Message-ID: <dba3f7d693a1e224f4b6808ea0c38eb4897d7121.camel@gmx.de>
Date:   Sat, 06 May 2023 04:36:56 +0200
From:   Mike Galbraith <efault@....de>
To:     LKML <linux-kernel@...r.kernel.org>
Subject: ext4_release_dir..rb_next_postorder crash during resume

[11440.128780] PM: suspend exit
[11441.013370] general protection fault, probably for non-canonical address 0x3c301188a7121294: 0000 [#1] SMP NOPTI
[11441.013379] CPU: 0 PID: 20199 Comm: mandb Kdump: loaded Tainted: G            E      6.3.0.g78b421b-master #9
[11441.013383] Hardware name: MEDION MS-7848/MS-7848, BIOS M7848W08.20C 09/23/2013
[11441.013385] RIP: 0010:rb_next_postorder+0x10/0x50
[11441.013391] Code: 10 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 31 c0 48 85 ff 74 12 48 8b 17 48 83 e2 fc 74 09 <48> 39 7a 10 48 89 d0 74 05 c3 cc cc cc cc 48 8b 52 08 48 85 d2 74
[11441.013395] RSP: 0018:ffff888289a73e70 EFLAGS: 00010206
[11441.013397] RAX: 0000000000000000 RBX: ffff88819472c7d8 RCX: 0000000000377d77
[11441.013400] RDX: 3c301188a7121284 RSI: ffff88819472ca48 RDI: ffff88819472c7e0
[11441.013402] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff888194793740
[11441.013403] R10: 0000000000000246 R11: 0000000000000000 R12: ffff88819472c7d8
[11441.013405] R13: 0000000000000000 R14: ffff888194793fc0 R15: 0000000000000000
[11441.013407] FS:  00007f00826235c0(0000) GS:ffff88840ec00000(0000) knlGS:0000000000000000
[11441.013410] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[11441.013421] CR2: 000055b19886e000 CR3: 000000022743a002 CR4: 00000000001706f0
[11441.013423] Call Trace:
[11441.013426]  <TASK>
[11441.013429]  free_rb_tree_fname+0x2f/0x70 [ext4]
[11441.013465]  ext4_release_dir+0x1a/0x30 [ext4]
[11441.013486]  __fput+0x87/0x240
[11441.013491]  task_work_run+0x66/0xa0
[11441.013505]  exit_to_user_mode_prepare+0x18a/0x190
[11441.013508]  syscall_exit_to_user_mode+0x12/0x30
[11441.013512]  do_syscall_64+0x46/0x90
[11441.013515]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[11441.013519] RIP: 0033:0x7f0081716ae7
[11441.013521] Code: 02 b8 ff ff ff ff eb c0 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 09 f3 c3 0f 1f 80 00 00 00 00 48 8b 15 71 d3
[11441.013524] RSP: 002b:00007ffcc64775e8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[11441.013527] RAX: 0000000000000000 RBX: 000055b198858b30 RCX: 00007f0081716ae7
[11441.013529] RDX: 00007f00817f4a40 RSI: 0000000000000000 RDI: 0000000000000004
[11441.013530] RBP: 000055b1974208e0 R08: 0000000000000000 R09: 000055b197420878
[11441.013532] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffcc6477708
[11441.013534] R13: 000055b198858b50 R14: 000055b198865e70 R15: 0000000000000000
[11441.013536]  </TASK>
[11441.013538] Modules linked in: af_packet(E) uas(E) ip6table_mangle(E) ip6table_raw(E) iptable_raw(E) usblp(E) joydev(E) usb_storage(E) bridge(E) stp(E) llc(E) iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) nfnetlink(E) ebtable_filter(E) ebtables(E) ip6table_filter(E) ip6_tables(E) iptable_filter(E) bpfilter(E) nls_iso8859_1(E) nls_cp437(E) intel_rapl_msr(E) intel_rapl_common(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) coretemp(E) kvm_intel(E) iTCO_wdt(E) snd_hda_codec_realtek(E) intel_pmc_bxt(E) at24(E) snd_hda_codec_generic(E) regmap_i2c(E) ledtrig_audio(E) snd_hda_codec_hdmi(E) mei_hdcp(E) iTCO_vendor_support(E) snd_hda_intel(E) snd_intel_dspcfg(E) kvm(E) snd_hda_codec(E) snd_hwdep(E) snd_hda_core(E) r8169(E) irqbypass(E) snd_pcm(E) realtek(E) i2c_i801(E) snd_timer(E) pcspkr(E) mdio_devres(E) i2c_smbus(E) mei_me(E) snd(E) lpc_ich(E) libphy(E) soundcore(E) mfd_core(E) mei(E) fan(E) thermal(E) intel_smartconnect(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sch_fq_codel(E) sunrpc(E) fuse(E) configfs(E)
[11441.013582]  ip_tables(E) x_tables(E) hid_logitech_hidpp(E) hid_logitech_dj(E) hid_generic(E) usbhid(E) nouveau(E) drm_ttm_helper(E) ttm(E) i2c_algo_bit(E) drm_display_helper(E) crct10dif_pclmul(E) crc32_pclmul(E) ghash_clmulni_intel(E) drm_kms_helper(E) sha512_ssse3(E) sha512_generic(E) xhci_pci(E) syscopyarea(E) sysfillrect(E) ehci_pci(E) sysimgblt(E) ahci(E) aesni_intel(E) xhci_hcd(E) libahci(E) crypto_simd(E) ehci_hcd(E) cryptd(E) drm(E) libata(E) usbcore(E) cec(E) usb_common(E) rc_core(E) video(E) wmi(E) button(E) sd_mod(E) t10_pi(E) crc64_rocksoft_generic(E) crc64_rocksoft(E) crc64(E) vfat(E) fat(E) virtio_blk(E) virtio_mmio(E) virtio(E) virtio_ring(E) ext4(E) crc32c_intel(E) crc16(E) mbcache(E) jbd2(E) loop(E) sg(E) dm_multipath(E) dm_mod(E) scsi_dh_rdac(E) scsi_dh_emc(E) scsi_dh_alua(E) scsi_mod(E) scsi_common(E) msr(E) efivarfs(E) autofs4(E)
[11441.013627] Dumping ftrace buffer:
[11441.013630]    (ftrace buffer empty)

(gdb) list *rb_next_postorder+0x10
0xffffffff818d9eb0 is in rb_next_postorder (lib/rbtree.c:612).
607             if (!node)
608                     return NULL;
609             parent = rb_parent(node);
610
611             /* If we're sitting on node, we've already seen our children */
612             if (parent && node == parent->rb_left && parent->rb_right) {
613                     /* If we are the parent's left node, go to the parent's right
614                      * node then all the way down to the left */
615                     return rb_left_deepest_node(parent->rb_right);
616             } else
(gdb)

Powered by blists - more mailing lists