[BUG REPORT] General protection fault while discarding extents on XFS on next-20240305

[Chandan Babu R <chandanbabu@kernel.org>]

Hi,

Executing generic/251 on an XFS filesystem with next-20240305 kernel caused
the following call trace,

[ 6105.092156] XFS (loop5): discard failed for extent [0x344,4], error -4
[ 6105.094267] general protection fault, probably for non-canonical address 0xdffffc000000002a: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 6105.097056] KASAN: null-ptr-deref in range [0x0000000000000150-0x0000000000000157]
[ 6105.098639] CPU: 1 PID: 906401 Comm: fstrim Kdump: loaded Not tainted 6.8.0-rc7-next-20240305+ #1
[ 6105.100368] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.6.6 08/22/2023
[ 6105.102049] RIP: 0010:submit_bio_noacct+0x3bc/0x17e0
[ 6105.103441] Code: 00 00 41 89 c5 41 83 e5 01 0f 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 4d 63 ed 4a 8d bc 2b 56 01 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 d3 0f 00 00
[ 6105.107067] RSP: 0018:ffa00000056a7898 EFLAGS: 00010203
[ 6105.108547] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1fe2200032629a49
[ 6105.110107] RDX: 000000000000002a RSI: 00000000007fffff RDI: 0000000000000157
[ 6105.111686] RBP: ff1100019314d200 R08: 0000000000000000 R09: ff110001026e0880
[ 6105.113281] R10: ff110001026e0887 R11: 0000000000000001 R12: ff1100019314d210
[ 6105.114871] R13: 0000000000000001 R14: ff1100019314d208 R15: ff110001026e0860
[ 6105.116446] FS:  00007f6f4bbfd800(0000) GS:ff110003ee480000(0000) knlGS:0000000000000000
[ 6105.118185] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6105.119630] CR2: 000055997361d4a8 CR3: 000000016f144004 CR4: 0000000000771ef0
[ 6105.121230] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 6105.122772] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 6105.124510] PKRU: 55555554
[ 6105.125601] Call Trace:
3[ 6105.126672]  <TASK>
[ 6105.133971]  xfs_discard_extents+0x340/0x860 [xfs]
[ 6105.139534]  xfs_ioc_trim+0x4b1/0x960 [xfs]
[ 6105.150011]  xfs_file_ioctl+0xc49/0x1370 [xfs]
[ 6105.167691]  __x64_sys_ioctl+0x132/0x1a0
[ 6105.168725]  do_syscall_64+0x69/0x170
[ 6105.169681]  entry_SYSCALL_64_after_hwframe+0x6c/0x74

The above *probably* occured because __blkdev_issue_discard() noticed a pending
signal, processed the bio, freed the bio and returned a non-NULL bio pointer
to the caller (i.e. xfs_discard_extents()).

xfs_discard_extents() then tries to process the freed bio once again.

-- 
Chandan