linux-kernel - Re: kernel BUG when mounting large block xfs backed by 9p (folio ref count bug)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aSTwj8LfyFvAXEqc@casper.infradead.org>
Date: Mon, 24 Nov 2025 23:55:59 +0000
From: Matthew Wilcox <willy@...radead.org>
To: Dominique Martinet <asmadeus@...ewreck.org>
Cc: Chris Arges <carges@...udflare.com>,
	David Howells <dhowells@...hat.com>, ericvh@...nel.org,
	lucho@...kov.net, linux_oss@...debyte.com, v9fs@...ts.linux.dev,
	linux-kernel@...r.kernel.org, kernel-team@...udflare.com
Subject: Re: kernel BUG when mounting large block xfs backed by 9p (folio ref
 count bug)

On Tue, Nov 25, 2025 at 08:12:17AM +0900, Dominique Martinet wrote:
> > When the loop-back mount occurs the system crashes immediately with
> > the following:
> > [   31.276957][  T255] loop0: detected capacity change from 0 to 614400
> > [   31.286377][  T255] XFS (loop0): EXPERIMENTAL large block size feature enabled.  Use at your own risk!
> > [   31.286624][  T255] XFS (loop0): Mounting V5 Filesystem fa3c2d3c-b936-4ee3-a5a8-e80ba36298cc
> > [   31.395721][   T62] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102600
> > [   31.395833][   T62] head: order:9 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> > [   31.395915][   T62] flags: 0x2ffff800000040(head|node=0|zone=2|lastcpupid=0x1ffff)
> > [   31.395976][   T62] page_type: f8(unknown)

        PGTY_large_kmalloc      = 0xf8,

So somebody called kmalloc(2 * 1024 * 1024).  Not sure if that's helpful
in tracking this down?

> > [   31.396004][   T62] raw: 002ffff800000040 0000000000000000 dead000000000122 0000000000000000
> > [   31.396092][   T62] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
> > [   31.396174][   T62] head: 002ffff800000040 0000000000000000 dead000000000122 0000000000000000
> > [   31.396251][   T62] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
> > [   31.396339][   T62] head: 002ffff800000009 ffffea0004098001 00000000ffffffff 00000000ffffffff
> > [   31.396425][   T62] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000200
> > [   31.396523][   T62] page dumped because: VM_BUG_ON_FOLIO(((unsigned int) folio_ref_count(folio) + 127u <= 127u))
> > [   31.396641][   T62] ------------[ cut here ]------------
> > [   31.396689][   T62] kernel BUG at include/linux/mm.h:1386!
> > [   31.396748][   T62] Oops: invalid opcode: 0000 [#1] SMP NOPTI
> > [   31.396820][   T62] CPU: 4 UID: 0 PID: 62 Comm: kworker/u32:1 Not tainted 6.18.0-rc7-cloudflare-2025.11.11-21-gab0ed6ff #1 PREEMPT(voluntary)
> > [   31.396947][   T62] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 2025.02-8 05/13/2025                                                                                                                   [   31.397031][   T62] Workqueue: loop0 loop_rootcg_workfn
> > [   31.397084][   T62] RIP: 0010:__iov_iter_get_pages_alloc+0x7b6/0x920
> > [   31.397152][   T62] Code: 08 4c 89 5d 10 44 88 55 20 e9 0d fb ff ff 0f 0b 4d 85 ed 0f 85 fc fb ff ff e9 38 fd ff ff 48 c7 c6 20 88 6d 83 e8 fa 2f b7 ff <0f> 0b 31 f6 b9 c0 0c 00 00 ba 01 00 00 00 4c 89 0c 24 48 8d 3
> > c dd
> > [   31.397310][   T62] RSP: 0018:ffffc90000257908 EFLAGS: 00010246
> > [   31.397365][   T62] RAX: 000000000000005c RBX: 0000000000000020 RCX: 0000000000000003
> > [   31.397424][   T62] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffff83f38508
> > [   31.397498][   T62] RBP: ffff888101af90f8 R08: 0000000000000000 R09: ffffc900002577a0
> > [   31.397571][   T62] R10: ffffffff83f084c8 R11: 0000000000000003 R12: 0000000000020000
> > [   31.397654][   T62] R13: ffffc90000257a70 R14: ffffc90000257a68 R15: ffffea0004098000
> > [   31.397727][   T62] FS:  0000000000000000(0000) GS:ffff8882b3266000(0000) knlGS:0000000000000000
> > [   31.397819][   T62] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [   31.397890][   T62] CR2: 00007f846eb985a0 CR3: 0000000004620003 CR4: 0000000000772ef0
> > [   31.397964][   T62] PKRU: 55555554
> > [   31.398005][   T62] Call Trace:
> > [   31.398045][   T62]  <TASK>
> > [   31.398075][   T62]  ? kvm_sched_clock_read+0x11/0x20
> > [   31.398131][   T62]  ? sched_clock+0x10/0x30
> > [   31.398179][   T62]  ? sched_clock_cpu+0xf/0x1d0
> > [   31.398234][   T62]  iov_iter_get_pages_alloc2+0x20/0x50
> > [   31.398277][   T62]  p9_get_mapped_pages.part.0.constprop.0+0x6f/0x280 [9pnet_virtio]

Oh, hang on.  You're passing a kmalloc'ed page to
iov_iter_get_pages_alloc().  That's not allowed ...

see https://lore.kernel.org/all/20250310142750.1209192-1-willy@infradead.org/

> > [   31.398354][   T62]  ? p9pdu_vwritef+0xe0/0x6e0 [9pnet]
> > [   31.398413][   T62]  ? pdu_write+0x2d/0x40 [9pnet]
> > [   31.398464][   T62]  p9_virtio_zc_request+0x92/0x69a [9pnet_virtio]
> > [   31.398530][   T62]  ? p9pdu_vwritef+0xe0/0x6e0 [9pnet]
> > [   31.398582][   T62]  ? p9pdu_finalize+0x32/0x90 [9pnet]
> > [   31.398620][   T62]  ? p9_client_prepare_req+0xbe/0x150 [9pnet]
> > [   31.398693][   T62]  p9_client_zc_rpc.constprop.0+0xf4/0x2f0 [9pnet]
> > [   31.398768][   T62]  ? p9_client_xattrwalk+0x148/0x1d0 [9pnet]
> > [   31.398840][   T62]  p9_client_write+0x16a/0x240 [9pnet]