linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
* WARNING in __folio_mark_dirty
@ 2021-11-10  1:20 Hao Sun
  2021-11-10  1:57 ` Matthew Wilcox
  0 siblings, 1 reply; 7+ messages in thread
From: Hao Sun @ 2021-11-10  1:20 UTC (permalink / raw)
  To: konishi.ryusuke, linux-nilfs, Linux Kernel Mailing List, akpm, Linux MM

Hello,

When using Healer to fuzz the latest Linux kernel, the following crash
was triggered.

HEAD commit: 6b75d88fa81b Merge branch 'i2c/for-current'
git tree: upstream
console output: https://paste.ubuntu.com/p/C22bhzvZP6/
kernel config: https://paste.ubuntu.com/p/b62Hp7BfJn/
C reproducer: https://paste.ubuntu.com/p/2mchRNDJr4/
Syzlang reproducer: https://paste.ubuntu.com/p/xM3DQ2f5Qz/

If you fix this issue, please add the following tag to the commit:
Reported-by: Hao Sun <sunhao.th@gmail.com>

NILFS (loop10): segctord starting. Construction interval = 5 seconds,
CP frequency < 30 seconds
------------[ cut here ]------------
WARNING: CPU: 3 PID: 18327 at include/linux/backing-dev.h:269
inode_to_wb include/linux/backing-dev.h:269 [inline]
WARNING: CPU: 3 PID: 18327 at include/linux/backing-dev.h:269
folio_account_dirtied mm/page-writeback.c:2460 [inline]
WARNING: CPU: 3 PID: 18327 at include/linux/backing-dev.h:269
__folio_mark_dirty+0xab2/0xe80 mm/page-writeback.c:2509
Modules linked in:
CPU: 3 PID: 18327 Comm: segctord Not tainted 5.15.0+ #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:inode_to_wb include/linux/backing-dev.h:269 [inline]
RIP: 0010:folio_account_dirtied mm/page-writeback.c:2460 [inline]
RIP: 0010:__folio_mark_dirty+0xab2/0xe80 mm/page-writeback.c:2509
Code: ff ff ff 48 8d 78 70 e8 8c 69 96 07 31 ff 89 c6 89 44 24 10 e8
ff 52 d8 ff 8b 44 24 10 85 c0 0f 85 13 fa ff ff e8 8e 51 d8 ff <0f> 0b
e9 07 fa ff ff e8 82 51 d8 ff e8 9d 6a 96 07 31 ff 41 89 c7
RSP: 0018:ffffc900076ef7c0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88802c478378 RCX: ffff88802fc33980
RDX: 0000000000000000 RSI: ffff88802fc33980 RDI: 0000000000000002
RBP: ffffea0000b7ca80 R08: ffffffff819f0012 R09: 0000000000000000
R10: 0000000000000005 R11: fffff9400016f950 R12: 0000000000000246
R13: ffff88802c478138 R14: 0000000000000001 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff888135d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056054d573c18 CR3: 0000000021c4e000 CR4: 0000000000350ee0
Call Trace:
<TASK>
__set_page_dirty include/linux/pagemap.h:784 [inline]
mark_buffer_dirty+0x501/0x6a0 fs/buffer.c:1108
nilfs_btree_propagate_p fs/nilfs2/btree.c:1889 [inline]
nilfs_btree_propagate+0x4ba/0xce0 fs/nilfs2/btree.c:2085
nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337
nilfs_collect_dat_data+0x45/0xd0 fs/nilfs2/segment.c:625
nilfs_segctor_apply_buffers+0x149/0x480 fs/nilfs2/segment.c:1009
nilfs_segctor_scan_file+0x3d9/0x570 fs/nilfs2/segment.c:1058
nilfs_segctor_collect_blocks+0xa33/0x2fb0 fs/nilfs2/segment.c:1224
nilfs_segctor_collect fs/nilfs2/segment.c:1494 [inline]
nilfs_segctor_do_construct+0x1228/0x5ef0 fs/nilfs2/segment.c:2036
nilfs_segctor_construct+0x79f/0xb10 fs/nilfs2/segment.c:2372
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2480 [inline]
nilfs_segctor_thread+0x3be/0xe40 fs/nilfs2/segment.c:2563
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>


^ permalink raw reply	[flat|nested] 7+ messages in thread
* WARNING in __folio_mark_dirty
@ 2025-04-30  8:39 胡焜
  0 siblings, 0 replies; 7+ messages in thread
From: 胡焜 @ 2025-04-30  8:39 UTC (permalink / raw)
  To: Andrew Morton
  Cc: 覃佳基,
	baishuoran, linux-kernel, syzkaller, linux-fsdevel, linux-mm

[-- Attachment #1: Type: text/plain, Size: 5717 bytes --]

Dear Maintainers，



When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (37th and 76th)was triggered.




37th：
HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https://github.com/pghk13/Kernel-Bug/blob/main/1220_6.13rc_KASAN/2.%E5%9B%9E%E5%BD%92-11/14-KASAN_%20slab-out-of-bounds%20Read%20in%20hfsplus_bnode_read/14call_trace.txt
Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0305_6.15rc1/config.txt
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/37repro.c
Syzlang reproducer: https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/37repro.txt


76th：
HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/76call_trace.txt
Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0305_6.15rc1/config.txt
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/76repro.c
Syzlang reproducer: https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/76repro.txt






The two errors seem to have the same error points, but there are a few differences in the process. They all trigger warnings in the __folio_mark_dirty+0xb50/0xf10 function of backing-dev.h:251. In __folio_mark_dirty function, a warning is triggered when the code tries to access or modify the backing-dev information. The 76th call stack has longer call chains from file writebacks: writeback work queues → writeback inodes → GFS2 write inodes → log refreshes.
We have reproduced this issue several times on 6.15-rc1 again.








If you fix this issue, please add the following tag to the commit:
Reported-by: Kun Hu <huk23@m.fudan.edu.cn&gt;, Jiaji Qin <jjtan24@m.fudan.edu.cn&gt;, Shuoran Bai <baishuoran@hrbeu.edu.cn&gt;






37th：
==================================================================
WARNING: CPU: 2 PID: 9494 at ./include/linux/backing-dev.h:251 __folio_mark_dirty+0xb50/0xf10
Modules linked in:
CPU: 2 UID: 0 PID: 9494 Comm: gfs2_logd/syz:s Not tainted 6.15.0-rc1 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:__folio_mark_dirty+0xb50/0xf10
Code: ff ff 48 8d 78 70 e8 af e3 76 09 31 ff 89 c6 89 44 24 08 e8 72 d3 c5 ff 8b 44 24 08 85 c0 0f 85 af f9 ff ff e8 51 d1 c5 ff 90 <0f&gt; 0b 90 e9 a1 f9 ff ff e8 43 d1 c5 ff 90 0f 0b 90 e9 59 f5 ff ff
RSP: 0018:ffffc90014bb7b18 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88804298cb58 RCX: ffffffff81f5408e
RDX: 0000000000000000 RSI: ffff888023edc900 RDI: 0000000000000002
RBP: ffffea00015c9d80 R08: 0000000000000000 R09: ffffed10085319a0
R10: ffffed100853199f R11: ffff88804298ccff R12: 0000000000000246
R13: ffff888049bd8bc8 R14: 0000000000000001 R15: 0000000000000001
FS: &nbsp;0000000000000000(0000) GS:ffff888097c6b000(0000) knlGS:0000000000000000
CS: &nbsp;0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff2c7be9028 CR3: 000000000e180000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
&nbsp;<TASK&gt;
&nbsp;mark_buffer_dirty+0x358/0x410
&nbsp;gfs2_unpin+0x106/0xef0
&nbsp;buf_lo_after_commit+0x155/0x230
&nbsp;gfs2_log_flush+0xd95/0x2cb0
&nbsp;gfs2_logd+0x29b/0x12c0
&nbsp;kthread+0x447/0x8a0
&nbsp;ret_from_fork+0x48/0x80
&nbsp;ret_from_fork_asm+0x1a/0x30
&nbsp;</TASK&gt;
extracting prog: 1h56m11.644263162s
minimizing prog: 14m12.695891417s
simplifying prog options: 0s
extracting C: 32.234365976s
simplifying C: 9m50.565845853s










