* INFO: task can't die in corrupted
@ 2020-10-07 9:18 syzbot
2020-10-07 21:32 ` [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() Eric Biggers
0 siblings, 1 reply; 11+ messages in thread
From: syzbot @ 2020-10-07 9:18 UTC (permalink / raw)
To: chao, jaegeuk, linux-f2fs-devel, linux-fsdevel, linux-kernel,
syzkaller-bugs, viro
Hello,
syzbot found the following issue on:
HEAD commit: a804ab08 Add linux-next specific files for 20201006
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000
kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb
dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000
The issue was bisected to:
commit eede846af512572b1f30b34f9889d7df64c017d4
Author: Jaegeuk Kim <jaegeuk@kernel.org>
Date: Fri Oct 2 21:17:35 2020 +0000
f2fs: f2fs_get_meta_page_nofail should not be failed
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10a8aafb900000
console output: https://syzkaller.appspot.com/x/log.txt?x=14a8aafb900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ee250ac8137be41d7b13@syzkaller.appspotmail.com
Fixes: eede846af512 ("f2fs: f2fs_get_meta_page_nofail should not be failed")
INFO: task syz-executor178:6870 can't die for more than 143 seconds.
task:syz-executor178 state:R
stack:26960 pid: 6870 ppid: 6869 flags:0x00004006
Call Trace:
Showing all locks held in the system:
1 lock held by khungtaskd/1179:
#0: ffffffff8a554da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6242
1 lock held by systemd-journal/3920:
1 lock held by in:imklog/6769:
#0: ffff88809eebc130 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:930
1 lock held by syz-executor178/6870:
#0: ffff8880925120e0 (&type->s_umount_key#47/1){+.+.}-{3:3}, at: alloc_super+0x201/0xaf0 fs/super.c:229
=============================================
Kernel panic - not syncing: hung_task: blocked tasks
CPU: 0 PID: 1179 Comm: khungtaskd Not tainted 5.9.0-rc8-next-20201006-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x198/0x1fb lib/dump_stack.c:118
panic+0x382/0x7fb kernel/panic.c:231
check_hung_uninterruptible_tasks kernel/hung_task.c:257 [inline]
watchdog.cold+0x23e/0x248 kernel/hung_task.c:339
kthread+0x3af/0x4a0 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 11+ messages in thread* [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-07 9:18 INFO: task can't die in corrupted syzbot @ 2020-10-07 21:32 ` Eric Biggers 2020-10-07 21:53 ` jaegeuk 0 siblings, 1 reply; 11+ messages in thread From: Eric Biggers @ 2020-10-07 21:32 UTC (permalink / raw) To: Jaegeuk Kim Cc: chao, linux-f2fs-devel, syzkaller-bugs, linux-kernel, syzbot+ee250ac8137be41d7b13 [moved linux-fsdevel to Bcc] On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: a804ab08 Add linux-next specific files for 20201006 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 > kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb > dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 > compiler: gcc (GCC) 10.1.0-syz 20200507 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 > > The issue was bisected to: > > commit eede846af512572b1f30b34f9889d7df64c017d4 > Author: Jaegeuk Kim <jaegeuk@kernel.org> > Date: Fri Oct 2 21:17:35 2020 +0000 > > f2fs: f2fs_get_meta_page_nofail should not be failed > Jaegeuk, it looks like the loop you added in the above commit doesn't terminate if the requested page is beyond the end of the device. - Eric ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-07 21:32 ` [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() Eric Biggers @ 2020-10-07 21:53 ` jaegeuk 2020-10-09 1:42 ` [f2fs-dev] " Chao Yu 0 siblings, 1 reply; 11+ messages in thread From: jaegeuk @ 2020-10-07 21:53 UTC (permalink / raw) To: Eric Biggers Cc: chao, linux-f2fs-devel, syzkaller-bugs, linux-kernel, syzbot+ee250ac8137be41d7b13 On 10/07, Eric Biggers wrote: > [moved linux-fsdevel to Bcc] > > On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: a804ab08 Add linux-next specific files for 20201006 > > git tree: linux-next > > console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb > > dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 > > compiler: gcc (GCC) 10.1.0-syz 20200507 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 > > > > The issue was bisected to: > > > > commit eede846af512572b1f30b34f9889d7df64c017d4 > > Author: Jaegeuk Kim <jaegeuk@kernel.org> > > Date: Fri Oct 2 21:17:35 2020 +0000 > > > > f2fs: f2fs_get_meta_page_nofail should not be failed > > > > Jaegeuk, it looks like the loop you added in the above commit doesn't terminate > if the requested page is beyond the end of the device. Yes, that will go infinite loop. Otherwise, it will trigger a panic during the device reboot. Let me think how to avoid that before trying to get the wrong lba access. > > - Eric ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-07 21:53 ` jaegeuk @ 2020-10-09 1:42 ` Chao Yu 2020-10-09 1:50 ` jaegeuk 0 siblings, 1 reply; 11+ messages in thread From: Chao Yu @ 2020-10-09 1:42 UTC (permalink / raw) To: jaegeuk, Eric Biggers Cc: syzbot+ee250ac8137be41d7b13, syzkaller-bugs, linux-kernel, linux-f2fs-devel On 2020/10/8 5:53, jaegeuk@kernel.org wrote: > On 10/07, Eric Biggers wrote: >> [moved linux-fsdevel to Bcc] >> >> On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: >>> Hello, >>> >>> syzbot found the following issue on: >>> >>> HEAD commit: a804ab08 Add linux-next specific files for 20201006 >>> git tree: linux-next >>> console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 >>> kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb >>> dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 >>> compiler: gcc (GCC) 10.1.0-syz 20200507 >>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 >>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 >>> >>> The issue was bisected to: >>> >>> commit eede846af512572b1f30b34f9889d7df64c017d4 >>> Author: Jaegeuk Kim <jaegeuk@kernel.org> >>> Date: Fri Oct 2 21:17:35 2020 +0000 >>> >>> f2fs: f2fs_get_meta_page_nofail should not be failed >>> >> >> Jaegeuk, it looks like the loop you added in the above commit doesn't terminate >> if the requested page is beyond the end of the device. > > Yes, that will go infinite loop. Otherwise, it will trigger a panic during > the device reboot. Let me think how to avoid that before trying to get the > wrong lba access. Delivering f2fs_get_sum_page()'s return value needs a lot of codes change, I think we can just zeroing sum_page in error case, as we have already shutdown f2fs via calling f2fs_stop_checkpoint(), then f2fs_cp_error() will stop all updates to filesystem data including summary pages. Thoughts? Thanks, > >> >> - Eric > > > _______________________________________________ > Linux-f2fs-devel mailing list > Linux-f2fs-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel > . > ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-09 1:42 ` [f2fs-dev] " Chao Yu @ 2020-10-09 1:50 ` jaegeuk 2020-10-09 2:37 ` Chao Yu 0 siblings, 1 reply; 11+ messages in thread From: jaegeuk @ 2020-10-09 1:50 UTC (permalink / raw) To: Chao Yu Cc: Eric Biggers, syzbot+ee250ac8137be41d7b13, syzkaller-bugs, linux-kernel, linux-f2fs-devel On 10/09, Chao Yu wrote: > On 2020/10/8 5:53, jaegeuk@kernel.org wrote: > > On 10/07, Eric Biggers wrote: > > > [moved linux-fsdevel to Bcc] > > > > > > On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: > > > > Hello, > > > > > > > > syzbot found the following issue on: > > > > > > > > HEAD commit: a804ab08 Add linux-next specific files for 20201006 > > > > git tree: linux-next > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 > > > > compiler: gcc (GCC) 10.1.0-syz 20200507 > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 > > > > > > > > The issue was bisected to: > > > > > > > > commit eede846af512572b1f30b34f9889d7df64c017d4 > > > > Author: Jaegeuk Kim <jaegeuk@kernel.org> > > > > Date: Fri Oct 2 21:17:35 2020 +0000 > > > > > > > > f2fs: f2fs_get_meta_page_nofail should not be failed > > > > > > > > > > Jaegeuk, it looks like the loop you added in the above commit doesn't terminate > > > if the requested page is beyond the end of the device. > > > > Yes, that will go infinite loop. Otherwise, it will trigger a panic during > > the device reboot. Let me think how to avoid that before trying to get the > > wrong lba access. > > Delivering f2fs_get_sum_page()'s return value needs a lot of codes change, I think > we can just zeroing sum_page in error case, as we have already shutdown f2fs via > calling f2fs_stop_checkpoint(), then f2fs_cp_error() will stop all updates to > filesystem data including summary pages. That sounds like one solution tho, I'm afraid of getting another panic by wrong zero'ed summary page. > > Thoughts? > > Thanks, > > > > > > > > > - Eric > > > > > > _______________________________________________ > > Linux-f2fs-devel mailing list > > Linux-f2fs-devel@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel > > . > > ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-09 1:50 ` jaegeuk @ 2020-10-09 2:37 ` Chao Yu 2020-10-09 4:32 ` jaegeuk 0 siblings, 1 reply; 11+ messages in thread From: Chao Yu @ 2020-10-09 2:37 UTC (permalink / raw) To: jaegeuk Cc: Eric Biggers, syzbot+ee250ac8137be41d7b13, syzkaller-bugs, linux-kernel, linux-f2fs-devel On 2020/10/9 9:50, jaegeuk@kernel.org wrote: > On 10/09, Chao Yu wrote: >> On 2020/10/8 5:53, jaegeuk@kernel.org wrote: >>> On 10/07, Eric Biggers wrote: >>>> [moved linux-fsdevel to Bcc] >>>> >>>> On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: >>>>> Hello, >>>>> >>>>> syzbot found the following issue on: >>>>> >>>>> HEAD commit: a804ab08 Add linux-next specific files for 20201006 >>>>> git tree: linux-next >>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 >>>>> kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb >>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 >>>>> compiler: gcc (GCC) 10.1.0-syz 20200507 >>>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 >>>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 >>>>> >>>>> The issue was bisected to: >>>>> >>>>> commit eede846af512572b1f30b34f9889d7df64c017d4 >>>>> Author: Jaegeuk Kim <jaegeuk@kernel.org> >>>>> Date: Fri Oct 2 21:17:35 2020 +0000 >>>>> >>>>> f2fs: f2fs_get_meta_page_nofail should not be failed >>>>> >>>> >>>> Jaegeuk, it looks like the loop you added in the above commit doesn't terminate >>>> if the requested page is beyond the end of the device. >>> >>> Yes, that will go infinite loop. Otherwise, it will trigger a panic during >>> the device reboot. Let me think how to avoid that before trying to get the >>> wrong lba access. >> >> Delivering f2fs_get_sum_page()'s return value needs a lot of codes change, I think >> we can just zeroing sum_page in error case, as we have already shutdown f2fs via >> calling f2fs_stop_checkpoint(), then f2fs_cp_error() will stop all updates to >> filesystem data including summary pages. > > That sounds like one solution tho, I'm afraid of getting another panic by > wrong zero'ed summary page. What case do you mean? maybe I missed some corner cases? Thanks, > >> >> Thoughts? >> >> Thanks, >> >>> >>>> >>>> - Eric >>> >>> >>> _______________________________________________ >>> Linux-f2fs-devel mailing list >>> Linux-f2fs-devel@lists.sourceforge.net >>> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel >>> . >>> > . > ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-09 2:37 ` Chao Yu @ 2020-10-09 4:32 ` jaegeuk 2020-10-09 7:05 ` Chao Yu 0 siblings, 1 reply; 11+ messages in thread From: jaegeuk @ 2020-10-09 4:32 UTC (permalink / raw) To: Chao Yu Cc: Eric Biggers, syzbot+ee250ac8137be41d7b13, syzkaller-bugs, linux-kernel, linux-f2fs-devel On 10/09, Chao Yu wrote: > On 2020/10/9 9:50, jaegeuk@kernel.org wrote: > > On 10/09, Chao Yu wrote: > > > On 2020/10/8 5:53, jaegeuk@kernel.org wrote: > > > > On 10/07, Eric Biggers wrote: > > > > > [moved linux-fsdevel to Bcc] > > > > > > > > > > On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: > > > > > > Hello, > > > > > > > > > > > > syzbot found the following issue on: > > > > > > > > > > > > HEAD commit: a804ab08 Add linux-next specific files for 20201006 > > > > > > git tree: linux-next > > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 > > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb > > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 > > > > > > compiler: gcc (GCC) 10.1.0-syz 20200507 > > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 > > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 > > > > > > > > > > > > The issue was bisected to: > > > > > > > > > > > > commit eede846af512572b1f30b34f9889d7df64c017d4 > > > > > > Author: Jaegeuk Kim <jaegeuk@kernel.org> > > > > > > Date: Fri Oct 2 21:17:35 2020 +0000 > > > > > > > > > > > > f2fs: f2fs_get_meta_page_nofail should not be failed > > > > > > > > > > > > > > > > Jaegeuk, it looks like the loop you added in the above commit doesn't terminate > > > > > if the requested page is beyond the end of the device. > > > > > > > > Yes, that will go infinite loop. Otherwise, it will trigger a panic during > > > > the device reboot. Let me think how to avoid that before trying to get the > > > > wrong lba access. > > > > > > Delivering f2fs_get_sum_page()'s return value needs a lot of codes change, I think > > > we can just zeroing sum_page in error case, as we have already shutdown f2fs via > > > calling f2fs_stop_checkpoint(), then f2fs_cp_error() will stop all updates to > > > filesystem data including summary pages. > > > > That sounds like one solution tho, I'm afraid of getting another panic by > > wrong zero'ed summary page. > > What case do you mean? maybe I missed some corner cases? I sent v2 to fix syzbot issue, which fixes wrong use of f2fs_get_meta_page_nofail. > > Thanks, > > > > > > > > > Thoughts? > > > > > > Thanks, > > > > > > > > > > > > > > > > > - Eric > > > > > > > > > > > > _______________________________________________ > > > > Linux-f2fs-devel mailing list > > > > Linux-f2fs-devel@lists.sourceforge.net > > > > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel > > > > . > > > > > > . > > ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-09 4:32 ` jaegeuk @ 2020-10-09 7:05 ` Chao Yu 2020-10-09 14:56 ` jaegeuk 0 siblings, 1 reply; 11+ messages in thread From: Chao Yu @ 2020-10-09 7:05 UTC (permalink / raw) To: jaegeuk Cc: Eric Biggers, syzbot+ee250ac8137be41d7b13, syzkaller-bugs, linux-kernel, linux-f2fs-devel On 2020/10/9 12:32, jaegeuk@kernel.org wrote: > On 10/09, Chao Yu wrote: >> On 2020/10/9 9:50, jaegeuk@kernel.org wrote: >>> On 10/09, Chao Yu wrote: >>>> On 2020/10/8 5:53, jaegeuk@kernel.org wrote: >>>>> On 10/07, Eric Biggers wrote: >>>>>> [moved linux-fsdevel to Bcc] >>>>>> >>>>>> On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: >>>>>>> Hello, >>>>>>> >>>>>>> syzbot found the following issue on: >>>>>>> >>>>>>> HEAD commit: a804ab08 Add linux-next specific files for 20201006 >>>>>>> git tree: linux-next >>>>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 >>>>>>> kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb >>>>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 >>>>>>> compiler: gcc (GCC) 10.1.0-syz 20200507 >>>>>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 >>>>>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 >>>>>>> >>>>>>> The issue was bisected to: >>>>>>> >>>>>>> commit eede846af512572b1f30b34f9889d7df64c017d4 >>>>>>> Author: Jaegeuk Kim <jaegeuk@kernel.org> >>>>>>> Date: Fri Oct 2 21:17:35 2020 +0000 >>>>>>> >>>>>>> f2fs: f2fs_get_meta_page_nofail should not be failed >>>>>>> >>>>>> >>>>>> Jaegeuk, it looks like the loop you added in the above commit doesn't terminate >>>>>> if the requested page is beyond the end of the device. >>>>> >>>>> Yes, that will go infinite loop. Otherwise, it will trigger a panic during >>>>> the device reboot. Let me think how to avoid that before trying to get the >>>>> wrong lba access. >>>> >>>> Delivering f2fs_get_sum_page()'s return value needs a lot of codes change, I think >>>> we can just zeroing sum_page in error case, as we have already shutdown f2fs via >>>> calling f2fs_stop_checkpoint(), then f2fs_cp_error() will stop all updates to >>>> filesystem data including summary pages. >>> >>> That sounds like one solution tho, I'm afraid of getting another panic by >>> wrong zero'ed summary page. >> >> What case do you mean? maybe I missed some corner cases? > > I sent v2 to fix syzbot issue, which fixes wrong use of > f2fs_get_meta_page_nofail. I agreed to fix that case, however we may encounter deadloop in other places where we call f2fs_get_meta_page_nofail()? like the case that filesystem will always see EIO after we shutdown device via dmflakey? Thanks, > >> >> Thanks, >> >>> >>>> >>>> Thoughts? >>>> >>>> Thanks, >>>> >>>>> >>>>>> >>>>>> - Eric >>>>> >>>>> >>>>> _______________________________________________ >>>>> Linux-f2fs-devel mailing list >>>>> Linux-f2fs-devel@lists.sourceforge.net >>>>> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel >>>>> . >>>>> >>> . >>> > . > ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-09 7:05 ` Chao Yu @ 2020-10-09 14:56 ` jaegeuk 2020-10-13 2:30 ` Chao Yu 0 siblings, 1 reply; 11+ messages in thread From: jaegeuk @ 2020-10-09 14:56 UTC (permalink / raw) To: Chao Yu Cc: Eric Biggers, syzbot+ee250ac8137be41d7b13, syzkaller-bugs, linux-kernel, linux-f2fs-devel On 10/09, Chao Yu wrote: > On 2020/10/9 12:32, jaegeuk@kernel.org wrote: > > On 10/09, Chao Yu wrote: > > > On 2020/10/9 9:50, jaegeuk@kernel.org wrote: > > > > On 10/09, Chao Yu wrote: > > > > > On 2020/10/8 5:53, jaegeuk@kernel.org wrote: > > > > > > On 10/07, Eric Biggers wrote: > > > > > > > [moved linux-fsdevel to Bcc] > > > > > > > > > > > > > > On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: > > > > > > > > Hello, > > > > > > > > > > > > > > > > syzbot found the following issue on: > > > > > > > > > > > > > > > > HEAD commit: a804ab08 Add linux-next specific files for 20201006 > > > > > > > > git tree: linux-next > > > > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 > > > > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb > > > > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 > > > > > > > > compiler: gcc (GCC) 10.1.0-syz 20200507 > > > > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 > > > > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 > > > > > > > > > > > > > > > > The issue was bisected to: > > > > > > > > > > > > > > > > commit eede846af512572b1f30b34f9889d7df64c017d4 > > > > > > > > Author: Jaegeuk Kim <jaegeuk@kernel.org> > > > > > > > > Date: Fri Oct 2 21:17:35 2020 +0000 > > > > > > > > > > > > > > > > f2fs: f2fs_get_meta_page_nofail should not be failed > > > > > > > > > > > > > > > > > > > > > > Jaegeuk, it looks like the loop you added in the above commit doesn't terminate > > > > > > > if the requested page is beyond the end of the device. > > > > > > > > > > > > Yes, that will go infinite loop. Otherwise, it will trigger a panic during > > > > > > the device reboot. Let me think how to avoid that before trying to get the > > > > > > wrong lba access. > > > > > > > > > > Delivering f2fs_get_sum_page()'s return value needs a lot of codes change, I think > > > > > we can just zeroing sum_page in error case, as we have already shutdown f2fs via > > > > > calling f2fs_stop_checkpoint(), then f2fs_cp_error() will stop all updates to > > > > > filesystem data including summary pages. > > > > > > > > That sounds like one solution tho, I'm afraid of getting another panic by > > > > wrong zero'ed summary page. > > > > > > What case do you mean? maybe I missed some corner cases? > > > > I sent v2 to fix syzbot issue, which fixes wrong use of > > f2fs_get_meta_page_nofail. > > I agreed to fix that case, however we may encounter deadloop in other > places where we call f2fs_get_meta_page_nofail()? like the case that > filesystem will always see EIO after we shutdown device via dmflakey? We may need another option to deal with this. At least, however, it's literally _nofail function which should guarantee no error, instead of hiding the error with zero'ed page. > > Thanks, > > > > > > > > > Thanks, > > > > > > > > > > > > > > > > > Thoughts? > > > > > > > > > > Thanks, > > > > > > > > > > > > > > > > > > > > > > > > > - Eric > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > Linux-f2fs-devel mailing list > > > > > > Linux-f2fs-devel@lists.sourceforge.net > > > > > > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel > > > > > > . > > > > > > > > > > . > > > > > > . > > ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-09 14:56 ` jaegeuk @ 2020-10-13 2:30 ` Chao Yu 2020-10-13 3:08 ` jaegeuk 0 siblings, 1 reply; 11+ messages in thread From: Chao Yu @ 2020-10-13 2:30 UTC (permalink / raw) To: jaegeuk Cc: Eric Biggers, syzbot+ee250ac8137be41d7b13, syzkaller-bugs, linux-kernel, linux-f2fs-devel Jaegeuk, I guess you missed sending last applied patch to mailing list? Thanks, On 2020/10/9 22:56, jaegeuk@kernel.org wrote: > On 10/09, Chao Yu wrote: >> On 2020/10/9 12:32, jaegeuk@kernel.org wrote: >>> On 10/09, Chao Yu wrote: >>>> On 2020/10/9 9:50, jaegeuk@kernel.org wrote: >>>>> On 10/09, Chao Yu wrote: >>>>>> On 2020/10/8 5:53, jaegeuk@kernel.org wrote: >>>>>>> On 10/07, Eric Biggers wrote: >>>>>>>> [moved linux-fsdevel to Bcc] >>>>>>>> >>>>>>>> On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: >>>>>>>>> Hello, >>>>>>>>> >>>>>>>>> syzbot found the following issue on: >>>>>>>>> >>>>>>>>> HEAD commit: a804ab08 Add linux-next specific files for 20201006 >>>>>>>>> git tree: linux-next >>>>>>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 >>>>>>>>> kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb >>>>>>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 >>>>>>>>> compiler: gcc (GCC) 10.1.0-syz 20200507 >>>>>>>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 >>>>>>>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 >>>>>>>>> >>>>>>>>> The issue was bisected to: >>>>>>>>> >>>>>>>>> commit eede846af512572b1f30b34f9889d7df64c017d4 >>>>>>>>> Author: Jaegeuk Kim <jaegeuk@kernel.org> >>>>>>>>> Date: Fri Oct 2 21:17:35 2020 +0000 >>>>>>>>> >>>>>>>>> f2fs: f2fs_get_meta_page_nofail should not be failed >>>>>>>>> >>>>>>>> >>>>>>>> Jaegeuk, it looks like the loop you added in the above commit doesn't terminate >>>>>>>> if the requested page is beyond the end of the device. >>>>>>> >>>>>>> Yes, that will go infinite loop. Otherwise, it will trigger a panic during >>>>>>> the device reboot. Let me think how to avoid that before trying to get the >>>>>>> wrong lba access. >>>>>> >>>>>> Delivering f2fs_get_sum_page()'s return value needs a lot of codes change, I think >>>>>> we can just zeroing sum_page in error case, as we have already shutdown f2fs via >>>>>> calling f2fs_stop_checkpoint(), then f2fs_cp_error() will stop all updates to >>>>>> filesystem data including summary pages. >>>>> >>>>> That sounds like one solution tho, I'm afraid of getting another panic by >>>>> wrong zero'ed summary page. >>>> >>>> What case do you mean? maybe I missed some corner cases? >>> >>> I sent v2 to fix syzbot issue, which fixes wrong use of >>> f2fs_get_meta_page_nofail. >> >> I agreed to fix that case, however we may encounter deadloop in other >> places where we call f2fs_get_meta_page_nofail()? like the case that >> filesystem will always see EIO after we shutdown device via dmflakey? > > We may need another option to deal with this. At least, however, it's literally > _nofail function which should guarantee no error, instead of hiding the error > with zero'ed page. > >> >> Thanks, >> >>> >>>> >>>> Thanks, >>>> >>>>> >>>>>> >>>>>> Thoughts? >>>>>> >>>>>> Thanks, >>>>>> >>>>>>> >>>>>>>> >>>>>>>> - Eric >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> Linux-f2fs-devel mailing list >>>>>>> Linux-f2fs-devel@lists.sourceforge.net >>>>>>> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel >>>>>>> . >>>>>>> >>>>> . >>>>> >>> . >>> > . > ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [f2fs-dev] [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() 2020-10-13 2:30 ` Chao Yu @ 2020-10-13 3:08 ` jaegeuk 0 siblings, 0 replies; 11+ messages in thread From: jaegeuk @ 2020-10-13 3:08 UTC (permalink / raw) To: Chao Yu Cc: Eric Biggers, syzbot+ee250ac8137be41d7b13, syzkaller-bugs, linux-kernel, linux-f2fs-devel On 10/13, Chao Yu wrote: > Jaegeuk, > > I guess you missed sending last applied patch to mailing list? I was testing locally and supposed to post it soon before pull request. Putting it in -dev can give some soak time in -next. No worries. Thanks, > > Thanks, > > On 2020/10/9 22:56, jaegeuk@kernel.org wrote: > > On 10/09, Chao Yu wrote: > > > On 2020/10/9 12:32, jaegeuk@kernel.org wrote: > > > > On 10/09, Chao Yu wrote: > > > > > On 2020/10/9 9:50, jaegeuk@kernel.org wrote: > > > > > > On 10/09, Chao Yu wrote: > > > > > > > On 2020/10/8 5:53, jaegeuk@kernel.org wrote: > > > > > > > > On 10/07, Eric Biggers wrote: > > > > > > > > > [moved linux-fsdevel to Bcc] > > > > > > > > > > > > > > > > > > On Wed, Oct 07, 2020 at 02:18:19AM -0700, syzbot wrote: > > > > > > > > > > Hello, > > > > > > > > > > > > > > > > > > > > syzbot found the following issue on: > > > > > > > > > > > > > > > > > > > > HEAD commit: a804ab08 Add linux-next specific files for 20201006 > > > > > > > > > > git tree: linux-next > > > > > > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=17fe30bf900000 > > > > > > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=26c1b4cc4a62ccb > > > > > > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=ee250ac8137be41d7b13 > > > > > > > > > > compiler: gcc (GCC) 10.1.0-syz 20200507 > > > > > > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1336413b900000 > > > > > > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f7392b900000 > > > > > > > > > > > > > > > > > > > > The issue was bisected to: > > > > > > > > > > > > > > > > > > > > commit eede846af512572b1f30b34f9889d7df64c017d4 > > > > > > > > > > Author: Jaegeuk Kim <jaegeuk@kernel.org> > > > > > > > > > > Date: Fri Oct 2 21:17:35 2020 +0000 > > > > > > > > > > > > > > > > > > > > f2fs: f2fs_get_meta_page_nofail should not be failed > > > > > > > > > > > > > > > > > > > > > > > > > > > > Jaegeuk, it looks like the loop you added in the above commit doesn't terminate > > > > > > > > > if the requested page is beyond the end of the device. > > > > > > > > > > > > > > > > Yes, that will go infinite loop. Otherwise, it will trigger a panic during > > > > > > > > the device reboot. Let me think how to avoid that before trying to get the > > > > > > > > wrong lba access. > > > > > > > > > > > > > > Delivering f2fs_get_sum_page()'s return value needs a lot of codes change, I think > > > > > > > we can just zeroing sum_page in error case, as we have already shutdown f2fs via > > > > > > > calling f2fs_stop_checkpoint(), then f2fs_cp_error() will stop all updates to > > > > > > > filesystem data including summary pages. > > > > > > > > > > > > That sounds like one solution tho, I'm afraid of getting another panic by > > > > > > wrong zero'ed summary page. > > > > > > > > > > What case do you mean? maybe I missed some corner cases? > > > > > > > > I sent v2 to fix syzbot issue, which fixes wrong use of > > > > f2fs_get_meta_page_nofail. > > > > > > I agreed to fix that case, however we may encounter deadloop in other > > > places where we call f2fs_get_meta_page_nofail()? like the case that > > > filesystem will always see EIO after we shutdown device via dmflakey? > > > > We may need another option to deal with this. At least, however, it's literally > > _nofail function which should guarantee no error, instead of hiding the error > > with zero'ed page. > > > > > > > > Thanks, > > > > > > > > > > > > > > > > > Thanks, > > > > > > > > > > > > > > > > > > > > > > > > > Thoughts? > > > > > > > > > > > > > > Thanks, > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > - Eric > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > Linux-f2fs-devel mailing list > > > > > > > > Linux-f2fs-devel@lists.sourceforge.net > > > > > > > > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel > > > > > > > > . > > > > > > > > > > > > > > . > > > > > > > > > > . > > > > > > . > > ^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2020-10-13 3:08 UTC | newest] Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-10-07 9:18 INFO: task can't die in corrupted syzbot 2020-10-07 21:32 ` [f2fs bug] infinite loop in f2fs_get_meta_page_nofail() Eric Biggers 2020-10-07 21:53 ` jaegeuk 2020-10-09 1:42 ` [f2fs-dev] " Chao Yu 2020-10-09 1:50 ` jaegeuk 2020-10-09 2:37 ` Chao Yu 2020-10-09 4:32 ` jaegeuk 2020-10-09 7:05 ` Chao Yu 2020-10-09 14:56 ` jaegeuk 2020-10-13 2:30 ` Chao Yu 2020-10-13 3:08 ` jaegeuk
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).