From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752461AbeDESzO (ORCPT ); Thu, 5 Apr 2018 14:55:14 -0400 Received: from mail-pl0-f52.google.com ([209.85.160.52]:34699 "EHLO mail-pl0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752018AbeDESzM (ORCPT ); Thu, 5 Apr 2018 14:55:12 -0400 X-Google-Smtp-Source: AIpwx4+PdE/y1aebNCYpR4qakAUl/wLmZoPG706EiCxgJLTCfYnRe6RDMUyX7+nDRScGoVPFm+jIVaHdI/dkk8ghZtQ= MIME-Version: 1.0 In-Reply-To: <20180403043854.GL1150@dastard> References: <20180403043854.GL1150@dastard> From: Dmitry Vyukov Date: Thu, 5 Apr 2018 20:54:50 +0200 Message-ID: Subject: Re: WARNING: bad unlock balance in xfs_iunlock To: Dave Chinner Cc: syzbot , darrick.wong@oracle.com, LKML , linux-xfs@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 3, 2018 at 6:38 AM, Dave Chinner wrote: > On Mon, Apr 02, 2018 at 07:01:02PM -0700, syzbot wrote: >> Hello, >> >> syzbot hit the following crash on upstream commit >> 86bbbebac1933e6e95e8234c4f7d220c5ddd38bc (Mon Apr 2 18:47:07 2018 +0000) >> Merge branch 'ras-core-for-linus' of >> git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip >> syzbot dashboard link: >> https://syzkaller.appspot.com/bug?extid=84a67953651a971809ba >> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5719304272084992 >> syzkaller reproducer: >> https://syzkaller.appspot.com/x/repro.syz?id=5767783983874048 > > What a mess. A hand built, hopelessly broken filesystem image made > up of hex dumps, written into a mmap()d region of memory, then > copied into a tmpfs file and mounted with the loop device. > > Engineers that can debug broken filesystems don't grow on trees. If > we are to have any hope of understanding what the hell this test is > doing, the bot needs to supply us with a copy of the built > filesystem image the test uses. We need to be able to point forensic > tools at the image to decode all the structures into human readable > format - if we are forced to do that by hand or jump through hoops > to create our own filesystem image than I'm certainly not going to > waste time looking at these reports... Hi Dave, Here is the image: https://drive.google.com/file/d/1jzhGGe5SBJcqfsjxCLHoh4Kazke1oTfC/view (took me about a minute to extract from test by replacing memfd_create with open and running the program). Then do the following to trigger the bug: losetup /dev/loop0 xfs.repro mkdir xfs mount -t xfs -o nouuid,prjquota,noikeep,quota /dev/loop0 xfs To answer your more general question: syzbot is not a system to test solely file systems, it finds bugs in hundreds of kernel subsystems. Generating image for file systems, media files for sound and FaceDancer programs that crash host when FaceDancer device is plugged into USB is not feasible. And in the end it's not even clear what kernel subsystem is at fault and even if it somehow figures out that it's a filesystem, it's unclear that it's exactly an image that provokes the bug. syzbot provides C reproducers which is a reasonable common ground for bug reports. At this point the bug needs human attention. Some bugs are trivial enough that a developer does not even need to look at the reproducer. Some bugs are so involved that only an expert in a particular subsystem can figure out what happens there.