From: "Björn Töpel" <bjorn@kernel.org>
To: linux-fsdevel@vger.kernel.org,
Alexander Viro <viro@zeniv.linux.org.uk>,
Christian Brauner <brauner@kernel.org>, Jan Kara <jack@suse.cz>,
linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org
Cc: "Theodore Ts'o" <tytso@mit.edu>,
Andreas Dilger <adilger.kernel@dilger.ca>,
linux-ext4@vger.kernel.org, Conor Dooley <conor@kernel.org>
Subject: riscv32 EXT4 splat, 6.8 regression?
Date: Fri, 12 Apr 2024 16:57:08 +0200 [thread overview]
Message-ID: <878r1ibpdn.fsf@all.your.base.are.belong.to.us> (raw)
Hi!
I've been looking at an EXT4 splat on riscv32, that LKFT found [1]:
| EXT4-fs (vda): mounted filesystem 13697a42-d10e-4a9e-8e56-cb9083be92f9 ro with ordered data mode. Quota mode: disabled.
| VFS: Mounted root (ext4 filesystem) readonly on device 254:0.
| Unable to handle kernel NULL pointer dereference at virtual address 00000006
| Oops [#1]
| Modules linked in:
| CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.8.0 #41
| Hardware name: riscv-virtio,qemu (DT)
| epc : ext4_search_dir+0x52/0xe4
| ra : __ext4_find_entry+0x1d6/0x578
| epc : c035b60e ra : c035b876 sp : c253fc10
| gp : c21a7380 tp : c25c8000 t0 : 44c0657f
| t1 : 0000000c t2 : 1de5b089 s0 : c253fc50
| s1 : 00000000 a0 : fffffffc a1 : fffff000
| a2 : 00000000 a3 : c29c04f8 a4 : c253fd00
| a5 : 00000000 a6 : c253fcfc a7 : fffffff3
| s2 : 00001000 s3 : 00000000 s4 : 00001000
| s5 : c29c04f8 s6 : c292db40 s7 : c253fcfc
| s8 : fffffff7 s9 : c253fd00 s10: fffff000
| s11: c292db40 t3 : 00000007 t4 : 5e8b4525
| t5 : 00000000 t6 : 00000000
| status: 00000120 badaddr: 00000006 cause: 0000000d
| [<c035b60e>] ext4_search_dir+0x52/0xe4
| [<c035b876>] __ext4_find_entry+0x1d6/0x578
| [<c035bcaa>] ext4_lookup+0x92/0x200
| [<c0295c14>] __lookup_slow+0x8e/0x142
| [<c029943a>] walk_component+0x104/0x174
| [<c0299f18>] path_lookupat+0x78/0x182
| [<c029b24c>] filename_lookup+0x96/0x158
| [<c029b346>] kern_path+0x38/0x56
| [<c0c1bee4>] init_mount+0x46/0x96
| [<c0c2ae1c>] devtmpfs_mount+0x44/0x7a
| [<c0c01c26>] prepare_namespace+0x226/0x27c
| [<c0c01130>] kernel_init_freeable+0x27e/0x2a0
| [<c0b78402>] kernel_init+0x2a/0x158
| [<c0b82bf2>] ret_from_fork+0xe/0x20
| Code: 84ae a809 d303 0044 949a 0f63 0603 991a fd63 0584 (c603) 0064
| ---[ end trace 0000000000000000 ]---
| Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
This was not present in 6.7. Bisection wasn't really helpful (to me at
least); I got it down to commit c604110e662a ("Merge tag 'vfs-6.8.misc'
of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs"), and when I
revert the commits in the vfs merge the splat went away, but I *really*
struggle to see how those are related...
What I see in ext4_search_dir() is that search_buf is 0xfffff000, and at
some point the address wraps to zero, and boom. I doubt that 0xfffff000
is a sane address.
Maybe this is something the the fs folks can spot directly? In the
meantime I'll continue to dig...
Thanks, and have a nice weeked!
Björn
[1] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.8.y/build/v6.8.4-281-g6d08df6c401e/testrun/23369914/suite/log-parser-test/tests/
next reply other threads:[~2024-04-12 14:57 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-12 14:57 Björn Töpel [this message]
2024-04-12 15:43 ` riscv32 EXT4 splat, 6.8 regression? Theodore Ts'o
2024-04-12 16:59 ` Björn Töpel
2024-04-13 4:35 ` Theodore Ts'o
2024-04-13 10:01 ` Conor Dooley
2024-04-13 14:43 ` Nam Cao
2024-04-14 0:24 ` Theodore Ts'o
2024-04-14 1:46 ` Andreas Dilger
2024-04-14 2:04 ` Theodore Ts'o
2024-04-14 2:18 ` Al Viro
2024-04-14 2:15 ` Al Viro
2024-04-14 4:16 ` Andreas Dilger
2024-04-14 14:08 ` Björn Töpel
2024-04-15 13:04 ` Christian Brauner
2024-04-15 16:04 ` Björn Töpel
2024-04-16 6:44 ` Nam Cao
2024-04-16 8:25 ` Christian Brauner
2024-04-16 11:02 ` Björn Töpel
2024-04-16 14:24 ` Mike Rapoport
2024-04-16 15:17 ` Nam Cao
2024-04-16 15:30 ` Nam Cao
2024-04-16 15:56 ` Björn Töpel
2024-04-16 16:19 ` Nam Cao
2024-04-16 16:31 ` Mike Rapoport
2024-04-16 17:00 ` Matthew Wilcox
2024-04-16 18:34 ` Mike Rapoport
2024-04-16 22:36 ` Nam Cao
2024-04-17 15:31 ` Theodore Ts'o
2024-04-17 18:06 ` Nam Cao
2024-04-17 19:34 ` Mike Rapoport
2024-04-17 22:09 ` Andreas Dilger
2024-04-18 9:17 ` Nam Cao
2024-04-16 18:05 ` Björn Töpel
2024-04-16 18:09 ` Nam Cao
2024-04-16 16:19 ` Mike Rapoport
2024-04-16 16:31 ` Matthew Wilcox
2024-04-16 18:18 ` Mike Rapoport
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878r1ibpdn.fsf@all.your.base.are.belong.to.us \
--to=bjorn@kernel.org \
--cc=adilger.kernel@dilger.ca \
--cc=brauner@kernel.org \
--cc=conor@kernel.org \
--cc=jack@suse.cz \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=tytso@mit.edu \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).