[f2fs-dev] [Bug 214895] New: F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[f2fs-dev] [Bug 214895] New: F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=214895

            Bug ID: 214895
           Summary: F2FS BUG: KASAN: stack-out-of-bounds in
                    d_shrink_add+0x17f/0x1c0
           Product: File System
           Version: 2.5
    Kernel Version: 4.15.7
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: f2fs
          Assignee: filesystem_f2fs@kernel-bugs.kernel.org
          Reporter: 793679547@qq.com
        Regression: No

Created attachment 299377
  --> https://bugzilla.kernel.org/attachment.cgi?id=299377&action=edit
out.c

I tested the Linux kernel under version 4.15.7, and encounter a kernel bug when
I try to umount the f2fs file system. The following script triggers a KASAN
stack-out-of-bounds in f2fs file system, which only contains the commands
related to file operation and mount operation.

#!/bin/bash

dd if=/dev/zero of=f2fs-0.img bs=1M count=2278
mkfs.f2fs -a 0 -o 16 -t 1 -z 7 -q f2fs-0.img

g++ -std=c++11 -static "out.c" -o "./runner" -pthread

loop_dev="/dev/loop0"
losetup "$loop_dev" f2fs-0.img

./runner

umount /root/mnt
losetup -d $loop_dev
---------------------------------------
File "out.c" realizes the file operation and mount operation by C++ language.

Core dump:
4,996,511831432,-;CPU: 3 PID: 72 Comm: kworker/u16:1 Not tainted 4.15.7 #1
4,997,511831443,-;Hardware name: LENOVO 20J6A00NHH/20J6A00NHH, BIOS R0FET24W
(1.04 ) 12/21/2016
4,998,511831462,-;Workqueue: writeback wb_workfn (flush-7:0)
4,999,511831485,-;RIP: 0010:mempool_alloc+0x116/0x3c0
4,1000,511831495,-;RSP: 0018:ffff8807e2767338 EFLAGS: 00010293
4,1001,511831509,-;RAX: dffffc0000000004 RBX: 1ffff100fc4ece6e RCX:
ffffffffa68720af
4,1002,511831519,-;RDX: 0000000000000000 RSI: 0000000001408800 RDI:
0000000000000000
4,1003,511831530,-;RBP: ffff8807e2767418 R08: 0000000000000001 R09:
0000000000000000
4,1004,511831540,-;R10: ffffed00f8633b16 R11: ffff8807c319d8b7 R12:
0000000000000000
4,1005,511831551,-;R13: dffffc0000000000 R14: ffff8806d063ab50 R15:
0000000000000020
4,1006,511831564,-;FS:  0000000000000000(0000) GS:ffff8807e76c0000(0000)
knlGS:0000000000000000
4,1007,511831575,-;CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
4,1008,511831586,-;CR2: 00007f6db21a53cc CR3: 000000062120e006 CR4:
00000000003606e0
4,1009,511831594,-;Call Trace:
4,1010,511831616,-; ? remove_element.isra.4+0x210/0x210
4,1011,511831634,-; ? mem_cgroup_uncharge+0x160/0x160
4,1012,511831726,-; __submit_bio+0x498/0xa50 [f2fs]
4,1013,511831819,-; __submit_merged_bio+0x1bb/0x760 [f2fs]
4,1014,511831926,-; __submit_merged_write_cond+0x21f/0x740 [f2fs]
4,1015,511832038,-; f2fs_write_cache_pages+0xf81/0x1250 [f2fs]
4,1016,511832154,-; ? __write_data_page+0x1bd0/0x1bd0 [f2fs]
4,1017,511832265,-; ? build_free_nids+0x6c1/0x1170 [f2fs]
4,1018,511832339,-; ? __radix_tree_lookup+0x2c6/0x360
4,1019,511832380,-; ? _find_next_bit+0x131/0x170
4,1020,511832496,-; __f2fs_write_data_pages+0x801/0xb90 [f2fs]
4,1021,511832547,-; ? __put_user_ns+0x80/0x80
4,1022,511832773,-; ? f2fs_write_data_page+0x40/0x40 [f2fs]
4,1023,511832862,-; ? clear_node_page_dirty+0x410/0x410 [f2fs]
4,1024,511832884,-; ? set_page_dirty+0x14b/0x380
4,1025,511832988,-; f2fs_write_data_pages+0x9b/0xc0 [f2fs]
4,1026,511833064,-; ? f2fs_write_data_pages+0x9b/0xc0 [f2fs]
4,1027,511833141,-; ? __f2fs_write_data_pages+0xb90/0xb90 [f2fs]
4,1028,511833157,-; do_writepages+0x123/0x1c0
4,1029,511833175,-; __writeback_single_inode+0xe7/0xd00
4,1030,511833192,-; writeback_sb_inodes+0x4d4/0xe80
4,1031,511833209,-; ? wbc_detach_inode+0x700/0x700
4,1032,511833223,-; ? string+0x1af/0x270
4,1033,511833242,-; ? wb_io_lists_populated+0xc1/0x110
4,1034,511833257,-; ? queue_io+0x21f/0x410
4,1035,511833272,-; wb_writeback+0x2c4/0xa80
4,1036,511833288,-; ? __writeback_inodes_wb+0x280/0x280
4,1037,511833302,-; ? set_worker_desc+0x198/0x200
4,1038,511833319,-; ? current_is_workqueue_rescuer+0x140/0x140
4,1039,511833338,-; wb_workfn+0x290/0xfd0
4,1040,511833351,-; ? wb_workfn+0x290/0xfd0
4,1041,511833367,-; ? __switch_to+0x1fd/0x1530
4,1042,511833385,-; ? inode_wait_for_writeback+0x70/0x70
4,1043,511833402,-; ? __clear_rsb+0x25/0x3d
4,1044,511833416,-; ? __clear_rsb+0x15/0x3d
4,1045,511833432,-; ? __schedule+0x959/0x2080
4,1046,511833447,-; ? put_pwq+0x4c/0x130
4,1047,511833464,-; process_one_work+0x8ae/0x1590
4,1048,511833482,-; worker_thread+0x575/0x15d0
4,1049,511833500,-; kthread+0x38e/0x460
4,1050,511833515,-; ? rescuer_thread+0x1150/0x1150
4,1051,511833529,-; ? kthread_create_worker+0x100/0x100
4,1052,511833545,-; ret_from_fork+0x35/0x40
4,1053,511833556,-;Code: 89 85 40 ff ff ff 48 8d 85 78 ff ff ff 48 89 85 30 ff
ff ff 48 83 c0 18 48 89 85 28 ff ff ff e8 c1 36 e1 ff 48 8b 85 40 ff ff ff <80>
38 00 0f 85 68 02 00 00 48 8b 85 48 ff ff ff 4d 8b 74 24 20 
1,1054,511833745,-;RIP: mempool_alloc+0x116/0x3c0 RSP: ffff8807e2767338
4,1055,511833829,-;---[ end trace 08bf240f83ef61f5 ]---
3,1056,511833920,-;==================================================================
3,1057,511833966,-;BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0
3,1058,511834021,-;Read of size 8 at addr ffff8807e2767b98 by task
kworker/u16:1/72
3,1059,511834074,-;
4,1060,511834198,-;CPU: 3 PID: 72 Comm: kworker/u16:1 Tainted: G      D        
 4.15.7 #1
4,1061,511834330,-;Hardware name: LENOVO 20J6A00NHH/20J6A00NHH, BIOS R0FET24W
(1.04 ) 12/21/2016
4,1062,511834470,-;Workqueue: writeback wb_workfn (flush-7:0)
4,1063,511834652,-;Call Trace:
4,1064,511834738,-; dump_stack+0xd8/0x124
4,1065,511834831,-; print_address_description+0x95/0x400
4,1066,511834927,-; kasan_report+0x21c/0x3f0
4,1067,511835028,-; ? d_shrink_add+0x17f/0x1c0
4,1068,511835127,-; __asan_report_load8_noabort+0x29/0x40
4,1069,511835233,-; d_shrink_add+0x17f/0x1c0
4,1070,511835329,-; select_collect+0xed/0x290
4,1071,511835439,-; detach_and_collect+0xce/0x100
4,1072,511835543,-; d_walk+0x1b7/0x660
4,1073,511835632,-; ? d_delete+0x330/0x330
4,1074,511835738,-; ? select_collect+0x290/0x290
4,1075,511835830,-; d_invalidate+0x195/0x300
4,1076,511835916,-; ? d_drop+0x60/0x60
4,1077,511836014,-; ? d_lookup+0x92/0xc0
4,1078,511836114,-; proc_flush_task+0x29e/0x570
4,1079,511836216,-; ? proc_map_files_readdir+0xcd0/0xcd0
4,1080,511836339,-; release_task+0xa8/0x1350
4,1081,511836432,-; ? cgroup_post_fork+0x310/0x310
4,1082,511836535,-; ? unregister_hw_breakpoint+0x41/0x50
4,1083,511836701,-; do_exit+0x17f5/0x3140
4,1084,511836826,-; ? mm_update_next_owner+0x900/0x900
4,1085,511837037,-; ? kthread+0x38e/0x460
4,1086,511837131,-; rewind_stack_do_exit+0x17/0x20
3,1087,511837204,-;
3,1088,511837250,-;The buggy address belongs to the page:
0,1089,511837336,-;page:ffffea001f89d9c0 count:0 mapcount:0 mapping:         
(null) index:0x0
0,1090,511837406,-;flags: 0x17ffffc0000000()
1,1091,511837513,-;raw: 0017ffffc0000000 0000000000000000 0000000000000000
00000000ffffffff
1,1092,511837621,-;raw: ffffea001f89d9e0 ffffea001f89d9e0 0000000000000000
0000000000000000
1,1093,511837664,-;page dumped because: kasan: bad access detected
3,1094,511837700,-;
3,1095,511837748,-;Memory state around the buggy address:
3,1096,511837835,-; ffff8807e2767a80: 00 00 00 00 00 f3 f3 f3 00 00 00 00 00 00
00 00
3,1097,511837916,-; ffff8807e2767b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00
f1 f1
3,1098,511838008,-;>ffff8807e2767b80: f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00
00 00
3,1099,511838058,-;                            ^
3,1100,511838138,-; ffff8807e2767c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 f1
3,1101,511838222,-; ffff8807e2767c80: f1 f1 f1 00 00 f2 f2 f2 f2 f2 f2 00 05 f2
f2 00
3,1102,511838274,-;==================================================================

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

[f2fs-dev] [Bug 214895] F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=214895

Daniel Santos (daniel.santos@pobox.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |daniel.santos@pobox.com

--- Comment #1 from Daniel Santos (daniel.santos@pobox.com) ---
That's a 3.5 year old kernel and 4.15 is EOLed.  Can you see if this bug still
exists in one of the current longterm releases, like 4.19.214 or 4.14.253?
https://www.kernel.org

When you have a bug like this, it's always best to check to see if it still
exists in a longterm branch, because bug fixes are regularly back-ported to
these branches.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

[f2fs-dev] [Bug 214895] F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=214895

--- Comment #2 from limbo_wg (793679547@qq.com) ---
Thank you for your valuable advice! I have listened to your suggestions, and
tested the scripts on both kernel version 4.19.214 and 4.14.253. Unfortunately,
this bug still exists, and the kernel crashed in the same place.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

[f2fs-dev] [Bug 214895] F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=214895

Chao Yu (chao@kernel.org) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |chao@kernel.org

--- Comment #3 from Chao Yu (chao@kernel.org) ---
I can see the KASAN related bug occurs in d_shrink_add(), the callpath doesn't
come from f2fs, it doesn't look like a f2fs bug?

BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

BTW, could you please try last 5.15 kernel?

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

[f2fs-dev] [Bug 214895] F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=214895

Chao Yu (chao@kernel.org) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #4 from Chao Yu (chao@kernel.org) ---
Oh, sorry, I guess this is a known issue which has been reported in below link
[1], please apply fixing patch [2] to see whether it can fix your problem.

[1] https://bugzilla.kernel.org/show_bug.cgi?id=204135

[2]
https://lore.kernel.org/linux-f2fs-devel/20190712085700.4239-1-yuchao0@huawei.com/T/#u

I can't reproduce this issue due to the "runner" test program crashed in 733
line.

(gdb) r
> Make dir /root/mnt
> Begin testing syscall...
> To mount root ...
MOUNT ROOT f2fs on /root/mnt: with
[nouser_xattr,active_logs=6,inline_data,fastboot,extent_cache]
> Mount root done...
[Detaching after vfork from child process 14904]
mount(dev: /dev/loop11, g_workspace: /root/mnt, fs: f2fs, 0, option:
nouser_xattr,active_logs=6,inline_data,fastboot,extent_cache)REMOUNT ROOT f2fs
on /root/mnt: with
[discard,no_heap,active_logs=6,inline_data,flush_merge,fastboot,extent_cache,mode=adaptive]
munmap_chunk(): invalid pointer

Program received signal SIGABRT, Aborted.
0x00000000004cc56b in raise ()
(gdb) bt
#0  0x00000000004cc56b in raise ()
#1  0x0000000000403ae3 in abort ()
#2  0x00000000004e6556 in __libc_message ()
#3  0x00000000004ecaec in malloc_printerr ()
#4  0x00000000004ecd1c in munmap_chunk ()
#5  0x0000000000405943 in m_deepen (curr_path=0x5855a8
"/root/mnt/fONyUHhUjtamPfvodyYSGfoo_318/gLCxIfoo_576/tFawtTrTsddGXmDCrYIvnOmEJPwiSUPkLfMfpHlZwOnItTpnEDfoo_663/biCedwbdHbfFfoo_884",
depth=665)
    at 214895.c:212
#6  0x0000000000408681 in test_syscall () at 214895.c:733
#7  0x000000000040b48c in main (argc=1, argv=0x7fffffffe388) at 214895.c:1260
(gdb) quit
A debugging session is active.

        Inferior 1 [process 14896] will be killed.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

[f2fs-dev] [Bug 214895] F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=214895

--- Comment #5 from Chao Yu (chao@kernel.org) ---
*** Bug 214889 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

[f2fs-dev] [Bug 214895] F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=214895

--- Comment #6 from Chao Yu (chao@kernel.org) ---
*** Bug 214891 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

[f2fs-dev] [Bug 214895] F2FS BUG: KASAN: stack-out-of-bounds in d_shrink_add+0x17f/0x1c0

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=214895

--- Comment #7 from Chao Yu (chao@kernel.org) ---
*** Bug 214893 has been marked as a duplicate of this bug. ***

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel