Re: [BUG][xfstests generic/133] deadlock and crach on xfs, BUG: KASAN: slab-out-of-bounds in xfs_read_iomap_begin+0x5f2/0x750 [xfs]

[Chandan Babu R <chandanbabu@kernel.org>]

On Thu, Feb 08, 2024 at 04:46:16 PM +0800, Zorro Lang wrote:
> Hi,
>
> Recently I hit a deadlock then panic at the end [1] by running
> xfstests generic/133 on x86_64 xfs with linux v6.8-rc3+. And
> it's reproducible by loop running g/133 many times.
>
> But I found that each time I hit this deadlock, the testing
> machine uses a *multi-stripes* disk/fs, likes:
>
> TEST_DEV:
> meta-data=/dev/sda2              isize=512    agcount=16, agsize=245744 blks
>          =                       sectsz=512   attr=2, projid32bit=1
>          =                       crc=1        finobt=1, sparse=1, rmapbt=0
>          =                       reflink=1    bigtime=1 inobtcount=1 nrext64=1
> data     =                       bsize=4096   blocks=3931904, imaxpct=25
>          =                       sunit=16     swidth=32 blks
> naming   =version 2              bsize=4096   ascii-ci=0, ftype=1
> log      =internal log           bsize=4096   blocks=16384, version=2
>          =                       sectsz=512   sunit=16 blks, lazy-count=1
> realtime =none                   extsz=4096   blocks=0, rtextents=0
>
> SCRATCH_DEV:
> meta-data=/dev/sda3              isize=512    agcount=16, agsize=245744 blks
>          =                       sectsz=512   attr=2, projid32bit=1
>          =                       crc=1        finobt=1, sparse=1, rmapbt=0
>          =                       reflink=1    bigtime=1 inobtcount=1 nrext64=1
> data     =                       bsize=4096   blocks=3931904, imaxpct=25
>          =                       sunit=16     swidth=32 blks
> naming   =version 2              bsize=4096   ascii-ci=0, ftype=1
> log      =internal log           bsize=4096   blocks=16384, version=2
>          =                       sectsz=512   sunit=16 blks, lazy-count=1
> realtime =none                   extsz=4096   blocks=0, rtextents=0
>

"Multiple stripes" is one of the configurations on which I execute
fstests. However, I noticed that my kernel build configuration did not have
KASAN enabled.

Even with KASAN enabled, I am unable to recreate the bug. I have executed
generic/133 test for 100 iterations on a kernel built from torvalds/master
branch.

How easy/difficult is it to recreate this bug on your test machine?

> I haven't reproduced this issue on a xfs with sunit=0 and swidth=0.
>
> The newest linux commit id (HEAD) which I used to hit this issue is
> (mainline linux):
>
> commit 547ab8fc4cb04a1a6b34377dd8fad34cd2c8a8e3
> Author: Linus Torvalds <torvalds@linux-foundation.org>
> Date:   Wed Feb 7 18:06:16 2024 +0000
>
>     Merge tag 'loongarch-fixes-6.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
>

-- 
Chandan