https://bugzilla.kernel.org/show_bug.cgi?id=202925 Bug ID: 202925 Summary: BUG: failure at fs/buffer.c:195/__find_get_block_slow()! Product: File System Version: 2.5 Kernel Version: 5.0.0 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: ext4 Assignee: fs_ext4@xxxxxxxxxxxxxxxxxxxx Reporter: jungyeon@xxxxxxxxxx Regression: No Created attachment 281829 --> https://bugzilla.kernel.org/attachment.cgi?id=281829&action=edit image&program - Overview After mounting crafted image and running the attached program, I got this segmentation fault while running attached program. I also tried to reproduce on vm, but it only failed on lkl. LKL is Linux Kernel Library. poc_03.c is a program that calls lists of system calls in userspace and the craft image is a potentially faulty image to test error cases. https://gts3.org/~jungyeon/ext4-combined at the link above, I uploaded the executable file required for this test. - Produces ./lkl/tools/lkl/ext4-combined -t ext4 -i tmp.img -p poc_03.c.raw -v (poc_03.c shows it's internal programs) - Messages [ 0.000000] Linux version 5.0.0+ (jungyeon@copper) (gcc version 7.3.0 (Ubuntu 7.3.0-27ubuntu1~18.04)) #1 Wed Mar 13 19:57:50 EDT 2019 [ 0.000000] memblock address range: 0x7fffe4000000 - 0x7fffebfff000 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32319 [ 0.000000] Kernel command line: mem=128M virtio_mmio.device=316@0x1000000:1 [ 0.000000] Dentry cache hash table entries: 16384 (order: 5, 131072 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 4, 65536 bytes) [ 0.000000] Memory available: 129044k/131068k RAM [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 4096 [ 0.000000] lkl: irqs initialized [ 0.000000] clocksource: lkl: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns [ 0.000001] lkl: time and timers initialized (irq2) [ 0.000009] pid_max: default: 4096 minimum: 301 [ 0.000073] Mount-cache hash table entries: 512 (order: 0, 4096 bytes) [ 0.000086] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes) [ 0.002805] printk: console [lkl_console0] enabled [ 0.002839] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.004581] clocksource: Switched to clocksource lkl [ 0.004960] virtio-mmio: Registering device virtio-mmio.0 at 0x1000000-0x100013b, IRQ 1. [ 0.005453] workingset: timestamp_bits=62 max_order=15 bucket_order=0 [ 0.015235] virtio-mmio virtio-mmio.0: Failed to enable 64-bit or 32-bit DMA. Trying to continue, but this might not work. [ 0.015492] virtio_blk virtio0: [vda] 32768 512-byte logical blocks (16.8 MB/16.0 MiB) [ 0.016404] random: get_random_bytes called from .LC28+0x21/0x38 with crng_init=0 [ 0.016827] Warning: unable to open an initial console. [ 0.016877] This architecture does not have kernel memory protection. [ 0.016883] Run /init as init process [ 0.019880] EXT4-fs warning (device vda): ext4_clear_journal_err:4988: Filesystem error recorded from previous mount: Readonly filesystem [ 0.019894] EXT4-fs warning (device vda): ext4_clear_journal_err:4989: Marking fs in need of filesystem check. [ 0.020276] EXT4-fs (vda): warning: mounting fs with errors, running e2fsck is recommended [ 0.020464] EXT4-fs (vda): mounted filesystem with writeback