From mboxrd@z Thu Jan 1 00:00:00 1970 From: Zheng Liu Subject: Re: 3.9-rc6 ext4: free_rb_tree_fname oops Date: Wed, 10 Jul 2013 10:06:41 +0800 Message-ID: <20130710020641.GA8523@gmail.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Linux Kernel , linux-fsdevel@vger.kernel.org, linux-ext4@vger.kernel.org To: Daniel J Blueman Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-ext4-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org Hi Daniel, On Mon, Jun 24, 2013 at 02:34:00PM +0800, Daniel J Blueman wrote: > On 16 April 2013 15:37, Daniel J Blueman wrote: > > When using e4defrag on a ext4 filesystem created a month ago, I ran > > into this fatal page fault [1] > > while running e4defrag on 3.9-rc6 (Ubuntu mainline). > > > > e2fsdump output is at http://quora.org/2012/e2fsdump.txt ; let me know > > if you need any more info. > > With 3.9.6 mainline, I got the exact same protection fault at > free_rb_tree_fname() from ext4_htree_free_dir_info() [1]. This > suggests use-after-free, as there's no pagetable mapping. > > There is nothing special with my setups, so there is fair chance it's > reproducible there with e4defrag on a few month old filesystem and > recent kernels. These days I try to reproduce this bug, but unfortunately I couldn't hit it. I create/read/write/delete some files in a SSD disk to simulate a file system that has been used for a while. Then I use e4defrag to defrag this file system. But I couldn't trigger the bug. The kernel version is the latest ext4/dev branch, and the e2fsprgs version is the 1.42.7. Do you have a method to easily reproduce this bug? Thanks, - Zheng