linux-kernel - Re: Bug in Kernel 6.8.x, 6.9.x Causing Trace/Panic During Shutdown/Reboot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAE4VaRFwdxNuUWb=S+itDLZf1rOZx9px+xoLWCi+hdUaWJwj6Q@mail.gmail.com>
Date: Thu, 13 Jun 2024 10:32:24 +0300
From: Ilkka Naulapää <digirigawa@...il.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: "Linux regression tracking (Thorsten Leemhuis)" <regressions@...mhuis.info>, 
	Linux regressions mailing list <regressions@...ts.linux.dev>, stable@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org
Subject: Re: Bug in Kernel 6.8.x, 6.9.x Causing Trace/Panic During Shutdown/Reboot

ok, so if you don't have any idea where this bug is after those debug
patches, I'll try to find some time to bisect it as a last resort.
Stay tuned.

--Ilkka

On Wed, Jun 12, 2024 at 6:56 PM Steven Rostedt <rostedt@...dmis.org> wrote:
>
> On Wed, 12 Jun 2024 15:36:22 +0200
> "Linux regression tracking (Thorsten Leemhuis)" <regressions@...mhuis.info> wrote:
>
> > Hi, Thorsten here, the Linux kernel's regression tracker. Top-posting
> > for once, to make this easily accessible to everyone.
> >
> > Ilkka or Steven, what happened to this? This thread looks stalled. I
> > also was unsuccessful when looking for other threads related to this
> > report or the culprit. Did it fall through the cracks or am I missing
> > something here?
>
> Honesty, I have no idea where the bug is. I can't reproduce it. These
> patches I sent would check all the places that add to the list to make
> sure the proper trace_inode was being added, and the output shows that
> they are all correct. Then suddenly, something that came from the
> inode cache is calling the tracefs inode cache to free it, and that's
> where the bug is happening.
>
> This really looks like another bug that the recent changes have made
> more predominate.
>
> -- Steve
>
>
> >
> > Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
> > --
> > Everything you wanna know about Linux kernel regression tracking:
> > https://linux-regtracking.leemhuis.info/about/#tldr
> > If I did something stupid, please tell me, as explained on that page.
> >
> > #regzbot poke
> >
> > On 02.06.24 09:32, Ilkka Naulapää wrote:
> > > sorry longer delay, been a bit busy but here is the result from that
> > > new patch. Only applied this patch so if the previous one is needed
> > > also, let me know and I'll rerun it.
> > >
> > > --Ilkka
> > >
> > > On Thu, May 30, 2024 at 5:00 PM Steven Rostedt <rostedt@...dmis.org> wrote:
> > >>
> > >> On Thu, 30 May 2024 16:02:37 +0300
> > >> Ilkka Naulapää <digirigawa@...il.com> wrote:
> > >>
> > >>> applied your patch and here's the output.
> > >>>
> > >>
> > >> Unfortunately, it doesn't give me any new information. I added one more
> > >> BUG on, want to try this? Otherwise, I'm pretty much at a lost. :-/
> > >>
> > >> -- Steve
> > >>
> > >> diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
> > >> index de5b72216b1a..a090495e78c9 100644
> > >> --- a/fs/tracefs/inode.c
> > >> +++ b/fs/tracefs/inode.c
> > >> @@ -39,13 +39,17 @@ static struct inode *tracefs_alloc_inode(struct super_block *sb)
> > >>                 return NULL;
> > >>
> > >>         ti->flags = 0;
> > >> +       ti->magic = 20240823;
> > >>
> > >>         return &ti->vfs_inode;
> > >>  }
> > >>
> > >>  static void tracefs_free_inode(struct inode *inode)
> > >>  {
> > >> -       kmem_cache_free(tracefs_inode_cachep, get_tracefs(inode));
> > >> +       struct tracefs_inode *ti = get_tracefs(inode);
> > >> +
> > >> +       BUG_ON(ti->magic != 20240823);
> > >> +       kmem_cache_free(tracefs_inode_cachep, ti);
> > >>  }
> > >>
> > >>  static ssize_t default_read_file(struct file *file, char __user *buf,
> > >> @@ -147,16 +151,6 @@ static const struct inode_operations tracefs_dir_inode_operations = {
> > >>         .rmdir          = tracefs_syscall_rmdir,
> > >>  };
> > >>
> > >> -struct inode *tracefs_get_inode(struct super_block *sb)
> > >> -{
> > >> -       struct inode *inode = new_inode(sb);
> > >> -       if (inode) {
> > >> -               inode->i_ino = get_next_ino();
> > >> -               inode->i_atime = inode->i_mtime = inode_set_ctime_current(inode);
> > >> -       }
> > >> -       return inode;
> > >> -}
> > >> -
> > >>  struct tracefs_mount_opts {
> > >>         kuid_t uid;
> > >>         kgid_t gid;
> > >> @@ -384,6 +378,7 @@ static void tracefs_dentry_iput(struct dentry *dentry, struct inode *inode)
> > >>                 return;
> > >>
> > >>         ti = get_tracefs(inode);
> > >> +       BUG_ON(ti->magic != 20240823);
> > >>         if (ti && ti->flags & TRACEFS_EVENT_INODE)
> > >>                 eventfs_set_ef_status_free(dentry);
> > >>         iput(inode);
> > >> @@ -568,6 +563,18 @@ struct dentry *eventfs_end_creating(struct dentry *dentry)
> > >>         return dentry;
> > >>  }
> > >>
> > >> +struct inode *tracefs_get_inode(struct super_block *sb)
> > >> +{
> > >> +       struct inode *inode = new_inode(sb);
> > >> +
> > >> +       BUG_ON(sb->s_op != &tracefs_super_operations);
> > >> +       if (inode) {
> > >> +               inode->i_ino = get_next_ino();
> > >> +               inode->i_atime = inode->i_mtime = inode_set_ctime_current(inode);
> > >> +       }
> > >> +       return inode;
> > >> +}
> > >> +
> > >>  /**
> > >>   * tracefs_create_file - create a file in the tracefs filesystem
> > >>   * @name: a pointer to a string containing the name of the file to create.
> > >> diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h
> > >> index 69c2b1d87c46..9059b8b11bb6 100644
> > >> --- a/fs/tracefs/internal.h
> > >> +++ b/fs/tracefs/internal.h
> > >> @@ -9,12 +9,15 @@ enum {
> > >>  struct tracefs_inode {
> > >>         unsigned long           flags;
> > >>         void                    *private;
> > >> +       unsigned long           magic;
> > >>         struct inode            vfs_inode;
> > >>  };
> > >>
> > >>  static inline struct tracefs_inode *get_tracefs(const struct inode *inode)
> > >>  {
> > >> -       return container_of(inode, struct tracefs_inode, vfs_inode);
> > >> +       struct tracefs_inode *ti = container_of(inode, struct tracefs_inode, vfs_inode);
> > >> +       BUG_ON(ti->magic != 20240823);
> > >> +       return ti;
> > >>  }
> > >>
> > >>  struct dentry *tracefs_start_creating(const char *name, struct dentry *parent);
>