On 22/03/16 01:47PM, Sachin Sant wrote: > While running LTP tests(execveat03) against 5.17.0-rc8-next-20220315 > On a POWER10 LPAR following crash is seen: > > [ 945.659049] dummy_del_mod: loading out-of-tree module taints kernel. > [ 945.659951] dummy_del_mod: module verification failed: signature and/or required key missing - tainting kernel > [ 955.520206] process 'execveat01' launched '/dev/fd/-1' with NULL argv: empty string added > [ 955.529560] loop0: detected capacity change from 0 to 524288 > [ 955.830492] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem Ok, so it has mounted ext2 using ext4 subsystem. This means there is no journal. > [ 955.831047] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. > [ 955.831056] ext2 filesystem being mounted at /var/tmp/avocado_2hol2hy1/ltp-SHEyyra8b0/3CPNpu/mntpoint supports timestamps until 2038 (0x7fffffff) > [ 955.907793] Kernel attempted to read user page (1) - exploit attempt? (uid: 0) > [ 955.907806] BUG: Kernel NULL pointer dereference on read at 0x00000001 > [ 955.907809] Faulting instruction address: 0xc008000000be04ec > [ 955.907811] Oops: Kernel access of bad area, sig: 11 [#1] > [ 955.907814] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries > [ 955.907818] Modules linked in: overlay vfat fat btrfs blake2b_generic xor raid6_pq zstd_compress xfs loop sctp ip6_udp_tunnel udp_tunnel dm_mod nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables bonding libcrc32c nfnetlink sunrpc pseries_rng xts vmx_crypto sch_fq_codel ext4 mbcache jbd2 sd_mod t10_pi crc64_rocksoft crc64 sg ibmvscsi ibmveth scsi_transport_srp fuse [last unloaded: dummy_del_mod] > [ 955.907849] CPU: 30 PID: 1947255 Comm: execveat03 Tainted: G OE 5.17.0-rc8-next-20220315 #1 > [ 955.907853] NIP: c008000000be04ec LR: c008000000ba4b00 CTR: c0000000004fd040 > [ 955.907856] REGS: c0000002474831a0 TRAP: 0300 Tainted: G OE (5.17.0-rc8-next-20220315) > [ 955.907860] MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28028282 XER: 20040000 > [ 955.907869] CFAR: c008000000ba4afc DAR: 0000000000000001 DSISR: 40000000 IRQMASK: 0 > [ 955.907869] GPR00: c008000000ba4b00 c000000247483440 c008000000c28000 0000000000000001 > [ 955.907869] GPR04: c000000206668af8 c008000000be0068 0000000000000000 0000000000000000 > [ 955.907869] GPR08: 0000000000000002 0000000000000004 0000000000000000 c008000000be7f68 > [ 955.907869] GPR12: c0000000004fd040 c000000effbe7280 0000000000000000 0000000000000001 > [ 955.907869] GPR16: 0000000000000000 c0000000029b4048 0000000000000000 0000000000000000 > [ 955.907869] GPR20: 0000000000000000 c0000000029b4048 0000000000000004 c000000206668af8 > [ 955.907869] GPR24: c000000247483528 0000000000000001 c008000000c01208 0000000000000000 > [ 955.907869] GPR28: 0000000000000001 c000000206668af8 c0000001f0d92e80 0000000000000001 > [ 955.907904] NIP [c008000000be04ec] __ext4_fc_track_link+0x44/0xf0 [ext4] > [ 955.907927] LR [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4] > [ 955.907946] Call Trace: > [ 955.907947] [c000000247483440] [0000000000000004] 0x4 (unreliable) > [ 955.907950] [c0000002474834a0] [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4] > [ 955.907969] [c000000247483670] [c0000000004a498c] vfs_rename+0x9cc/0xe00 > [ 955.907975] [c000000247483760] [c008000000341820] ovl_do_rename.constprop.28+0x78/0x140 [overlay] > [ 955.907982] [c000000247483830] [c008000000341b50] ovl_make_workdir+0x268/0x7e0 [overlay] > [ 955.907988] [c000000247483960] [c008000000343aa8] ovl_fill_super+0x1060/0x2160 [overlay] > [ 955.907994] [c000000247483ae0] [c000000000492f68] mount_nodev+0x78/0x100 > [ 955.907998] [c000000247483b20] [c008000000340054] ovl_mount+0x2c/0x50 [overlay] > [ 955.908004] [c000000247483b40] [c0000000004f676c] legacy_get_tree+0x4c/0xb0 > [ 955.908008] [c000000247483b70] [c00000000049063c] vfs_get_tree+0x4c/0x150 > [ 955.908012] [c000000247483bf0] [c0000000004d3768] path_mount+0x8e8/0xd50 > [ 955.908017] [c000000247483cb0] [c0000000004d3c50] do_mount+0x80/0xd0 > [ 955.908021] [c000000247483d10] [c0000000004d3e3c] sys_mount+0x19c/0x370 > [ 955.908025] [c000000247483db0] [c00000000003375c] system_call_exception+0x18c/0x390 > [ 955.908029] [c000000247483e10] [c00000000000c64c] system_call_common+0xec/0x270 > [ 955.908034] --- interrupt: c00 at 0x7fffa9b38dfc > [ 955.908036] NIP: 00007fffa9b38dfc LR: 000000001001ba78 CTR: 0000000000000000 > [ 955.908039] REGS: c000000247483e80 TRAP: 0c00 Tainted: G OE (5.17.0-rc8-next-20220315) > [ 955.908042] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 24002202 XER: 00000000 > [ 955.908050] IRQMASK: 0 > [ 955.908050] GPR00: 0000000000000015 00007ffff95c64c0 00007fffa9c07300 0000000010029a08 > [ 955.908050] GPR04: 0000000010027de0 0000000010029a08 0000000000000000 00000000100299c0 > [ 955.908050] GPR08: 0000000000004000 0000000000000000 0000000000000000 0000000000000000 > [ 955.908050] GPR12: 0000000000000000 00007fffa9e1a340 0000000000000000 0000000000000000 > [ 955.908050] GPR16: 0000000000000000 0000000000000000 ffffffffffffffff 0000000010027a38 > [ 955.908050] GPR20: 00000000100284d0 0000000010028238 00000000100280f8 00007ffff95c65b0 > [ 955.908050] GPR24: 0000000000000003 0000000010051098 0000000010050c60 00000000100555c8 > [ 955.908050] GPR28: 000000000000040c 0000000010027b08 0000000000000000 0000000000000001 > [ 955.908083] NIP [00007fffa9b38dfc] 0x7fffa9b38dfc > [ 955.908086] LR [000000001001ba78] 0x1001ba78 > [ 955.908090] --- interrupt: c00 > [ 955.908092] Instruction dump: > [ 955.908095] fba1ffe8 fbc1fff0 7cbe2b78 fbe1fff8 3ca20000 e8a5a0c8 7c7f1b78 39200004 > [ 955.908103] 38e00000 7c9d2378 f8010010 f821ffa1 <e8630000> 38c10028 e94d1100 f9410038 > [ 955.908112] ---[ end trace 0000000000000000 ]--- > [ 955.908943] > [ 956.908946] Kernel panic - not syncing: Fatal exception > > Bisect points to following commit: > commit 9d5623d7ef8765f21f629e4ac636c19ec245e254 > ext4: return early for non-eligible fast_commit track events > > Reverting this commit allows the test to run successfully. Hi Sachin, Thanks so much for the report. Yes, this was discussed today here [1]. Ted mentioned, he had to add a change to fix this crash. Once that is in, this should be fixed. If you like you can apply below change and continue with your testing. [1]: https://lore.kernel.org/linux-ext4/164714672856.1260831.16671323737369796834.b4-ty@xxxxxxx/T/#mdeff2bbdf0d107021514a9c44478d642936c4f9c -ritesh diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index 39e223f7bf64..e37da8d5cd0c 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -3891,12 +3891,19 @@ static int ext4_rename(struct user_namespace *mnt_userns, struct inode *old_dir, ext4_fc_mark_ineligible(old.inode->i_sb, EXT4_FC_REASON_RENAME_DIR, handle); } else { + struct super_block *sb = old.inode->i_sb; + if (new.inode) ext4_fc_track_unlink(handle, new.dentry); - __ext4_fc_track_link(handle, old.inode, new.dentry); - __ext4_fc_track_unlink(handle, old.inode, old.dentry); - if (whiteout) - __ext4_fc_track_create(handle, whiteout, old.dentry); + if (test_opt2(sb, JOURNAL_FAST_COMMIT) && + !(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) && + !(ext4_test_mount_flag(sb, EXT4_MF_FC_INELIGIBLE))) { + __ext4_fc_track_link(handle, old.inode, new.dentry); + __ext4_fc_track_unlink(handle, old.inode, old.dentry); + if (whiteout) + __ext4_fc_track_create(handle, whiteout, + old.dentry); + } } if (new.inode) {
