From: bugzilla-daemon@bugzilla.kernel.org
To: linux-f2fs-devel@lists.sourceforge.net
Subject: [f2fs-dev] [Bug 204135] New: F2FS: BUG: KASAN: null-ptr-deref in mempool_alloc+0xd8/0x2e0
Date: Thu, 11 Jul 2019 07:18:06 +0000 [thread overview]
Message-ID: <bug-204135-202145@https.bugzilla.kernel.org/> (raw)
https://bugzilla.kernel.org/show_bug.cgi?id=204135
Bug ID: 204135
Summary: F2FS: BUG: KASAN: null-ptr-deref in
mempool_alloc+0xd8/0x2e0
Product: File System
Version: 2.5
Kernel Version: 5.1.3
Hardware: All
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: f2fs
Assignee: filesystem_f2fs@kernel-bugs.kernel.org
Reporter: midwinter1993@gmail.com
Regression: No
The following script triggers a KASAN null pointer dereference in f2fs file
system.
I tested under kernel 5.1.3 using Qemu; this bug may not happen every time but
according to my tries, it almost happens deterministically.
```
#!/bin/bash
MOUNT_DIR=/root/mnt
DISK=xx.img
dd if=/dev/zero of=$DISK bs=1M count=192
mkfs.f2fs -a 0 -o 19 -t 1 -z 3 -f -q $DISK
mkdir -pv $MOUNT_DIR
mount $DISK $MOUNT_DIR -o "noextent_cache"
mkdir $MOUNT_DIR/Umfoo_28
mount $DISK $MOUNT_DIR -o "remount,noextent_cache,mode=lfs,io_bits=7" # BUG
OCCURS
umount $MOUNT_DIR
```
--- Core dump ---
[ 35.256703]
==================================================================
[ 35.257772] BUG: KASAN: null-ptr-deref in mempool_alloc+0xd8/0x2e0
[ 35.258646] Read of size 8 at addr 0000000000000020 by task umount/2161
[ 35.259591]
[ 35.259833] CPU: 0 PID: 2161 Comm: umount Not tainted 5.1.3 #8
[ 35.260646] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 35.261953] Call Trace:
[ 35.262315] dump_stack+0x8a/0xce
[ 35.262787] ? mempool_alloc+0xd8/0x2e0
[ 35.263330] ? mempool_alloc+0xd8/0x2e0
[ 35.263819] kasan_report.cold+0x5/0x32
[ 35.264199] ? mempool_alloc+0xd8/0x2e0
[ 35.264678] mempool_alloc+0xd8/0x2e0
[ 35.265197] ? mempool_resize+0x410/0x410
[ 35.265760] ? blk_init_request_from_bio+0xd0/0xd0
[ 35.266439] ? __write_data_page+0x4c9/0x1140
[ 35.267063] __submit_merged_bio+0x519/0x8c0
[ 35.267671] __submit_merged_write_cond+0x41a/0x520
[ 35.268373] f2fs_write_cache_pages+0xb08/0xb40
[ 35.269021] ? __write_data_page+0x1140/0x1140
[ 35.269658] ? update_group_capacity+0x340/0x340
[ 35.270320] f2fs_write_data_pages+0x796/0x8b0
[ 35.270962] ? f2fs_write_cache_pages+0xb40/0xb40
[ 35.271631] ? deref_stack_reg+0x84/0xd0
[ 35.272195] ? __read_once_size_nocheck.constprop.0+0x10/0x10
[ 35.273005] ? __orc_find+0x63/0xc0
[ 35.273499] ? unwind_next_frame+0x8a8/0x9b0
[ 35.274104] ? f2fs_write_cache_pages+0xb40/0xb40
[ 35.274767] do_writepages+0xbb/0x1e0
[ 35.275287] ? page_writeback_cpu_online+0x10/0x10
[ 35.275970] ? __orc_find+0x63/0xc0
[ 35.276464] ? stack_access_ok+0x35/0x90
[ 35.277039] ? unwind_next_frame+0x8a8/0x9b0
[ 35.277644] ? __update_load_avg_cfs_rq+0x2f/0x4a0
[ 35.278340] ? rb_next+0x33/0x80
[ 35.278800] __filemap_fdatawrite_range+0x142/0x1d0
[ 35.279488] ? delete_from_page_cache_batch+0x650/0x650
[ 35.280239] ? _raw_spin_lock_irq+0xd0/0xd0
[ 35.280833] f2fs_sync_dirty_inodes+0x167/0x490
[ 35.281475] f2fs_write_checkpoint+0x462/0x2f70
[ 35.282115] ? __schedule+0x481/0xc80
[ 35.282633] ? update_cfs_group+0x1d/0x1a0
[ 35.283213] ? __enqueue_entity+0xae/0xe0
[ 35.283786] ? pci_mmcfg_check_reserved+0x130/0x130
[ 35.284478] ? _raw_spin_lock_irq+0x76/0xd0
[ 35.285073] ? f2fs_wait_on_all_pages_writeback+0x1a0/0x1a0
[ 35.285859] ? try_to_wake_up+0xa4/0x750
