kernel BUG in jfs_evict_inode

kernel BUG in jfs_evict_inode

[Hao Sun]

Hello,

When using Healer to fuzz the latest Linux kernel, the following crash
was triggered.

HEAD commit: 0513e464f900 Merge tag 'perf-tools-fixes-for-v5.15-2021-09-27'
git tree: upstream
console output:
https://drive.google.com/file/d/1NSVdsjViaEUbSeaWVC-UYThJlWp0lvVW/view?usp=sharing
kernel config: https://drive.google.com/file/d/1Jqhc4DpCVE8X7d-XBdQnrMoQzifTG5ho/view?usp=sharing
C reproducer: https://drive.google.com/file/d/184Rm6ijCSvoPQ5yHX7LOzbjXVtx7lyvN/view?usp=sharing
Syzlang reproducer:
https://drive.google.com/file/d/12c_LoGNiQQOutVwi3b2XL83fDTG_BpdB/view?usp=sharing

If you fix this issue, please add the following tag to the commit:
Reported-by: Hao Sun <sunhao.th@gmail.com>

------------[ cut here ]------------
kernel BUG at fs/jfs/inode.c:168!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 2759 Comm: syz-executor Not tainted 5.15.0-rc3+ #21
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
RIP: 0010:jfs_evict_inode+0x157/0x1a0 fs/jfs/inode.c:168
Code: 83 78 28 00 74 0d e8 48 b5 7f ff 48 89 df e8 c0 de 00 00 e8 3b
b5 7f ff 48 89 df e8 33 25 b1 ff e9 fb fe ff ff e8 29 b5 7f ff <0f> 0b
e8 22 b5 7f ff 48 89 df e8 1a 34 00 00 eb b4 e8 13 b5 7f ff
RSP: 0018:ffffc90000867d68 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888018cb41a8 RCX: 0000000000000000
RDX: ffff8880167ec500 RSI: ffffffff81b7dc37 RDI: ffff888018cb41a8
RBP: ffffffff81b7dae0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffc90000867ce8 R11: 0000000000000001 R12: ffffffff84964600
R13: ffffffff853a64cd R14: ffff88801a91d980 R15: ffff88801a91d000
FS:  00000000025cb940(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc3c3d0da4 CR3: 0000000016458000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 evict+0xfd/0x1e0 fs/inode.c:588
 dispose_list+0x61/0x90 fs/inode.c:621
 evict_inodes+0x194/0x1f0 fs/inode.c:671
 generic_shutdown_super+0x45/0x170 fs/super.c:454
 kill_block_super+0x2c/0x60 fs/super.c:1395
 deactivate_locked_super+0x43/0x80 fs/super.c:335
 deactivate_super+0x53/0x80 fs/super.c:366
 cleanup_mnt+0x138/0x1b0 fs/namespace.c:1137
 task_work_run+0x86/0xd0 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x271/0x280 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 do_syscall_64+0x40/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x46c777
Code: ff d0 48 89 c7 b8 3c 00 00 00 0f 05 48 c7 c1 bc ff ff ff f7 d8
64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc3c3d14d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000046c777
RDX: 0000000000404e22 RSI: 0000000000000002 RDI: 00007ffc3c3d15a0
RBP: 00007ffc3c3d15a0 R08: 00000000025d5033 R09: 000000000000000b
R10: 00000000fffffffb R11: 0000000000000246 R12: 00000000004e38c6
R13: 00007ffc3c3d2650 R14: 00007ffc3c3d264c R15: 0000000000000010
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace a937ecc93c68ee05 ]---
RIP: 0010:jfs_evict_inode+0x157/0x1a0 fs/jfs/inode.c:168
Code: 83 78 28 00 74 0d e8 48 b5 7f ff 48 89 df e8 c0 de 00 00 e8 3b
b5 7f ff 48 89 df e8 33 25 b1 ff e9 fb fe ff ff e8 29 b5 7f ff <0f> 0b
e8 22 b5 7f ff 48 89 df e8 1a 34 00 00 eb b4 e8 13 b5 7f ff
RSP: 0018:ffffc90000867d68 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888018cb41a8 RCX: 0000000000000000
RDX: ffff8880167ec500 RSI: ffffffff81b7dc37 RDI: ffff888018cb41a8
RBP: ffffffff81b7dae0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffc90000867ce8 R11: 0000000000000001 R12: ffffffff84964600
R13: ffffffff853a64cd R14: ffff88801a91d980 R15: ffff88801a91d000
FS:  00000000025cb940(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc3c3d0da4 CR3: 0000000016458000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554

kernel BUG in jfs_evict_inode

[Sanan Hasanov]

Good day, dear maintainers,

We found a bug using a modified kernel configuration file used by syzbot.

We enhanced the coverage of the configuration file using our tool, klocalizer.

Kernel Branch: 6.3.0-next-20230426
Kernel Config: https://drive.google.com/file/d/16JKx3e-lqX9uQFDinkLwGNE9YWGyNH3o/view?usp=sharing
Reproducer: https://drive.google.com/file/d/1OPF8Di2dWSX10ejBfqopxpBU0BIZyqWW/view?usp=sharing

Thank you!

Best regards,
Sanan Hasanov

------------[ cut here ]------------
kernel BUG at fs/jfs/inode.c:169!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4961 Comm: syz-executor.7 Not tainted 6.3.0-next-20230426 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:jfs_evict_inode+0x3eb/0x4b0 fs/jfs/inode.c:169
Code: 7c 24 80 00 74 0d e8 a4 6c a9 fe 48 89 df e8 fc 5f 02 00 e8 97 6c a9 fe 48 89 df e8 af e4 28 ff e9 e3 fc ff ff e8 85 6c a9 fe <0f> 0b 48 c7 c7 20 67 2c 8c e8 67 a5 f9 fe e9 44 fc ff ff e8 5d a5
RSP: 0018:ffffc9000b6578e8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888076d0d770 RCX: 0000000000000000
RDX: ffff8880467cbb80 RSI: ffffffff82d81bab RDI: ffff888076d0d760
RBP: ffff888076d0d3f8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888076d0d848
R13: ffff888076d0d798 R14: ffffffff8a084920 R15: ffff88807d8f8a00
FS:  0000000000000000(0000) GS:ffff888119c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc88d736c0 CR3: 000000007cee3000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 evict+0x2ed/0x6b0 fs/inode.c:665
 dispose_list+0x117/0x1e0 fs/inode.c:698
 evict_inodes+0x345/0x440 fs/inode.c:748
 generic_shutdown_super+0xaf/0x480 fs/super.c:479
 kill_block_super+0xa1/0x100 fs/super.c:1407
 deactivate_locked_super+0x98/0x160 fs/super.c:331
 deactivate_super+0xb1/0xd0 fs/super.c:362
 cleanup_mnt+0x2ae/0x3d0 fs/namespace.c:1177
 task_work_run+0x168/0x260 kernel/task_work.c:179
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0xb07/0x29f0 kernel/exit.c:871
 do_group_exit+0xd4/0x2a0 kernel/exit.c:1021
 get_signal+0x2311/0x25c0 kernel/signal.c:2874
 arch_do_signal_or_restart+0x79/0x5a0 arch/x86/kernel/signal.c:307
 exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
 exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
 irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:310
 exc_page_fault+0xc4/0x180 arch/x86/mm/fault.c:1615
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7f4acfa8edd5
Code: Unable to access opcode bytes at 0x7f4acfa8edab.
RSP: 002b:00000000fffffe80 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f4acfbbbf80 RCX: 00007f4acfa8edcd
RDX: 0000000000000000 RSI: 00000000fffffe80 RDI: 0000000058208080
RBP: 00007f4acfafc59c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffe57fcc43f R14: 00007ffe57fcc5e0 R15: 00007f4ace9fdd80
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jfs_evict_inode+0x3eb/0x4b0 fs/jfs/inode.c:169
Code: 7c 24 80 00 74 0d e8 a4 6c a9 fe 48 89 df e8 fc 5f 02 00 e8 97 6c a9 fe 48 89 df e8 af e4 28 ff e9 e3 fc ff ff e8 85 6c a9 fe <0f> 0b 48 c7 c7 20 67 2c 8c e8 67 a5 f9 fe e9 44 fc ff ff e8 5d a5
RSP: 0018:ffffc9000b6578e8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888076d0d770 RCX: 0000000000000000
RDX: ffff8880467cbb80 RSI: ffffffff82d81bab RDI: ffff888076d0d760
RBP: ffff888076d0d3f8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888076d0d848
R13: ffff888076d0d798 R14: ffffffff8a084920 R15: ffff88807d8f8a00
FS:  0000000000000000(0000) GS:ffff888119c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc88d736c0 CR3: 000000007cee3000 CR4: 0000000000350ef0