Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 16 Mar 2022 15:36:21 +0530
From:   Ritesh Harjani <riteshh@linux.ibm.com>
To:     Sachin Sant <sachinp@linux.ibm.com>
Cc:     Ext4 Developers List <linux-ext4@vger.kernel.org>,
        linuxppc-dev@lists.ozlabs.org,
        open list <linux-kernel@vger.kernel.org>
Subject: Re: [powerpc]Kernel crash while running LTP (execveat03)
 [next-20220315]
Message-ID: <20220316100621.c5vpouz6cvyu6l7h@riteshh-domain>
References: <19C0AAEE-43C1-4A17-83DC-5EC24BB1E0BE@linux.ibm.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <19C0AAEE-43C1-4A17-83DC-5EC24BB1E0BE@linux.ibm.com>
MIME-Version: 1.0
Precedence: bulk

On 22/03/16 01:47PM, Sachin Sant wrote:
> While running LTP tests(execveat03) against 5.17.0-rc8-next-20220315
> On a POWER10 LPAR following crash is seen:
>
> [  945.659049] dummy_del_mod: loading out-of-tree module taints kernel.
> [  945.659951] dummy_del_mod: module verification failed: signature and/or required key missing - tainting kernel
> [  955.520206] process 'execveat01' launched '/dev/fd/-1' with NULL argv: empty string added
> [  955.529560] loop0: detected capacity change from 0 to 524288
> [  955.830492] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem


Ok, so it has mounted ext2 using ext4 subsystem.
This means there is no journal.

> [  955.831047] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
> [  955.831056] ext2 filesystem being mounted at /var/tmp/avocado_2hol2hy1/ltp-SHEyyra8b0/3CPNpu/mntpoint supports timestamps until 2038 (0x7fffffff)
> [  955.907793] Kernel attempted to read user page (1) - exploit attempt? (uid: 0)
> [  955.907806] BUG: Kernel NULL pointer dereference on read at 0x00000001
> [  955.907809] Faulting instruction address: 0xc008000000be04ec
> [  955.907811] Oops: Kernel access of bad area, sig: 11 [#1]
> [  955.907814] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
> [  955.907818] Modules linked in: overlay vfat fat btrfs blake2b_generic xor raid6_pq zstd_compress xfs loop sctp ip6_udp_tunnel udp_tunnel dm_mod nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables bonding libcrc32c nfnetlink sunrpc pseries_rng xts vmx_crypto sch_fq_codel ext4 mbcache jbd2 sd_mod t10_pi crc64_rocksoft crc64 sg ibmvscsi ibmveth scsi_transport_srp fuse [last unloaded: dummy_del_mod]
> [  955.907849] CPU: 30 PID: 1947255 Comm: execveat03 Tainted: G           OE     5.17.0-rc8-next-20220315 #1
> [  955.907853] NIP:  c008000000be04ec LR: c008000000ba4b00 CTR: c0000000004fd040
> [  955.907856] REGS: c0000002474831a0 TRAP: 0300   Tainted: G           OE      (5.17.0-rc8-next-20220315)
> [  955.907860] MSR:  800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 28028282  XER: 20040000
> [  955.907869] CFAR: c008000000ba4afc DAR: 0000000000000001 DSISR: 40000000 IRQMASK: 0
> [  955.907869] GPR00: c008000000ba4b00 c000000247483440 c008000000c28000 0000000000000001
> [  955.907869] GPR04: c000000206668af8 c008000000be0068 0000000000000000 0000000000000000
> [  955.907869] GPR08: 0000000000000002 0000000000000004 0000000000000000 c008000000be7f68
> [  955.907869] GPR12: c0000000004fd040 c000000effbe7280 0000000000000000 0000000000000001
> [  955.907869] GPR16: 0000000000000000 c0000000029b4048 0000000000000000 0000000000000000
> [  955.907869] GPR20: 0000000000000000 c0000000029b4048 0000000000000004 c000000206668af8
> [  955.907869] GPR24: c000000247483528 0000000000000001 c008000000c01208 0000000000000000
> [  955.907869] GPR28: 0000000000000001 c000000206668af8 c0000001f0d92e80 0000000000000001
> [  955.907904] NIP [c008000000be04ec] __ext4_fc_track_link+0x44/0xf0 [ext4]
> [  955.907927] LR [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4]
> [  955.907946] Call Trace:
> [  955.907947] [c000000247483440] [0000000000000004] 0x4 (unreliable)
> [  955.907950] [c0000002474834a0] [c008000000ba4b00] ext4_rename+0x878/0xdc0 [ext4]
> [  955.907969] [c000000247483670] [c0000000004a498c] vfs_rename+0x9cc/0xe00
> [  955.907975] [c000000247483760] [c008000000341820] ovl_do_rename.constprop.28+0x78/0x140 [overlay]
> [  955.907982] [c000000247483830] [c008000000341b50] ovl_make_workdir+0x268/0x7e0 [overlay]
> [  955.907988] [c000000247483960] [c008000000343aa8] ovl_fill_super+0x1060/0x2160 [overlay]
> [  955.907994] [c000000247483ae0] [c000000000492f68] mount_nodev+0x78/0x100
> [  955.907998] [c000000247483b20] [c008000000340054] ovl_mount+0x2c/0x50 [overlay]
> [  955.908004] [c000000247483b40] [c0000000004f676c] legacy_get_tree+0x4c/0xb0
> [  955.908008] [c000000247483b70] [c00000000049063c] vfs_get_tree+0x4c/0x150
> [  955.908012] [c000000247483bf0] [c0000000004d3768] path_mount+0x8e8/0xd50
> [  955.908017] [c000000247483cb0] [c0000000004d3c50] do_mount+0x80/0xd0
> [  955.908021] [c000000247483d10] [c0000000004d3e3c] sys_mount+0x19c/0x370
> [  955.908025] [c000000247483db0] [c00000000003375c] system_call_exception+0x18c/0x390
> [  955.908029] [c000000247483e10] [c00000000000c64c] system_call_common+0xec/0x270
> [  955.908034] --- interrupt: c00 at 0x7fffa9b38dfc
> [  955.908036] NIP:  00007fffa9b38dfc LR: 000000001001ba78 CTR: 0000000000000000
> [  955.908039] REGS: c000000247483e80 TRAP: 0c00   Tainted: G           OE      (5.17.0-rc8-next-20220315)
> [  955.908042] MSR:  800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE>  CR: 24002202  XER: 00000000
> [  955.908050] IRQMASK: 0
> [  955.908050] GPR00: 0000000000000015 00007ffff95c64c0 00007fffa9c07300 0000000010029a08
> [  955.908050] GPR04: 0000000010027de0 0000000010029a08 0000000000000000 00000000100299c0
> [  955.908050] GPR08: 0000000000004000 0000000000000000 0000000000000000 0000000000000000
> [  955.908050] GPR12: 0000000000000000 00007fffa9e1a340 0000000000000000 0000000000000000
> [  955.908050] GPR16: 0000000000000000 0000000000000000 ffffffffffffffff 0000000010027a38
> [  955.908050] GPR20: 00000000100284d0 0000000010028238 00000000100280f8 00007ffff95c65b0
> [  955.908050] GPR24: 0000000000000003 0000000010051098 0000000010050c60 00000000100555c8
> [  955.908050] GPR28: 000000000000040c 0000000010027b08 0000000000000000 0000000000000001
> [  955.908083] NIP [00007fffa9b38dfc] 0x7fffa9b38dfc
> [  955.908086] LR [000000001001ba78] 0x1001ba78
> [  955.908090] --- interrupt: c00
> [  955.908092] Instruction dump:
> [  955.908095] fba1ffe8 fbc1fff0 7cbe2b78 fbe1fff8 3ca20000 e8a5a0c8 7c7f1b78 39200004
> [  955.908103] 38e00000 7c9d2378 f8010010 f821ffa1 <e8630000> 38c10028 e94d1100 f9410038
> [  955.908112] ---[ end trace 0000000000000000 ]---
> [  955.908943]
> [  956.908946] Kernel panic - not syncing: Fatal exception
>
> Bisect points to following commit:
> commit 9d5623d7ef8765f21f629e4ac636c19ec245e254
>     ext4: return early for non-eligible fast_commit track events
>
> Reverting this commit allows the test to run successfully.

Hi Sachin,

Thanks so much for the report. Yes, this was discussed today here [1].
Ted mentioned, he had to add a change to fix this crash.
Once that is in, this should be fixed.

If you like you can apply below change and continue with your testing.

[1]: https://lore.kernel.org/linux-ext4/164714672856.1260831.16671323737369796834.b4-ty@mit.edu/T/#mdeff2bbdf0d107021514a9c44478d642936c4f9c

-ritesh


diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 39e223f7bf64..e37da8d5cd0c 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3891,12 +3891,19 @@ static int ext4_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 		ext4_fc_mark_ineligible(old.inode->i_sb,
 			EXT4_FC_REASON_RENAME_DIR, handle);
 	} else {
+		struct super_block *sb = old.inode->i_sb;
+
 		if (new.inode)
 			ext4_fc_track_unlink(handle, new.dentry);
-		__ext4_fc_track_link(handle, old.inode, new.dentry);
-		__ext4_fc_track_unlink(handle, old.inode, old.dentry);
-		if (whiteout)
-			__ext4_fc_track_create(handle, whiteout, old.dentry);
+		if (test_opt2(sb, JOURNAL_FAST_COMMIT) &&
+		    !(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) &&
+		    !(ext4_test_mount_flag(sb, EXT4_MF_FC_INELIGIBLE))) {
+			__ext4_fc_track_link(handle, old.inode, new.dentry);
+			__ext4_fc_track_unlink(handle, old.inode, old.dentry);
+			if (whiteout)
+				__ext4_fc_track_create(handle, whiteout,
+						       old.dentry);
+		}
 	}

 	if (new.inode) {