All of lore.kernel.org
 help / color / mirror / Atom feed
* [syzbot] [bcachefs?] kernel BUG in cpu_replicas_add_entry
@ 2024-05-12 17:46 syzbot
  2024-05-13 11:05 ` Edward Adam Davis
  2024-05-13 12:07 ` [PATCH] bcachefs: if input options invalid return -BCH_ERR_option_name Edward Adam Davis
  0 siblings, 2 replies; 4+ messages in thread
From: syzbot @ 2024-05-12 17:46 UTC (permalink / raw)
  To: bfoster, kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    cf87f46fd34d Merge tag 'drm-fixes-2024-05-11' of https://g..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=148f37bc980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=9d7ea7de0cb32587
dashboard link: https://syzkaller.appspot.com/bug?extid=73414091bd382684ee2b
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=159e243f180000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1460fc5c980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9c147953fc8e/disk-cf87f46f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a55c9d1f91fc/vmlinux-cf87f46f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f8dab47ae8c2/bzImage-cf87f46f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7ca4b9223f48/mount_0.gz

The issue was bisected to:

commit 03ef80b469d5d83530ce1ce15be78a40e5300f9b
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date:   Sat Sep 23 22:41:51 2023 +0000

    bcachefs: Ignore unknown mount options

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=176de750980000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=14ede750980000
console output: https://syzkaller.appspot.com/x/log.txt?x=10ede750980000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+73414091bd382684ee2b@syzkaller.appspotmail.com
Fixes: 03ef80b469d5 ("bcachefs: Ignore unknown mount options")

loop0: detected capacity change from 0 to 32768
bcachefs (loop0): mounting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,nojournal_transaction_names
bcachefs (loop0): recovering from clean shutdown, journal seq 10
------------[ cut here ]------------
kernel BUG at fs/bcachefs/replicas.c:205!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 5075 Comm: syz-executor128 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:cpu_replicas_add_entry+0x6c8/0x6f0 fs/bcachefs/replicas.c:205
Code: 24 18 e8 ab 22 be fd e9 57 fd ff ff e8 f1 c5 5c fd 90 0f 0b e8 e9 c5 5c fd 90 0f 0b e8 e1 c5 5c fd 90 0f 0b e8 d9 c5 5c fd 90 <0f> 0b e8 d1 c5 5c fd 90 0f 0b e8 c9 c5 5c fd 90 0f 0b e8 c1 c5 5c
RSP: 0018:ffffc9000346ef18 EFLAGS: 00010293
RAX: ffffffff843941b7 RBX: dffffc0000000000 RCX: ffff888023cd5a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff84393d28 R09: ffffffff843804ad
R10: 0000000000000007 R11: ffff888023cd5a00 R12: 1ffff1100eb70101
R13: ffff888071e440a3 R14: 0000000000000000 R15: ffff888071e440a0
FS:  000055556e8b0380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561d03c02678 CR3: 0000000074648000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 bch2_replicas_set_usage+0x3cf/0x710 fs/bcachefs/replicas.c:630
 journal_replay_early+0xba/0x4f0 fs/bcachefs/recovery.c:411
 bch2_fs_recovery+0x39c2/0x63b0 fs/bcachefs/recovery.c:747
 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1043
 bch2_fs_open+0xa8d/0xdf0 fs/bcachefs/super.c:2105
 bch2_mount+0x71d/0x1320 fs/bcachefs/fs.c:1903
 legacy_get_tree+0xee/0x190 fs/fs_context.c:662
 vfs_get_tree+0x90/0x2a0 fs/super.c:1779
 do_new_mount+0x2be/0xb40 fs/namespace.c:3352
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efe923c2b7a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffec93a6af8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffec93a6b10 RCX: 00007efe923c2b7a
RDX: 0000000020011a00 RSI: 0000000020011a40 RDI: 00007ffec93a6b10
RBP: 0000000000000004 R08: 00007ffec93a6b50 R09: 0066666666666666
R10: 0000000001200014 R11: 0000000000000282 R12: 0000000001200014
R13: 00007ffec93a6b50 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:cpu_replicas_add_entry+0x6c8/0x6f0 fs/bcachefs/replicas.c:205
Code: 24 18 e8 ab 22 be fd e9 57 fd ff ff e8 f1 c5 5c fd 90 0f 0b e8 e9 c5 5c fd 90 0f 0b e8 e1 c5 5c fd 90 0f 0b e8 d9 c5 5c fd 90 <0f> 0b e8 d1 c5 5c fd 90 0f 0b e8 c9 c5 5c fd 90 0f 0b e8 c1 c5 5c
RSP: 0018:ffffc9000346ef18 EFLAGS: 00010293
RAX: ffffffff843941b7 RBX: dffffc0000000000 RCX: ffff888023cd5a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff84393d28 R09: ffffffff843804ad
R10: 0000000000000007 R11: ffff888023cd5a00 R12: 1ffff1100eb70101
R13: ffff888071e440a3 R14: 0000000000000000 R15: ffff888071e440a0
FS:  000055556e8b0380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561d03c02678 CR3: 0000000074648000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [syzbot] [bcachefs?] kernel BUG in cpu_replicas_add_entry
  2024-05-12 17:46 [syzbot] [bcachefs?] kernel BUG in cpu_replicas_add_entry syzbot
@ 2024-05-13 11:05 ` Edward Adam Davis
  2024-05-13 11:24   ` syzbot
  2024-05-13 12:07 ` [PATCH] bcachefs: if input options invalid return -BCH_ERR_option_name Edward Adam Davis
  1 sibling, 1 reply; 4+ messages in thread
From: Edward Adam Davis @ 2024-05-13 11:05 UTC (permalink / raw)
  To: syzbot+73414091bd382684ee2b; +Cc: linux-kernel, syzkaller-bugs

please test kb in cpu_replicas_add_entry

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git cf87f46fd34d

diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
index e1800c4119b5..2fc59b8aa32d 100644
--- a/fs/bcachefs/opts.c
+++ b/fs/bcachefs/opts.c
@@ -443,7 +443,7 @@ int bch2_parse_mount_opts(struct bch_fs *c, struct bch_opts *opts,
 			  char *options)
 {
 	char *copied_opts, *copied_opts_start;
-	char *opt, *name, *val;
+	char *opt, *name, *val, opts_set = 0;
 	int ret, id;
 	struct printbuf err = PRINTBUF;
 	u64 v;
@@ -498,8 +498,11 @@ int bch2_parse_mount_opts(struct bch_fs *c, struct bch_opts *opts,
 			goto bad_val;
 
 		bch2_opt_set_by_id(opts, id, v);
+		opts_set = 1;
 	}
 
+	if (!opts_set)
+		goto bad_opt;
 	ret = 0;
 	goto out;
 


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [syzbot] [bcachefs?] kernel BUG in cpu_replicas_add_entry
  2024-05-13 11:05 ` Edward Adam Davis
@ 2024-05-13 11:24   ` syzbot
  0 siblings, 0 replies; 4+ messages in thread
From: syzbot @ 2024-05-13 11:24 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+73414091bd382684ee2b@syzkaller.appspotmail.com

Tested on:

commit:         cf87f46f Merge tag 'drm-fixes-2024-05-11' of https://g..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=152aa96c980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=9d7ea7de0cb32587
dashboard link: https://syzkaller.appspot.com/bug?extid=73414091bd382684ee2b
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=112bfdd4980000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH] bcachefs: if input options invalid return -BCH_ERR_option_name
  2024-05-12 17:46 [syzbot] [bcachefs?] kernel BUG in cpu_replicas_add_entry syzbot
  2024-05-13 11:05 ` Edward Adam Davis
@ 2024-05-13 12:07 ` Edward Adam Davis
  1 sibling, 0 replies; 4+ messages in thread
From: Edward Adam Davis @ 2024-05-13 12:07 UTC (permalink / raw)
  To: syzbot+73414091bd382684ee2b
  Cc: bfoster, kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs

When the input parameter options format is invalid, it will cause the opts object
to not be set correctly. 
When a similar situation occurs, it should return -BCH_ERR_option_name and terminate
the mounting action.

Fixes: 03ef80b469d5 ("bcachefs: Ignore unknown mount options")
Reported-and-tested-by: syzbot+73414091bd382684ee2b@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/bcachefs/opts.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/bcachefs/opts.c b/fs/bcachefs/opts.c
index e1800c4119b5..2fc59b8aa32d 100644
--- a/fs/bcachefs/opts.c
+++ b/fs/bcachefs/opts.c
@@ -443,7 +443,7 @@ int bch2_parse_mount_opts(struct bch_fs *c, struct bch_opts *opts,
 			  char *options)
 {
 	char *copied_opts, *copied_opts_start;
-	char *opt, *name, *val;
+	char *opt, *name, *val, opts_set = 0;
 	int ret, id;
 	struct printbuf err = PRINTBUF;
 	u64 v;
@@ -498,8 +498,11 @@ int bch2_parse_mount_opts(struct bch_fs *c, struct bch_opts *opts,
 			goto bad_val;
 
 		bch2_opt_set_by_id(opts, id, v);
+		opts_set = 1;
 	}
 
+	if (!opts_set)
+		goto bad_opt;
 	ret = 0;
 	goto out;
 
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2024-05-13 12:18 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-05-12 17:46 [syzbot] [bcachefs?] kernel BUG in cpu_replicas_add_entry syzbot
2024-05-13 11:05 ` Edward Adam Davis
2024-05-13 11:24   ` syzbot
2024-05-13 12:07 ` [PATCH] bcachefs: if input options invalid return -BCH_ERR_option_name Edward Adam Davis

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.