https://bugzilla.kernel.org/show_bug.cgi?id=215784 Bug ID: 215784 Summary: kernel NULL pointer dereference in fs/xfs/xfs_buf_item_recover.c: xlog_recover_do_inode_buffer() when mount a corrupted image Product: File System Version: 2.5 Kernel Version: 5.17.1, 5.15.32 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: XFS Assignee: filesystem_xfs@xxxxxxxxxxxxxxxxxxxxxx Reporter: wenqingliu0120@xxxxxxxxx Regression: No Created attachment 300672 --> https://bugzilla.kernel.org/attachment.cgi?id=300672&action=edit corrupted image and .config - Overview kernel NULL pointer dereference in fs/xfs/xfs_buf_item_recover.c: xlog_recover_do_inode_buffer() when mount a corrupted image - Reproduce tested on kernel 5.17.1, 5.15.32 $ mkdir mnt $ unzip tmp18.zip $ sudo mount -t xfs tmp18.img mnt - Kernel dump [ 26.379286] loop0: detected capacity change from 0 to 32768 [ 26.399630] XFS (loop0): Deprecated V4 format (crc=0) will not be supported after September 2030. [ 26.399771] XFS (loop0): Mounting V10 Filesystem [ 26.399889] XFS (loop0): Log size 87 blocks too small, minimum size is 845 blocks [ 26.399892] XFS (loop0): Log size out of supported range. [ 26.399916] XFS (loop0): Continuing onwards, but if log hangs are experienced then please report this message in the bug report. [ 26.404903] XFS (loop0): Starting recovery (logdev: internal) [ 26.406206] BUG: kernel NULL pointer dereference, address: 0000000000000060 [ 26.406251] #PF: supervisor read access in kernel mode [ 26.406273] #PF: error_code(0x0000) - not-present page [ 26.406294] PGD 0 P4D 0 [ 26.406304] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 26.406319] CPU: 0 PID: 895 Comm: mount Not tainted 5.17.1 #1 [ 26.406340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 26.406371] RIP: 0010:xlog_recover_do_inode_buffer+0x10f/0x230 [xfs] [ 26.406681] Code: 5d 41 5e 41 5f 5d c3 44 39 d3 7c 6b 48 8b 4d b8 49 63 c4 48 63 f3 48 c1 e0 04 49 63 fa 48 89 f3 48 29 fb 48 03 41 18 48 03 18 <8b> 0b 85 c9 0f 84 ac 00 00 00 48 8b 7d c0 44 89 45 ac 44 89 55 b0 [ 26.406744] RSP: 0018:ffffa72b009ab988 EFLAGS: 00010206 [ 26.406764] RAX: ffff98f38f553ef0 RBX: 0000000000000060 RCX: ffff98f38f640900 [ 26.406789] RDX: 0000000000000003 RSI: 0000000000000060 RDI: 0000000000000000 [ 26.406814] RBP: ffffa72b009ab9e0 R08: 0000000000000180 R09: 8080808080808080 [ 26.406840] R10: 0000000000000000 R11: fefefefefefefeff R12: 0000000000000001 [ 26.406867] R13: ffff98f38e456000 R14: 0000000000000000 R15: ffff98f391418600 [ 26.406894] FS: 00007f649dd76080(0000) GS:ffff98f575c00000(0000) knlGS:0000000000000000 [ 26.406923] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.406943] CR2: 0000000000000060 CR3: 00000001068fe006 CR4: 0000000000370ef0 [ 26.406972] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.406998] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.407025] Call Trace: [ 26.407050] <TASK> [ 26.407061] ? __xfs_buf_submit+0x9b/0x1d0 [xfs] [ 26.407175] xlog_recover_buf_commit_pass2+0x48c/0x650 [xfs] [ 26.407300] xlog_recover_items_pass2+0x4e/0xc0 [xfs] [ 26.407429] xlog_recover_commit_trans+0x2de/0x300 [xfs] [ 26.407552] xlog_recovery_process_trans+0x8e/0xc0 [xfs] [ 