kernel BUG at fs/9p/acl.c:96! 4.1.1 bz #94531

kernel BUG at fs/9p/acl.c:96! 4.1.1 bz #94531

[Sverd Johnsen]

I filed this a few months ago and can still be reproduced easily with
kernel 4.1.1:

https://bugzilla.kernel.org/show_bug.cgi?id=94531

[  224.248568] ------------[ cut here ]------------
[  224.252792] kernel BUG at fs/9p/acl.c:96!
[  224.256308] invalid opcode: 0000 [#1]
[  224.258424] Modules linked in: af_packet
[  224.258424] CPU: 0 PID: 266 Comm: ls Not tainted 4.1.1-kvm #1
[  224.258424] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.8.2-20150617_082717-anatol 04/01/2014
[  224.258424] task: ffff880025029a40 ti: ffff8800252f0000 task.ti:
ffff8800252f0000
[  224.258424] RIP: 0010:[<ffffffff81149c5f>]  [<ffffffff81149c5f>]
v9fs_get_cached_acl+0xf/0x13
[  224.258424] RSP: 0018:ffff8800252f3d08  EFLAGS: 00010246
[  224.258424] RAX: ffffffffffffffff RBX: ffff8800252f3db0 RCX: 0000000000000000
[  224.258424] RDX: ffffffffffffffff RSI: 0000000000008000 RDI: ffff880025cba040
[  224.258424] RBP: ffff8800252f3d08 R08: 0000000000008000 R09: ff72726462626000
[  224.258424] R10: ffff880025ca3600 R11: 0000000000000000 R12: ffff880025ca3600
[  224.258424] R13: 0000000000000000 R14: 0000000000000000 R15: ffff880025cba040
[  224.258424] FS:  00007fad3f89b700(0000) GS:ffffffff8161a000(0000)
knlGS:0000000000000000
[  224.258424] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  224.258424] CR2: 00007fad3f8b1000 CR3: 0000000001f1b000 CR4: 00000000000007b0
[  224.258424] Stack:
[  224.258424]  ffff8800252f3d38 ffffffff81149f1f 0000000000000000
0000000000000000
[  224.258424]  ffff8800252f3db0 ffff880025ca3600 ffff8800252f3d60
ffffffff810ce701
[  224.258424]  0000000000000000 0000000000000000 ffff8800252f3dc7
ffff8800252f3d98
[  224.258424] Call Trace:
[  224.258424]  [<ffffffff81149f1f>] v9fs_xattr_get_acl+0x67/0xaf
[  224.258424]  [<ffffffff810ce701>] generic_getxattr+0x4d/0x55
[  224.258424]  [<ffffffff810cea8c>] vfs_getxattr+0x90/0x9d
[  224.258424]  [<ffffffff810cedf3>] getxattr+0xcb/0x186
[  224.258424]  [<ffffffff810c0de5>] ? user_path_at_empty+0x80/0xca
[  224.258424]  [<ffffffff8115ee7e>] ? __aa_current_profile+0x1c/0x1e
[  224.258424]  [<ffffffff811481a3>] ? v9fs_cached_dentry_delete+0x28/0x35
[  224.258424]  [<ffffffff810cef0a>] path_getxattr+0x5c/0xa2
[  224.258424]  [<ffffffff810cf684>] SyS_getxattr+0xf/0x11
[  224.258424]  [<ffffffff8138d26b>] system_call_fastpath+0x12/0x71
[  224.258424] Code: 33 f6 ff 8b 45 d4 eb 08 31 c0 c3 b8 f4 ff ff ff
5a 5b 41 5c 41 5d 41 5e 41 5f 5d c3 55 48 89 e5 e8 3b 29 fa ff 48 83
f8 ff 75 02 <0f> 0b 5d c3 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83
ec 70
[  224.258424] RIP  [<ffffffff81149c5f>] v9fs_get_cached_acl+0xf/0x13
[  224.258424]  RSP <ffff8800252f3d08>
[  224.366590] ---[ end trace 11bd711b8565ce78 ]---
[  224.367527] Kernel panic - not syncing: Fatal exception
[  224.368142] Kernel Offset: disabled
[  224.368610] Rebooting in 30 seconds..

/home  home-archvm-one 9p
rw,relatime,dirsync,trans=virtio,version=9p2000.L,posixacl,cache=fscache

If something on the host pollutes the directory where 9p is mounted in
the guest it crashes the kernel on ls/getfacl or whatever.

Re: kernel BUG at fs/9p/acl.c:96! 4.1.1 bz #94531

[Al Viro]

On Wed, Jul 08, 2015 at 03:58:54PM +0200, Sverd Johnsen wrote:
> I filed this a few months ago and can still be reproduced easily with
> kernel 4.1.1:
> 
> https://bugzilla.kernel.org/show_bug.cgi?id=94531
> 
> [  224.248568] ------------[ cut here ]------------
> [  224.252792] kernel BUG at fs/9p/acl.c:96!

See if this fixes the sucker on your setup; it should've removed the
inode from hash, since leaving it there means that the next attempt
to look it up via iget5_locked() will just succeed, with no indication
of failed inode setup...

diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 09e4433..e8aa57d 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
 	unlock_new_inode(inode);
 	return inode;
 error:
-	unlock_new_inode(inode);
-	iput(inode);
+	iget_failed(inode);
 	return ERR_PTR(retval);
 
 }