Running some fuzzing by a unprivileged user on virtiofs could trigger the
warning below. The warning was introduced not long ago by the commit
c146024ec44c ("fuse: fix warning in tree_insert() and clean up writepage
insertion").
From the logs, the last piece of the fuzzing code is:
fgetxattr(fd=426, name=0x7f39a69af000, value=0x7f39a8abf000, size=1)
[main] testfile fd:426 filename:trinity-testfile2 flags:2 fopened:1 fcntl_flags:42c00 global:1
[main] start: 0x7f39a58e6000 size:4KB name: trinity-testfile2 global:1
[15969.175004][T179559] WARNING: CPU: 0 PID: 179559 at fs/fuse/file.c:1732 tree_insert.part.40+0x0/0x10 [fuse]
[15969.180644][T179559] Modules linked in: loop isofs kvm_intel kvm irqbypass nls_ascii nls_cp437 vfat fat ip_tables x_tables virtiofs fuse sr_mod sd_mod cdrom ata_piix virtio_pci virtio_ring e1000 virtio libat]
[15969.197671][T179559] CPU: 0 PID: 179559 Comm: trinity-c24 Tainted: G O 5.9.0-rc8-next-20201007+ #1
[15969.204027][T179559] Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014
[15969.208993][T179559] RIP: 0010:tree_insert.part.40+0x0/0x10 [fuse]
[15969.213593][T179559] Code: 44 24 10 48 8b 74 24 08 48 8b 0c 24 e9 40 fc ff ff 66 0f 1f 84 00 00 00 00 00 0f 0b c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 <0f> 0b c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 48 b0
[15969.224348][T179559] RSP: 0018:ffffc90007fc77f8 EFLAGS: 00010286
[15969.227798][T179559] RAX: ffff8884b8f73500 RBX: ffff8884b8f76900 RCX: ffff8889e45ff910
[15969.233572][T179559] RDX: 0000000000000000 RSI: ffff8884b8f76900 RDI: ffff8884b8f735b0
[15969.238282][T179559] RBP: ffffea000550c880 R08: ffff8884b8f769f8 R09: fffff52000ff8ef2
[15969.243394][T179559] R10: 0000000000000003 R11: fffff52000ff8ef2 R12: ffff8889e45ff480
[15969.247845][T179559] R13: ffffea0004d71380 R14: ffff88818285c000 R15: ffff8889e45ff9b0
[15969.252884][T179559] FS: 00007f39a8ab7740(0000) GS:ffff888bcc600000(0000) knlGS:0000000000000000
[15969.258385][T179559] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[15969.262647][T179559] CR2: 000000000000008f CR3: 0000000557d56005 CR4: 0000000000770ef0
[15969.268492][T179559] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[15969.273773][T179559] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[15969.278030][T179559] PKRU: 55555554
[15969.279920][T179559] Call Trace:
[15969.282279][T179559] fuse_writepage_locked+0xa20/0xd10 [fuse]
[15969.285587][T179559] fuse_launder_page+0x5b/0xc0 [fuse]
[15969.288303][T179559] invalidate_inode_pages2_range+0x709/0xa90
invalidate_inode_pages2_range at mm/truncate.c:765
[15969.292495][T179559] ? truncate_exceptional_pvec_entries.part.18+0x460/0x460
[15969.296605][T179559] ? rcu_read_lock_sched_held+0x9c/0xd0
[15969.301015][T179559] ? rcu_read_lock_bh_held+0xb0/0xb0
[15969.304427][T179559] ? rcu_read_unlock+0x40/0x40
[15969.306759][T179559] ? _raw_spin_unlock+0x1a/0x30
[15969.309124][T179559] ? fuse_change_attributes+0x237/0x540 [fuse]
[15969.313701][T179559] fuse_do_getattr+0x28b/0xd50 [fuse]
fuse_do_getattr at fs/fuse/dir.c:962
[15969.316774][T179559] ? do_syscall_64+0x33/0x40
[15969.319617][T179559] ? fuse_dentry_revalidate+0x6c0/0x6c0 [fuse]
[15969.323498][T179559] ? rcu_read_lock_bh_held+0xb0/0xb0
[15969.326591][T179559] ? find_held_lock+0x33/0x1c0
[15969.328989][T179559] ? rwlock_bug.part.1+0x90/0x90
[15969.332202][T179559] fuse_permission+0x29c/0x3c0 [fuse]
[15969.335564][T179559] ? __kasan_kmalloc.constprop.11+0xc1/0xd0
[15969.338445][T179559] inode_permission+0x2c1/0x390
[15969.342187][T179559] vfs_getxattr+0x43/0x80
[15969.344605][T179559] getxattr+0xe5/0x210
[15969.347120][T179559] ? path_listxattr+0x100/0x100
[15969.350019][T179559] ? rcu_read_lock_sched_held+0x9c/0xd0
[15969.354014][T179559] ? rcu_read_lock_bh_held+0xb0/0xb0
[15969.356977][T179559] ? find_held_lock+0x33/0x1c0
[15969.359631][T179559] ? __task_pid_nr_ns+0x127/0x3a0
[15969.363099][T179559] ? lock_downgrade+0x730/0x730
[15969.365714][T179559] ? syscall_enter_from_user_mode+0x17/0x50
[15969.369104][T179559] ? rcu_read_lock_sched_held+0x9c/0xd0
[15969.374492][T179559] __x64_sys_fgetxattr+0xd9/0x140
[15969.377317][T179559] do_syscall_64+0x33/0x40
[15969.380588][T179559] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[15969.384059][T179559] RIP: 0033:0x7f39a83ca78d
[15969.386559][T179559] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8
[15969.399200][T179559] RSP: 002b:00007ffe920f3778 EFLAGS: 00000246 ORIG_RAX: 00000000000000c1
[15969.405661][T179559] RAX: ffffffffffffffda RBX: 00000000000000c1 RCX: 00007f39a83ca78d
[15969.411274][T179559] RDX: 00007f39a8abf000 RSI: 00007f39a69af000 RDI: 00000000000001aa
[15969.415813][T179559] RBP: 00000000000000c1 R08: 0000000004800000 R09: 000000000000003e
[15969.421984][T179559] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002
[15969.426794][T179559] R13: 00007f39a8a08058 R14: 00007f39a8ab76c0 R15: 00007f39a8a08000
[15969.432779][T179559] CPU: 0 PID: 179559 Comm: trinity-c24 Tainted: G O 5.9.0-rc8-next-20201007+ #1
[15969.439042][T179559] Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014
[15969.442756][T179559] Call Trace:
[15969.442756][T179559] dump_stack+0x99/0xcb
[15969.448559][T179559] __warn.cold.13+0xe/0x55
[15969.450606][T179559] ? fuse_write_file_get.isra.35.part.36+0x10/0x10 [fuse]
[15969.450606][T179559] report_bug+0x1af/0x260
[15969.460111][T179559] handle_bug+0x44/0x80
[15969.462805][T179559] exc_invalid_op+0x13/0x40
[15969.462805][T179559] asm_exc_invalid_op+0x12/0x20
[15969.462805][T179559] RIP: 0010:tree_insert.part.40+0x0/0x10 [fuse]
[15969.474710][T179559] Code: 44 24 10 48 8b 74 24 08 48 8b 0c 24 e9 40 fc ff ff 66 0f 1f 84 00 00 00 00 00 0f 0b c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 <0f> 0b c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 48 b0
[15969.474710][T179559] RSP: 0018:ffffc90007fc77f8 EFLAGS: 00010286
[15969.497893][T179559] RAX: ffff8884b8f73500 RBX: ffff8884b8f76900 RCX: ffff8889e45ff910
[15969.497893][T179559] RDX: 0000000000000000 RSI: ffff8884b8f76900 RDI: ffff8884b8f735b0
[15969.497893][T179559] RBP: ffffea000550c880 R08: ffff8884b8f769f8 R09: fffff52000ff8ef2
[15969.510577][T179559] R10: 0000000000000003 R11: fffff52000ff8ef2 R12: ffff8889e45ff480
[15969.516419][T179559] R13: ffffea0004d71380 R14: ffff88818285c000 R15: ffff8889e45ff9b0
[15969.516419][T179559] fuse_writepage_locked+0xa20/0xd10 [fuse]
[15969.516419][T179559] fuse_launder_page+0x5b/0xc0 [fuse]
[15969.532794][T179559] invalidate_inode_pages2_range+0x709/0xa90
[15969.532794][T179559] ? truncate_exceptional_pvec_entries.part.18+0x460/0x460
[15969.541808][T179559] ? rcu_read_lock_sched_held+0x9c/0xd0
[15969.544178][T179559] ? rcu_read_lock_bh_held+0xb0/0xb0
[15969.544178][T179559] ? rcu_read_unlock+0x40/0x40
[15969.552839][T179559] ? _raw_spin_unlock+0x1a/0x30
[15969.552839][T179559] ? fuse_change_attributes+0x237/0x540 [fuse]
[15969.552839][T179559] fuse_do_getattr+0x28b/0xd50 [fuse]
[15969.552839][T179559] ? do_syscall_64+0x33/0x40
[15969.552839][T179559] ? fuse_dentry_revalidate+0x6c0/0x6c0 [fuse]
[15969.552839][T179559] ? rcu_read_lock_bh_held+0xb0/0xb0
[15969.552839][T179559] ? find_held_lock+0x33/0x1c0
[15969.552839][T179559] ? rwlock_bug.part.1+0x90/0x90
[15969.552839][T179559] fuse_permission+0x29c/0x3c0 [fuse]
[15969.552839][T179559] ? __kasan_kmalloc.constprop.11+0xc1/0xd0
[15969.590685][T179559] inode_permission+0x2c1/0x390
[15969.590685][T179559] vfs_getxattr+0x43/0x80
[15969.590685][T179559] getxattr+0xe5/0x210
[15969.590685][T179559] ? path_listxattr+0x100/0x100
[15969.600479][T179559] ? rcu_read_lock_sched_held+0x9c/0xd0
[15969.600479][T179559] ? rcu_read_lock_bh_held+0xb0/0xb0
[15969.600479][T179559] ? find_held_lock+0x33/0x1c0
[15969.600479][T179559] ? __task_pid_nr_ns+0x127/0x3a0
[15969.600479][T179559] ? lock_downgrade+0x730/0x730
[15969.600479][T179559] ? syscall_enter_from_user_mode+0x17/0x50
[15969.600479][T179559] ? rcu_read_lock_sched_held+0x9c/0xd0
[15969.600479][T179559] __x64_sys_fgetxattr+0xd9/0x140
[15969.630463][T179559] do_syscall_64+0x33/0x40
[15969.630463][T179559] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[15969.630463][T179559] RIP: 0033:0x7f39a83ca78d
[15969.630463][T179559] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8
[15969.650571][T179559] RSP: 002b:00007ffe920f3778 EFLAGS: 00000246 ORIG_RAX: 00000000000000c1
[15969.650571][T179559] RAX: ffffffffffffffda RBX: 00000000000000c1 RCX: 00007f39a83ca78d
[15969.650571][T179559] RDX: 00007f39a8abf000 RSI: 00007f39a69af000 RDI: 00000000000001aa
[15969.672210][T179559] RBP: 00000000000000c1 R08: 0000000004800000 R09: 000000000000003e
[15969.672418][T179559] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002
[15969.680577][T179559] R13: 00007f39a8a08058 R14: 00007f39a8ab76c0 R15: 00007f39a8a08000
[15969.689364][T179559] irq event stamp: 2861013
[15969.692445][T179559] hardirqs last enabled at (2861023): [<ffffffff84c2aecf>] console_unlock+0x81f/0xa20
[15969.698923][T179559] hardirqs last disabled at (2861030): [<ffffffff84c2addb>] console_unlock+0x72b/0xa20
[15969.706311][T179559] softirqs last enabled at (2860498): [<ffffffff8600061b>] __do_softirq+0x61b/0x95d
[15969.713236][T179559] softirqs last disabled at (2860383): [<ffffffff85e00ec2>] asm_call_irq_on_stack+0x12/0x20
[15969.720777][T179559] ---[ end trace b6274835e0c14c38 ]---
On Wed, 2020-10-07 at 16:08 -0400, Qian Cai wrote:
> Running some fuzzing by a unprivileged user on virtiofs could trigger the
> warning below. The warning was introduced not long ago by the commit
> c146024ec44c ("fuse: fix warning in tree_insert() and clean up writepage
> insertion").
>
> From the logs, the last piece of the fuzzing code is:
>
> fgetxattr(fd=426, name=0x7f39a69af000, value=0x7f39a8abf000, size=1)
I can still reproduce it on today's linux-next. Any idea on how to debug it
further?
The last syscall to trigger this time is:
ftruncate(fd=410, length=4)
[main] testfile fd:410 filename:trinity-testfile1 flags:2 fopened:1 fcntl_flags:42400 global:1
[main] start: 0x7fadab1eb000 size:4KB name: trinity-testfile1 global:1
[ 3353.774694][T124459] WARNING: CPU: 45 PID: 124459 at fs/fuse/file.c:1742 tree_insert.part.39+0x0/0x10 [fuse]
[ 3353.777295][T124459] Modules linked in: isofs kvm_intel kvm irqbypass nls_ascii nls_cp437 vfat fat ip_tables x_tables virtiofs fuse sr_mod sd_mod cdrom ata_piix virtio_pci virtio_ring e1000 libata virtio dm_d
[ 3353.783690][T124459] CPU: 45 PID: 124459 Comm: trinity-c45 Not tainted 5.10.0-rc1-next-20201029+ #3
[ 3353.786200][T124459] Hardware name: Red Hat KVM, BIOS 1.14.0-1.module+el8.3.0+7638+07cf13d2 04/01/2014
[ 3353.788746][T124459] RIP: 0010:tree_insert.part.39+0x0/0x10 [fuse]
[ 3353.790847][T124459] Code: fd b7 d7 48 8b 0c 24 e9 ec fb ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 0b c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 <0f> 0b c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 48 b0
[ 3353.796025][T124459] RSP: 0018:ffffc90008b4f828 EFLAGS: 00010286
[ 3353.797628][T124459] RAX: ffff88818875cd00 RBX: ffff888261d9a100 RCX: ffff8882051023d0
[ 3353.799752][T124459] RDX: 0000000000000000 RSI: ffff888261d9a100 RDI: ffff88818875cdb0
[ 3353.803681][T124459] RBP: ffffea000a835300 R08: ffff888261d9a1f8 R09: fffff52001169ef8
[ 3353.807019][T124459] R10: 0000000000000003 R11: fffff52001169ef8 R12: ffff888205101f40
[ 3353.810694][T124459] R13: ffffea0007d812c0 R14: ffff8881b48b1000 R15: ffff888205102470
[ 3353.813877][T124459] FS: 00007fadae016740(0000) GS:ffff888bcd140000(0000) knlGS:0000000000000000
[ 3353.817613][T124459] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3353.819366][T124459] CR2: 00000000000000e6 CR3: 0000000125140004 CR4: 0000000000170ee0
[ 3353.822295][T124459] Call Trace:
[ 3353.823242][T124459] fuse_writepage_locked+0xa43/0xd40 [fuse]
[ 3353.824930][T124459] fuse_launder_page+0x5b/0xc0 [fuse]
[ 3353.826466][T124459] invalidate_inode_pages2_range+0x709/0xa90
[ 3353.828231][T124459] ? unmap_mapping_pages+0x91/0x230
[ 3353.829703][T124459] ? truncate_exceptional_pvec_entries.part.18+0x460/0x460
[ 3353.832203][T124459] ? unmap_mapping_pages+0xbd/0x230
[ 3353.833657][T124459] ? virtio_fs_wake_pending_and_unlock+0x1eb/0x610 [virtiofs]
[ 3353.835757][T124459] ? lock_downgrade+0x700/0x700
[ 3353.837184][T124459] ? down_write+0xdb/0x150
[ 3353.838484][T124459] ? unmap_mapping_pages+0xbd/0x230
[ 3353.840278][T124459] ? do_wp_page+0xc50/0xc50
[ 3353.841603][T124459] fuse_do_setattr+0xd9c/0x13f0 [fuse]
[ 3353.843155][T124459] ? print_usage_bug+0x1a0/0x1a0
[ 3353.844527][T124459] ? fuse_flush_times+0x3d0/0x3d0 [fuse]
[ 3353.846129][T124459] ? mark_held_locks+0xb0/0x110
[ 3353.847471][T124459] fuse_setattr+0x1ff/0x4b0 [fuse]
[ 3353.848901][T124459] notify_change+0x6ca/0xc30
[ 3353.850663][T124459] ? down_write_killable_nested+0x170/0x170
[ 3353.852334][T124459] ? do_truncate+0xdd/0x180
[ 3353.853651][T124459] do_truncate+0xdd/0x180
[ 3353.854912][T124459] ? do_sys_openat2+0x5b0/0x5b0
[ 3353.856339][T124459] ? rcu_read_lock_any_held+0xcd/0xf0
[ 3353.857898][T124459] ? __sb_start_write+0x229/0x2d0
[ 3353.859314][T124459] do_sys_ftruncate+0x1f5/0x2c0
[ 3353.861148][T124459] ? trace_hardirqs_on+0x1c/0x150
[ 3353.862529][T124459] do_syscall_64+0x33/0x40
[ 3353.863801][T124459] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 3353.865413][T124459] RIP: 0033:0x7fadad92978d
[ 3353.866612][T124459] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8
[ 3353.872380][T124459] RSP: 002b:00007fffabe83818 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
[ 3353.874667][T124459] RAX: ffffffffffffffda RBX: 000000000000004d RCX: 00007fadad92978d
[ 3353.876842][T124459] RDX: fffffffffffffffd RSI: 0000000000000004 RDI: 000000000000019a
[ 3353.879053][T124459] RBP: 000000000000004d R08: 207124800010c410 R09: 00009a60a1048000
[ 3353.881679][T124459] R10: 00000000ffff0000 R11: 0000000000000246 R12: 0000000000000002
[ 3353.883872][T124459] R13: 00007fadaded4058 R14: 00007fadae0166c0 R15: 00007fadaded4000
[ 3353.886136][T124459] CPU: 45 PID: 124459 Comm: trinity-c45 Not tainted 5.10.0-rc1-next-20201029+ #3
[ 3353.888602][T124459] Hardware name: Red Hat KVM, BIOS 1.14.0-1.module+el8.3.0+7638+07cf13d2 04/01/2014
[ 3353.891506][T124459] Call Trace:
[ 3353.891653][T124459] dump_stack+0x99/0xcb
[ 3353.891653][T124459] __warn.cold.13+0xe/0x55
[ 3353.891653][T124459] ? fuse_write_file_get.isra.34.part.35+0x10/0x10 [fuse]
[ 3353.891653][T124459] report_bug+0x1af/0x260
[ 3353.891653][T124459] handle_bug+0x44/0x80
[ 3353.891653][T124459] exc_invalid_op+0x13/0x40
[ 3353.891653][T124459] asm_exc_invalid_op+0x12/0x20
[ 3353.891653][T124459] RIP: 0010:tree_insert.part.39+0x0/0x10 [fuse]
[ 3353.891653][T124459] Code: fd b7 d7 48 8b 0c 24 e9 ec fb ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 0b c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 <0f> 0b c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 48 b0
[ 3353.891653][T124459] RSP: 0018:ffffc90008b4f828 EFLAGS: 00010286
[ 3353.891653][T124459] RAX: ffff88818875cd00 RBX: ffff888261d9a100 RCX: ffff8882051023d0
[ 3353.891653][T124459] RDX: 0000000000000000 RSI: ffff888261d9a100 RDI: ffff88818875cdb0
[ 3353.891653][T124459] RBP: ffffea000a835300 R08: ffff888261d9a1f8 R09: fffff52001169ef8
[ 3353.891653][T124459] R10: 0000000000000003 R11: fffff52001169ef8 R12: ffff888205101f40
[ 3353.891653][T124459] R13: ffffea0007d812c0 R14: ffff8881b48b1000 R15: ffff888205102470
[ 3353.891653][T124459] fuse_writepage_locked+0xa43/0xd40 [fuse]
[ 3353.891653][T124459] fuse_launder_page+0x5b/0xc0 [fuse]
[ 3353.891653][T124459] invalidate_inode_pages2_range+0x709/0xa90
[ 3353.891653][T124459] ? unmap_mapping_pages+0x91/0x230
[ 3353.891653][T124459] ? truncate_exceptional_pvec_entries.part.18+0x460/0x460
[ 3353.891653][T124459] ? unmap_mapping_pages+0xbd/0x230
[ 3353.891653][T124459] ? virtio_fs_wake_pending_and_unlock+0x1eb/0x610 [virtiofs]
[ 3353.891653][T124459] ? lock_downgrade+0x700/0x700
[ 3353.891653][T124459] ? down_write+0xdb/0x150
[ 3353.891653][T124459] ? unmap_mapping_pages+0xbd/0x230
[ 3353.891653][T124459] ? do_wp_page+0xc50/0xc50
[ 3353.891653][T124459] fuse_do_setattr+0xd9c/0x13f0 [fuse]
[ 3353.891653][T124459] ? print_usage_bug+0x1a0/0x1a0
[ 3353.891653][T124459] ? fuse_flush_times+0x3d0/0x3d0 [fuse]
[ 3353.891653][T124459] ? mark_held_locks+0xb0/0x110
[ 3353.891653][T124459] fuse_setattr+0x1ff/0x4b0 [fuse]
[ 3353.891653][T124459] notify_change+0x6ca/0xc30
[ 3353.891653][T124459] ? down_write_killable_nested+0x170/0x170
[ 3353.891653][T124459] ? do_truncate+0xdd/0x180
[ 3353.891653][T124459] do_truncate+0xdd/0x180
[ 3353.891653][T124459] ? do_sys_openat2+0x5b0/0x5b0
[ 3353.891653][T124459] ? rcu_read_lock_any_held+0xcd/0xf0
[ 3353.891653][T124459] ? __sb_start_write+0x229/0x2d0
[ 3353.891653][T124459] do_sys_ftruncate+0x1f5/0x2c0
[ 3353.891653][T124459] ? trace_hardirqs_on+0x1c/0x150
[ 3353.891653][T124459] do_syscall_64+0x33/0x40
[ 3353.891653][T124459] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 3353.891653][T124459] RIP: 0033:0x7fadad92978d
[ 3353.891653][T124459] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8
[ 3353.891653][T124459] RSP: 002b:00007fffabe83818 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
[ 3353.891653][T124459] RAX: ffffffffffffffda RBX: 000000000000004d RCX: 00007fadad92978d
[ 3353.891653][T124459] RDX: fffffffffffffffd RSI: 0000000000000004 RDI: 000000000000019a
[ 3353.891653][T124459] RBP: 000000000000004d R08: 207124800010c410 R09: 00009a60a1048000
[ 3353.891653][T124459] R10: 00000000ffff0000 R11: 0000000000000246 R12: 0000000000000002
[ 3353.891653][T124459] R13: 00007fadaded4058 R14: 00007fadae0166c0 R15: 00007fadaded4000
[ 3353.982969][T124459] irq event stamp: 192225
[ 3353.984184][T124459] hardirqs last enabled at (192233): [<ffffffff97c2cf2f>] console_unlock+0x81f/0xa20
[ 3353.986913][T124459] hardirqs last disabled at (192240): [<ffffffff97c2ce3b>] console_unlock+0x72b/0xa20
[ 3353.989561][T124459] softirqs last enabled at (191878): [<ffffffff9900061b>] __do_softirq+0x61b/0x95d
[ 3353.992558][T124459] softirqs last disabled at (191873): [<ffffffff98e00ec2>] asm_call_irq_on_stack+0x12/0x20
[ 3353.995337][T124459] ---[ end trace c2dc55cf6d30e0a3 ]---
On Thu, Oct 29, 2020 at 4:02 PM Qian Cai <[email protected]> wrote:
>
> On Wed, 2020-10-07 at 16:08 -0400, Qian Cai wrote:
> > Running some fuzzing by a unprivileged user on virtiofs could trigger the
> > warning below. The warning was introduced not long ago by the commit
> > c146024ec44c ("fuse: fix warning in tree_insert() and clean up writepage
> > insertion").
> >
> > From the logs, the last piece of the fuzzing code is:
> >
> > fgetxattr(fd=426, name=0x7f39a69af000, value=0x7f39a8abf000, size=1)
>
> I can still reproduce it on today's linux-next. Any idea on how to debug it
> further?
Can you please try the attached patch?
Thanks,
Miklos
On Thu, 2020-10-29 at 16:20 +0100, Miklos Szeredi wrote:
> On Thu, Oct 29, 2020 at 4:02 PM Qian Cai <[email protected]> wrote:
> > On Wed, 2020-10-07 at 16:08 -0400, Qian Cai wrote:
> > > Running some fuzzing by a unprivileged user on virtiofs could trigger the
> > > warning below. The warning was introduced not long ago by the commit
> > > c146024ec44c ("fuse: fix warning in tree_insert() and clean up writepage
> > > insertion").
> > >
> > > From the logs, the last piece of the fuzzing code is:
> > >
> > > fgetxattr(fd=426, name=0x7f39a69af000, value=0x7f39a8abf000, size=1)
> >
> > I can still reproduce it on today's linux-next. Any idea on how to debug it
> > further?
>
> Can you please try the attached patch?
So far so good. I'll keep running it over the weekend to be a little bit sure.
It was taking a while to reproduce.
On Thu, 2020-10-29 at 16:20 +0100, Miklos Szeredi wrote:
> On Thu, Oct 29, 2020 at 4:02 PM Qian Cai <[email protected]> wrote:
> > On Wed, 2020-10-07 at 16:08 -0400, Qian Cai wrote:
> > > Running some fuzzing by a unprivileged user on virtiofs could trigger the
> > > warning below. The warning was introduced not long ago by the commit
> > > c146024ec44c ("fuse: fix warning in tree_insert() and clean up writepage
> > > insertion").
> > >
> > > From the logs, the last piece of the fuzzing code is:
> > >
> > > fgetxattr(fd=426, name=0x7f39a69af000, value=0x7f39a8abf000, size=1)
> >
> > I can still reproduce it on today's linux-next. Any idea on how to debug it
> > further?
>
> Can you please try the attached patch?
It has survived the testing over the weekend. There is a issue that virtiofsd
hung, but it looks like a separate issue.
On Mon, Nov 2, 2020 at 3:26 PM Qian Cai <[email protected]> wrote:
>
> On Thu, 2020-10-29 at 16:20 +0100, Miklos Szeredi wrote:
> > On Thu, Oct 29, 2020 at 4:02 PM Qian Cai <[email protected]> wrote:
> > > On Wed, 2020-10-07 at 16:08 -0400, Qian Cai wrote:
> > > > Running some fuzzing by a unprivileged user on virtiofs could trigger the
> > > > warning below. The warning was introduced not long ago by the commit
> > > > c146024ec44c ("fuse: fix warning in tree_insert() and clean up writepage
> > > > insertion").
> > > >
> > > > From the logs, the last piece of the fuzzing code is:
> > > >
> > > > fgetxattr(fd=426, name=0x7f39a69af000, value=0x7f39a8abf000, size=1)
> > >
> > > I can still reproduce it on today's linux-next. Any idea on how to debug it
> > > further?
> >
> > Can you please try the attached patch?
>
> It has survived the testing over the weekend. There is a issue that virtiofsd
> hung, but it looks like a separate issue.
Thanks very much for the testing. Queued up the patch.
Miklos