26.407672] xlog_recover_process_data+0xab/0x130 [xfs] [ 26.407795] xlog_do_recovery_pass+0x2d5/0x5c0 [xfs] [ 26.407917] xlog_do_log_recovery+0x7f/0xb0 [xfs] [ 26.408036] xlog_do_recover+0x34/0x190 [xfs] [ 26.408161] xlog_recover+0xbc/0x170 [xfs] [ 26.408291] xfs_log_mount+0x125/0x2d0 [xfs] [ 26.408402] xfs_mountfs+0x4e0/0xa50 [xfs] [ 26.408517] ? kmem_alloc+0x88/0x140 [xfs] [ 26.408627] ? xfs_filestream_get_parent+0x70/0x70 [xfs] [ 26.408737] xfs_fs_fill_super+0x69f/0x880 [xfs] [ 26.408848] ? sget_fc+0x1be/0x230 [ 26.408865] ? xfs_fs_inode_init_once+0x70/0x70 [xfs] [ 26.408977] get_tree_bdev+0x16a/0x280 [ 26.408995] vfs_get_tree+0x22/0xc0 [ 26.409696] path_mount+0x59b/0x9a0 [ 26.410319] do_mount+0x75/0x90 [ 26.410919] __x64_sys_mount+0x86/0xd0 [ 26.411514] do_syscall_64+0x37/0xb0 [ 26.412135] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 26.412817] RIP: 0033:0x7f649d63715a [ 26.413372] Code: 48 8b 0d 31 8d 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fe 8c 2c 00 f7 d8 64 89 01 48 [ 26.414587] RSP: 002b:00007ffd3e3729d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 26.415210] RAX: ffffffffffffffda RBX: 000055b763052420 RCX: 00007f649d63715a [ 26.415832] RDX: 000055b763052600 RSI: 000055b763054320 RDI: 000055b76305bc40 [ 26.416472] RBP: 0000000000000000 R08: 0000000000000000 R09: 000055b763052620 [ 26.417099] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 000055b76305bc40 [ 26.417710] R13: 000055b763052600 R14: 0000000000000000 R15: 00007f649db588a4 [ 26.418317] </TASK> [ 26.418860] Modules linked in: joydev iscsi_tcp libiscsi_tcp libiscsi input_leds serio_raw scsi_transport_iscsi qemu_fw_cfg xfs autofs4 raid10 raid456 hid_generic usbhid async_raid6_recov async_memcpy async_pq async_xor hid async_tx raid1 raid0 multipath linear qxl drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd psmouse cryptd [ 26.421641] CR2: 0000000000000060 [ 26.422322] ---[ end trace 0000000000000000 ]--- [ 26.422928] RIP: 0010:xlog_recover_do_inode_buffer+0x10f/0x230 [xfs] [ 26.423656] Code: 5d 41 5e 41 5f 5d c3 44 39 d3 7c 6b 48 8b 4d b8 49 63 c4 48 63 f3 48 c1 e0 04 49 63 fa 48 89 f3 48 29 fb 48 03 41 18 48 03 18 <8b> 0b 85 c9 0f 84 ac 00 00 00 48 8b 7d c0 44 89 45 ac 44 89 55 b0 [ 26.425066] RSP: 0018:ffffa72b009ab988 EFLAGS: 00010206 [ 26.425819] RAX: ffff98f38f553ef0 RBX: 0000000000000060 RCX: ffff98f38f640900 [ 26.426511] RDX: 0000000000000003 RSI: 0000000000000060 RDI: 0000000000000000 [ 26.427232] RBP: ffffa72b009ab9e0 R08: 0000000000000180 R09: 8080808080808080 [ 26.427962] R10: 0000000000000000 R11: fefefefefefefeff R12: 0000000000000001 [ 26.428690] R13: ffff98f38e456000 R14: 0000000000000000 R15: ffff98f391418600 [ 26.429405] FS: 00007f649dd76080(0000) GS:ffff98f575c00000(0000) knlGS:0000000000000000 [ 26.430096] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.430797] CR2: 0000000000000060 CR3: 00000001068fe006 CR4: 0000000000370ef0 [ 26.431506] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.432226] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 -- You may reply to this email to add a comment. You are receiving this mail because: You are watching the assignee of the bug.
