While running LTP tests(execveat03) against 5.17.0-rc8-next-20220315
On a POWER10 LPAR following crash is seen:
[ 945.659049] dummy_del_mod: loading out-of-tree module taints kernel.
[ 945.659951] dummy_del_mod: module verification failed: signature and/or required key missing - tainting kernel
[ 955.520206] process 'execveat01' launched '/dev/fd/-1' with NULL argv: empty string added
[ 955.529560] loop0: detected capacity change from 0 to 524288
[ 955.830492] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
[ 955.831047] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 955.831056] ext2 filesystem being mounted at /var/tmp/avocado_2hol2hy1/ltp-SHEyyra8b0/3CPNpu/mntpoint supports timestamps until 2038 (0x7fffffff)
[ 955.907793] Kernel attempted to read user page (1) - exploit attempt? (uid: 0)
[ 955.907806] BUG: Kernel NULL pointer dereference on read at 0x00000001
[ 955.907809] Faulting instruction address: 0xc008000000be04ec
[ 955.907811] Oops: Kernel access of bad area, sig: 11 [#1]
[ 955.907814] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
[ 955.907818] Modules linked in: overlay vfat fat btrfs blake2b_generic xor raid6_pq zstd_compress xfs loop sctp ip6_udp_tunnel udp_tunnel dm_mod nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables bonding libcrc32c nfnetlink sunrpc pseries_rng xts vmx_crypto sch_fq_codel ext4 mbcache jbd2 sd_mod t10_pi crc64_rocksoft crc64 sg ibmvscsi ibmveth scsi_transport_srp fuse [last unloaded: dummy_del_mod]
[ 955.907849] CPU: 30 PID: 1947255 Comm: execveat03 Tainted: G OE 5.17.0-rc8-next-20220315 #1
[ 955.907853] NIP: c008000000be04ec LR: c008000000ba4b00 CTR: c0000000004fd040
[ 955.907856] REGS: c0000002474831a0 TRAP: 0300 Tainted: G OE (5.17.0-rc8-next-20220315)
[ 955.907860] MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28028282 XER: 20040000
[ 955.907869] CFAR: c008000000ba4afc DAR: 0000000000000001 DSISR: 40000000 IRQMASK: 0
[ 955.907869] GPR00: c008000000ba4b00 c000000247483440 c008000000c28000 0000000000000001
[ 955.907869] GPR04: c000000206668af8 c008000000be0068 0000000000000000 0000000000000000
[ 955.907869] GPR08: 0000000000000002 0000000000000004 0000000000000000 c008000000be7f68
[ 955.907869] GPR12: c0000000004fd040 c000000effbe7280 0000000000000000 0000000000000001
[ 955.907869] GPR16: 0000000000000000 c0000000029b4048 0000000000000000 0000000000000000
[ 955.907869] GPR20: 0000000000000000 c0000000029b4048 0000000000000004 c000000206668af8
[ 955.907869] GPR24: c000000247483528 0000000000000001 c008000000c01208 0000000000000000
[ 955.907869] GPR28: 0000000000000001 c000000206668af8 c0000001f0d92e80 0000000000000001
[ 955.907904] NIP [c008000000be04ec] __ext4_fc_track_link+0x44/0xf0 [ext4]
[ 955.907927] LR [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4]
[ 955.907946] Call Trace:
[ 955.907947] [c000000247483440] [0000000000000004] 0x4 (unreliable)
[ 955.907950] [c0000002474834a0] [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4]
[ 955.907969] [c000000247483670] [c0000000004a498c] vfs_rename+0x9cc/0xe00
[ 955.907975] [c000000247483760] [c008000000341820] ovl_do_rename.constprop.28+0x78/0x140 [overlay]
[ 955.907982] [c000000247483830] [c008000000341b50] ovl_make_workdir+0x268/0x7e0 [overlay]
[ 955.907988] [c000000247483960] [c008000000343aa8] ovl_fill_super+0x1060/0x2160 [overlay]
[ 955.907994] [c000000247483ae0] [c000000000492f68] mount_nodev+0x78/0x100
[ 955.907998] [c000000247483b20] [c008000000340054] ovl_mount+0x2c/0x50 [overlay]
[ 955.908004] [c000000247483b40] [c0000000004f676c] legacy_get_tree+0x4c/0xb0
[ 955.908008] [c000000247483b70] [c00000000049063c] vfs_get_tree+0x4c/0x150
[ 955.908012] [c000000247483bf0] [c0000000004d3768] path_mount+0x8e8/0xd50
[ 955.908017] [c000000247483cb0] [c0000000004d3c50] do_mount+0x80/0xd0
[ 955.908021] [c000000247483d10] [c0000000004d3e3c] sys_mount+0x19c/0x370
[ 955.908025] [c000000247483db0] [c00000000003375c] system_call_exception+0x18c/0x390
[ 955.908029] [c000000247483e10] [c00000000000c64c] system_call_common+0xec/0x270
[ 955.908034] --- interrupt: c00 at 0x7fffa9b38dfc
[ 955.908036] NIP: 00007fffa9b38dfc LR: 000000001001ba78 CTR: 0000000000000000
[ 955.908039] REGS: c000000247483e80 TRAP: 0c00 Tainted: G OE (5.17.0-rc8-next-20220315)
[ 955.908042] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 24002202 XER: 00000000
[ 955.908050] IRQMASK: 0
[ 955.908050] GPR00: 0000000000000015 00007ffff95c64c0 00007fffa9c07300 0000000010029a08
[ 955.908050] GPR04: 0000000010027de0 0000000010029a08 0000000000000000 00000000100299c0
[ 955.908050] GPR08: 0000000000004000 0000000000000000 0000000000000000 0000000000000000
[ 955.908050] GPR12: 0000000000000000 00007fffa9e1a340 0000000000000000 0000000000000000
[ 955.908050] GPR16: 0000000000000000 0000000000000000 ffffffffffffffff 0000000010027a38
[ 955.908050] GPR20: 00000000100284d0 0000000010028238 00000000100280f8 00007ffff95c65b0
[ 955.908050] GPR24: 0000000000000003 0000000010051098 0000000010050c60 00000000100555c8
[ 955.908050] GPR28: 000000000000040c 0000000010027b08 0000000000000000 0000000000000001
[ 955.908083] NIP [00007fffa9b38dfc] 0x7fffa9b38dfc
[ 955.908086] LR [000000001001ba78] 0x1001ba78
[ 955.908090] --- interrupt: c00
[ 955.908092] Instruction dump:
[ 955.908095] fba1ffe8 fbc1fff0 7cbe2b78 fbe1fff8 3ca20000 e8a5a0c8 7c7f1b78 39200004
[ 955.908103] 38e00000 7c9d2378 f8010010 f821ffa1 <e8630000> 38c10028 e94d1100 f9410038
[ 955.908112] ---[ end trace 0000000000000000 ]---
[ 955.908943]
[ 956.908946] Kernel panic - not syncing: Fatal exception
Bisect points to following commit:
commit 9d5623d7ef8765f21f629e4ac636c19ec245e254
ext4: return early for non-eligible fast_commit track events
Reverting this commit allows the test to run successfully.
Thanks
-Sachin
On 22/03/16 01:47PM, Sachin Sant wrote:
While running LTP tests(execveat03) against 5.17.0-rc8-next-20220315
On a POWER10 LPAR following crash is seen:
[ 945.659049] dummy_del_mod: loading out-of-tree module taints kernel.
[ 945.659951] dummy_del_mod: module verification failed: signature and/or required key missing - tainting kernel
[ 955.520206] process 'execveat01' launched '/dev/fd/-1' with NULL argv: empty string added
[ 955.529560] loop0: detected capacity change from 0 to 524288
[ 955.830492] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
Ok, so it has mounted ext2 using ext4 subsystem.
This means there is no journal.
