linux-kernel - Re: [PATCH] ext4: fix crash on test_mb_mark

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <av5necgeitkiormvqsh75kvgq3arjwxxqxpqievulgz2rvi3dg@75hdi2ubarmr>
Date: Fri, 25 Jul 2025 13:06:18 +0200
From: Jan Kara <jack@...e.cz>
To: Zhang Yi <yi.zhang@...weicloud.com>
Cc: linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org, tytso@....edu, adilger.kernel@...ger.ca, jack@...e.cz, 
	ojaswin@...ux.ibm.com, linux@...ck-us.net, yi.zhang@...wei.com, libaokun1@...wei.com, 
	yukuai3@...wei.com, yangerkun@...wei.com
Subject: Re: [PATCH] ext4: fix crash on test_mb_mark_used kunit tests

On Fri 25-07-25 10:16:54, Zhang Yi wrote:
> From: Zhang Yi <yi.zhang@...wei.com>
> 
> mb_set_largest_free_order() requires the parameter bb_largest_free_order
> and the list bb_largest_free_order_node to be initialized, and
> mb_update_avg_fragment_size() requires the parameter
> bb_avg_fragment_size_order and bb_avg_fragment_size_node to be
> initialized too. But the test_mb_mark_used kunit tests do not init these
> parameters, and trigger the following crash issue.
> 
>  Pid: 35, comm: kunit_try_catch Tainted: G W N 6.16.0-rc4-00031-gbbe11dd13a3f-dirty
>  RIP: 0033:mb_set_largest_free_order+0x5c/0xc0
>  RSP: 00000000a0883d98  EFLAGS: 00010206
>  RAX: 0000000060aeaa28 RBX: 0000000060a2d400 RCX: 0000000000000008
>  RDX: 0000000060aea9c0 RSI: 0000000000000000 RDI: 0000000060864000
>  RBP: 0000000060aea9c0 R08: 0000000000000000 R09: 0000000060a2d400
>  R10: 0000000000000400 R11: 0000000060a9cc00 R12: 0000000000000006
>  R13: 0000000000000400 R14: 0000000000000305 R15: 0000000000000000
>  Kernel panic - not syncing: Segfault with no mm
>  CPU: 0 UID: 0 PID: 35 Comm: kunit_try_catch Tainted: G W N 6.16.0-rc4-00031-gbbe11dd13a3f-dirty #36 NONE
>  Tainted: [W]=WARN, [N]=TEST
>  Stack:
>   60210c60 00000200 60a9e400 00000400
>   40060300280 60864000 60a9cc00 60a2d400
>   00000400 60aea9c0 60a9cc00 60aea9c0
>  Call Trace:
>   [<60210c60>] ? ext4_mb_generate_buddy+0x1f0/0x230
>   [<60215c3b>] ? test_mb_mark_used+0x28b/0x4e0
>   [<601df5bc>] ? ext4_get_group_desc+0xbc/0x150
>   [<600bf1c0>] ? ktime_get_ts64+0x0/0x190
>   [<60086370>] ? to_kthread+0x0/0x40
>   [<602b559b>] ? kunit_try_run_case+0x7b/0x100
>   [<60086370>] ? to_kthread+0x0/0x40
>   [<602b7850>] ? kunit_generic_run_threadfn_adapter+0x0/0x30
>   [<602b7862>] ? kunit_generic_run_threadfn_adapter+0x12/0x30
>   [<60086a51>] ? kthread+0xf1/0x250
>   [<6004a541>] ? new_thread_handler+0x41/0x60
>  [ERROR] Test: test_mb_mark_used: 0 tests run!
> 
> Fixes: bbe11dd13a3f ("ext4: fix largest free orders lists corruption on mb_optimize_scan switch")
> Reported-by: Theodore Ts'o <tytso@....edu>
> Closes: https://lore.kernel.org/linux-ext4/20250724145437.GD80823@mit.edu/
> Signed-off-by: Zhang Yi <yi.zhang@...wei.com>
> ---
> This patch applies to the kernel that has only merged bbe11dd13a3f
> ("ext4: fix largest free orders lists corruption on mb_optimize_scan
> switch"), but not merged 458bfb991155 ("ext4: convert free groups order
> lists to xarrays").

Hum, I think it would be best to just squash this into bbe11dd13a3f and
then just rebase & squash the other unittest fixup to the final commit when
we have to rebase anyway. Because otherwise backports to stable kernel will
quickly become rather messy.

								Honza

 
>  fs/ext4/mballoc-test.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/fs/ext4/mballoc-test.c b/fs/ext4/mballoc-test.c
> index d634c12f1984..ba939be0ec55 100644
> --- a/fs/ext4/mballoc-test.c
> +++ b/fs/ext4/mballoc-test.c
> @@ -802,6 +802,10 @@ static void test_mb_mark_used(struct kunit *test)
>  	KUNIT_ASSERT_EQ(test, ret, 0);
>  
>  	grp->bb_free = EXT4_CLUSTERS_PER_GROUP(sb);
> +	grp->bb_largest_free_order = -1;
> +	grp->bb_avg_fragment_size_order = -1;
> +	INIT_LIST_HEAD(&grp->bb_largest_free_order_node);
> +	INIT_LIST_HEAD(&grp->bb_avg_fragment_size_node);
>  	mbt_generate_test_ranges(sb, ranges, TEST_RANGE_COUNT);
>  	for (i = 0; i < TEST_RANGE_COUNT; i++)
>  		test_mb_mark_used_range(test, &e4b, ranges[i].start,
> @@ -875,6 +879,10 @@ static void test_mb_free_blocks(struct kunit *test)
>  	ext4_unlock_group(sb, TEST_GOAL_GROUP);
>  
>  	grp->bb_free = 0;
> +	grp->bb_largest_free_order = -1;
> +	grp->bb_avg_fragment_size_order = -1;
> +	INIT_LIST_HEAD(&grp->bb_largest_free_order_node);
> +	INIT_LIST_HEAD(&grp->bb_avg_fragment_size_node);
>  	memset(bitmap, 0xff, sb->s_blocksize);
>  
>  	mbt_generate_test_ranges(sb, ranges, TEST_RANGE_COUNT);
> -- 
> 2.46.1
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR