linux-kernel - Re: kernel BUG when mounting large block xfs backed by 9p (folio ref count bug)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aSXQy4sPcqbarPcc@861G6M3>
Date: Tue, 25 Nov 2025 09:52:43 -0600
From: Chris Arges <carges@...udflare.com>
To: Dominique Martinet <asmadeus@...ewreck.org>
Cc: David Howells <dhowells@...hat.com>,
	"Matthew Wilcox (Oracle)" <willy@...radead.org>, ericvh@...nel.org,
	lucho@...kov.net, linux_oss@...debyte.com, v9fs@...ts.linux.dev,
	linux-kernel@...r.kernel.org, kernel-team@...udflare.com
Subject: Re: kernel BUG when mounting large block xfs backed by 9p (folio ref
 count bug)

On 2025-11-25 08:12:17, Dominique Martinet wrote:
> Chris Arges wrote on Mon, Nov 24, 2025 at 09:47:23AM -0600:
> > Hello, I found a potential issue in 9p/netfs, I can easily reproduce this on
> > my end. Happy to run additional tests, collect info or test patches as needed.
> 
> Thanks for the report! I've added a few folks in cc.
> 
> > When testing v6.18-rc7 I noticed a crash when doing the following:
> > - Launch the kernel using vng: https://github.com/arighi/virtme-ng
> >   - This uses 9p/virtio to connect to the root filesystem as RW
> > - From within the VM do the following:
> > ```
> > dd if=/dev/zero of=./xfs.img bs=1M count=300
> > yes | mkfs.xfs -b size=8192 ./xfs.img
> > rm -rf ./mount && mkdir -p ./mount
> > mount -o loop ./xfs.img ./mount
> > ```
> 
> Just a note this needs CONFIG_TRANSPARENT_HUGEPAGE to mount a xfs
> filesystem with block size > page size
> With this (and loop, xfs, 9p etc) enabled I could run this script,
> but it didn't blow up on my 9p-next branch;
> I'll try on v6.18-rc7 next but I ran out of time before going to work.
> If you could attach your .config it'd be great to check if I still don't
> repro.
> 

Config attached.
--chris


View attachment "config-amd64" of type "text/plain" (153058 bytes)