[ 955.831047] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 955.831056] ext2 filesystem being mounted at /var/tmp/avocado_2hol2hy1/ltp-SHEyyra8b0/3CPNpu/mntpoint supports timestamps until 2038 (0x7fffffff)
[ 955.907793] Kernel attempted to read user page (1) - exploit attempt? (uid: 0)
[ 955.907806] BUG: Kernel NULL pointer dereference on read at 0x00000001
[ 955.907809] Faulting instruction address: 0xc008000000be04ec
[ 955.907811] Oops: Kernel access of bad area, sig: 11 [#1]
[ 955.907814] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
[ 955.907818] Modules linked in: overlay vfat fat btrfs blake2b_generic xor raid6_pq zstd_compress xfs loop sctp ip6_udp_tunnel udp_tunnel dm_mod nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables bonding libcrc32c nfnetlink sunrpc pseries_rng xts vmx_crypto sch_fq_codel ext4 mbcache jbd2 sd_mod t10_pi crc64_rocksoft crc64 sg ibmvscsi ibmveth scsi_transport_srp fuse [last unloaded: dummy_del_mod]
[ 955.907849] CPU: 30 PID: 1947255 Comm: execveat03 Tainted: G OE 5.17.0-rc8-next-20220315 #1
[ 955.907853] NIP: c008000000be04ec LR: c008000000ba4b00 CTR: c0000000004fd040
[ 955.907856] REGS: c0000002474831a0 TRAP: 0300 Tainted: G OE (5.17.0-rc8-next-20220315)
[ 955.907860] MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28028282 XER: 20040000
[ 955.907869] CFAR: c008000000ba4afc DAR: 0000000000000001 DSISR: 40000000 IRQMASK: 0
[ 955.907869] GPR00: c008000000ba4b00 c000000247483440 c008000000c28000 0000000000000001
[ 955.907869] GPR04: c000000206668af8 c008000000be0068 0000000000000000 0000000000000000
[ 955.907869] GPR08: 0000000000000002 0000000000000004 0000000000000000 c008000000be7f68
[ 955.907869] GPR12: c0000000004fd040 c000000effbe7280 0000000000000000 0000000000000001
[ 955.907869] GPR16: 0000000000000000 c0000000029b4048 0000000000000000 0000000000000000
[ 955.907869] GPR20: 0000000000000000 c0000000029b4048 0000000000000004 c000000206668af8
[ 955.907869] GPR24: c000000247483528 0000000000000001 c008000000c01208 0000000000000000
[ 955.907869] GPR28: 0000000000000001 c000000206668af8 c0000001f0d92e80 0000000000000001
[ 955.907904] NIP [c008000000be04ec] __ext4_fc_track_link+0x44/0xf0 [ext4]
[ 955.907927] LR [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4]
[ 955.907946] Call Trace:
[ 955.907947] [c000000247483440] [0000000000000004] 0x4 (unreliable)
[ 955.907950] [c0000002474834a0] [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4]
[ 955.907969] [c000000247483670] [c0000000004a498c] vfs_rename+0x9cc/0xe00
[ 955.907975] [c000000247483760] [c008000000341820] ovl_do_rename.constprop.28+0x78/0x140 [overlay]
[ 955.907982] [c000000247483830] [c008000000341b50] ovl_make_workdir+0x268/0x7e0 [overlay]
[ 955.907988] [c000000247483960] [c008000000343aa8] ovl_fill_super+0x1060/0x2160 [overlay]
[ 955.907994] [c000000247483ae0] [c000000000492f68] mount_nodev+0x78/0x100
[ 955.907998] [c000000247483b20] [c008000000340054] ovl_mount+0x2c/0x50 [overlay]
[ 955.908004] [c000000247483b40] [c0000000004f676c] legacy_get_tree+0x4c/0xb0
[ 955.908008] [c000000247483b70] [c00000000049063c] vfs_get_tree+0x4c/0x150
[ 955.908012] [c000000247483bf0] [c0000000004d3768] path_mount+0x8e8/0xd50
[ 955.908017] [c000000247483cb0] [c0000000004d3c50] do_mount+0x80/0xd0
[ 955.908021] [c000000247483d10] [c0000000004d3e3c] sys_mount+0x19c/0x370
[ 955.908025] [c000000247483db0] [c00000000003375c] system_call_exception+0x18c/0x390
[ 955.908029] [c000000247483e10] [c00000000000c64c] system_call_common+0xec/0x270
[ 955.908034] --- interrupt: c00 at 0x7fffa9b38dfc
[ 955.908036] NIP: 00007fffa9b38dfc LR: 000000001001ba78 CTR: 0000000000000000
