linux-kernel - Kernel crashes after 529262d56dbe "block: remove ->poll

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <0bd2d36e-bef0-b836-7039-124ae4d346a6@virtuozzo.com>
Date:   Wed, 5 Dec 2018 15:19:34 +0300
From:   Kirill Tkhai <ktkhai@...tuozzo.com>
To:     hch@....de, sagi@...mberg.me, axboe@...nel.dk,
        linux-block@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Kernel crashes after 529262d56dbe "block: remove ->poll_fn"

Hi,

commit 529262d56dbe from today linux-next makes my kernel crash:

Author: Christoph Hellwig <hch@....de>
Date:   Sun Dec 2 17:46:26 2018 +0100

    block: remove ->poll_fn

Traceback is below, config and reproducer (not minimal, just a random one populating swap) are attached.

[   29.097612] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[   29.098730] #PF error: [INSTR]
[   29.099104] PGD 0 P4D 0 
[   29.099425] Oops: 0010 [#1] PREEMPT SMP
[   29.099879] CPU: 3 PID: 925 Comm: bash Not tainted 4.20.0-rc5-next-20181205+ #244
[   29.100658] RIP: 0010:          (null)
[   29.101100] Code: Bad RIP value.
[   29.101480] RSP: 0000:ffffc9000023fb80 EFLAGS: 00010202
[   29.102061] RAX: ffffffff8182d0e0 RBX: ffff88807ceee000 RCX: 0000000000000000
[   29.102818] RDX: ffff88807d560f40 RSI: 0000000000000000 RDI: ffff88807ceee000
[   29.103661] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000002000
[   29.104560] R10: 00000000ffffffff R11: ffff88807c854150 R12: 0000000000000000
[   29.105458] R13: 0000000000000002 R14: ffff88807d7236c0 R15: ffffc9000023fe20
[   29.106438] FS:  00007faba91d7740(0000) GS:ffff88807db80000(0000) knlGS:0000000000000000
[   29.107304] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   29.107917] CR2: ffffffffffffffd6 CR3: 000000007a172000 CR4: 00000000000006a0
[   29.109401] Call Trace:
[   29.110017]  ? blk_poll+0x27c/0x340
[   29.110691]  ? submit_bio+0x40/0x120
[   29.111278]  ? swap_readpage+0x148/0x190
[   29.111924]  ? read_swap_cache_async+0x53/0x60
[   29.112670]  ? swap_cluster_readahead+0x231/0x2b0
[   29.113310]  ? swapin_readahead+0x2ce/0x400
[   29.113878]  ? pagecache_get_page+0x2b/0x210
[   29.114416]  ? do_swap_page+0x42c/0x800
[   29.114919]  ? __handle_mm_fault+0x544/0xdd0
[   29.115455]  ? handle_mm_fault+0x112/0x230
[   29.115978]  ? __do_page_fault+0x196/0x410
[   29.116501]  ? __put_user_4+0x19/0x20
[   29.116990]  ? page_fault+0x5/0x20
[   29.117451]  ? page_fault+0x1b/0x20
[   29.117925] CR2: 0000000000000000
[   29.118472] ---[ end trace 0faa4ddc190b41fa ]---

Reverting QUEUE_FLAG_POLL on top of today linux-next fixes the problem:

diff --git a/block/blk-mq.c b/block/blk-mq.c
index eabc7fcd96db..7dcf23e838ec 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2828,6 +2828,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
 	q->queue_flags |= QUEUE_FLAG_MQ_DEFAULT;
 	if (set->nr_maps > HCTX_TYPE_POLL)
 		blk_queue_flag_set(QUEUE_FLAG_POLL, q);
+	q->queue_flags &= ~(1 << QUEUE_FLAG_POLL);
 
 	if (!(set->flags & BLK_MQ_F_SG_MERGE))
 		blk_queue_flag_set(QUEUE_FLAG_NO_SG_MERGE, q);

Kirill

View attachment ".config" of type "text/plain" (46314 bytes)

View attachment "simple_madvice.c" of type "text/x-csrc" (544 bytes)