WARNING in get_next_unlocked_entry
Subsystems (3)
syzbot
syzbotHello,
syzbot found the following issue on:
HEAD commit: e927c520e1ba Merge tag 'loongarch-fixes-6.18-1' of git://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=129957cd980000 kernel config: https://syzkaller.appspot.com/x/.config?x=929790bc044e87d7 dashboard link: https://syzkaller.appspot.com/bug?extid=31b8fb02cb8a25bd5e78 compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16994692580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16d58d32580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-e927c520.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/924fb782edf1/vmlinux-e927c520.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7e6af189c28e/bzImage-e927c520.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6a0aec9d15b8/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1740497c580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
loop0: detected capacity change from 0 to 16 erofs (device loop0): mounted with root inode @ nid 36.
------------[ cut here ]------------ WARNING: CPU: 0 PID: 5492 at fs/dax.c:224 get_next_unlocked_entry+0x329/0x340 fs/dax.c:224 Modules linked in: CPU: 0 UID: 0 PID: 5492 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:get_next_unlocked_entry+0x329/0x340 fs/dax.c:224 Code: 45 1d 10 48 3b 84 24 c0 00 00 00 75 22 4c 89 e8 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 3e 8a f9 08 cc e8 08 59 6e ff 90 <0f> 0b 90 eb a0 e8 6d a6 f6 08 66 66 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ffffc90002b7e8a0 EFLAGS: 00010093 RAX: ffffffff8251ba68 RBX: 1ffff9200056fd9c RCX: ffff8880354e4900 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90002b7e9b0 R08: ffffc90002b7e937 R09: 0000000000000000 R10: ffffc90002b7e900 R11: fffff5200056fd27 R12: ffffc90002b7e918 R13: ffffea00010af380 R14: ffffc90002b7e900 R15: dffffc0000000000 FS: 0000555581eb2500(0000) GS:ffff88808d730000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000557f23763138 CR3: 00000000424dd000 CR4: 0000000000352ef0 Call Trace: <TASK> grab_mapping_entry+0x176/0x660 fs/dax.c:660 dax_iomap_pte_fault fs/dax.c:1891 [inline] dax_iomap_fault+0x8ab/0x18d0 fs/dax.c:2080 __do_fault+0x138/0x390 mm/memory.c:5281 do_cow_fault mm/memory.c:5746 [inline] do_fault mm/memory.c:5852 [inline] do_pte_missing mm/memory.c:4362 [inline] handle_pte_fault mm/memory.c:6195 [inline] __handle_mm_fault+0x1719/0x5400 mm/memory.c:6336 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6505 faultin_page mm/gup.c:1126 [inline] __get_user_pages+0x165c/0x2a00 mm/gup.c:1428 __get_user_pages_locked mm/gup.c:1692 [inline] get_user_pages_remote+0x2f1/0xac0 mm/gup.c:2614 uprobe_write+0x1b6/0x2160 kernel/events/uprobes.c:529 uprobe_write_opcode+0xa8/0xf0 kernel/events/uprobes.c:493 set_swbp+0x121/0x290 arch/x86/kernel/uprobes.c:1090 install_breakpoint+0x451/0x5a0 kernel/events/uprobes.c:1170 register_for_each_vma+0xabb/0xc30 kernel/events/uprobes.c:1315 uprobe_apply+0xfb/0x270 kernel/events/uprobes.c:1459 uprobe_perf_open kernel/trace/trace_uprobe.c:1371 [inline] trace_uprobe_register+0x4df/0x560 kernel/trace/trace_uprobe.c:1533 perf_trace_event_open kernel/trace/trace_event_perf.c:184 [inline] perf_trace_event_init+0x19a/0x9d0 kernel/trace/trace_event_perf.c:206 perf_uprobe_init+0x12e/0x1a0 kernel/trace/trace_event_perf.c:332 perf_uprobe_event_init+0xe6/0x180 kernel/events/core.c:11170 perf_try_init_event+0x17f/0x870 kernel/events/core.c:12615 perf_init_event kernel/events/core.c:12713 [inline] perf_event_alloc+0x133e/0x2be0 kernel/events/core.c:12988 __do_sys_perf_event_open kernel/events/core.c:13506 [inline] __se_sys_perf_event_open+0x772/0x1d70 kernel/events/core.c:13387 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe38998f6c9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe19690378 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007fe389be5fa0 RCX: 00007fe38998f6c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0 RBP: 00007fe389a11f91 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe389be5fa0 R14: 00007fe389be5fa0 R15: 0000000000000005 </TASK>
---
This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
PATCH 1/1 erofs: correct FSDAX detection
The detection of the primary device is skipped incorrectly if the multiple or flattened feature is enabled.
It also fixes the FSDAX misdetection for non-block extra blobs.
--- fs/erofs/super.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
fs/erofs/super.c +11 -11
@@ -174,15 +174,15 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,if (!erofs_is_fileio_mode (sbi)) { dif->dax_dev =fs_dax_get_by_bdev (file_bdev (file), &dif->dax_part_off,NULL ,NULL ); -if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { -erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , - dif->path); -clear_opt (&sbi->opt,DAX_ALWAYS ); - } }else if (!S_ISREG (file_inode (file)->i_mode)) {fput (file);return -EINVAL ; } +if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { +erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , + dif->path); +clear_opt (&sbi->opt,DAX_ALWAYS ); + } dif->file = file; }
@@ -215,13 +215,13 @@ static int erofs_scan_devices(struct super_block *sb, ondisk_extradevs, sbi->devs->extra_devices);return -EINVAL ; } -if (!ondisk_extradevs) { -if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { -erofs_info (sb,"DAX unsupported by block device. Turning off DAX." ); -clear_opt (&sbi->opt,DAX_ALWAYS ); - } -return 0 ; + +if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { +erofs_info (sb,"DAX unsupported by block device. Turning off DAX." ); +clear_opt (&sbi->opt,DAX_ALWAYS ); } +if (!ondisk_extradevs) +return 0 ;if (!sbi->devs->extra_devices && !erofs_is_fscache_mode (sb)) sbi->devs->flatdev = true;
Signature · 1 line
2.43.5
Re: [PATCH] erofs: correct FSDAX detection
Quoted 46 lines · On November 17, 2025 19:57 Gao Xiang wrote:
The detection of the primary device is skipped incorrectly if the multiple or flattened feature is enabled.
It also fixes the FSDAX misdetection for non-block extra blobs.
Fixes c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device")Reported-by [email protected]Cc Yuezhang Mo <[email protected]>Signed-off-by Gao Xiang <[email protected]>--- fs/erofs/super.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)fs/erofs/super.c +5
-8@@ -174,15 +174,15 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,if (!erofs_is_fileio_mode (sbi)) { dif->dax_dev =fs_dax_get_by_bdev (file_bdev (file), &dif->dax_part_off,NULL ,NULL ); -if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { -erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , - dif->path); -clear_opt (&sbi->opt,DAX_ALWAYS ); - } }else if (!S_ISREG (file_inode (file)->i_mode)) {fput (file);return -EINVAL ; } +if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { +erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , + dif->path); +clear_opt (&sbi->opt,DAX_ALWAYS ); + } dif->file = file; }@@ -215,13 +215,13 @@ static int erofs_scan_devices(struct super_block *sb, ondisk_extradevs, sbi->devs->extra_devices);return -EINVAL ; } -if (!ondisk_extradevs) { -if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { -erofs_info (sb,"DAX unsupported by block device. Turning off DAX." );
fs/erofs/super.c static int erofs_scan_devices(struct super_block *sb, · line 224
Quoted 10 lines
fs/erofs/super.c +6
-3-clear_opt (&sbi->opt,DAX_ALWAYS ); - } -return 0 ; + +if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { +erofs_info (sb,"DAX unsupported by block device. Turning off DAX." ); +clear_opt (&sbi->opt,DAX_ALWAYS ); } +if (!ondisk_extradevs) +return 0 ;
Hi Gao Xiang,
If using multiple devices, is there still file data on the primary device? If the primary device only contains metadata, the primary device does not need to support DAX.
Quoted 5 lines
fs/erofs/super.c +0
-1if (!sbi->devs->extra_devices && !erofs_is_fscache_mode (sb)) sbi->devs->flatdev = true; --2.43.5
Re: [PATCH] erofs: correct FSDAX detection
Quoted 60 lines · On 2025/11/21 12:12, [email protected] wrote:
Quoted 46 lines · On November 17, 2025 19:57 Gao Xiang wrote:
The detection of the primary device is skipped incorrectly if the multiple or flattened feature is enabled.
It also fixes the FSDAX misdetection for non-block extra blobs.
Fixes c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device")Reported-by [email protected]Cc Yuezhang Mo <[email protected]>Signed-off-by Gao Xiang <[email protected]>--- fs/erofs/super.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)fs/erofs/super.c +5
-8@@ -174,15 +174,15 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,if (!erofs_is_fileio_mode (sbi)) { dif->dax_dev =fs_dax_get_by_bdev (file_bdev (file), &dif->dax_part_off,NULL ,NULL ); -if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { -erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , - dif->path); -clear_opt (&sbi->opt,DAX_ALWAYS ); - } }else if (!S_ISREG (file_inode (file)->i_mode)) {fput (file);return -EINVAL ; } +if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { +erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , + dif->path); +clear_opt (&sbi->opt,DAX_ALWAYS ); + } dif->file = file; }@@ -215,13 +215,13 @@ static int erofs_scan_devices(struct super_block *sb, ondisk_extradevs, sbi->devs->extra_devices);return -EINVAL ; } -if (!ondisk_extradevs) { -if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { -erofs_info (sb,"DAX unsupported by block device. Turning off DAX." );fs/erofs/super.c static int erofs_scan_devices(struct super_block *sb, · line 224
Quoted 10 lines
fs/erofs/super.c +6
-3-clear_opt (&sbi->opt,DAX_ALWAYS ); - } -return 0 ; + +if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { +erofs_info (sb,"DAX unsupported by block device. Turning off DAX." ); +clear_opt (&sbi->opt,DAX_ALWAYS ); } +if (!ondisk_extradevs) +return 0 ;Hi Gao Xiang,
Quoted 3 lines
If using multiple devices, is there still file data on the primary device? If the primary device only contains metadata, the primary device does not need to support DAX.
Hi Yuezhang,
Currently we don't have a per-device/file fsdax selection design/implementation.
If fsdax is on, for example, directory data arranged in the primary device will go through fsdax path (but your case above is that the primary device does not need to support fsdax.)
Anyway, in principle, we could make them work, but per-device FSDAX needs a detailed design, I think we should restrict them on the per-filesystem basis now.
Thanks,
Gao Xiang
Quoted 6 lines
Quoted 6 lines
fs/erofs/super.c +0
-1if (!sbi->devs->extra_devices && !erofs_is_fscache_mode (sb)) sbi->devs->flatdev = true; --2.43.5
Re: [PATCH] erofs: correct FSDAX detection
In reply to Gao XiangQuoted 10 lines · Gao Xiang
The detection of the primary device is skipped incorrectly if the multiple or flattened feature is enabled.
It also fixes the FSDAX misdetection for non-block extra blobs.
Fixes c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device")Reported-by [email protected]Cc Yuezhang Mo <[email protected]>Signed-off-by Gao Xiang <[email protected]>
Thanks,
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git dev-test
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Tested on:
commit: 3027b141 erofs: correct FSDAX detection git tree: git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git dev-test console output: https://syzkaller.appspot.com/x/log.txt?x=16e2597c580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f dashboard link: https://syzkaller.appspot.com/bug?extid=31b8fb02cb8a25bd5e78 compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.