On Mon 16-12-19 11:48:36, Jan Kara wrote: > On Tue 03-12-19 08:10:37, Dave Chinner wrote: > > [cc linux-ext4@vger.kernel.org - this is reported from the new ext4 > > dio->iomap code] > > > > On Mon, Dec 02, 2019 at 09:15:08AM -0800, syzbot wrote: > > > Hello, > > > > > > syzbot found the following crash on: > > > > > > HEAD commit: b94ae8ad Merge tag 'seccomp-v5.5-rc1' of git://git.kernel... > > > git tree: upstream > > > console output: https://syzkaller.appspot.com/x/log.txt?x=135a8d7ae00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=c2e464ae414aee8c > > > dashboard link: https://syzkaller.appspot.com/bug?extid=bea68382bae9490e7dd6 > > > compiler: clang version 9.0.0 (/home/glider/llvm/clang > > > 80fee25776c2fb61e74c1ecb1a523375c2500b69) > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1135cb36e00000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14e90abce00000 > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+bea68382bae9490e7dd6@syzkaller.appspotmail.com > > > ... > > Looks like buffered read IO on a loopback device on an ext4 image > > file, and something is being tripped over in the new ext4 direct IO > > path. Might be an iomap issue, might be an ext4 issue, but it looks > > like the buffered read bio completion is running while the iov is > > still being submitted... > > Looking a bit more into this, I'm pretty sure this is caused by commit > 8cefc107ca54c "pipe: Use head and tail pointers for the ring, not cursor > and length". The pipe dereference it has added to iov_iter_alignment() is > just bogus for all iter types except for pipes. I'll send a fix. For reference the fix I've sent is attached. Honza -- Jan Kara SUSE Labs, CR