linux-kernel - Re: [REGRESSION] 9pfs issues on 6.12-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2196250.1729540103@warthog.procyon.org.uk>
Date: Mon, 21 Oct 2024 20:48:23 +0100
From: David Howells <dhowells@...hat.com>
To: Antony Antony <antony@...nome.org>
Cc: dhowells@...hat.com, Sedat Dilek <sedat.dilek@...il.com>,
    Maximilian Bosch <maximilian@...sch.me>,
    Linux regressions mailing list <regressions@...ts.linux.dev>,
    LKML <linux-kernel@...r.kernel.org>, linux-fsdevel@...r.kernel.org,
    Christian Brauner <brauner@...nel.org>
Subject: Re: [REGRESSION] 9pfs issues on 6.12-rc1

I may have reproduced the bug (see attached), though the symptoms are slightly
different.  Hopefully, it's just the one bug.

David
---
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x5626ca804 pfn:0x7948
flags: 0x2000000000000000(zone=1)
raw: 2000000000000000 ffffea000024d3c8 ffffea00001e5248 0000000000000000
raw: 00000005626ca804 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u))
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:1444!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 3 UID: 0 PID: 303 Comm: md5sum Not tainted 6.12.0-rc2-ktest-00012-g57e4ac5316ef-dirty #8
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
RIP: 0010:__iov_iter_get_pages_alloc+0x701/0x7e0
Code: 0f 0b 4d 85 f6 0f 85 f8 fc ff ff e9 21 fe ff ff 48 c7 c6 38 6b 40 82 e8 cd f4 aa ff 0f 0b 48 c7 c6 38 6b 40 82 e8 bf f4 aa ff <0f> 0b 4d 89 6a 18 49 89 52 08 4d 89 42 10 45 88 4a 20 e9 26 fb ff
RSP: 0018:ffff88800804f5c0 EFLAGS: 00010286
RAX: 000000000000005c RBX: 0000000000001000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000027 RDI: 00000000ffffffff
RBP: ffff88800804f648 R08: ffff88807f1d8fa8 R09: 00000000fffc0000
R10: ffff88807dbd9000 R11: 0000000000000002 R12: 0000000000000001
R13: 0000000000001000 R14: 0000000000000000 R15: 0000000000001000
FS:  00007f0c42c29580(0000) GS:ffff88807d8c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560cff5bb000 CR3: 00000000046a0002 CR4: 0000000000370eb0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ? __die_body.cold+0x19/0x2b
 ? __die+0x2a/0x40
 ? die+0x2f/0x50
 ? do_trap+0xb8/0x100
 ? do_error_trap+0x6c/0x90
 ? __iov_iter_get_pages_alloc+0x701/0x7e0
 ? exc_invalid_op+0x52/0x70
 ? __iov_iter_get_pages_alloc+0x701/0x7e0
 ? asm_exc_invalid_op+0x1b/0x20
 ? __iov_iter_get_pages_alloc+0x701/0x7e0
 ? radix_tree_node_alloc.constprop.0+0xab/0xf0
 iov_iter_get_pages_alloc2+0x20/0x50
 p9_get_mapped_pages.part.0+0x77/0x260
 ? find_held_lock+0x31/0x90
 ? p9_tag_alloc+0x1c8/0x2f0
 p9_virtio_zc_request+0x339/0x6f0
 ? debug_smp_processor_id+0x17/0x20
 ? debug_smp_processor_id+0x17/0x20
 ? rcu_is_watching+0x11/0x50
 ? p9_client_prepare_req+0x15f/0x190
 p9_client_zc_rpc.constprop.0+0xe6/0x330
 p9_client_read_once+0x145/0x2b0
 p9_client_read+0x59/0x80
 v9fs_issue_read+0x3d/0xa0
 netfs_read_to_pagecache+0x27b/0x580
 netfs_readahead+0x197/0x2f0
 read_pages+0x4a/0x300
 page_cache_ra_unbounded+0x197/0x250
 page_cache_ra_order+0x2f7/0x400
 ? __this_cpu_preempt_check+0x13/0x20
 ? lock_release+0x168/0x290
 page_cache_async_ra+0x1be/0x220
 filemap_get_pages+0x2f3/0x870
 filemap_read+0xdc/0x470
 ? __this_cpu_preempt_check+0x13/0x20
 ? lock_acquire+0xcc/0x1c0
 ? preempt_count_add+0x4e/0xc0
 ? down_read_interruptible+0xb3/0x1b0
 netfs_buffered_read_iter+0x5c/0x90
 netfs_file_read_iter+0x29/0x40
 v9fs_file_read_iter+0x1b/0x30
 vfs_read+0x22b/0x330
 ksys_read+0x62/0xe0
 __x64_sys_read+0x19/0x20
 x64_sys_call+0x1b70/0x1d20
 do_syscall_64+0x47/0x110
 entry_SYSCALL_64_after_hwframe+0x76/0x7e