Re: Potential smb/dfs regression introduced in kernel 6.6

["Steinbeißer, Sebastian" <Sebastian.Steinbeisser@lrz.de>]

[-- Attachment #1.1: Type: text/plain, Size: 12832 bytes --]

Dear Paulo,

this is my first rodeo with bisect and the first with the kernel in >10
years - but by no means my first with git - here's what I found:

I've been using a freshly installed Debian 12 virtual box vm and I've
been following [1].

As a "test" I used the following script to see if the initial error
could be reproduced:
```test.sh
#!/bin/bash

mkdir -vp /tmp/test
sudo mount -t cifs //IP_ADDR/volume01 /tmp/test -o
username=$USER,domain=ADS
read -rs
ls /tmp/test
read -rs
ls /tmp/test/*
read -rs
sudo umount /tmp/test
```

A "good" output would be
```

volume02  volume03
/tmp/test/volume02:

/tmp/test/volume03:
```

The individual steps are as follows:
```notes.txt
git bisect start
git bisect good 9a49e221a64111535f65e9c8804db24d11eaff8b
git bisect bad 539aad7f14

# yields dedd6c894110 - script crashes with
volume02  volume03
./test.sh: line 8:  1867 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields 0e72db77672ff4758a31fb5259c754a7bb229751

git bisect good
# yields 29057cc5bddc785ea0a11534d7ad2546fa0872d3 - script crashes with
volume02  volume03
./test.sh: line 8:  1881 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields 1c9f8dff62d85ce00b0e99f774a84bd783af7cac - script crashes with
volume02  volume03
./test.sh: line 8:  1865 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields 8ae5d298ef2005da5454fc1680f983e85d3e1622 - script crashes with
volume02  volume03
./test.sh: line 8:  1865 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields cd99b9eb4b702563c5ac7d26b632a628f5a832a5

git bisect good
# yields df57721f9a63e8a1fb9b9b2e70de4aa4c7e0cd2e - script crashes with
volume02  volume03
./test.sh: line 8:  1865 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields b6f6167ea8a424d14b41c172fe7a5f49e164f221

git bisect good
# yields eb501c2d96cfce6b42528e8321ea085ec605e790

git bisect good
# yields c6b53dcec07c842af75123d9b29684bdbd36a407

git bisect good
# yields 4debf77169ee459c46ec70e13dc503bc25efd7d2

git bisect good
# yields 089f7f591348ca3325639f541fa4f78d9540dab5 - script crashes with
volume02  volume03
./test.sh: line 8:  1865 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields f4e5ceb6c1a64f9f8c666877164d95d5eb46da5b - script crashes with
volume02  volume03
./test.sh: line 8:  1865 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields 69a4e06c0e7bceeba95104180110841d232e94e4 - script crashes with
volume02  volume03
./test.sh: line 8:  1865 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields a18280e7fdea1f2f0736c45f9fee27eccd3998ae - script crashes with
volume02  volume03
./test.sh: line 8:  1865 Killed                  ls /tmp/test/*
umount: /tmp/test: target is busy.

# mark it as bad
git bisect bad
# yields f2762ae4d3e0bceeabfac4bc3c53700d80a602c9

git bisect good
a18280e7fdea1f2f0736c45f9fee27eccd3998ae is the first bad commit
commit a18280e7fdea1f2f0736c45f9fee27eccd3998ae
Author: Paulo Alcantara <pc@manguebit.com>
Date:   Thu Aug 17 12:34:09 2023 -0300

    smb: cilent: set reparse mount points as automounts
    
    By doing so we can selectively mark those submounts as
'noserverino'
    rather than whole mount and thus avoiding inode collisions in them.
    
    Consider a "test" SMB share that has two mounted NTFS volumes
    (vol0 & vol1) inside it.
    
    * Before patch
    
    $ mount.cifs //srv/test /mnt/1 -o ...,serverino
    $ ls -li /mnt/1/vol0
    total 1
    281474976710693 drwxr-xr-x 2 root root 0 Jul 15 00:23 $RECYCLE.BIN
    281474976710696 drwxr-xr-x 2 root root 0 Jul 18 18:23 System
Volume...
    281474976710699 -rwxr-xr-x 1 root root 0 Aug 14 21:53 f0
    281474976710700 -rwxr-xr-x 1 root root 0 Aug 15 18:52 f2
    281474976710698 drwxr-xr-x 2 root root 0 Aug 12 19:39 foo
    281474976710692 -rwxr-xr-x 1 root root 5 Aug  4 21:18 vol0_f0.txt
    $ ls -li /mnt/1/vol1
    total 0
    281474976710693 drwxr-xr-x 2 root root 0 Jul 15 00:23 $RECYCLE.BIN
    281474976710696 drwxr-xr-x 2 root root 0 Jul 18 18:23 System
Volume...
    281474976710698 drwxr-xr-x 2 root root 0 Aug 12 19:39 bar
    281474976710699 -rwxr-xr-x 1 root root 0 Aug 14 22:03 f0
    281474976710700 -rwxr-xr-x 1 root root 0 Aug 14 22:52 f1
    281474976710692 -rwxr-xr-x 1 root root 0 Jul 15 00:23 vol1_f0.txt
    
    * After patch
    
    $ mount.cifs //srv/test /mnt/1 -o ...,serverino
    $ ls -li /mnt/1/vol0
    total 1
    590 drwxr-xr-x 2 root root 0 Jul 15 00:23 $RECYCLE.BIN
    594 drwxr-xr-x 2 root root 0 Jul 18 18:23 System Volume Information
    591 -rwxr-xr-x 1 root root 0 Aug 14 21:53 f0
    592 -rwxr-xr-x 1 root root 0 Aug 15 18:52 f2
    593 drwxr-xr-x 2 root root 0 Aug 12 19:39 foo
    595 -rwxr-xr-x 1 root root 5 Aug  4 21:18 vol0_f0.txt
    $ ls -li /mnt/1/vol1
    total 0
    596 drwxr-xr-x 2 root root 0 Jul 15 00:23 $RECYCLE.BIN
    600 drwxr-xr-x 2 root root 0 Jul 18 18:23 System Volume Information
    597 drwxr-xr-x 2 root root 0 Aug 12 19:39 bar
    598 -rwxr-xr-x 1 root root 0 Aug 14 22:03 f0
    599 -rwxr-xr-x 1 root root 0 Aug 14 22:52 f1
    601 -rwxr-xr-x 1 root root 0 Jul 15 00:23 vol1_f0.txt
    
    Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>

 fs/smb/client/cifsglob.h  |   2 +-
 fs/smb/client/inode.c     | 344 +++++++++++++++++++++++++-------------
--------
 fs/smb/client/namespace.c |  19 +--
 fs/smb/client/readdir.c   |   1 +
 4 files changed, 194 insertions(+), 172 deletions(-)
```

Note, that this did not behave as initially seen with the two Lubuntu
installations, but non the less an error occurred.
Checking dmesg right after the error showed:
```error.log
[   28.924415] CIFS: Attempting to mount //IP_ADDR/volume01
[   31.507014] BUG: kernel NULL pointer dereference, address: 0000000000000000
[   31.507022] #PF: supervisor read access in kernel mode
[   31.507024] #PF: error_code(0x0000) - not-present page
[   31.507025] PGD 0 P4D 0 
[   31.507028] Oops: 0000 [#1] PREEMPT SMP PTI
[   31.507031] CPU: 0 PID: 1834 Comm: ls Not tainted 6.5.0-rc7+ #26
[   31.507033] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   31.507034] RIP: 0010:smb2_query_symlink+0xf/0x310
[   31.507045] Code: 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 56 41 55 41 54 49 89 d4 55 <49> 8b 29 53 4c 89 c3 44 8b 6d 64 f6 05 4f 2f 0c 02 01 74 05 0f 1f
[   31.507047] RSP: 0018:ffffa15ac2e038e0 EFLAGS: 00010282
[   31.507048] RAX: ffffffff974d4240 RBX: ffffa15ac2e03a20 RCX: ffff8b1f40bd4ff6
[   31.507049] RDX: ffff8b1f77eb1cc0 RSI: ffff8b1f5aa60800 RDI: 000000000000000f
[   31.507050] RBP: ffffa15ac2e03958 R08: ffffa15ac2e03960 R09: 0000000000000000
[   31.507051] R10: ffffa15ac2e03900 R11: 0000000000000000 R12: ffff8b1f77eb1cc0
[   31.507052] R13: ffff8b1f77eb1cc0 R14: ffff8b1f5aa60800 R15: ffff8b1f5aa67800
[   31.507053] FS:  00007f18b0ad5800(0000) GS:ffff8b2057c00000(0000) knlGS:0000000000000000
[   31.507054] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   31.507055] CR2: 0000000000000000 CR3: 00000001392b4004 CR4: 00000000000706f0
[   31.507058] Call Trace:
[   31.507063]  <TASK>
[   31.507065]  ? __die+0x1f/0x70
[   31.507070]  ? page_fault_oops+0x17d/0x4b0
[   31.507073]  ? exc_page_fault+0x73/0x170
[   31.507077]  ? asm_exc_page_fault+0x22/0x30
[   31.507080]  ? __pfx_smb2_query_symlink+0x10/0x10
[   31.507083]  ? smb2_query_symlink+0xf/0x310
[   31.507085]  cifs_get_fattr+0x5ce/0x9d0
[   31.507087]  ? __d_alloc+0x2b/0x230
[   31.507090]  cifs_get_inode_info+0x92/0x120
[   31.507092]  cifs_lookup+0x14e/0x7f0
[   31.507094]  ? generic_permission+0x35/0x230
[   31.507097]  __lookup_slow+0x86/0x130
[   31.507100]  walk_component+0xdb/0x150
[   31.507101]  path_lookupat+0x67/0x190
[   31.507102]  filename_lookup+0xe4/0x1f0
[   31.507104]  vfs_statx+0x9e/0x180
[   31.507108]  do_statx+0x67/0xb0
[   31.507110]  __x64_sys_statx+0x62/0x80
[   31.507112]  do_syscall_64+0x5b/0xc0
[   31.507116]  ? __count_memcg_events+0x49/0x90
[   31.507119]  ? count_memcg_events.constprop.0+0x1a/0x30
[   31.507121]  ? handle_mm_fault+0x9a/0x340
[   31.507123]  ? do_user_addr_fault+0x175/0x640
[   31.507125]  ? exit_to_user_mode_prepare+0x37/0x1b0
[   31.507128]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[   31.507130] RIP: 0033:0x7f18b0c69a2a
[   31.507133] Code: 48 8b 05 d9 a3 0d 00 ba ff ff ff ff 64 c7 00 16 00 00 00 e9 a5 fd ff ff e8 a3 06 02 00 0f 1f 00 41 89 ca b8 4c 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2e 89 c1 85 c0 74 0f 48 8b 05 a1 a3 0d 00 64
[   31.507134] RSP: 002b:00007ffc3c831988 EFLAGS: 00000206 ORIG_RAX: 000000000000014c
[   31.507135] RAX: ffffffffffffffda RBX: 000056116610db28 RCX: 00007f18b0c69a2a
[   31.507136] RDX: 0000000000000800 RSI: 00007ffc3c832367 RDI: 00000000ffffff9c
[   31.507137] RBP: 0000000000000002 R08: 00007ffc3c831990 R09: 0000000000000002
[   31.507138] R10: 0000000000000002 R11: 0000000000000206 R12: 00007ffc3c832367
[   31.507139] R13: 0000000000000000 R14: 000056116610db10 R15: 0000000000000003
[   31.507140]  </TASK>
[   31.507141] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_seq_device rfkill qrtr binfmt_misc intel_rapl_msr intel_rapl_common intel_pmc_core crc32_pclmul ghash_clmulni_intel sha512_ssse3 aesni_intel snd_intel8x0 crypto_simd snd_ac97_codec cryptd video ac97_bus rapl snd_pcm wmi snd_timer evdev joydev battery snd pcspkr soundcore vboxguest button ac serio_raw sg msr parport_pc ppdev lp parport fuse loop dm_mod efi_pstore configfs ip_tables x_tables autofs4 ext4 crc32c_generic crc16 mbcache jbd2 hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic sr_mod vmwgfx cdrom drm_ttm_helper ahci ttm ohci_pci ata_generic drm_kms_helper ohci_hcd ata_piix libahci ehci_pci ehci_hcd libata drm psmouse crct10dif_pclmul usbcore crct10dif_common scsi_mod crc32c_intel e1000 i2c_piix4 usb_common scsi_common
[   31.507192] CR2: 0000000000000000
[   31.507194] ---[ end trace 0000000000000000 ]---
[   31.507195] RIP: 0010:smb2_query_symlink+0xf/0x310
[   31.507197] Code: 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 56 41 55 41 54 49 89 d4 55 <49> 8b 29 53 4c 89 c3 44 8b 6d 64 f6 05 4f 2f 0c 02 01 74 05 0f 1f
[   31.507198] RSP: 0018:ffffa15ac2e038e0 EFLAGS: 00010282
[   31.507199] RAX: ffffffff974d4240 RBX: ffffa15ac2e03a20 RCX: ffff8b1f40bd4ff6
[   31.507200] RDX: ffff8b1f77eb1cc0 RSI: ffff8b1f5aa60800 RDI: 000000000000000f
[   31.507200] RBP: ffffa15ac2e03958 R08: ffffa15ac2e03960 R09: 0000000000000000
[   31.507201] R10: ffffa15ac2e03900 R11: 0000000000000000 R12: ffff8b1f77eb1cc0
[   31.507202] R13: ffff8b1f77eb1cc0 R14: ffff8b1f5aa60800 R15: ffff8b1f5aa67800
[   31.507203] FS:  00007f18b0ad5800(0000) GS:ffff8b2057c00000(0000) knlGS:0000000000000000
[   31.507204] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   31.507205] CR2: 0000000000000000 CR3: 00000001392b4004 CR4: 00000000000706f0
```

If you assume that I did something wrong or should check something
additionally, please let me know.

I'll try and get a setup where we can capture non-encrypted traffic.
This might take a bit next to my regular work but I'll do my best.

Thanks!

Best
Sebastian

[1]
https://kernel-team.pages.debian.net/kernel-handbook/ch-bugs.html#s9.2.1
+-------------------------------------------------------------+
 Sebastian Steinbeißer
 Leibniz-Rechenzentrum   Tel.:+49-89-35831-8779
 Boltzmannstraße 1       E-Mail: Sebastian.Steinbeisser@lrz.de
 D-85748 Garching
+-------------------------------------------------------------+


-----Original Message-----
From: Paulo Alcantara <pc@manguebit.com>
To: "Steinbeißer, Sebastian" <Sebastian.Steinbeisser@lrz.de>,
gregkh@linuxfoundation.org <gregkh@linuxfoundation.org>
Cc: regressions@lists.linux.dev <regressions@lists.linux.dev>
Subject: Re: Potential smb/dfs regression introduced in kernel 6.6
Date: 15.07.2024 14:21:14

Steinbeißer, Sebastian  <Sebastian.Steinbeisser@lrz.de> writes:

> I'll try and get that done. I'm currently in the process of bisecting
> the issue on the side.

Awesome.  Thanks!

[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5874 bytes --]