linux-kernel - [PATCH] ext4: fix crash on test_mb_mark

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250725021654.3188798-1-yi.zhang@huaweicloud.com>
Date: Fri, 25 Jul 2025 10:16:54 +0800
From: Zhang Yi <yi.zhang@...weicloud.com>
To: linux-ext4@...r.kernel.org
Cc: linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	tytso@....edu,
	adilger.kernel@...ger.ca,
	jack@...e.cz,
	ojaswin@...ux.ibm.com,
	linux@...ck-us.net,
	yi.zhang@...wei.com,
	yi.zhang@...weicloud.com,
	libaokun1@...wei.com,
	yukuai3@...wei.com,
	yangerkun@...wei.com
Subject: [PATCH] ext4: fix crash on test_mb_mark_used kunit tests

From: Zhang Yi <yi.zhang@...wei.com>

mb_set_largest_free_order() requires the parameter bb_largest_free_order
and the list bb_largest_free_order_node to be initialized, and
mb_update_avg_fragment_size() requires the parameter
bb_avg_fragment_size_order and bb_avg_fragment_size_node to be
initialized too. But the test_mb_mark_used kunit tests do not init these
parameters, and trigger the following crash issue.

 Pid: 35, comm: kunit_try_catch Tainted: G W N 6.16.0-rc4-00031-gbbe11dd13a3f-dirty
 RIP: 0033:mb_set_largest_free_order+0x5c/0xc0
 RSP: 00000000a0883d98  EFLAGS: 00010206
 RAX: 0000000060aeaa28 RBX: 0000000060a2d400 RCX: 0000000000000008
 RDX: 0000000060aea9c0 RSI: 0000000000000000 RDI: 0000000060864000
 RBP: 0000000060aea9c0 R08: 0000000000000000 R09: 0000000060a2d400
 R10: 0000000000000400 R11: 0000000060a9cc00 R12: 0000000000000006
 R13: 0000000000000400 R14: 0000000000000305 R15: 0000000000000000
 Kernel panic - not syncing: Segfault with no mm
 CPU: 0 UID: 0 PID: 35 Comm: kunit_try_catch Tainted: G W N 6.16.0-rc4-00031-gbbe11dd13a3f-dirty #36 NONE
 Tainted: [W]=WARN, [N]=TEST
 Stack:
  60210c60 00000200 60a9e400 00000400
  40060300280 60864000 60a9cc00 60a2d400
  00000400 60aea9c0 60a9cc00 60aea9c0
 Call Trace:
  [<60210c60>] ? ext4_mb_generate_buddy+0x1f0/0x230
  [<60215c3b>] ? test_mb_mark_used+0x28b/0x4e0
  [<601df5bc>] ? ext4_get_group_desc+0xbc/0x150
  [<600bf1c0>] ? ktime_get_ts64+0x0/0x190
  [<60086370>] ? to_kthread+0x0/0x40
  [<602b559b>] ? kunit_try_run_case+0x7b/0x100
  [<60086370>] ? to_kthread+0x0/0x40
  [<602b7850>] ? kunit_generic_run_threadfn_adapter+0x0/0x30
  [<602b7862>] ? kunit_generic_run_threadfn_adapter+0x12/0x30
  [<60086a51>] ? kthread+0xf1/0x250
  [<6004a541>] ? new_thread_handler+0x41/0x60
 [ERROR] Test: test_mb_mark_used: 0 tests run!

Fixes: bbe11dd13a3f ("ext4: fix largest free orders lists corruption on mb_optimize_scan switch")
Reported-by: Theodore Ts'o <tytso@....edu>
Closes: https://lore.kernel.org/linux-ext4/20250724145437.GD80823@mit.edu/
Signed-off-by: Zhang Yi <yi.zhang@...wei.com>
---
This patch applies to the kernel that has only merged bbe11dd13a3f
("ext4: fix largest free orders lists corruption on mb_optimize_scan
switch"), but not merged 458bfb991155 ("ext4: convert free groups order
lists to xarrays").

 fs/ext4/mballoc-test.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/ext4/mballoc-test.c b/fs/ext4/mballoc-test.c
index d634c12f1984..ba939be0ec55 100644
--- a/fs/ext4/mballoc-test.c
+++ b/fs/ext4/mballoc-test.c
@@ -802,6 +802,10 @@ static void test_mb_mark_used(struct kunit *test)
 	KUNIT_ASSERT_EQ(test, ret, 0);
 
 	grp->bb_free = EXT4_CLUSTERS_PER_GROUP(sb);
+	grp->bb_largest_free_order = -1;
+	grp->bb_avg_fragment_size_order = -1;
+	INIT_LIST_HEAD(&grp->bb_largest_free_order_node);
+	INIT_LIST_HEAD(&grp->bb_avg_fragment_size_node);
 	mbt_generate_test_ranges(sb, ranges, TEST_RANGE_COUNT);
 	for (i = 0; i < TEST_RANGE_COUNT; i++)
 		test_mb_mark_used_range(test, &e4b, ranges[i].start,
@@ -875,6 +879,10 @@ static void test_mb_free_blocks(struct kunit *test)
 	ext4_unlock_group(sb, TEST_GOAL_GROUP);
 
 	grp->bb_free = 0;
+	grp->bb_largest_free_order = -1;
+	grp->bb_avg_fragment_size_order = -1;
+	INIT_LIST_HEAD(&grp->bb_largest_free_order_node);
+	INIT_LIST_HEAD(&grp->bb_avg_fragment_size_node);
 	memset(bitmap, 0xff, sb->s_blocksize);
 
 	mbt_generate_test_ranges(sb, ranges, TEST_RANGE_COUNT);
-- 
2.46.1