From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from relay.sgi.com (relay3.corp.sgi.com [198.149.34.15]) by oss.sgi.com (Postfix) with ESMTP id 2AF5C7F5D for ; Wed, 2 Dec 2015 01:43:35 -0600 (CST) Received: from cuda.sgi.com (cuda1.sgi.com [192.48.157.11]) by relay3.corp.sgi.com (Postfix) with ESMTP id ACE03AC002 for ; Tue, 1 Dec 2015 23:43:31 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by cuda.sgi.com with ESMTP id BiIAGWuNzUkff2Zj (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Tue, 01 Dec 2015 23:43:29 -0800 (PST) From: Vegard Nossum Subject: BUG: unable to handle kernel paging request at ffffffff82200000 (xlog_recover_buffer_pass2) Message-ID: <565EA0DF.609@oracle.com> Date: Wed, 2 Dec 2015 08:42:23 +0100 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------020909090304020500060304" List-Id: XFS Filesystem from SGI List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: xfs-bounces@oss.sgi.com Sender: xfs-bounces@oss.sgi.com To: Dave Chinner Cc: xfs@oss.sgi.com This is a multi-part message in MIME format. --------------020909090304020500060304 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi, Mounting the attached XFS image (fuzzed) gives me the following invalid memory dereference on latest linus/master: XFS (vda): Mounting V4 Filesystem XFS (vda): Starting recovery (logdev: internal) XFS (vda): log record CRC mismatch: found 0x9f534964, expected 0xd46d59ce. ffffc90000442000: 00 00 00 01 00 00 00 00 69 01 00 00 e6 33 18 19 ........i....3.. ffffc90000442010: 00 00 00 10 69 00 00 00 4e 41 52 54 2a 00 00 00 ....i...NART*... XFS (vda): log record CRC mismatch: found 0xedba28e, expected 0x9f019b73. ffffc90000442000: 00 00 00 01 00 00 00 00 69 01 00 00 5c 47 88 1e ........i...\G.. ffffc90000442010: 00 00 00 10 69 00 00 00 4e 41 52 54 2a 00 00 00 ....i...NART*... XFS (vda): log record CRC mismatch: found 0x9f534964, expected 0xd46d59ce. ffffc9000044a000: 00 00 00 01 00 00 00 00 69 01 00 00 e6 33 18 19 ........i....3.. ffffc9000044a010: 00 00 00 10 69 00 00 00 4e 41 52 54 2a 00 00 00 ....i...NART*... BUG: unable to handle kernel paging request at ffffffff82200000 IP: [] memcpy_erms+0x6/0x10 PGD 1e10067 PUD 1e11063 PMD 0 Oops: 0000 [#1] SMP KASAN CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.4.0-rc3+ #245 task: ffff880016e28000 ti: ffff880016e30000 task.ti: ffff880016e30000 RIP: 0010:[] [] memcpy_erms+0x6/0x10 RSP: 0000:ffff880016e377b8 EFLAGS: 00010287 RAX: ffff88001494e380 RBX: 0000000000000027 RCX: ffffffff80285761 RDX: ffffffff81150400 RSI: ffffffff82200000 RDI: ffff88001581901f RBP: ffff880016e37808 R08: ffff880016429ba8 R09: 0000000000000018 R10: 0000000000000000 R11: 0000000000000000 R12: ffff880016429b90 R13: 0000000000000002 R14: 00000000ff022a08 R15: ffffffff81335361 FS: 0000000000000000(0000) GS:ffff880017200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff82200000 CR3: 0000000001e0f000 CR4: 00000000001406b0 Stack: ffffffff8133eb74 ffff880000079b80 ffff880015bf6e40 ffff880016429ba4 ffff880000108470 ffff880016429b90 ffff880014c26290 ffff880015bf6e40 ffff880000108450 ffff880000079b80 ffff880016e37870 ffffffff8133f02a Call Trace: [] ? xlog_recover_do_reg_buffer.isra.23+0x124/0x1b0 [] xlog_recover_buffer_pass2+0x35a/0x450 [] xlog_recover_commit_pass2+0xe9/0x160 [] xlog_recover_items_pass2+0x3c/0x60 [] xlog_recover_commit_trans+0x206/0x230 [] xlog_recovery_process_trans+0x7a/0xb0 [] xlog_recover_process_ophdr+0x5e/0xc0 [] xlog_recover_process_data+0x9a/0xc0 [] xlog_do_recovery_pass+0x440/0x540 [] ? kasan_poison_shadow+0x2f/0x40 [] xlog_do_log_recovery+0x79/0xc0 [] xlog_do_recover+0x11/0xe0 [] xlog_recover+0xa3/0x140 [] xfs_log_mount+0x24e/0x2c0 [] xfs_mountfs+0x499/0x7d0 [] ? xfs_mru_cache_create+0x121/0x180 [] xfs_fs_fill_super+0x38d/0x4a0 [] mount_bdev+0x185/0x1c0 [] ? xfs_parseargs+0xaa0/0xaa0 [] xfs_fs_mount+0x10/0x20 [] mount_fs+0x34/0x160 [] ? __alloc_percpu+0x10/0x20 [] vfs_kern_mount+0x62/0x110 [] do_mount+0x21b/0xdd0 $ addr2line -e vmlinux -i ffffffff81475616 # memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:50 $ addr2line -e vmlinux -i ffffffff8133eb74 # xlog_recover_do_reg_buffer.isra.23+0x124/0x1b0 fs/xfs/xfs_log_recover.c:2238 $ addr2line -e vmlinux -i ffffffff8133f02a # xlog_recover_buffer_pass2+0x35a/0x450 fs/xfs/xfs_log_recover.c:2397 which is this bit: memcpy(xfs_buf_offset(bp, (uint)bit << XFS_BLF_SHIFT), /* dest */ item->ri_buf[i].i_addr, /* source */ nbits<