[ 955.908039] REGS: c000000247483e80 TRAP: 0c00 Tainted: G OE (5.17.0-rc8-next-20220315)
[ 955.908042] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 24002202 XER: 00000000
[ 955.908050] IRQMASK: 0
[ 955.908050] GPR00: 0000000000000015 00007ffff95c64c0 00007fffa9c07300 0000000010029a08
[ 955.908050] GPR04: 0000000010027de0 0000000010029a08 0000000000000000 00000000100299c0
[ 955.908050] GPR08: 0000000000004000 0000000000000000 0000000000000000 0000000000000000
[ 955.908050] GPR12: 0000000000000000 00007fffa9e1a340 0000000000000000 0000000000000000
[ 955.908050] GPR16: 0000000000000000 0000000000000000 ffffffffffffffff 0000000010027a38
[ 955.908050] GPR20: 00000000100284d0 0000000010028238 00000000100280f8 00007ffff95c65b0
[ 955.908050] GPR24: 0000000000000003 0000000010051098 0000000010050c60 00000000100555c8
[ 955.908050] GPR28: 000000000000040c 0000000010027b08 0000000000000000 0000000000000001
[ 955.908083] NIP [00007fffa9b38dfc] 0x7fffa9b38dfc
[ 955.908086] LR [000000001001ba78] 0x1001ba78
[ 955.908090] --- interrupt: c00
[ 955.908092] Instruction dump:
[ 955.908095] fba1ffe8 fbc1fff0 7cbe2b78 fbe1fff8 3ca20000 e8a5a0c8 7c7f1b78 39200004
[ 955.908103] 38e00000 7c9d2378 f8010010 f821ffa1 <e8630000> 38c10028 e94d1100 f9410038
[ 955.908112] ---[ end trace 0000000000000000 ]---
[ 955.908943]
[ 956.908946] Kernel panic - not syncing: Fatal exception
Bisect points to following commit:
commit 9d5623d7ef8765f21f629e4ac636c19ec245e254
ext4: return early for non-eligible fast_commit track events
Reverting this commit allows the test to run successfully.
Hi Sachin,
Thanks so much for the report. Yes, this was discussed today here [1].
Ted mentioned, he had to add a change to fix this crash.
Once that is in, this should be fixed.
If you like you can apply below change and continue with your testing.
[1]: https://lore.kernel.org/linux-ext4/164714672856.1260831.16671323737369796834.b4-ty@mit.edu/T/#mdeff2bbdf0d107021514a9c44478d642936c4f9c
-ritesh
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 39e223f7bf64..e37da8d5cd0c 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3891,12 +3891,19 @@ static int ext4_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
ext4_fc_mark_ineligible(old.inode->i_sb,
EXT4_FC_REASON_RENAME_DIR, handle);
} else {
+ struct super_block *sb = old.inode->i_sb;
+
if (new.inode)
ext4_fc_track_unlink(handle, new.dentry);
- __ext4_fc_track_link(handle, old.inode, new.dentry);
- __ext4_fc_track_unlink(handle, old.inode, old.dentry);
- if (whiteout)
- __ext4_fc_track_create(handle, whiteout, old.dentry);
+ if (test_opt2(sb, JOURNAL_FAST_COMMIT) &&
+ !(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) &&
+ !(ext4_test_mount_flag(sb, EXT4_MF_FC_INELIGIBLE))) {
+ __ext4_fc_track_link(handle, old.inode, new.dentry);
+ __ext4_fc_track_unlink(handle, old.inode, old.dentry);
+ if (whiteout)
+ __ext4_fc_track_create(handle, whiteout,
+ old.dentry);
+ }
}
if (new.inode) {
quoted
Bisect points to following commit:
commit 9d5623d7ef8765f21f629e4ac636c19ec245e254
ext4: return early for non-eligible fast_commit track events
Reverting this commit allows the test to run successfully.
Hi Sachin,
Thanks so much for the report. Yes, this was discussed today here [1].
Ted mentioned, he had to add a change to fix this crash.
Once that is in, this should be fixed.
If you like you can apply below change and continue with your testing.
Thanks. Yes this patch fixes the reported problem for me.
fwiw Tested-by: Sachin Sant [off-list ref]
[1]: https://lore.kernel.org/linux-ext4/164714672856.1260831.16671323737369796834.b4-ty@mit.edu/T/#mdeff2bbdf0d107021514a9c44478d642936c4f9c
-ritesh
- Sachin