[ 35.286416] ? bit_wait_io_timeout+0xc0/0xc0
[ 35.287021] ? __migrate_task.isra.0+0xa0/0xa0
[ 35.287650] ? pin_kill+0x121/0x260
[ 35.288152] ? pin_insert+0x30/0x30
[ 35.288648] ? kthread_stop+0x11b/0x260
[ 35.289191] kill_f2fs_super+0x1e7/0x210
[ 35.289746] ? __f2fs_commit_super+0xc0/0xc0
[ 35.290347] ? xas_start+0xbf/0x1c0
[ 35.290846] ? unregister_shrinker+0x9e/0xc0
[ 35.291446] ? kfree+0x9b/0x1c0
[ 35.291899] deactivate_locked_super+0x69/0xc0
[ 35.292525] deactivate_super+0x14e/0x160
[ 35.293094] ? iterate_supers_type+0x1c0/0x1c0
[ 35.293723] cleanup_mnt+0x71/0xc0
[ 35.294207] task_work_run+0x100/0x120
[ 35.294663] exit_to_usermode_loop+0x175/0x180
[ 35.295149] do_syscall_64+0x1f1/0x230
[ 35.295560] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 35.296114] RIP: 0033:0x7fe8e01f6d77
[ 35.296509] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00
31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01
f0 ff ff 73 01 c3 48 8b 0d f1 00 2b 00 f7 d8 64 89 01 48
[ 35.298601] RSP: 002b:00007ffff47cec68 EFLAGS: 00000246 ORIG_RAX:
00000000000000a6
[ 35.299401] RAX: 0000000000000000 RBX: 000055f947ec7080 RCX:
00007fe8e01f6d77
[ 35.300151] RDX: 0000000000000001 RSI: 0000000000000000 RDI:
000055f947ec7260
[ 35.300950] RBP: 000055f947ec7260 R08: 000055f947ec7280 R09:
0000000000000014
[ 35.301707] R10: 00000000000006b4 R11: 0000000000000246 R12:
00007fe8e06f8e64
[ 35.302455] R13: 0000000000000000 R14: 0000000000000000 R15:
00007ffff47ceef0
[ 35.303258]
==================================================================
[ 35.304025] Disabling lock debugging due to kernel taint
[ 35.305229] BUG: unable to handle kernel NULL pointer dereference at
0000000000000020
[ 35.306356] #PF error: [normal kernel read fault]
[ 35.307004] PGD 0 P4D 0
[ 35.307364] Oops: 0000 [#1] SMP KASAN PTI
[ 35.307914] CPU: 1 PID: 2161 Comm: umount Tainted: G B 5.1.3
#8
[ 35.308879] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 35.310142] RIP: 0010:mempool_alloc+0xd8/0x2e0
[ 35.310749] Code: 81 cb 00 20 09 00 4d 8d 74 24 18 89 44 24 08 65 48 8b 04
25 40 dd 01 00 48 89 44 24 10 e8 20 d9 f5 ff 4c 89 ff e8 d8 14 0c 00 <49> 8b 44
24 20 4c 89 f7 48 89 04 24 e8 c7 14 0c 00 49 8b 74 24 18
[ 35.313330] RSP: 0018:ffff8881129af3a0 EFLAGS: 00010286
[ 35.314034] RAX: 0000000000000000 RBX: 000000000009a800 RCX:
ffffffff9694c53d
[ 35.314959] RDX: 1ffffffff30c1557 RSI: 0000000000000246 RDI:
ffffffff9860aab8
[ 35.315914] RBP: 1ffff11022535e79 R08: 000000000000002c R09:
ffffed1022e03c9b
[ 35.316865] R10: ffffed1022e03c9a R11: ffff88811701e4d7 R12:
0000000000000000
[ 35.317811] R13: 0000000000000400 R14: 0000000000000018 R15:
0000000000000020
[ 35.318759] FS: 00007fe8e0914e40(0000) GS:ffff888117100000(0000)
knlGS:0000000000000000
[ 35.319845] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 35.320620] CR2: 00007f2f50033048 CR3: 00000001137d6000 CR4:
00000000000006e0
[ 35.321568] Call Trace:
[ 35.321914] ? mempool_resize+0x410/0x410
[ 35.322460] ? blk_init_request_from_bio+0xd0/0xd0
[ 35.323108] ? __write_data_page+0x4c9/0x1140
[ 35.323701] __submit_merged_bio+0x519/0x8c0
[ 35.324287] __submit_merged_write_cond+0x41a/0x520
[ 35.325004] f2fs_write_cache_pages+0xb08/0xb40
[ 35.325621] ? __write_data_page+0x1140/0x1140
[ 35.326226] ? update_group_capacity+0x340/0x340
[ 35.326853] f2fs_write_data_pages+0x796/0x8b0
[ 35.327459] ? f2fs_write_cache_pages+0xb40/0xb40
[ 35.328101] ? deref_stack_reg+0x84/0xd0
[ 35.328635] ? __read_once_size_nocheck.constprop.0+0x10/0x10
[ 35.329404] ? __orc_find+0x63/0xc0
[ 35.329879] ? unwind_next_frame+0x8a8/0x9b0
[ 35.330458] ? f2fs_write_cache_pages+0xb40/0xb40
[ 35.331092] do_writepages+0xbb/0x1e0
[ 35.331592] ? page_writeback_cpu_online+0x10/0x10
[ 35.332249] ? __orc_find+0x63/0xc0
[ 35.332730] ? stack_access_ok+0x35/0x90
[ 35.333270] ? unwind_next_frame+0x8a8/0x9b0
[ 35.333855] ? __update_load_avg_cfs_rq+0x2f/0x4a0
[ 35.334508] ? rb_next+0x33/0x80
[ 35.334958] __filemap_fdatawrite_range+0x142/0x1d0
[ 35.335622] ? delete_from_page_cache_batch+0x650/0x650
[ 35.336330] ? _raw_spin_lock_irq+0xd0/0xd0
[ 35.336898] f2fs_sync_dirty_inodes+0x167/0x490
[ 35.337509] f2fs_write_checkpoint+0x462/0x2f70
[ 35.338123] ? __schedule+0x481/0xc80
[ 35.338622] ? update_cfs_group+0x1d/0x1a0
[ 35.339176] ? __enqueue_entity+0xae/0xe0
[ 35.339721] ? pci_mmcfg_check_reserved+0x130/0x130
[ 35.340390] ? _raw_spin_lock_irq+0x76/0xd0
[ 35.340967] ? f2fs_wait_on_all_pages_writeback+0x1a0/0x1a0
[ 35.341726] ? try_to_wake_up+0xa4/0x750
[ 35.342267] ? bit_wait_io_timeout+0xc0/0xc0
[ 35.342854] ? __migrate_task.isra.0+0xa0/0xa0
[ 35.343465] ? pin_kill+0x121/0x260
[ 35.343953] ? pin_insert+0x30/0x30
[ 35.344438] ? kthread_stop+0x11b/0x260
[ 35.344967] kill_f2fs_super+0x1e7/0x210
[ 35.345509] ? __f2fs_commit_super+0xc0/0xc0
[ 35.346095] ? xas_start+0xbf/0x1c0
[ 35.346579] ? unregister_shrinker+0x9e/0xc0
[ 35.347165] ? kfree+0x9b/0x1c0
[ 35.347601] deactivate_locked_super+0x69/0xc0
[ 35.348189] deactivate_super+0x14e/0x160
[ 35.348740] ? iterate_supers_type+0x1c0/0x1c0
[ 35.349351] cleanup_mnt+0x71/0xc0
[ 35.349824] task_work_run+0x100/0x120
[ 35.350342] exit_to_usermode_loop+0x175/0x180
[ 35.350954] do_syscall_64+0x1f1/0x230
[ 35.351472] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 35.352165] RIP: 0033:0x7fe8e01f6d77
[ 35.352659] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00
31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01
f0 ff ff 73 01 c3 48 8b 0d f1 00 2b 00 f7 d8 64 89 01 48
[ 35.355180] RSP: 002b:00007ffff47cec68 EFLAGS: 00000246 ORIG_RAX:
00000000000000a6
[ 35.356208] RAX: 0000000000000000 RBX: 000055f947ec7080 RCX:
00007fe8e01f6d77
[ 35.357171] RDX: 0000000000000001 RSI: 0000000000000000 RDI:
000055f947ec7260
[ 35.358134] RBP: 000055f947ec7260 R08: 000055f947ec7280 R09:
0000000000000014
[ 35.359097] R10: 00000000000006b4 R11: 0000000000000246 R12:
00007fe8e06f8e64
[ 35.360062] R13: 0000000000000000 R14: 0000000000000000 R15:
00007ffff47ceef0
[ 35.361021] Modules linked in:
[ 35.361446] Dumping ftrace buffer:
[ 35.361914] (ftrace buffer empty)
[ 35.362406] CR2: 0000000000000020
[ 35.363006] ---[ end trace d88b774adc80a9fc ]---
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
next reply other threads:[~2019-07-11 7:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-11 7:18 bugzilla-daemon [this message]
2019-07-16 9:09 ` [f2fs-dev] [Bug 204135] F2FS: BUG: KASAN: null-ptr-deref in mempool_alloc+0xd8/0x2e0 bugzilla-daemon
2019-07-17 1:51 ` bugzilla-daemon
2019-07-17 1:58 ` bugzilla-daemon
2019-07-22 3:38 ` bugzilla-daemon
2019-07-22 3:49 ` bugzilla-daemon
2019-07-30 3:56 ` bugzilla-daemon
2019-07-30 6:25 ` bugzilla-daemon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-204135-202145@https.bugzilla.kernel.org/ \
--to=bugzilla-daemon@bugzilla.kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox