【syzkaller】kernel BUG in ext4_mb_new_inode_pa

**【标题描述】【syzkaller】kernel BUG in ext4_mb_new_inode_pa

**一、缺陷信息**

**内核信息：**
5.10内核

**缺陷归属组件：**

**缺陷归属的版本：**

openEuler 2203SP3

**缺陷简述：**

syzkaller触发BUG，系统重启

**【环境信息】**
硬件信息
- TaiShan 200 2280
软件信息
- openEuler 2203SP3

网络信息
- 如果有特殊组网，请提供网络拓扑信息

**【问题复现步骤】**，请描述具体的操作步骤
**【实际结果】**，请描述出问题的结果和影响
**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等
kernel BUG at fs/ext4/mballoc.c:4159!
Internal error: Oops - BUG: 0 [#1] SMP
Modules linked in:
CPU: 0 PID: 122 Comm: kworker/u8:2 Not tainted 5.10.0-03428-g14411f58f8ce-dirty #1
Hardware name: linux,dummy-virt (DT)
Workqueue: writeback wb_workfn (flush-8:0)
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
pc : ext4_mb_new_inode_pa+0x898/0xcc0 fs/ext4/mballoc.c:4159
lr : ext4_mb_new_inode_pa+0x898/0xcc0 fs/ext4/mballoc.c:4159
sp : ffffa00018116aa0
x29: ffffa00018116aa0 x28: ffff0000d5095e24 
x27: 0000000000000000 x26: 00000000fffffd91 
x25: ffff0000d5095e44 x24: ffff0000ca9c8b70 
x23: ffff0000d5095e38 x22: ffff0000ca9c8800 
x21: 0000000000000000 x20: ffff0000d79c8c80 
x19: ffff0000d5095e08 x18: 0000000000000000 
x17: 0000000000000000 x16: 0000000000000000 
x15: 0000ffffcefa1a18 x14: ffffa000108af34c 
x13: 0000000000000000 x12: ffff80001953c25c 
x11: 1fffe0001953c25b x10: ffff80001953c25b 
x9 : ffffa00010a88418 x8 : ffff0000ca9e12d8 
x7 : 1ffff40003022d68 x6 : 0000000041b58ab3 
x5 : ffff0000c8a629c0 x4 : 0000000000000000 
x3 : ffffa00010a782ac x2 : 00000000fffffd91 
x1 : ffff0000c8a629c0 x0 : 0000000000000000 
Call trace:
 ext4_mb_new_inode_pa+0x898/0xcc0 fs/ext4/mballoc.c:4159
 ext4_mb_new_preallocation fs/ext4/mballoc.c:4258 [inline]
 ext4_mb_use_best_found+0x608/0x6f0 fs/ext4/mballoc.c:1715
 ext4_mb_measure_extent.constprop.0+0x278/0x300 fs/ext4/mballoc.c:1788
 ext4_mb_complex_scan_group+0x138/0x344 fs/ext4/mballoc.c:2027
 ext4_mb_regular_allocator+0x6b4/0x1240 fs/ext4/mballoc.c:2422
 ext4_mb_new_blocks+0x9a4/0xe70 fs/ext4/mballoc.c:5123
 ext4_ext_map_blocks+0x1030/0x15c4 fs/ext4/extents.c:4299
 ext4_map_blocks+0x414/0xde4 fs/ext4/inode.c:648
 mpage_map_one_extent+0xfc/0x3b4 fs/ext4/inode.c:2415
 mpage_map_and_submit_extent+0x114/0x644 fs/ext4/inode.c:2468
 ext4_writepages+0xde8/0x10fc fs/ext4/inode.c:2842
 do_writepages+0xd4/0x200 mm/page-writeback.c:2347
 __writeback_single_inode+0xe0/0x74c fs/fs-writeback.c:1470
 writeback_sb_inodes+0x4f0/0xd40 fs/fs-writeback.c:1733
 wb_writeback+0x248/0xa64 fs/fs-writeback.c:1908
 wb_do_writeback+0xe0/0x54c fs/fs-writeback.c:2053
 wb_workfn+0xac/0x3c0 fs/fs-writeback.c:2094
 process_one_work+0x478/0xb54 kernel/workqueue.c:2280
 worker_thread+0x120/0x95c kernel/workqueue.c:2426
 kthread+0x20c/0x25c kernel/kthread.c:313
 ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1030
Code: 97e46e1f 6b1a037f 54ffc722 97e46aa8 (d4210000) 
---[ end trace ecfaf055bac0677d ]---

**缺陷详情参考链接：**

**缺陷分析指导链接：**
https：xxx

__ext4_ioctl
 ext4_ioctl_setflags
  ext4_ind_migrate
   ext4_alloc_da_blocks
    filemap_flush
	 __filemap_fdatawrite
	  __filemap_fdatawrite_range
	   do_writepages
	    ext4_writepages
		 mpage_map_and_submit_extent
		  mpage_map_one_extent
		   ext4_map_blocks
		    ext4_ext_map_blocks
			 ext4_mb_new_blocks
			  ext4_mb_regular_allocator
			   ext4_mb_try_best_found
			    ext4_mb_use_best_found
				 ext4_mb_new_preallocation
				  ext4_mb_new_inode_pa+0x898/0xcc0 fs/ext4/mballoc.c:4159
				   BUG_ON(new_bex_end > (ac->ac_g_ex.fe_logical + EXT4_C2B(sbi, ac->ac_g_ex.fe_len)))
块分配结束后，分配得到的 best 比原始分配请求的长度长，因此会将分配的多余的长度放到预分配链表中, 在 ext4_mb_new_inode_pa 调整 extent 之后发现新的end比 目标 end 还要大，因此触发 BUG_ON.
这是因为当我们计算 ext4_free_extent 的结束位置时，这个位置可能恰好在 ext4_lblk_t(即 uint) 溢出的位置。比如当 ac_g_ex.fe_logical 为 4294965248，ac_g_ex.fe_len 为 2048，此时计算得到的 end 为 0x100000000，也就是 0. 假如 ac->ac_o_ex.fe_logical 不是调整 best extent 中的第一种情况, 也就是 new_bex_end > 0 时，上面的问题就会触发。

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (2)

GVPopenEuler/kernelClosed

Content Risk Flag