data mode. Opts: errors=remount-ro [ 0.034246] BUG: failure at fs/buffer.c:195/__find_get_block_slow()! [ 0.034264] Kernel panic - not syncing: BUG! [ 0.034268] Call Trace: [ 0.034275] (____ptrval____): [<55555559bc94>] .LC81+0x5f/0xfb [ 0.034282] (____ptrval____): [<5555555c6025>] major_names+0x75/0x80 [ 0.034289] (____ptrval____): [<5555555978f4>] .LC11+0x14/0x20 [ 0.034296] (____ptrval____): [<55555575e71f>] ext4_mark_iloc_dirty+0x126f/0x1640 [ 0.034303] (____ptrval____): [<5555556a91c5>] __find_get_block+0xda5/0xdb0 [ 0.034307] (____ptrval____): [<5555555978f4>] .LC11+0x14/0x20 [ 0.034314] (____ptrval____): [<5555557f876b>] jbd2_journal_cancel_revoke+0x2cb/0x440 [ 0.034319] (____ptrval____): [<5555557e80b9>] do_get_write_access+0x7f9/0xc20 [ 0.034324] (____ptrval____): [<5555557e782e>] jbd2_journal_get_write_access+0x1fe/0x290 [ 0.034331] (____ptrval____): [<55555570d542>] __ext4_journal_get_write_access+0xa2/0x130 [ 0.034341] (____ptrval____): [<55555573f72e>] ext4_free_data+0x9e/0x450 [ 0.034358] (____ptrval____): [<555555740524>] ext4_free_branches+0x654/0x6f0 [ 0.034370] (____ptrval____): [<5555557400ec>] ext4_free_branches+0x21c/0x6f0 [ 0.034381] (____ptrval____): [<55555573f4bf>] ext4_ind_truncate+0x8ff/0xad0 [ 0.034391] (____ptrval____): [<55555575e71f>] ext4_mark_iloc_dirty+0x126f/0x1640 [ 0.034402] (____ptrval____): [<5555555978f4>] .LC11+0x14/0x20 [ 0.034414] (____ptrval____): [<5555558801b7>] __down_write_common+0x177/0x290 [ 0.034426] (____ptrval____): [<5555555bafd4>] ___might_sleep+0x44/0x150 [ 0.034436] (____ptrval____): [<55555574ed4e>] ext4_truncate+0x93e/0xaf0 [ 0.034445] (____ptrval____): [<55555574dd7f>] ext4_evict_inode+0xbdf/0xe50 [ 0.034456] (____ptrval____): [<555555667e2c>] evict+0x20c/0x800 [ 0.034464] (____ptrval____): [<5555556621bb>] iput+0x53b/0x800 [ 0.034473] (____ptrval____): [<55555565bf16>] dentry_unlink_inode+0x276/0x2b0 [ 0.034483] (____ptrval____): [<555555654c42>] __dentry_kill+0x3a2/0x5b0 [ 0.034495] (____ptrval____): [<555555653b7b>] dput+0x34b/0x7c0 [ 0.034505] (____ptrval____): [<55555561669d>] __fput+0x2bd/0x490 [ 0.034513] (____ptrval____): [<555555616289>] ____fput+0x39/0x40 [ 0.034525] (____ptrval____): [<5555555b24ca>] task_work_run+0xba/0xf0 [ 0.034534] (____ptrval____): [<55555559800f>] .LC2+0x3f/0x40 [ 0.034543] [ 0.034551] ---[ end Kernel panic - not syncing: BUG! ]--- - Primitive reasons when __find_get_block_slow is call, the bdev is NULL. I temporarily put BUG_ON to get stack trace. 192 static struct buffer_head * 193 __find_get_block_slow(struct block_device *bdev, sector_t block) 194 { 195 BUG_ON(bdev == NULL); 196 struct inode *bd_inode = bdev->bd_inode; 197 struct address_space *bd_mapping = bd_inode->i_mapping; 198 struct buffer_head *ret = NULL; 199 pgoff_t index; 200 struct buffer_head *bh; 201 struct buffer_head *head; 202 struct page *page; 203 int all_mapped = 1; 204 static DEFINE_RATELIMIT_STATE(last_warned, HZ, 1); 205 206 index = block >> (PAGE_SHIFT - bd_inode->i_blkbits); 207 page = find_get_page_flags(bd_mapping, index, FGP_ACCESSED); 208 if (!page) 209 goto out; -- You are receiving this mail because: You are watching the assignee of the bug.
