mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Randy Dunlap <rdunlap@infradead.org>
To: Dmitry Vyukov <dvyukov@google.com>, Al Viro <viro@ZenIV.linux.org.uk>
Cc: syzbot <syzbot+3fd34060f26e766536ff@syzkaller.appspotmail.com>,
	LKML <linux-kernel@vger.kernel.org>,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
	syzkaller <syzkaller@googlegroups.com>
Subject: Re: WARNING: filesystem loop5 was created with 512 inodes, the real maximum is 511, mounting anyway
Date: Wed, 2 Dec 2020 20:15:47 -0800	[thread overview]
Message-ID: <0bc4dbbe-1adb-de9d-641f-bdc2a02efc8b@infradead.org> (raw)
In-Reply-To: <dc76e615-a2fc-64e1-c979-4699d0d57309@infradead.org>

On 12/1/20 1:17 PM, Randy Dunlap wrote:
> On 11/30/20 11:47 PM, Dmitry Vyukov wrote:
>> On Tue, Dec 1, 2020 at 2:03 AM Randy Dunlap <rdunlap@infradead.org> wrote:
>>>
>>> On 11/30/20 12:43 AM, Dmitry Vyukov wrote:
>>>> On Mon, Nov 30, 2020 at 5:29 AM Randy Dunlap <rdunlap@infradead.org> wrote:
>>>>>
>>>>> On 11/27/20 4:32 AM, syzbot wrote:
>>>>>> Hello,
>>>>>>
>>>>>> syzbot found the following issue on:
>>>>>>
>>>>>> HEAD commit:    418baf2c Linux 5.10-rc5
>>>>>> git tree:       upstream
>>>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=171555b9500000
>>>>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=b81aff78c272da44
>>>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=3fd34060f26e766536ff
>>>>>> compiler:       gcc (GCC) 10.1.0-syz 20200507
>>>>>>
>>>>>> Unfortunately, I don't have any reproducer for this issue yet.
>>>>>>
>>>>>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>>>>>> Reported-by: syzbot+3fd34060f26e766536ff@syzkaller.appspotmail.com
>>>>>>
>>>>>> BFS-fs: bfs_fill_super(): loop5 is unclean, continuing
>>>>>> BFS-fs: bfs_fill_super(): WARNING: filesystem loop5 was created with 512 inodes, the real maximum is 511, mounting anyway
>>>>>> BFS-fs: bfs_fill_super(): Last block not available on loop5: 120
>>>>>> BFS-fs: bfs_fill_super(): loop5 is unclean, continuing
>>>>>> BFS-fs: bfs_fill_super(): WARNING: filesystem loop5 was created with 512 inodes, the real maximum is 511, mounting anyway
>>>>>> BFS-fs: bfs_fill_super(): Last block not available on loop5: 120
>>>>>>
>>>>>>
>>>>>> ---
>>>>>> This report is generated by a bot. It may contain errors.
>>>>>> See https://goo.gl/tpsmEJ for more information about syzbot.
>>>>>> syzbot engineers can be reached at syzkaller@googlegroups.com.
>>>>>>
>>>>>> syzbot will keep track of this issue. See:
>>>>>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

...

>>>> Hi Randy,
>>>>
>>>> I see this bug was reported with a reproducer:
>>>> https://syzkaller.appspot.com/bug?id=a32ebd5db2f7c957b82cf54b97bdecf367bf0421
>>>> I assume it's a dup of this one.
>>>
>>> Sure, looks the same.
>>>
>>>> If you need the image itself, you can dump it to a file in the C
>>>> reproducer inside of syz_mount_image before mount call.
>>>
>>> Yes, got that.
>>>
>>> What outcome or result are you looking for here?
>>> Or what do you see as the problem?
>>
>> Hi Randy,
>>
>> "WARNING:" in kernel output is supposed to mean a kernel source bug.
>> Presence of that kernel bug is what syzbot has reported.
>>
>> Note: the bug may be a misuse of the "WARNING:" for invalid user
>> inputs in output as well :)
> 
> 
> [adding Al Viro]
> 
> Hi Dmitry,
> 
> I expect that the "WARNING:" message is being interpreted incorrectly here,
> but that's a minor issue IMO.
> 
> 	if (info->si_lasti == BFS_MAX_LASTI)
> 		printf("WARNING: filesystem %s was created with 512 inodes, the real maximum is 511, mounting anyway\n", s->s_id);
> 

...

> 
> 
> However, in testing this, I see that the BFS image is not mounted
> on /dev/loop# at all.
> 
> 'mount' says:
> 
> # mount -t bfs -o loop bfsfilesyz000.img  /mnt/stand
> mount: /mnt/stand: mount(2) system call failed: Not a directory.
> 
> (but it is a directory)
> 
> and I have tracked that down to fs/namespace.c::graft_tree()
> returning -ENOTDIR, but I don't know why that is happening.
> 
> 
> Al, can you provide any insights on this?

OK, with Al's help, here is the situation.

If I use a regular file instead of a directory, the mount
command succeeds.

The printk() from fs/bfs/inode.c that uses the WARNING: string
is not a WARN() or WARN_ON(). It's just a printk().

<linux/asm-generic/bug.h> says:

 * Do not include "BUG"/"WARNING" in format strings manually to make these
 * conditions distinguishable from kernel issues.

so if I change fs/bfs/inode.c to use "warning:" or "Warning," or "Note:",
this little problem should go away.  Is that correct?


thanks.
-- 
~Randy


  parent reply	other threads:[~2020-12-03  4:16 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-11-27 12:32 syzbot
2020-11-30  4:29 ` Randy Dunlap
2020-11-30  8:43   ` Dmitry Vyukov
2020-12-01  1:03     ` Randy Dunlap
2020-12-01  7:47       ` Dmitry Vyukov
2020-12-01 21:17         ` Randy Dunlap
2020-12-02  7:59           ` Dmitry Vyukov
2020-12-03  4:15           ` Randy Dunlap [this message]
2020-12-03 12:55             ` Dmitry Vyukov
2020-12-03 12:56               ` Dmitry Vyukov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0bc4dbbe-1adb-de9d-641f-bdc2a02efc8b@infradead.org \
    --to=rdunlap@infradead.org \
    --cc=dvyukov@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+3fd34060f26e766536ff@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=syzkaller@googlegroups.com \
    --cc=viro@ZenIV.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®