2b63aca8 CR3: 000000022b48c005 CR4:
00000000001606f0
[ 168.430995] Call Trace:
[ 168.431350] f2fs_replace_block+0x45/0x70
[ 168.431873] recover_data+0xaf3/0x1780
[ 168.432390] f2fs_recover_fsync_data+0x613/0x710
[ 168.433070] ? proc_create_single_data+0x37/0x50
[ 168.433749] f2fs_fill_super+0x1043/0x1aa0
[ 168.434353] ? f2fs_commit_super+0x180/0x180
[ 168.435022] mount_bdev+0x16d/0x1a0
[ 168.435492] mount_fs+0x4a/0x170
[ 168.435945] vfs_kern_mount+0x5d/0x100
[ 168.436499] do_mount+0x200/0xcf0
[ 168.436987] ? memdup_user+0x39/0x60
[ 168.437450] ksys_mount+0x79/0xc0
[ 168.437882] __x64_sys_mount+0x1c/0x20
[ 168.438370] do_syscall_64+0x43/0xf0
[ 168.438892] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 168.439645] RIP: 0033:0x7f77a1778b9a
[ 168.440144] Code: 48 8b 0d 01 c3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e
0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01
f0 ff ff 73 01 c3 48 8b 0d ce c2 2b 00 f7 d8 64 89 01 48
[ 168.442600] RSP: 002b:00007ffd2b63bd08 EFLAGS: 00000202 ORIG_RAX:
00000000000000a5
[ 168.443765] RAX: ffffffffffffffda RBX: 0000000001481050 RCX:
00007f77a1778b9a
[ 168.444774] RDX: 0000000001481230 RSI: 0000000001481f20 RDI:
0000000001481250
[ 168.445799] RBP: 0000000000000000 R08: 0000000000000000 R09:
0000000000000013
[ 168.446748] R10: 00000000c0ed0000 R11: 0000000000000202 R12:
0000000001481250
[ 168.447811] R13: 0000000001481230 R14: 0000000000000000 R15:
0000000000000003
[ 168.448805] Modules linked in:
[ 168.449266] ---[ end trace 5e10f6c9bf2f50fb ]---
[ 168.449908] RIP: 0010:f2fs_do_replace_block+0x499/0x4e0
[ 168.450677] Code: 6c 7e 8a e8 d9 c9 fd ff 0f 0b 8b 4c 24 08 49 8b 3e 41 b8
06 00 00 00 48 c7 c2 b0 39 81 8a 48 c7 c6 7b 6c 7e 8a e8 b7 c9 fd ff <0f> 0b 49
8b 3e 41 b8 06 00 00 00 44 89 e1 48 c7 c2 b0 39 81 8a 48
[ 168.453437] RSP: 0018:ffffacdec0cffa88 EFLAGS: 00010282
[ 168.454123] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[ 168.455169] RDX: 0000000000000000 RSI: ffff9ef677a15418 RDI:
ffff9ef677a15418
[ 168.456216] RBP: ffff9ef6734dd000 R08: 0000000000065053 R09:
0000000000000005
[ 168.457166] R10: 00000000ffffff00 R11: ffffacdec0cff8cd R12:
0000000000001700
[ 168.458209] R13: 0000000000000003 R14: ffff9ef67603a800 R15:
0000000000000003
[ 168.459189] FS: 00007f77a1e99840(0000) GS:ffff9ef677a00000(0000)
knlGS:0000000000000000
[ 168.460345] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 168.461187] CR2: 00007ffd2b63aca8 CR3: 000000022b48c005 CR4:
00000000001606f0
[ 168.463257] mount (1886) used greatest stack depth: 13152 bytes left
--
You are receiving this mail because:
You are watching the assignee of the bug.
next reply other threads:[~2019-04-09 20:43 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-09 20:43 bugzilla-daemon [this message]
2019-04-15 14:56 ` [Bug 203215] failure at fs/f2fs/f2fs.h:2809/verify_blkaddr()! bugzilla-daemon
2019-07-08 18:41 ` [f2fs-dev] " bugzilla-daemon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-203215-202145@https.bugzilla.kernel.org/ \
--to=bugzilla-daemon@bugzilla.kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).