mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: CJ <firefly0158@163.com>
To: aivazian.tigran@gmail.com
Cc: linux-kernel@vger.kernel.org
Subject: WARNING in mark_buffer_dirty on v7.2-rc3
Date: Tue, 10 Nov 2026 14:46:14 +0800 (CST)	[thread overview]
Message-ID: <1505d488.5126.1a1c4351165.Coremail.firefly0158@163.com> (raw)


Hi,


syzbot reported "WARNING in mark_buffer_dirty" on linux-5.15. The same
failure is still reproducible on v7.2-rc3 with the reproducer below.


Tested kernel:
  Linux v7.2-rc3
  HEAD a13c140cc289c0b7b3770bce5b3ad42ab35074aa


Observed failure:
WARNING: fs/buffer.c:1093 at mark_buffer_dirty+0x385/0x410, CPU#1: syz.0.19/10538
RIP: 0010:mark_buffer_dirty+0x385/0x410
Call Trace:
<TASK>
bfs_get_block+0x3e3/0xe90
__block_write_begin_int+0x4b4/0x18b0
block_write_begin+0xa6/0x1e0
bfs_write_begin+0x33/0xd0
generic_perform_write+0x3cc/0x8b0
__generic_file_write_iter+0x1f6/0x240
generic_file_write_iter+0xe1/0x380
vfs_write+0xbaf/0x1160
ksys_pwrite64+0x163/0x1a0
do_syscall_64+0xc4/0x7a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f32817ae49d
</TASK>


This is the assertion site reported by syzbot; I am not claiming a specific root cause.


This is a report of a still-reproducible failure, not a bisected root cause.


Reproducer:
  SYZ reproducer: 

syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000240)='./bus\x00', 0x8008, &(0x7f0000000100)=ANY=[@ANYRES64=0x0], 0xf, 0xab, &(0x7f0000010140)="$eJzs1zGKwkAYBeB/s7CbdptFsLBO4x08ilhqI1aK4A3Ei3gVj5DewiKtiCOYiIidRQT5vmLgzWPgtbM7brubIiKtIlLRme7T3Wy+GA8n9Rl8pCwifiMij4jeX50Pg7r7avqyWo7K6vv58c+69b0AAMDrsug/5nNqLk7NL/Aa/m993vI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHe7BAAA//+dfyiL")
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101142, 0xeaff)
write$uinput_user_dev(r1, &(0x7f0000000400)={'syz0\x00', {0x7, 0x5, 0x6, 0x8}, 0x1d, [0x2, 0xc95a, 0x6, 0x9, 0x7f, 0x401, 0x4, 0x7f, 0x0, 0xfffffff9, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d3b, 0x1dd2, 0x5, 0x7, 0x0, 0x80000000, 0x4, 0x7, 0x80000001, 0x3c5b, 0x3, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x2, 0xe661, 0x2, 0x9, 0x5, 0x7fff, 0x4c74, 0x23, 0x4, 0x7, 0xa, 0x7f, 0x71, 0x7, 0x8, 0x3, 0x0, 0x5, 0x40, 0x91, 0x6, 0xfffffff9, 0x3, 0xb, 0x4, 0x8, 0x0, 0x80, 0x0, 0xa, 0x6, 0x8, 0xfffffff9, 0x3, 0x40], [0x10000007, 0xc, 0x12f, 0x8000, 0x10, 0x8, 0x129432e2, 0xf, 0xf9, 0x3, 0x2bf, 0x6c9, 0x9, 0xfffffffe, 0x3, 0x7691, 0xe4, 0x5, 0x80, 0xe, 0x312, 0x8000, 0xea4, 0xa, 0x4, 0x4000, 0x8000, 0xb, 0x401, 0x39f, 0x6, 0xfffffffd, 0x100, 0x1005, 0x2, 0x5f31, 0x3, 0x0, 0x5, 0x8, 0x9, 0x4, 0x7fff, 0x8, 0x9, 0x3ff, 0x5, 0x0, 0x1, 0x8000, 0x6, 0x2, 0x7f, 0x9, 0x5, 0x8, 0x8, 0x1, 0x7, 0xb, 0x9, 0x48c92690, 0x6, 0xff], [0x7, 0x6, 0x4, 0x64e, 0xfffffdfe, 0x80010002, 0x8d2, 0x9, 0x2, 0x7eff, 0x0, 0x5, 0xb, 0x0, 0x4000005, 0x5, 0x0, 0x1ef, 0x5, 0x7f, 0x86, 0x8001, 0x10000009, 0x3e7, 0x80000b, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x200, 0x200, 0x7, 0x3, 0xfffffffe, 0x15, 0x0, 0x60000000, 0x6, 0x53cf697b, 0x5, 0x6, 0x54fe12d0, 0x0, 0x200, 0xffffffff, 0x400002, 0xfffffff9, 0x0, 0x6, 0x5, 0x0, 0x6, 0x3e, 0x120000, 0x3, 0x6, 0x9, 0x4, 0x800], [0x2, 0xbb2f, 0x0, 0x7, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x401, 0x7, 0x3, 0x800, 0x10000, 0x6, 0x7fff, 0x8ffff, 0x5, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x5, 0xffffffff, 0x7fff7ffe, 0x5, 0x8, 0xc8, 0x3, 0x3, 0x6, 0x0, 0x8, 0x100, 0x4, 0x7fff, 0x2, 0x9, 0x6, 0x100, 0x10000, 0x5, 0x184d99e8, 0x2b91, 0xa1f, 0x7d, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x28, 0xb1c, 0x4c400000, 0x200, 0xff, 0xfff]}, 0x45c)
write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f0000000bc0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10)
r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x42, 0x1ff)
write(r3, &(0x7f0000000140)='2', 0x200)
r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x2, 0x0)
pwrite64(r4, &(0x7f0000000140)='2', 0x200, 0x200)
pwrite64(r4, &(0x7f0000000140)='2', 0x200, 0x400)
pwrite64(r4, &(0x7f0000000140)='2', 0x200, 0x600)
pwrite64(r4, &(0x7f0000000140)='2', 0x200, 0x800)
pwrite64(r4, &(0x7f0000000140)='2', 0x200, 0xa00)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15)
pwrite64(r2, &(0x7f0000000140)='2', 0xfdef, 0xe7c)



Artifacts:
  console: https://pastebin.com/raw/yp6iaRG3
  kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=e1bb6d24ef2164eb


Thanks.


                 reply	other threads:[~2026-11-10  6:46 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1505d488.5126.1a1c4351165.Coremail.firefly0158@163.com \
    --to=firefly0158@163.com \
    --cc=aivazian.tigran@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®