76th：
==================================================================
WARNING: CPU: 3 PID: 3051 at ./include/linux/backing-dev.h:251 __folio_mark_dirty+0xb50/0xf10
Modules linked in:
CPU: 3 UID: 0 PID: 3051 Comm: kworker/u18:5 Not tainted 6.15.0-rc1 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:__folio_mark_dirty+0xb50/0xf10
Code: ff ff 48 8d 78 70 e8 af e3 76 09 31 ff 89 c6 89 44 24 08 e8 72 d3 c5 ff 8b 44 24 08 85 c0 0f 85 af f9 ff ff e8 51 d1 c5 ff 90 <0f&gt; 0b 90 e9 a1 f9 ff ff e8 43 d1 c5 ff 90 0f 0b 90 e9 59 f5 ff ff
RSP: 0018:ffffc90011e2f410 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88804266bfd8 RCX: ffffffff81f5408e
RDX: 0000000000000000 RSI: ffff888043e48000 RDI: 0000000000000002
RBP: ffffea000086e9c0 R08: 0000000000000000 R09: ffffed10084cd830
R10: ffffed10084cd82f R11: ffff88804266c17f R12: 0000000000000246
R13: ffff888012bf87f0 R14: 0000000000000001 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880eb46b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6410e8e140 CR3: 0000000023648000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK&gt;
mark_buffer_dirty+0x358/0x410
gfs2_unpin+0x106/0xef0
buf_lo_after_commit+0x155/0x230
gfs2_log_flush+0xd95/0x2cb0
gfs2_write_inode+0x371/0x450
__writeback_single_inode+0xad7/0xf50
writeback_sb_inodes+0x5f5/0xee0
__writeback_inodes_wb+0xbe/0x270
wb_writeback+0x728/0xb50
wb_workfn+0x96e/0xe90
process_scheduled_works+0x5de/0x1bd0
worker_thread+0x5a9/0xd10
kthread+0x447/0x8a0
ret_from_fork+0x48/0x80
ret_from_fork_asm+0x1a/0x30
</TASK&gt;






thanks,
Kun Hu

[-- Attachment #2: Type: text/html, Size: 7439 bytes --]

^ permalink raw reply	[flat|nested] 7+ messages in thread
* WARNING in __folio_mark_dirty
@ 2025-05-02  3:26 huk23
  2025-05-02  3:29 ` Andrew Morton
  0 siblings, 1 reply; 7+ messages in thread
From: huk23 @ 2025-05-02  3:26 UTC (permalink / raw)
  To: Andrew Morton
  Cc: jjtan24, 白烁冉,
	linux-kernel, syzkaller, linux-fsdevel, linux-mm

Dear Maintainers，


When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (37th and 76th)was triggered.


37th：
HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https://github.com/pghk13/Kernel-Bug/blob/main/1220_6.13rc_KASAN/2.%E5%9B%9E%E5%BD%92-11/14-KASAN_%20slab-out-of-bounds%20Read%20in%20hfsplus_bnode_read/14call_trace.txt
Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0305_6.15rc1/config.txt
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/37repro.c
Syzlang reproducer: https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/37repro.txt

76th：
HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/76call_trace.txt
Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0305_6.15rc1/config.txt
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/76repro.c
Syzlang reproducer: https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/76-UBSAN_%20shift-out-of-bounds%20in%20bch2_trans_iter_init_outlined/76repro.txt



The two errors seem to have the same error points, but there are a few differences in the process. They all trigger warnings in the __folio_mark_dirty+0xb50/0xf10 function of backing-dev.h:251. In __folio_mark_dirty function, a warning is triggered when the code tries to access or modify the backing-dev information. The 76th call stack has longer call chains from file writebacks: writeback work queues → writeback inodes → GFS2 write inodes → log refreshes.
We have reproduced this issue several times on 6.15-rc1 again.




If you fix this issue, please add the following tag to the commit:
Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn>, Shuoran Bai <baishuoran@hrbeu.edu.cn>



37th：
==================================================================
WARNING: CPU: 2 PID: 9494 at ./include/linux/backing-dev.h:251 __folio_mark_dirty+0xb50/0xf10
Modules linked in:
CPU: 2 UID: 0 PID: 9494 Comm: gfs2_logd/syz:s Not tainted 6.15.0-rc1 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:__folio_mark_dirty+0xb50/0xf10
Code: ff ff 48 8d 78 70 e8 af e3 76 09 31 ff 89 c6 89 44 24 08 e8 72 d3 c5 ff 8b 44 24 08 85 c0 0f 85 af f9 ff ff e8 51 d1 c5 ff 90 <0f> 0b 90 e9 a1 f9 ff ff e8 43 d1 c5 ff 90 0f 0b 90 e9 59 f5 ff ff
RSP: 0018:ffffc90014bb7b18 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88804298cb58 RCX: ffffffff81f5408e
RDX: 0000000000000000 RSI: ffff888023edc900 RDI: 0000000000000002
RBP: ffffea00015c9d80 R08: 0000000000000000 R09: ffffed10085319a0
R10: ffffed100853199f R11: ffff88804298ccff R12: 0000000000000246
R13: ffff888049bd8bc8 R14: 0000000000000001 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888097c6b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff2c7be9028 CR3: 000000000e180000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
 <TASK>
 mark_buffer_dirty+0x358/0x410
 gfs2_unpin+0x106/0xef0
 buf_lo_after_commit+0x155/0x230
 gfs2_log_flush+0xd95/0x2cb0
 gfs2_logd+0x29b/0x12c0
 kthread+0x447/0x8a0
 ret_from_fork+0x48/0x80
 ret_from_fork_asm+0x1a/0x30
 </TASK>
extracting prog: 1h56m11.644263162s
minimizing prog: 14m12.695891417s
simplifying prog options: 0s
extracting C: 32.234365976s
simplifying C: 9m50.565845853s





76th：
==================================================================
WARNING: CPU: 3 PID: 3051 at ./include/linux/backing-dev.h:251 __folio_mark_dirty+0xb50/0xf10
Modules linked in:
CPU: 3 UID: 0 PID: 3051 Comm: kworker/u18:5 Not tainted 6.15.0-rc1 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:__folio_mark_dirty+0xb50/0xf10
Code: ff ff 48 8d 78 70 e8 af e3 76 09 31 ff 89 c6 89 44 24 08 e8 72 d3 c5 ff 8b 44 24 08 85 c0 0f 85 af f9 ff ff e8 51 d1 c5 ff 90 <0f> 0b 90 e9 a1 f9 ff ff e8 43 d1 c5 ff 90 0f 0b 90 e9 59 f5 ff ff
RSP: 0018:ffffc90011e2f410 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88804266bfd8 RCX: ffffffff81f5408e
RDX: 0000000000000000 RSI: ffff888043e48000 RDI: 0000000000000002
RBP: ffffea000086e9c0 R08: 0000000000000000 R09: ffffed10084cd830
R10: ffffed10084cd82f R11: ffff88804266c17f R12: 0000000000000246
R13: ffff888012bf87f0 R14: 0000000000000001 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880eb46b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6410e8e140 CR3: 0000000023648000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
mark_buffer_dirty+0x358/0x410
gfs2_unpin+0x106/0xef0
buf_lo_after_commit+0x155/0x230
gfs2_log_flush+0xd95/0x2cb0
gfs2_write_inode+0x371/0x450
__writeback_single_inode+0xad7/0xf50
writeback_sb_inodes+0x5f5/0xee0
__writeback_inodes_wb+0xbe/0x270
wb_writeback+0x728/0xb50
wb_workfn+0x96e/0xe90
process_scheduled_works+0x5de/0x1bd0
worker_thread+0x5a9/0xd10
kthread+0x447/0x8a0
ret_from_fork+0x48/0x80
ret_from_fork_asm+0x1a/0x30
</TASK>



thanks,
Kun Hu


^ permalink raw reply	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-05-02  9:52 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-10  1:20 WARNING in __folio_mark_dirty Hao Sun
2021-11-10  1:57 ` Matthew Wilcox
2021-11-10 14:07   ` Ryusuke Konishi
2025-04-30  8:39 胡焜
2025-05-02  3:26 huk23
2025-05-02  3:29 ` Andrew Morton
2025-05-02  9:52   ` Andreas Gruenbacher

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox