3143febf7925bd1ea398bd1a775551133bd69ffd
Summary
Version: v4.7-7962-g07f00f0
kernel BUG at fs/jbd2/commit.c:825!
Boot/crash log
Linux version 4.7.0 (vegard@lenuta) (gcc version 5.3.0 20151204 (Ubuntu 5.3.0-3ubuntu1~14.04) ) #1 Mon Aug 1 09:26:41 CEST 2016
Command line: ignore_loglevel oops=panic panic=-1 panic_on_warn=1 rootfstype=9p root=/dev/root rootflags=trans=virtio,version=9p2000.L rw console=ttyS0 init=/home/vegard/fuzzbot/tmp/ext4/init
x86/fpu: Legacy x87 FPU detected.
x86/fpu: Using 'eager' FPU context switches.
e820: BIOS-provided physical RAM map:
BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
BIOS-e820: [mem 0x0000000000100000-0x0000000007ffdfff] usable
BIOS-e820: [mem 0x0000000007ffe000-0x0000000007ffffff] reserved
BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
debug: ignoring loglevel setting.
NX (Execute Disable) protection: active
Hypervisor detected: KVM
e820: update [mem 0x00000000-0x00000fff] usable ==> reserved
e820: remove [mem 0x000a0000-0x000fffff] usable
e820: last_pfn = 0x7ffe max_arch_pfn = 0x400000000
found SMP MP-table at [mem 0x000f0b10-0x000f0b1f] mapped at [ffff8800000f0b10]
Base memory trampoline at [ffff880000099000] 99000 size 24576
BRK [0x0266b000, 0x0266bfff] PGTABLE
BRK [0x0266c000, 0x0266cfff] PGTABLE
BRK [0x0266d000, 0x0266dfff] PGTABLE
BRK [0x0266e000, 0x0266efff] PGTABLE
kvm-clock: Using msrs 4b564d01 and 4b564d00
kvm-clock: cpu 0, msr 0:7ffd001, primary cpu clock
kvm-clock: using sched offset of 5811 cycles
clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
Zone ranges:
DMA32 [mem 0x0000000000001000-0x0000000007ffdfff]
Normal empty
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x0000000000001000-0x000000000009efff]
node 0: [mem 0x0000000000100000-0x0000000007ffdfff]
Initmem setup node 0 [mem 0x0000000000001000-0x0000000007ffdfff]
On node 0 totalpages: 32668
DMA32 zone: 448 pages used for memmap
DMA32 zone: 21 pages reserved
DMA32 zone: 32668 pages, LIFO batch:7
kasan: KernelAddressSanitizer initialized
Intel MultiProcessor Specification v1.4
MPTABLE: OEM ID: BOCHSCPU
MPTABLE: Product ID: 0.1
MPTABLE: APIC at: 0xFEE00000
Processor #0 (Bootup-CPU)
IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
Processors: 1
KVM setup async PF for cpu 0
kvm-stealtime: cpu 0, msr 1c50f00
e820: [mem 0x08000000-0xfeffbfff] available for PCI devices
Booting paravirtualized kernel on KVM
clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32199
Kernel command line: ignore_loglevel oops=panic panic=-1 panic_on_warn=1 rootfstype=9p root=/dev/root rootflags=trans=virtio,version=9p2000.L rw console=ttyS0 init=/home/vegard/fuzzbot/tmp/ext4/init
PID hash table entries: 512 (order: 0, 4096 bytes)
Dentry cache hash table entries: 16384 (order: 5, 131072 bytes)
Inode-cache hash table entries: 8192 (order: 4, 65536 bytes)
Memory: 84800K/130672K available (8486K kernel code, 1244K rwdata, 1456K rodata, 700K init, 8716K bss, 45872K reserved, 0K cma-reserved)
NR_IRQS:4352 nr_irqs:48 16
console [ttyS0] enabled
tsc: Fast TSC calibration using PIT
tsc: Detected 2593.927 MHz processor
Calibrating delay loop (skipped) preset value.. 5188.21 BogoMIPS (lpj=10376424)
pid_max: default: 4096 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes)
Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
CPU: Intel QEMU Virtual CPU version 2.0.0 (family: 0x6, model: 0x6, stepping: 0x3)
Performance Events: Broken PMU hardware detected, using software events only.
Failed to access perfctr msr (MSR c2 is 0)
..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
devtmpfs: initialized
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
NET: Registered protocol family 16
PCI: Using configuration type 1 for base access
PCI: Probing PCI hardware
PCI: root bus 00: using default resources
PCI: Probing PCI hardware (bus 00)
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [io 0x0000-0xffff]
pci_bus 0000:00: root bus resource [mem 0x00000000-0xffffffffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: [8086:1237] type 00 class 0x060000
pci 0000:00:01.0: [8086:7000] type 00 class 0x060100
pci 0000:00:01.1: [8086:7010] type 00 class 0x010180
pci 0000:00:01.1: reg 0x20: [io 0xc080-0xc08f]
pci 0000:00:01.1: legacy IDE quirk: reg 0x10: [io 0x01f0-0x01f7]
pci 0000:00:01.1: legacy IDE quirk: reg 0x14: [io 0x03f6]
pci 0000:00:01.1: legacy IDE quirk: reg 0x18: [io 0x0170-0x0177]
pci 0000:00:01.1: legacy IDE quirk: reg 0x1c: [io 0x0376]
pci 0000:00:01.3: [8086:7113] type 00 class 0x068000
pci 0000:00:02.0: [1013:00b8] type 00 class 0x030000
pci 0000:00:02.0: reg 0x10: [mem 0xfc000000-0xfdffffff pref]
pci 0000:00:02.0: reg 0x14: [mem 0xfebf0000-0xfebf0fff]
pci 0000:00:02.0: reg 0x30: [mem 0xfebe0000-0xfebeffff pref]
pci 0000:00:03.0: [8086:100e] type 00 class 0x020000
pci 0000:00:03.0: reg 0x10: [mem 0xfebc0000-0xfebdffff]
pci 0000:00:03.0: reg 0x14: [io 0xc000-0xc03f]
pci 0000:00:03.0: reg 0x30: [mem 0xfeb80000-0xfebbffff pref]
pci 0000:00:04.0: [1af4:1009] type 00 class 0x000200
pci 0000:00:04.0: reg 0x10: [io 0xc040-0xc07f]
pci 0000:00:04.0: reg 0x14: [mem 0xfebf1000-0xfebf1fff]
pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
pci 0000:00:01.0: PIIX/ICH IRQ router [8086:7000]
PCI: pci_cache_line_size set to 64 bytes
e820: reserve RAM buffer [mem 0x0009fc00-0x0009ffff]
e820: reserve RAM buffer [mem 0x07ffe000-0x07ffffff]
clocksource: Switched to clocksource kvm-clock
pci_bus 0000:00: resource 4 [io 0x0000-0xffff]
pci_bus 0000:00: resource 5 [mem 0x00000000-0xffffffffff]
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 128 (order: 1, 12288 bytes)
UDP-Lite hash table entries: 128 (order: 1, 12288 bytes)
platform rtc_cmos: registered platform RTC device (no PNP device found)
workingset: timestamp_bits=62 max_order=15 bucket_order=0
9p: Installing v9fs 9p2000 file system support
io scheduler noop registered (default)
virtio-pci 0000:00:04.0: PCI->APIC IRQ transform: INT A -> IRQ 11
virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
loop: module loaded
9pnet: Installing 9P2000 support
Key type encrypted registered
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
VFS: Mounted root (9p filesystem) on device 0:10.
devtmpfs: mounted
Freeing unused kernel memory: 700K (ffffffff81d39000 - ffffffff81de8000)
Write protecting the kernel read-only data: 12288k
Freeing unused kernel memory: 1748K (ffff88000184b000 - ffff880001a00000)
Freeing unused kernel memory: 592K (ffff880001b6c000 - ffff880001c00000)
random: fast init done
+ mount -t proc none /proc
+ mount -t sysfs none /sys
+ mkdir -p /mnt
+ mount -t tmpfs none /mnt
+ mkdir -p /var/run/screen
+ mount -t tmpfs none /var/run/screen
+ mount -t tmpfs none /tmp
+ echo ulimit -c unlimited
ulimit -c unlimited
+ ulimit -c unlimited
+ export AFL_SKIP_BIN_CHECK=1
+ AFL_SKIP_BIN_CHECK=1
+ cd /tmp
+ cp /home/vegard/fuzzbot/fuzzers/ext4/input.crashes/3143febf7925bd1ea398bd1a775551133bd69ffd .cur_input
+ /home/vegard/fuzzbot/fuzzers/ext4/runs/2016-08-01_v4.7-7962-g07f00f0/ext4.exe .cur_input
EXT4-fs (loop0): 1 truncate cleaned up
EXT4-fs (loop0): recovery complete
EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: errors=remount-ro
JBD2: Spotted dirty metadata buffer (dev = loop0, blocknr = 8273). There's a risk of filesystem corruption in case of system crash.
==================================================================
BUG: KASAN: use-after-free in jbd2_journal_commit_transaction+0x441b/0x4ac0 at addr ffff8800040922a0
Read of size 8 by task jbd2/loop0-8/60
page:ffffea00000e1ff0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x0()
page dumped because: kasan: bad access detected
CPU: 0 PID: 60 Comm: jbd2/loop0-8 Not tainted 4.7.0 #1
ffff8800040922a0 ffff880005f8f840 ffffffff814a9e32 ffff880005f8f8c8
ffffffff811ec93b ffffffff8183e2e0 ffff880006084420 0000000000000246
ffff880006094d20 0000000000000002 0000000000000001 ffff880005f8f8c8
Call Trace:
[<ffffffff814a9e32>] dump_stack+0x19/0x27 [<ffffffff811ec93b>] kasan_report_error+0x5bb/0x5e0 [<ffffffff811eca9d>] __asan_report_load8_noabort+0x3d/0x40 [<ffffffff813c148b>] jbd2_journal_commit_transaction+0x441b/0x4ac0 [<ffffffff813ca791>] kjournald2+0x1f1/0x6c0 [<ffffffff810bce25>] kthread+0x205/0x2d0 [<ffffffff818479ff>] ret_from_fork+0x1f/0x40 Memory state around the buggy address:
ffff880004092180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff880004092200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff880004092280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff880004092300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff880004092380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Disabling lock debugging due to kernel taint
------------[ cut here ]------------
kernel BUG at fs/jbd2/commit.c:825! invalid opcode: 0000 [#1] KASAN
CPU: 0 PID: 60 Comm: jbd2/loop0-8 Tainted: G B 4.7.0 #1
task: ffff880005c30240 task.stack: ffff880005f88000
RIP: 0010:[<ffffffff813bfa39>] [<ffffffff813bfa39>] jbd2_journal_commit_transaction+0x29c9/0x4ac0 RSP: 0018:ffff880005f8f910 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8800060844d0
RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
RBP: ffff880005f8fd30 R08: ffffffff81e222c0 R09: 0000000000000000
R10: 0000000000000010 R11: fffffbfff03c4285 R12: ffff880006033b80
R13: ffff880006033bc8 R14: 0000000000000000 R15: ffff8800040922a0
FS: 0000000000000000(0000) GS:ffffffff81c3e000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4dfa2530f0 CR3: 0000000005ee3000 CR4: 00000000000006b0
Stack:
0000000000000000 0000000000000000 0000000000000000 ffff880005c30800
0000000000000000 ffff880005fa83d8 ffff880006033bd0 ffff880005f8fc60
00000000fffedb9f 000000002552ce3f ffff880005c30240 ffff880006033b80
Call Trace:
[<ffffffff813ca791>] kjournald2+0x1f1/0x6c0 [<ffffffff810bce25>] kthread+0x205/0x2d0 [<ffffffff818479ff>] ret_from_fork+0x1f/0x40 Code: e6 e8 fc cb ff ff 85 c0 89 84 24 38 01 00 00 0f 84 41 fa ff ff 48 8b bc 24 48 01 00 00 e8 d0 21 01 00 e9 2f fa ff ff 0f 0b 0f 0b <0f> 0b 0f 0b 0f 0b 48 8b 84 24 48 01 00 00 48 8d b8 c0 03 00 00
RIP [<ffffffff813bfa39>] jbd2_journal_commit_transaction+0x29c9/0x4ac0 RSP <ffff880005f8f910>
---[ end trace dccb8e5c591653dd ]---
Kernel panic - not syncing: Fatal exception
Kernel Offset: disabled
Additional information
dumpe2fs 1.42.9 (4-Feb-2014)
dumpe2fs: A block group is missing an inode table while reading journal inode
Filesystem volume name: <none>
Last mounted on: /home/vegard/kernel-fuzzing-v1.0-pre1/mnt
Filesystem UUID: c54d8f19-a95c-41b0-8e9a-2e612005ef76
Filesystem magic number: 0xEF53
Filesystem revision #: 1 (dynamic)
Filesystem features: has_journal ext_attr resize_inode dir_index filetype extent flex_bg sparse_super huge_file dir_nlink extra_isize
Filesystem flags: signed_directory_hash
Default mount options: user_xattr acl
Filesystem state: clean
Errors behavior: Continue
Filesystem OS type: Linux
Inode count: 4096
Block count: 16384
Reserved block count: 819
Free blocks: 14693
Free inodes: 4077
First block: 12
Block size: 1024
Fragment size: 1024
Reserved GDT blocks: 63
Blocks per group: 8192
Fragments per group: 8192
Inodes per group: 2048
Inode blocks per group: 256
RAID stripe width: 3
Flex block group size: 16
Filesystem created: Wed Jul 6 11:18:12 2016
Last mount time: Wed Jul 6 11:18:12 2016
Last write time: Wed Jul 6 11:18:12 2016
Mount count: 1
Maximum mount count: -1
Last checked: Wed Jul 6 11:18:12 2016
Check interval: 0 (<none>)
Lifetime writes: 1213 kB
Reserved blocks uid: 0 (user root)
Reserved blocks gid: 0 (group root)
First inode: 11
Inode size: 128
Journal inode: 8
First orphan inode: 16
Default directory hash: half_md4
Directory Hash Seed: ae54ab18-324d-4951-83dd-96920d12f6a6
Journal backup: inode blocks
000400 00 10 00 00 00 40 00 00 33 03 00 00 65 39 00 00 >.....@..3...e9..<
000410 ed 0f 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 >................<
000420 00 20 00 00 00 20 00 00 00 08 00 00 d4 cc 7c 57 >. ... ........|W<
000430 d4 cc 7c 57 01 00 ff ff 53 ef 01 00 01 00 00 00 >..|W....S.......<
000440 d4 cc 7c 57 00 00 00 00 00 00 00 00 01 00 00 00 >..|W............<
000450 00 00 00 00 0b 00 00 00 80 00 00 00 3c 00 00 00 >............<...<
000460 42 02 00 00 69 00 00 00 c5 4d 8f 19 a9 5c 41 b0 >B...i....M...\A.<
000470 8e 9a 2e 61 20 05 ef 76 00 00 00 00 00 00 00 00 >...a ..v........<
000480 00 00 00 00 00 00 00 00 2f 68 6f 6d 65 2f 76 65 >......../home/ve<
000490 67 61 72 64 2f 6b 65 72 6e 65 6c 2d 66 75 7a 7a >gard/kernel-fuzz<
0004a0 69 6e 67 2d 76 31 2e 30 2d 70 72 65 31 2f 6d 6e >ing-v1.0-pre1/mn<
0004b0 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >t...............<
0004c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 00 >..............?.<
0004d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0004e0 08 00 00 00 00 00 00 00 10 00 00 00 ae 54 ab 18 >.............T..<
0004f0 32 4d 49 51 83 dd 96 92 0d 12 f6 a6 01 01 00 00 >2MIQ............<
000500 0c 00 00 00 00 00 00 00 d4 cc 7c 57 0a f3 01 00 >..........|W....<
000510 04 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 >................<
000520 42 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >B ..............<
000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 >................<
000550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000560 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000570 03 00 00 00 04 00 00 00 bd 04 00 00 00 00 00 00 >................<
000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
*
000800
Other versions
v4.7-7962-g07f00f0: kernel BUG at fs/jbd2/commit.c:825!
v4.7-6816-g797cee9: kernel BUG at fs/jbd2/commit.c:825!
v4.7-rc1-21-g7bc9491: kernel BUG at fs/jbd2/commit.c:825!
v4.7-rc7-27-gf97d104: kernel BUG at fs/jbd2/commit.c:825!
v4.7-rc7: kernel BUG at fs/jbd2/commit.c:825!
v4.6: kernel BUG at fs/jbd2/commit.c:821!
v4.5: kernel BUG at fs/jbd2/commit.c:844!
v4.4: kernel BUG at fs/jbd2/commit.c:844!
v4.3: kernel BUG at fs/jbd2/commit.c:848!
v4.2: kernel BUG at fs/jbd2/commit.c:848!
v4.1: kernel BUG at fs/jbd2/commit.c:848!
v4.0: kernel BUG at fs/jbd2/commit.c:848!