From: bugzilla-daemon@kernel.org
To: linux-xfs@vger.kernel.org
Subject: [Bug 215784] New: kernel NULL pointer dereference in fs/xfs/xfs_buf_item_recover.c: xlog_recover_do_inode_buffer() when mount a corrupted image
Date: Thu, 31 Mar 2022 20:19:59 +0000 [thread overview]
Message-ID: <bug-215784-201763@https.bugzilla.kernel.org/> (raw)
https://bugzilla.kernel.org/show_bug.cgi?id=215784
Bug ID: 215784
Summary: kernel NULL pointer dereference in
fs/xfs/xfs_buf_item_recover.c:
xlog_recover_do_inode_buffer() when mount a corrupted
image
Product: File System
Version: 2.5
Kernel Version: 5.17.1, 5.15.32
Hardware: All
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: XFS
Assignee: filesystem_xfs@kernel-bugs.kernel.org
Reporter: wenqingliu0120@gmail.com
Regression: No
Created attachment 300672
--> https://bugzilla.kernel.org/attachment.cgi?id=300672&action=edit
corrupted image and .config
- Overview
kernel NULL pointer dereference in fs/xfs/xfs_buf_item_recover.c:
xlog_recover_do_inode_buffer() when mount a corrupted image
- Reproduce
tested on kernel 5.17.1, 5.15.32
$ mkdir mnt
$ unzip tmp18.zip
$ sudo mount -t xfs tmp18.img mnt
- Kernel dump
[ 26.379286] loop0: detected capacity change from 0 to 32768
[ 26.399630] XFS (loop0): Deprecated V4 format (crc=0) will not be supported
after September 2030.
[ 26.399771] XFS (loop0): Mounting V10 Filesystem
[ 26.399889] XFS (loop0): Log size 87 blocks too small, minimum size is 845
blocks
[ 26.399892] XFS (loop0): Log size out of supported range.
[ 26.399916] XFS (loop0): Continuing onwards, but if log hangs are
experienced then please report this message in the bug report.
[ 26.404903] XFS (loop0): Starting recovery (logdev: internal)
[ 26.406206] BUG: kernel NULL pointer dereference, address: 0000000000000060
[ 26.406251] #PF: supervisor read access in kernel mode
[ 26.406273] #PF: error_code(0x0000) - not-present page
[ 26.406294] PGD 0 P4D 0
[ 26.406304] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 26.406319] CPU: 0 PID: 895 Comm: mount Not tainted 5.17.1 #1
[ 26.406340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.13.0-1ubuntu1.1 04/01/2014
[ 26.406371] RIP: 0010:xlog_recover_do_inode_buffer+0x10f/0x230 [xfs]
[ 26.406681] Code: 5d 41 5e 41 5f 5d c3 44 39 d3 7c 6b 48 8b 4d b8 49 63 c4
48 63 f3 48 c1 e0 04 49 63 fa 48 89 f3 48 29 fb 48 03 41 18 48 03 18 <8b> 0b 85
c9 0f 84 ac 00 00 00 48 8b 7d c0 44 89 45 ac 44 89 55 b0
[ 26.406744] RSP: 0018:ffffa72b009ab988 EFLAGS: 00010206
[ 26.406764] RAX: ffff98f38f553ef0 RBX: 0000000000000060 RCX:
ffff98f38f640900
[ 26.406789] RDX: 0000000000000003 RSI: 0000000000000060 RDI:
0000000000000000
[ 26.406814] RBP: ffffa72b009ab9e0 R08: 0000000000000180 R09:
8080808080808080
[ 26.406840] R10: 0000000000000000 R11: fefefefefefefeff R12:
0000000000000001
[ 26.406867] R13: ffff98f38e456000 R14: 0000000000000000 R15:
ffff98f391418600
[ 26.406894] FS: 00007f649dd76080(0000) GS:ffff98f575c00000(0000)
knlGS:0000000000000000
[ 26.406923] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 26.406943] CR2: 0000000000000060 CR3: 00000001068fe006 CR4:
0000000000370ef0
[ 26.406972] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 26.406998] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ 26.407025] Call Trace:
[ 26.407050] <TASK>
[ 26.407061] ? __xfs_buf_submit+0x9b/0x1d0 [xfs]
[ 26.407175] xlog_recover_buf_commit_pass2+0x48c/0x650 [xfs]
[ 26.407300] xlog_recover_items_pass2+0x4e/0xc0 [xfs]
[ 26.407429] xlog_recover_commit_trans+0x2de/0x300 [xfs]
[ 26.407552] xlog_recovery_process_trans+0x8e/0xc0 [xfs]
[ 26.407672] xlog_recover_process_data+0xab/0x130 [xfs]
[ 26.407795] xlog_do_recovery_pass+0x2d5/0x5c0 [xfs]
[ 26.407917] xlog_do_log_recovery+0x7f/0xb0 [xfs]
[ 26.408036] xlog_do_recover+0x34/0x190 [xfs]
[ 26.408161] xlog_recover+0xbc/0x170 [xfs]
[ 26.408291] xfs_log_mount+0x125/0x2d0 [xfs]
[ 26.408402] xfs_mountfs+0x4e0/0xa50 [xfs]
[ 26.408517] ? kmem_alloc+0x88/0x140 [xfs]
[ 26.408627] ? xfs_filestream_get_parent+0x70/0x70 [xfs]
[ 26.408737] xfs_fs_fill_super+0x69f/0x880 [xfs]
[ 26.408848] ? sget_fc+0x1be/0x230
[ 26.408865] ? xfs_fs_inode_init_once+0x70/0x70 [xfs]
[ 26.408977] get_tree_bdev+0x16a/0x280
[ 26.408995] vfs_get_tree+0x22/0xc0
[ 26.409696] path_mount+0x59b/0x9a0
[ 26.410319] do_mount+0x75/0x90
[ 26.410919] __x64_sys_mount+0x86/0xd0
[ 26.411514] do_syscall_64+0x37/0xb0
[ 26.412135] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 26.412817] RIP: 0033:0x7f649d63715a
[ 26.413372] Code: 48 8b 0d 31 8d 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e
0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01
f0 ff ff 73 01 c3 48 8b 0d fe 8c 2c 00 f7 d8 64 89 01 48
[ 26.414587] RSP: 002b:00007ffd3e3729d8 EFLAGS: 00000206 ORIG_RAX:
00000000000000a5
[ 26.415210] RAX: ffffffffffffffda RBX: 000055b763052420 RCX:
00007f649d63715a
[ 26.415832] RDX: 000055b763052600 RSI: 000055b763054320 RDI:
000055b76305bc40
[ 26.416472] RBP: 0000000000000000 R08: 0000000000000000 R09:
000055b763052620
[ 26.417099] R10: 00000000c0ed0000 R11: 0000000000000206 R12:
000055b76305bc40
[ 26.417710] R13: 000055b763052600 R14: 0000000000000000 R15:
00007f649db588a4
[ 26.418317] </TASK>
[ 26.418860] Modules linked in: joydev iscsi_tcp libiscsi_tcp libiscsi
input_leds serio_raw scsi_transport_iscsi qemu_fw_cfg xfs autofs4 raid10
raid456 hid_generic usbhid async_raid6_recov async_memcpy async_pq async_xor
hid async_tx raid1 raid0 multipath linear qxl drm_ttm_helper ttm drm_kms_helper
syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul
ghash_clmulni_intel aesni_intel crypto_simd psmouse cryptd
[ 26.421641] CR2: 0000000000000060
[ 26.422322] ---[ end trace 0000000000000000 ]---
[ 26.422928] RIP: 0010:xlog_recover_do_inode_buffer+0x10f/0x230 [xfs]
[ 26.423656] Code: 5d 41 5e 41 5f 5d c3 44 39 d3 7c 6b 48 8b 4d b8 49 63 c4
48 63 f3 48 c1 e0 04 49 63 fa 48 89 f3 48 29 fb 48 03 41 18 48 03 18 <8b> 0b 85
c9 0f 84 ac 00 00 00 48 8b 7d c0 44 89 45 ac 44 89 55 b0
[ 26.425066] RSP: 0018:ffffa72b009ab988 EFLAGS: 00010206
[ 26.425819] RAX: ffff98f38f553ef0 RBX: 0000000000000060 RCX:
ffff98f38f640900
[ 26.426511] RDX: 0000000000000003 RSI: 0000000000000060 RDI:
0000000000000000
[ 26.427232] RBP: ffffa72b009ab9e0 R08: 0000000000000180 R09:
8080808080808080
[ 26.427962] R10: 0000000000000000 R11: fefefefefefefeff R12:
0000000000000001
[ 26.428690] R13: ffff98f38e456000 R14: 0000000000000000 R15:
ffff98f391418600
[ 26.429405] FS: 00007f649dd76080(0000) GS:ffff98f575c00000(0000)
knlGS:0000000000000000
[ 26.430096] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 26.430797] CR2: 0000000000000060 CR3: 00000001068fe006 CR4:
0000000000370ef0
[ 26.431506] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 26.432226] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching the assignee of the bug.
next reply other threads:[~2022-03-31 20:20 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-31 20:19 bugzilla-daemon [this message]
2022-05-05 6:24 ` [Bug 215784] New: kernel NULL pointer dereference in fs/xfs/xfs_buf_item_recover.c: xlog_recover_do_inode_buffer() when mount a corrupted image Darrick J. Wong
2022-05-05 6:24 ` [Bug 215784] " bugzilla-daemon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-215784-201763@https.bugzilla.kernel.org/ \
--to=bugzilla-daemon@kernel.org \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.